Commit Graph

27924 Commits

Author SHA1 Message Date
Andrew Rumble
e9aedce4ab Merge pull request #33625 from overleaf/ar-update-vitest
[monorepo] bump vitest to 4.1.5

GitOrigin-RevId: 22ba2249ae384fd59347c9aa45c70f51ccdf8890
2026-05-18 08:06:49 +00:00
Andrew Rumble
19ad00c329 Merge pull request #33743 from overleaf/lg-systeminformation-upgrade
[Security Upgrade] Upgrade systeminformation to 5.31.6 (GHSA-hvx9-hwr7-wjj9)

GitOrigin-RevId: bd75d2bc59e183d23972e367f40f753c08ca6967
2026-05-18 08:06:41 +00:00
Eric Mc Sween
2913e462ec Merge pull request #33665 from overleaf/copilot/fix-error-logging-in-git-bridge
git-bridge: Log WrongBranchException and ForcedPushException at WARN instead of ERROR
GitOrigin-RevId: 7aaa934a0df614e336ce3c20b892af1af0cd070f
2026-05-18 08:06:29 +00:00
Eric Mc Sween
a3682af6e4 Merge pull request #33710 from overleaf/em-tpds-config
Clean up tpdsworker config from web and third-party-datastore

GitOrigin-RevId: 3856126d9dc856fea4bc4133b11402c35b10630b
2026-05-18 08:06:25 +00:00
Antoine Clausse
9e42d3a530 [web] Address design QA items on pricing page (#33682)
- pricing table: integration icons gap uses --spacing-06 (horizontal),
  integrations content gap uses --spacing-04 (vertical)
- Student card no longer renders with the green stroke highlight
- Interstitial H1 wrapped in .main-heading-section so its spacing
  matches the pricing page

Part of #33619.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 12ddd223f68c776c06a3d5dc5faa841819baae90
2026-05-18 08:06:17 +00:00
Antoine Clausse
0089c0af08 [web] Space skip link from disclaimer on interstitial (#33464)
The "continue with free plan" skip link sat directly under the
disclaimer with no separation. Add spacing-08 margin-top to match
the disclaimer's own padding-top above the cards.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: ba7334785757a39ca0bdff309ded224e6cb8e3bf
2026-05-18 08:06:09 +00:00
Olzhas Askar
868da835b6 Merge pull request #32434 from overleaf/oa-babelfish
[web] Project Babelfish

GitOrigin-RevId: da8c47c0831eaab3e2c74a9507892ae9571919e8
2026-05-18 08:05:57 +00:00
Olzhas Askar
d388e48a99 Merge pull request #33679 from overleaf/oa-plan-names
[web] Get plan names from the settings

GitOrigin-RevId: 1e61975c3306c025f33e05686f9d2b57964b4f65
2026-05-18 08:05:52 +00:00
Olzhas Askar
6c267e68d3 Merge pull request #33707 from overleaf/oa-learn-links
[web] Learn Overleaf links

GitOrigin-RevId: af9f72da008ad8b8c86e4c355268123eb6c40bcd
2026-05-18 08:05:48 +00:00
Andrew Rumble
25dfaab2a1 Merge pull request #33641 from overleaf/lg-fast-xml-builder-resolution
[Security upgrade] Pin fast-xml-builder to 1.1.7 via resolutions (GHSA-5wm8-gmm8-39j9, GHSA-45c6-75p6-83cc)

GitOrigin-RevId: ab13841bd8c20da98a136567cf7436ebb9f73722
2026-05-15 08:08:40 +00:00
Noel Schenk
ba016d798e Upgrade MongoDB image from 6.0 to 8.0 (#33579)
sharelatex  | The MongoDB server has version 6.0.27, but Overleaf requires at least version 8.0. Aborting.

