Fixes GHSA-xcpc-8h2w-3j85 / CVE-2026-39244 (high): a crafted ZIP archive
declaring a huge uncompressed size could force an unbounded Buffer.alloc
and OOM the process.
adm-zip 0.6.0 ships built-in TypeScript types, so @types/adm-zip is
dropped from both workspaces' devDependencies to avoid duplicate/
conflicting type declarations.
GitOrigin-RevId: dffc1c38a10f42d09c799ae768f1ffcfc0e09328
Fixes GHSA-xv26-6w52-cph6 (critical): message corruption via abuse of
protocol length headers in the WebSocket frame parser.
GitOrigin-RevId: 678d85f1132e55cfeeef266a65c2deb869fe41ae
* Replace the bibtex entries table with a card layout
Render each reference as a card (citation key, title, author, year and an
error indicator) instead of a table row. Drop @tanstack/react-table, which was
the last consumer of the dependency, and keep @tanstack/react-virtual for
virtualization.
- Add a compact card variant (via a `compact` prop) for the bibtex editor:
tighter spacing, no border-radius, and cards separated by a single collapsing
border rather than a gap.
- Add hover and green selected/selected+hover states.
- Move the select-all checkbox out of the scrolling list into the editor
toolbar so it stays fixed while the list scrolls.
- Lay out title/author/year with nested flex so author and year wrap together.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* In progress dark mode for review
* Slight design changes & updated dark mode
* Small tweaks to dark mode secondary text, and light mode border
* Truncate long authors, also use .summarize() on authors
* Refactor comments: reduce verbose, remove unnecessary
* Fix empty line
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Tom Wells <wellsthomas@hotmail.co.uk>
GitOrigin-RevId: feaa6718484eefb9e9efb44b99f456910697cb17
* [3rd-party-references] replace simple-oauth2 with openid-client
* Refactor OAuth2 handling: replace openid-client with custom OAuth2Client implementation
* Guard unconfigured OAuth2 providers with a controlled error
Providers whose client id/secret env vars are unset now stay registered
but without an OAuth2 client. Using one throws a controlled OError
("OAuth2 provider is not configured") from getOAuth2Client rather than a
TypeError from calling a method on undefined or sending "undefined"
credentials.
* Guard unconfigured OAuth2 providers with a controlled error
* Add clarification comments on OAuth 2.0 client ID and secret encoding requirements
* Add logging for invalid token expiration dates in parseToken function
GitOrigin-RevId: b17884ccba171ff4db8e6a698b3d4dcdca24e8ae
* [agents] allow running all the test-runner skill commands
* [agents] move linting into AGENTS.md
* [agents] double down on permissions and cwd
* [saas-e2e] add support for MOCHA_GREP
* [saas-e2e] fail fast by default outside CI
* [agents] avoid need for Codespace detection
* [agents] work around missing trust prompt in Codespaces
* [saas-e2e] e2e_test_setup: merge split-tests in dev-env
GitOrigin-RevId: f1c1cd2a732e98b2e6125ef86a2b2cda5d3aabb6
GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).
- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
root resolution to match the repo's patch convention
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041
* Bump yauzl to ^3.4.0 in history-v1 and web for Node 24.17
yauzl 3.x hangs extracting a large zip entry under Node 24.17 due to
stream backpressure changes. Fixes zip/project uploads, open-in-overleaf
template tests, and the SaaS-E2E "templates" test.
Also fix the open-in-overleaf acceptance test mock to serve the "too large"
fixture with a single res.end (Content-Length) instead of a backpressure-
ignoring res.write loop, which Node 24.17 surfaces as ECONNRESET (404)
instead of the expected 422.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Use plainTextResponse for large-file test fixture
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 55627b7c2c91959f0d1a7f3419467455edb06c9f
* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace
GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.
Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency
The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill
The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser
Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.
Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Combine js-yaml resolutions into a single global override
Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).
Note the scoped-vs-global tradeoff in the yarn-security-update skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7
* bump socket.io-client to overleaf fork 0.9.17-overleaf-6
Fixes GHSA-96hv-2xvq-fx4p (ws memory exhaustion DoS) by bumping the
overleaf/socket.io-client fork to a version that declares ws@^8.21.0
instead of ws@^1.1.5. The existing ws@npm:^8 resolution pins it to
8.21.0, removing ws@1.1.5 from yarn.lock entirely.
Depends on overleaf/socket.io-client#6.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* use 0.9.17-overleaf-6 tag for socket.io-client
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* use the socket.io-client-0.9.17-overleaf-6 release
* provide ws module for real-time acceptance tests
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 2d9a42f90bcf95a3a8f053df4c0092c4fbc26422
Lucie Germain