Minor changes in README.md

Track changes / comments: update backend to support frontend changes
Allow EXTERNAL_AUTH to be undefined, fixes #26
2026-11-12 21:23:45 +01:00 · 2025-04-09 15:31:39 +02:00 · 2025-04-09 15:31:39 +02:00 · 2025-04-09 15:31:39 +02:00 · 2025-04-09 15:31:39 +02:00 · 2025-04-09 15:31:39 +02:00
1928 changed files with 64276 additions and 79135 deletions
@@ -14,30 +14,872 @@
  <a href="#license">License</a>
 </p>

-<img src="doc/screenshot.png" alt="A screenshot of a project being edited in Overleaf Community Edition">
+<img src="doc/screenshot.png" alt="A screenshot of a project being edited in Overleaf Extended Community Edition">
 <p align="center">
-  Figure 1: A screenshot of a project being edited in Overleaf Community Edition.
+  Figure 1: A screenshot of a project being edited in Overleaf Extended Community Edition.
 </p>

 ## Community Edition

-[Overleaf](https://www.overleaf.com) is an open-source online real-time collaborative LaTeX editor. We run a hosted version at [www.overleaf.com](https://www.overleaf.com), but you can also run your own local version, and contribute to the development of Overleaf.
+[Overleaf](https://www.overleaf.com) is an open-source online real-time collaborative LaTeX editor. Overleaf runs a hosted version at [www.overleaf.com](https://www.overleaf.com), but you can also run your own local version, and contribute to the development of Overleaf.
+
+## Extended Community Edition
+
+The present "extended" version of Overleaf CE includes:
+
+- Sandboxed Compiles with TeX Live image selection
+- LDAP authentication
+- SAML authentication
+- OpenID Connect authentication
+- Real-time track changes and comments
+- Autocomplete of reference keys
+- Symbol Palette

 ## Enterprise

-If you want help installing and maintaining Overleaf in your lab or workplace, we offer an officially supported version called [Overleaf Server Pro](https://www.overleaf.com/for/enterprises). It also includes more features for security (SSO with LDAP or SAML), administration and collaboration (e.g. tracked changes). [Find out more!](https://www.overleaf.com/for/enterprises)
-
-## Keeping up to date
-
-Sign up to the [mailing list](https://mailchi.mp/overleaf.com/community-edition-and-server-pro) to get updates on Overleaf releases and development.
+If you want help installing and maintaining Overleaf in your lab or workplace, Overleaf offers an officially supported version called [Overleaf Server Pro](https://www.overleaf.com/for/enterprises).

 ## Installation

-We have detailed installation instructions in the [Overleaf Toolkit](https://github.com/overleaf/toolkit/).
+Detailed installation instructions can be found in the [Overleaf Toolkit](https://github.com/overleaf/toolkit/).
+To run a custom image, add a file named docker-compose.override.yml with the following or similar content into the `overleaf-toolkit/config directory`:

-## Upgrading
+```yml
+---
+services:
+    sharelatex:
+        image: sharelatex/sharelatex:ext-ce
+        volumes:
+          - ../config/certs:/overleaf/certs
+```
+Here, the attached volume provides convenient access for the container to the certificates needed for SAML or LDAP authentication.