COPYBARA_INTEGRATE_REVIEW=https://github.com/overleaf/overleaf/pull/1480 from noel-schenk:patch-1 4a13e4fbcdbc6c2683dc0595767426f40bf0093d

Co-authored-by: Noel Schenk <schenknoel@gmail.com>
GitOrigin-RevId: 9035d16f2c34edcb39c0da99e9d02b9ed8a9f6fa
2026-05-15 08:08:35 +00:00
Mathias Jakobsen
ac961f1d40 Merge pull request #33687 from overleaf/mj-temporary-tabs-fix
[web] Only consider real key presses to make tab permanent

GitOrigin-RevId: 50ab453445e111de2b317f50470f9f4eec39a66f
2026-05-15 08:08:28 +00:00
Mathias Jakobsen
6538c00742 Merge pull request #33690 from overleaf/mj-prune-deleted-tabs
[web] Prune non-existent tabs when file tree changes

GitOrigin-RevId: 97e68a88a201acc2d1e582911ca64e1f72f9bfe1
2026-05-15 08:08:19 +00:00
Copilot
3980b9e580 Fix IDOR in exports by adding token verification (Issue #31637) (#32883)
* Fix IDOR in exports by adding token verification

Implement jdleesmiller's suggested fix for Issue #31637:
- V1: Return export token in create response
- V1: Verify token in get_export using secure_compare
- Web: Pass token through fetchExport and fetchDownload
- Web: Return token from exportProject to frontend
- Frontend: Pass token as query param on status/download requests
- Add tests for both services

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix window.location.pathname to .href to preserve query params

Code review correctly identified that window.location.pathname strips
query parameters. Switch to window.location.href so the token query
parameter is preserved in download URLs.

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix test mocks to include token in POST responses

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/0350c6ef-0fff-4e98-8464-812cd92c523f

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Fix token assignment in initiateExport to use pollResponse token if available

Add requireExportToken config setting and tests for invalid/missing token cases

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/059bdba2-4f7a-4407-a5a5-cfcffd888739

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Add tests for export status and token validation in ExportsController and MockV1Api

Co-authored-by: Copilot <copilot@github.com>

* Update services/v1/main/app/controllers/api/v1/overleaf/exports_controller.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix linting

* fix fetchString response handling in ExportsHandler tests

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 399aef8eaa15ab3655f0905482f3a31fe94e2251
2026-05-15 08:08:04 +00:00
Miguel Serrano
5a886aa9fb [web] Add extra details to flexible license sales email (#32929)
* [web] Add extra details to flexible license sales email

GitOrigin-RevId: fbd41adae21c55c5e97f9531565100e1ae911808
2026-05-15 08:07:56 +00:00
Tim Down
248e149701 Default interstitial to monthly plans (#33706)
* Default interstitial to monthly plans except for upgrade, which defaults to user's existing subscription period

* Add tests for interstitial page period toggle defaults

GitOrigin-RevId: fa0ac41e7d8a7bf858b53e0940287b28ef21253d
2026-05-15 08:07:49 +00:00
Eric Mc Sween
529c332159 Merge pull request #33658 from overleaf/em-fix-docker-tag-length
build: truncate branch names to 96 chars for Docker image tags
GitOrigin-RevId: 9db313244e78a6d4e0aa5d8c08d25f1aac83318b
2026-05-14 08:06:45 +00:00
Jakob Ackermann
0c8e93bb33 [server-pro] fix tag name for branches with slash (#33685)
GitOrigin-RevId: 25ee2d340b17ce7c758ec8c7e156a67928ab6c73
2026-05-14 08:06:38 +00:00
Davinder Singh
a3a508d193 [WEB] Add analytics events for importing and exporting to different file types (#33614)
* adding events for success and failure for import and export from latex

* adding the operation property to capture the import/export keyword

GitOrigin-RevId: 2e5482b3c7517b402fc151966975ca8718729683
2026-05-14 08:06:30 +00:00
Jakob Ackermann
75a12dda17 [web] resync_projects: use the secondaries for all reads (#33684)
* [docstore] add useSecondary flag to projectHasRanges

The rev-check for unarchiving always consults with the primary.

Two extra changes:
- Add a projection argument to peekDoc in order to skip lines download
   from projectHasRanges.
- Add one retry to peekDoc to reduce chances of surfacing a rev-check
   violation.

