* [3rd-party-references] replace simple-oauth2 with openid-client
* Refactor OAuth2 handling: replace openid-client with custom OAuth2Client implementation
* Guard unconfigured OAuth2 providers with a controlled error
Providers whose client id/secret env vars are unset now stay registered
but without an OAuth2 client. Using one throws a controlled OError
("OAuth2 provider is not configured") from getOAuth2Client rather than a
TypeError from calling a method on undefined or sending "undefined"
credentials.
* Guard unconfigured OAuth2 providers with a controlled error
* Add clarification comments on OAuth 2.0 client ID and secret encoding requirements
* Add logging for invalid token expiration dates in parseToken function
GitOrigin-RevId: b17884ccba171ff4db8e6a698b3d4dcdca24e8ae
* [agents] allow running all the test-runner skill commands
* [agents] move linting into AGENTS.md
* [agents] double down on permissions and cwd
* [saas-e2e] add support for MOCHA_GREP
* [saas-e2e] fail fast by default outside CI
* [agents] avoid need for Codespace detection
* [agents] work around missing trust prompt in Codespaces
* [saas-e2e] e2e_test_setup: merge split-tests in dev-env
GitOrigin-RevId: f1c1cd2a732e98b2e6125ef86a2b2cda5d3aabb6
GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).
- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
root resolution to match the repo's patch convention
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041
* Bump yauzl to ^3.4.0 in history-v1 and web for Node 24.17
yauzl 3.x hangs extracting a large zip entry under Node 24.17 due to
stream backpressure changes. Fixes zip/project uploads, open-in-overleaf
template tests, and the SaaS-E2E "templates" test.
Also fix the open-in-overleaf acceptance test mock to serve the "too large"
fixture with a single res.end (Content-Length) instead of a backpressure-
ignoring res.write loop, which Node 24.17 surfaces as ECONNRESET (404)
instead of the expected 422.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Use plainTextResponse for large-file test fixture
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 55627b7c2c91959f0d1a7f3419467455edb06c9f
* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace
GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.
Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency
The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill
The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser
Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.
Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Combine js-yaml resolutions into a single global override
Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).
Note the scoped-vs-global tradeoff in the yarn-security-update skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7
* bump socket.io-client to overleaf fork 0.9.17-overleaf-6
Fixes GHSA-96hv-2xvq-fx4p (ws memory exhaustion DoS) by bumping the
overleaf/socket.io-client fork to a version that declares ws@^8.21.0
instead of ws@^1.1.5. The existing ws@npm:^8 resolution pins it to
8.21.0, removing ws@1.1.5 from yarn.lock entirely.
Depends on overleaf/socket.io-client#6.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* use 0.9.17-overleaf-6 tag for socket.io-client
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* use the socket.io-client-0.9.17-overleaf-6 release
* provide ws module for real-time acceptance tests
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 2d9a42f90bcf95a3a8f053df4c0092c4fbc26422
celebrate is declared in project-history's package.json but never imported
anywhere in the service. Dropping it removes one of the consumers pulling in
joi@17 and shrinks the dependency surface. docstore still uses celebrate, so
it remains in the lockfile.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 171c3e5435495d20256bd9b95158a275ec42f7e3
* [Security upgrade] bump tmp to ^0.2.6 in jobs/mirror-documentation (GHSA-ph9p-34f9-6g65)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Update yarn.lock: resolve tmp@^0.2.6 to 0.2.7
The lockfile had no entry for the ^0.2.6 range, causing Yarn to try
adding tmp@0.2.7 at CI time. With CI=true Yarn runs in --immutable mode,
so the unrecorded resolution failed every build. Ran yarn install locally
to record the ^0.2.6 → 0.2.7 resolution before pushing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 5f62c586817c6a35c77a2bd0ff1990897d574338
* Remove double spaces
* Enforce curly apostrophes
* Enforce French typographic spaces in fr.json
Add vitest test enforcing French spacing rules per
https://typographisme.net/post/Les-espaces-typographiques-et-le-web:
- NNBSP (U+202F) before ? ! ;
- NBSP (U+00A0) before :
- NBSP (U+00A0) around guillemets « »
Fix 38 fr.json values that were using NBSP (or no space) before ? ! ;.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Extend French typography test to numbers and percent signs
Add rules per https://typographisme.net/post/Les-espaces-typographiques-et-le-web:
- NNBSP (U+202F) between digit groups (thousands separator)
- NBSP (U+00A0) between a number and a following word/unit
- NBSP (U+00A0) before %
Fix 9 fr.json values where a regular space was used instead of NBSP between
a number and a following word (e.g. "1 résultat", "10 jetons", "7 jours").
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Use point médian for inclusive writing in fr.json
Replace parenthetical gender/plural markers like "sûr(e)", "abonné(e)",
"licence(s)" with the point médian "·" (e.g. "sûr·e", "abonné·e",
"licence·s") per modern French écriture inclusive.
Add a vitest rule rejecting "word(suffix)" patterns where suffix is 1-3
letters and there is no space before the opening parenthesis.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Simplify inclusive-writing check to "(e)" substring match
The previous regex (matchAll without the /g flag) would have thrown at
runtime. Drop matchAll entirely and use includes('(e)').