-If you are upgrading from a previous version of Overleaf, please see the [Release Notes section on the Wiki](https://github.com/overleaf/overleaf/wiki#release-notes) for all of the versions between your current version and the version you are upgrading to.
+If you want to build a Docker image of the extended CE based on the upstream v5.4.0 codebase, you can check out the corresponding tag by running:
+```
+git checkout v5.4.0-ext-v1
+```
+After building the image, switch to the latest state of the repository and check the `server-ce/hotfix` directory. If a subdirectory matching your version (e.g., `5.4.0`) exists, build a patched image.
+Alternatively, you can download a prebuilt image from Docker Hub:
+```
+docker pull overleafcep/sharelatex:5.4.0-ext-v1
+```
+Make sure to update the image name in overleaf-toolkit/config/docker-compose.override.yml accordingly.
+
+## Sandboxed Compiles
+
+To enable sandboxed compiles (also known as "Sibling containers"), set the following configuration options in `overleaf-toolkit/config/overleaf.rc`:
+
+```
+SERVER_PRO=true
+SIBLING_CONTAINERS_ENABLED=true
+```
+
+The following environment variables are used to specify which TeX Live images to use for sandboxed compiles:
+
+- `ALL_TEX_LIVE_DOCKER_IMAGES` **(required)**
+    * A comma-separated list of TeX Live images to use. These images will be downloaded or updated.
+      To skip downloading the images, set `SIBLING_CONTAINERS_PULL=false` in `config/overleaf.rc`.
+- `ALL_TEX_LIVE_DOCKER_IMAGE_NAMES`
+    * A comma-separated list of friendly names for the images. If omitted, the version name will be used (e.g., `latest-full`).
+- `TEX_LIVE_DOCKER_IMAGE` **(required)**
+    * The default TeX Live image that will be used for compiling new projects. The environment variable `ALL_TEX_LIVE_DOCKER_IMAGES` must include this image.
+
+Users can select the image for their project in the project menu.
+
+Here is an example where the default TeX Live image is `latest-full` from Docker Hub, but the `TL2024-historic` image can be used for older projects:
+```
+ALL_TEX_LIVE_DOCKER_IMAGES=texlive/texlive:latest-full, texlive/texlive:TL2024-historic
+ALL_TEX_LIVE_DOCKER_IMAGE_NAMES=TeXLive 2025, TeXLive 2024
+TEX_LIVE_DOCKER_IMAGE=texlive/texlive:latest-full
+```
+For additional details refer to
+[Server Pro: Sandboxed Compiles](https://github.com/overleaf/overleaf/wiki/Server-Pro:-Sandboxed-Compiles) and
+[Toolkit: Sandboxed Compiles](https://github.com/overleaf/toolkit/blob/master/doc/sandboxed-compiles.md).
+
+When the compilation takes place in a dedicated container, it is relatively safe to permit running external commands from inside the TeX
+file during compilation. This is required for packages like `minted`. For this purpose, the following environment variable can be used:
+
+- `TEX_COMPILER_EXTRA_FLAGS`
+    * A list of extra flags for TeX compiler. Example: `-shell-escape -file-line-error`
+
+<details>
+<summary><h4>Sample variables.env file</h4></summary>
+
+```
+OVERLEAF_APP_NAME="Our Overleaf Instance"
+
+ENABLED_LINKED_FILE_TYPES=project_file,project_output_file
+
+# Enables Thumbnail generation using ImageMagick
+ENABLE_CONVERSIONS=true
+
+# Disables email confirmation requirement
+EMAIL_CONFIRMATION_DISABLED=true
+
+## Nginx
+# NGINX_WORKER_PROCESSES=4
+# NGINX_WORKER_CONNECTIONS=768
+
+## Set for TLS via nginx-proxy
+# OVERLEAF_BEHIND_PROXY=true
+# OVERLEAF_SECURE_COOKIE=true
+
+OVERLEAF_SITE_URL=http://my-overleaf-instance.com
+OVERLEAF_NAV_TITLE=Our Overleaf Instance
+# OVERLEAF_HEADER_IMAGE_URL=http://somewhere.com/mylogo.png
+OVERLEAF_ADMIN_EMAIL=support@example.com
+
+OVERLEAF_LEFT_FOOTER=[{"text": "Contact your support team", "url": "mailto:support@example.com"}]
+OVERLEAF_RIGHT_FOOTER=[{"text":"Hello, I am on the Right", "url":"https://github.com/yu-i-i/overleaf-cep"}]
+
+OVERLEAF_EMAIL_FROM_ADDRESS=team@example.com
+OVERLEAF_EMAIL_SMTP_HOST=smtp.example.com
+OVERLEAF_EMAIL_SMTP_PORT=587
+OVERLEAF_EMAIL_SMTP_SECURE=false
+# OVERLEAF_EMAIL_SMTP_USER=
+# OVERLEAF_EMAIL_SMTP_PASS=
+# OVERLEAF_EMAIL_SMTP_NAME=
+OVERLEAF_EMAIL_SMTP_LOGGER=false
+OVERLEAF_EMAIL_SMTP_TLS_REJECT_UNAUTH=true
+OVERLEAF_EMAIL_SMTP_IGNORE_TLS=false
+OVERLEAF_CUSTOM_EMAIL_FOOTER=This system is run by department x
+
+OVERLEAF_PROXY_LEARN=true
+NAV_HIDE_POWERED_BY=true
+
+########################
+## Sandboxed Compiles ##
+########################
+
+ALL_TEX_LIVE_DOCKER_IMAGES=texlive/texlive:latest-full, texlive/texlive:TL2023-historic
+ALL_TEX_LIVE_DOCKER_IMAGE_NAMES=TeXLive 2024, TeXLive 2023
+TEX_LIVE_DOCKER_IMAGE=texlive/texlive:latest-full
+TEX_COMPILER_EXTRA_FLAGS=-shell-escape
+```
+</details>
+
+## Authentication Methods
+