* [web] resync_projects: use the secondaries for all reads

* [web] add default value for useSecondary

* [docstore] add default value for useSecondary

* [k8s] docstore: set MONGO_HAS_SECONDARIES=true

GitOrigin-RevId: f15ec4fdc1cabe74c1eab87bec85f28d6f7a587d
2026-05-14 08:06:26 +00:00
Domagoj Kriskovic
ff53705bfa Refactor Python output pane toolbar for improved layout and styling
GitOrigin-RevId: b6d838e5c9bd8023bf12df976dad0c50564a0b2f
2026-05-14 08:06:22 +00:00
renovate[bot]
fc66bbfb26 [CoreI] Update dependency axios to v1.15.2 from 1.15.0 [SECURITY] (#33398)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
GitOrigin-RevId: 567d0e7463084e872187a72085714f68d84dc5b6
2026-05-14 08:06:04 +00:00
Alf Eaton
d203a62834 Fix (un)fold all shortcuts on macOS (#33630)
GitOrigin-RevId: db0911cdfdeb19c90bd601e6173973d884859b09
2026-05-14 08:06:00 +00:00
Alf Eaton
6776f82952 Wait for parsing and syntax highlighting in autocomplete Cypress tests (#33667)
* Wait for parsing and syntax highlighting in autocomplete Cypress tests

* Wait for syntax highlighting in write-and-cite Cypress tests

GitOrigin-RevId: d48f10c864b0a170b4a02e95e3a989fdc4137dbb
2026-05-14 08:05:55 +00:00
Alf Eaton
00ddd8185c Upgrade webpack and related dependencies (#31638)
GitOrigin-RevId: e188a6ab9f7a024c1769a85e1d4e40ccb5d02213
2026-05-14 08:05:51 +00:00
Jakob Ackermann
b62d4814c3 [monorepo] turn throw statements in callback code into callback calls (#33524)
* [eslint-plugin] add rule for throw inside callback code

* [monorepo] enable our custom eslint plugins globally

* [monorepo] fix running make lint from root

* [monorepo] turn throw statements in callback code into callback calls

* [monorepo] add eslint-plugin libraries to all the Dockerfiles

* [monorepo] install eslint-plugin library at the root level

* [linked-url-proxy] add eslint-plugin library into Dockerfile

* [latexqc] add our eslint-plugin to eslint config

GitOrigin-RevId: b05e3ebbefb62370f2422e83880dd3913815270d
2026-05-14 08:05:47 +00:00
Kristina
d8df893593 [web] rm unnecessary webpack configuration (#33587)
GitOrigin-RevId: d9f305e59af2585db096a83c4cbd41ba5f785184
2026-05-14 08:05:39 +00:00
Jimmy Domagala-Tang
bc2f5ae746 Reject tracked changes notifications (#32917)
* [web] Reject tracked changes notifications

feat: adding new tests

feat: adding rejected changes notifications

feat: adding tests for rejectchanges

feat: updating tests for rejecting notifications;

feat: adding in rejecting user, and improving subject and activity line

fix: moving to a params object instead of positionals for email building

feat: updating to use events triggered from applyUpdate in document-updater

feat: updating to send rejected author ids with rejected change notification instead of change ids

feat: moving rejected author notification determination to updateManager instead of RangesManager, which is used by other paths

feat: only map to author if changes were made

* fix: gate by user status not project status

* fix: unit tests post-rebase

---------

Co-authored-by: Kristina Hjertberg <kristina.hjertberg@overleaf.com>
GitOrigin-RevId: f992e1885c47d1a6cf776740769d6d4763f3cb7c
2026-05-14 08:05:35 +00:00
Andrew Rumble
5e3561aedc Merge pull request #33655 from overleaf/lg-ip-address-resolution
Pin ip-address to 10.1.1 via resolutions (GHSA-v2v4-37r5-5v8g)

GitOrigin-RevId: c0233698549fee7f32c8a95a17b793b8535922c1
2026-05-14 08:05:30 +00:00
Jakob Ackermann
7c50dc9990 [history-v1] add endpoint for downloading latest zip (#33181)
* [history-v1] add endpoint for downloading latest zip

* [web] address review feedback

* [web] tests: do not overwrite db.projects.overleaf, extend it

* [web] set includeReferer flag from downloading zip

GitOrigin-RevId: e63e549f004230086f82eccf03b43fd62bde6071
2026-05-13 08:06:53 +00:00
Jakob Ackermann
b1931d0b3b [web] cleanup archived split-test assignments from user record on login (#33365)
* [web] cleanup archived split-test assignments from user record on login

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [migrations] purge archived split tests from all users

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [web] add missing mock and update snapshot test