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Add point médian to participles in fr.json
Apply inclusive writing (·e) to past participles agreeing with the
addressed user ("affilié·e", "invité·e", "connecté·e", "abonné·e", etc.).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Use inclusive forms in fr.json
* Change "de Overleaf" to "d’Overleaf"
* Fix tests
* Check for consecutive spaces, not just double spaces
* Update comment about guillemets
* Add ESLint rules for locale JSON conventions
Add three rules to @overleaf/eslint-plugin that run against locale JSON
files via @eslint/json:
- no-consecutive-spaces-in-locales
- no-straight-apostrophes-in-locales
- french-typography-in-locales
Wire them up in services/web/eslint.config.mjs against `locales/*.json`
(and `locales/fr.json` for the French-typography rule).
* Add `@eslint/json` so JSON files can be parsed
* Scope JS/TS-specific config to JS/TS files only so that built-in rules aren't applied to JSON files
* Disable `no-irregular-whitespace` in french-typography-in-locales.js
* Make the rules fixable
* Improve regexes: user `\s` instead of custom matchers
* Add sorted-keys-in-locales ESLint rule
Mirrors scripts/translations/sort.js as a fixable ESLint rule:
require top-level keys in locale JSON files to be sorted alphabetically.
The autofix re-serializes the file with sorted keys.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Add no-unused-locale-keys ESLint rule
Mirrors scripts/translations/cleanupUnusedLocales.js as a fixable ESLint
rule applied only to en.json. Shells out to `find` + `cat` once per
process (cached) to grep all candidate source files for key references,
then reports any en.json key that isn't found. The autofix re-serializes
en.json without the unused keys.
Hardcoded ALWAYS_USED set covers keys built at runtime (month names,
third-party-datastore notifications) that the regex scan can't see.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Add locale-variables-match-en ESLint rule
Mirrors scripts/translations/checkVariables.js as an ESLint rule applied
to non-en locale JSON files. Reads en.json (cached) and reports any
member whose `__name__` placeholders differ from the base.
GLOBALS (e.g. __appName__) are allowed as extras; IGNORE_NESTING_FOR
preserves the script's per-key exceptions.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Replace some double linebreak (@overleaf/no-consecutive-spaces-in-locales)
* Add no-orphan-locale-keys ESLint rule
Detect translation keys in non-en locale files that aren't present in
en.json. Mirrors the `--sync-non-en` flag of cleanupUnusedLocales.js.
The autofix re-serializes the locale file without the orphan keys,
sorted alphabetically.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Add tests for the locale JSON ESLint rules
Cover the four single-file rules:
- no-consecutive-spaces-in-locales
- no-straight-apostrophes-in-locales
- sorted-keys-in-locales
- french-typography-in-locales (including the inclusive-writing
suggestion for "(e)")
The three cross-file rules (no-unused-locale-keys, no-orphan-locale-keys,
locale-variables-match-en) read from disk and aren't covered here; they
need integration tests via fixtures.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Drop bin/lint_locales — checks are now covered by ESLint rules
The four checks in bin/lint_locales are duplicated by the new
@overleaf/eslint-plugin rules:
- sort.js --check → sorted-keys-in-locales
- cleanupUnusedLocales.js --check → no-unused-locale-keys
+ no-orphan-locale-keys
- checkVariables.js → locale-variables-match-en
- single-quote grep → no-straight-apostrophes-in-locales
`yarn lint` runs the ESLint rules against locales/*.json, so the
lint_locales script and Makefile target are redundant.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Remove Locales.test.mjs
* Delete scripts replaced by @overleaf/eslint-plugin rules
Remove the three locale scripts now superseded by ESLint rules:
- scripts/translations/sort.js → sorted-keys-in-locales
- scripts/translations/cleanupUnusedLocales.js → no-unused-locale-keys
+ no-orphan-locale-keys
- scripts/translations/checkVariables.js → locale-variables-match-en
Also drop the matching Makefile targets (sort_locales,
cleanup_unused_locales), update AGENTS.md / copilot-instructions.md to
point at `yarn lint --fix` instead, and prune the deleted entries from
the esm-check-migration allowlist.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Delete redundant scripts/translations/sort-locale-file.js
Single-file sort utility — superseded by `yarn lint --fix path/to/file.json`
via the sorted-keys-in-locales ESLint rule. No callers in repo.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Update comments and messages
* Add test file pattern to ESLint configuration
* Reorder "Backend specific rules" so `no-extraneous-dependencies` doesn't fail on test files
* Make french-typography fixes idempotent and catch edge cases
Apply Copilot's review feedback on PR #34221:
- autoFix() now uses `\\s*`/`\\s+` instead of `\\s?`/`\\s` so it
collapses any run of mixed whitespace into the correct NBSP/NNBSP,
making the fix idempotent and order-independent.
- The `:` lint regex now captures optional whitespace and reports
when it isn't NBSP (catches `"Liste :"` with a regular space).
- The `%` lint regex now matches the missing-space case (`"10%"`)
via `\\s*` instead of requiring one char between digit and `%`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Remove sort-locale-file.js from pre-commit
* Revert no-unused-locale-keys ESLint rule; Restore lint_locales scripts
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
GitOrigin-RevId: 8351fab074e6e7f77920b70237df1cd1c781e053
Andrew Rumble