* [web] gracefully access db.users.splitTests

---------

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
GitOrigin-RevId: bd185074a402556d7b7c812208cf834dd52b27a5
2026-05-13 08:06:49 +00:00
Antoine Clausse
13e426b14c [web] Share third-party integration icons + add Papers icon (#33537)
* [web] Add Papers/ReadCube icon to plans page integrations

Closes #33493

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Delete old 200kB zotero logo

* Allow png use in logos

* Allow wrap

* [web] Share third-party integration icon list across plans and onboarding pages

Extract the icons array to services/web/app/src/util/third-party-icons.mjs
so the plans-2026 feature table and the try_premium onboarding page render
from a single source. The try_premium page now also includes Papers and
follows the plans page ordering.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [web] Allow ciam try-premium logo row to wrap

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: f5a52418cbe01d9e343092b552183dffa3ae78bd
2026-05-13 08:06:44 +00:00
Antoine Clausse
e04be692e2 [web] Use content-secondary for plan card body text (#33466)
Plan cards inherited neutral-60 (=neutral-60) for description and
include-list text, which can fail WCAG contrast on the light card
background. Switch to content-secondary (=neutral-70) per Vee's
short-term recommendation; affects the free plan description, card
include items (e.g. "Basic AI allowance") and the in-card group
picker labels.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 42aff473a779b4b4f36b6c648d86097a79f820c8
2026-05-13 08:06:40 +00:00
Eric Mc Sween
d48af6dc1b Merge pull request #33213 from overleaf/em-git-bridge-structured-logging
git-bridge: structured JSON logging for GCP Cloud Logging
GitOrigin-RevId: 7ff06202cab6fe0e35c4a4f757d0b9ad04e5431a
2026-05-13 08:06:31 +00:00
Tim Down
85e55ebf5a Implement Briefly ad in onboarding flow (#33567)
GitOrigin-RevId: 78c7c38878024aaaf79def6ac7ca164d92a59a57
2026-05-13 08:06:02 +00:00
Tim Down
2f25793609 Merge pull request #33353 from overleaf/td-pricing-tooltip-esc
Dismiss Bootstrap tooltips via Esc key

GitOrigin-RevId: 2368a0691fd811180f908309f99b1f9a02c225ee
2026-05-13 08:05:58 +00:00
Alf Eaton
5e94f8abce Remove -- from test scripts (#33622)
GitOrigin-RevId: a33f09fb9924e4d02de6db0550c22585b2d331b6
2026-05-13 08:05:50 +00:00
jmescuderowritefull
c383674cd8 Fix suggestions blocked modal (#33571)
GitOrigin-RevId: fde20822d884678c729ed93b672b5ad131901938
2026-05-12 08:07:03 +00:00
Eric Mc Sween
943961ca18 Merge pull request #33539 from overleaf/em-doi-import
Library: accept DOIs in the paste references dialog
GitOrigin-RevId: bcef3cd654a1ac34f7d372930ec21116d460cd74
2026-05-12 08:06:59 +00:00
Eric Mc Sween
569f36d01b Merge pull request #33315 from overleaf/em-library-api-pagination
Add cursor-based pagination to GET /library/references

GitOrigin-RevId: 1acec69031b0ca82ef6e1e05eddb165acaf05003
2026-05-12 08:06:55 +00:00
Eric Mc Sween
aca60c02c0 Merge pull request #33391 from overleaf/em-bibtex-projection-32449
Use a projected state field for BibTeX entries in the editor

GitOrigin-RevId: 5034be8bdc0cb4b9d854135ac117046c1b3750e7
2026-05-12 08:06:47 +00:00
Jessica Lawshe
0f3ae5ac5b Merge pull request #33335 from overleaf/jel-add-email-captured-by-group
[web] Group with domain capture takes priority over Commons when adding new email

GitOrigin-RevId: 40eb561018f4be0badf9f3885d24553c5f8bbde7
2026-05-12 08:06:37 +00:00
Jessica Lawshe
ba13ccdb11 Merge pull request #33202 from overleaf/jel-domain-captured-by-group-settings-page
[Domain capture] Check `domainCapturedByGroup` for existing emails on user settings

GitOrigin-RevId: 5ac86b89969b186cce0cac410c2957e5aa1b9703
2026-05-12 08:06:33 +00:00
Jakob Ackermann
6a911e4ec3 [web] do not send a second response from api error handler (#33526)
GitOrigin-RevId: 6974f5d5f7042d5170eb2a755715b2d139f06130
2026-05-12 08:06:25 +00:00
Jakob Ackermann
1df98c028d [web] add includeReferer flag to SplitTestHandler.getAssignment (#33235)
* [web] add includeReferer flag to SplitTestHandler.getAssignment

* [web] tests: migrate User.getSplitTestAssignment to async/await

I don't want to fight with callbacks and optional arguments. Just move
it to async/await. New tests should use async/await, so there is no
point in making this work in callback-hell.

* [web] remove unused URL import

GitOrigin-RevId: 6251001e6ba7354f704fa663be8ef365ca0b9d23
2026-05-12 08:06:21 +00:00
Mathias Jakobsen
6b28a4ee5a Merge pull request #33560 from overleaf/mj-conversion-cleanup
[clsi+web] Small cleanups and improvements to conversions / exports

GitOrigin-RevId: 300adfbb91e89f754ee7f835db792ccb50b27613
2026-05-12 08:06:17 +00:00
Mathias Jakobsen
62d92b70dd Merge pull request #33341 from overleaf/mj-two-step-export-web
[web] Add two-step pandoc conversion download

GitOrigin-RevId: 093f435a497a7583d2b4d23558415cc442f84553
2026-05-12 08:06:13 +00:00
Alf Eaton
64d706f114 Revert "Wrap PDF setDocument in startViewTransition (#33346)" (#33580)
This reverts commit 353ab865de3c7872363a61592d86390dfc34dacc.

GitOrigin-RevId: dd103eb413a51861b31cd77542ca541e10df0c6c
2026-05-12 08:06:05 +00:00
renovate[bot]
5c5a80923a [Platform] Update dependency dompurify to v3.4.0 from 3.3.3 [SECURITY] (#33227)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
GitOrigin-RevId: da9d98ac0b4d3690bd2db18f7c4f61cf45fb379a
2026-05-12 08:05:58 +00:00
Alf Eaton
17dd108ce1 Wrap PDF setDocument in startViewTransition (#33346)
* Set scale synchronously on pagesinit to prevent 1.333 DPI flash

PDF.js resets its internal scale to 1.0 when setDocument() is called,
causing pages to momentarily render at the default 96/72 DPI scale
(1.333) before the React restore effect can apply the correct value.
Setting currentScaleValue directly in the pagesinit handler eliminates
this one-frame wrong-scale flash.

* Override .page display to block to prevent horizontal jump on recompile

Overleaf's global .loading class sets display:inline-flex, which
collides with PDF.js's transient 'loading' class on .page elements.
When the loading class is applied, inline-flex breaks margin:auto
centering, causing the page to jump horizontally. Forcing display:block
at higher specificity prevents the global rule from taking effect.

* Fix scrollToPosition offset using marginTop instead of borderWidth

scrollPageIntoView aligns the page content edge with the container top,
leaving scrollTop equal to the page's top margin (12px) rather than 0.
The previous correction used borderWidth (effectively 0) so the margin
offset was never compensated. Using marginTop scrolls back the correct
amount so the margin above the first page is visible.

* Prevent PDF viewer collapsing during recompile by preserving height

When setDocument() is called with a new PDF, _resetView() synchronously
clears all page elements, briefly collapsing the .pdfViewer div to the
viewport height. This produces a visible flicker before pagesinit fires
and pages are re-added.

Fix: record the current height and pin it as min-height on the .pdfViewer
element before calling setDocument(). A one-shot pagesinit listener
removes the constraint once the new pages are initialised at the correct
scale, by which point the element is already at its correct final height.

* Suppress PDF.js page-level loading spinner in Overleaf viewer

The PDF.js loadingIcon/loading classes briefly add a ::after pseudo-element
with display:block and contain:strict to each page div. Overleaf has its
own loading state UI so the spinner is redundant, and its activation was
the root cause of the shifts 4-5 height oscillation (the display change
broke CSS margin collapse on .pdfViewer, adding 2x page margins to its
computed height).

The display:block rule already added to .page prevents the direct cause
(Overleaf's .loading{display:inline-flex} colliding with the PDF.js class).
This rule makes the intent explicit by zeroing the ::after entirely.

* Wrap PDF setDocument in startViewTransition

---------

Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 353ab865de3c7872363a61592d86390dfc34dacc
2026-05-12 08:05:53 +00:00