+The following authentication methods are supported: local authentication, LDAP authentication, SAML authentication,
+and OpenID Connect (OIDC) authentication. Local authentication is always active. The environment variable `EXTERNAL_AUTH`
+specifies which external authentication methods are activated. The value of this variable is a list. If the list includes `ldap`, `saml`, or `oidc`,
+then LDAP authentication, SAML authentication, and OIDC authentication will be activated, respectively. 
+
+For example: `EXTERNAL_AUTH=ldap saml oidc`
+
+This configuration activates all available authentication methods, although this is rarely necessary.
+
+<details>
+<summary><h3>Local Authentication</h3></summary>
+
+Password of local users stored in the MongoDB database. An admin user can create a new local user. For details, visit the
+[wiki of Overleaf project](https://github.com/overleaf/overleaf/wiki/Creating-and-managing-users).
+
+It is possible to enforce password restrictions on local users:
+
+
+* `OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH`: The minimum length required
+
+* `OVERLEAF_PASSWORD_VALIDATION_MAX_LENGTH`: The maximum length allowed
+
+* `OVERLEAF_PASSWORD_VALIDATION_PATTERN`: is used to validate password strength
+
+  - `abc123` – password requires 3 letters and 3 numbers and be at least 6 characters long
+  - `aA` – password requires lower and uppercase letters and be at least 2 characters long
+  - `ab$3` – it must contain letters, digits and symbols and be at least 4 characters long
+  - There are 4 groups of characters: letters, UPPERcase letters, digits, symbols. Anything that is neither a letter nor a digit is considered to be a symbol.
+
+</details>
+
+<details>
+<summary><h3>LDAP Authentication</h3></summary>
+
+Internally, Overleaf LDAP uses the [passport-ldapauth](https://github.com/vesse/passport-ldapauth) library. Most of these configuration options are passed through to the `server` config object which is used to configure `passport-ldapauth`. If you are having issues configuring LDAP, it is worth reading the README for `passport-ldapauth` to understand the configuration it expects.
+
+When using Local and LDAP authentication methods, a user enters a `username` and `password` in the login form. If LDAP authentication is enabled, it is attempted first:
+
+1. An LDAP user is searched for in the LDAP directory using the filter defined by `OVERLEAF_LDAP_SEARCH_FILTER` and authenticated.
+2. If authentication is successful, the Overleaf users database is checked for a user with the primary email address that matches the email address of the authenticated LDAP user:
+   - If a matching user is found, the `hashedPassword` field for this user is deleted (if it exists). This ensures that the user can only log in via LDAP authentication in the future.
+   - If no matching user is found, a new Overleaf user is created using the email, first name, and last name retrieved from the LDAP server.
+3. If LDAP authentication fails or is unsuccessful, local authentication is attempted.
+
+#### Environment Variables
+
+- `OVERLEAF_LDAP_URL` **(required)**
+    * URL of the LDAP server.
+
+      - Example: `ldaps://ldap.example.com:636` (LDAP over SSL)
+      - Example: `ldap://ldap.example.com:389` (unencrypted or STARTTLS, if configured).
+
+- `OVERLEAF_LDAP_EMAIL_ATT`
+    * The email attribute returned by the LDAP server, default `mail`. Each LDAP user must have at least one email address.
+      If multiple addresses are provided, only the first one will be used.
+
+- `OVERLEAF_LDAP_FIRST_NAME_ATT`
+    * The property name holding the first name of the user which is used in the application, usually `givenName`.
+
+- `OVERLEAF_LDAP_LAST_NAME_ATT`
+    * The property name holding the family name of the user which is used in the application, usually `sn`.
+
+- `OVERLEAF_LDAP_NAME_ATT`
+    * The property name holding the full name of the user, usually `cn`. If either of the two previous variables is not defined,
+      the first and/or last name of the user is extracted from this variable. Otherwise, it is not used.
+
+- `OVERLEAF_LDAP_PLACEHOLDER`
+    * The placeholder for the login form, defaults to `Username`.
+
+- `OVERLEAF_LDAP_UPDATE_USER_DETAILS_ON_LOGIN`
+    * If set to `true`, updates the LDAP user `first_name` and `last_name` field on login, and turn off the user details form on the `/user/settings`
+      page for LDAP users. Otherwise, details will be fetched only on first login.
+
+- `OVERLEAF_LDAP_BIND_DN`
+    * The distinguished name of the LDAP user that should be used for the LDAP connection
+      (this user should be able to search/list accounts on the LDAP server),
+      e.g., `cn=ldap_reader,dc=example,dc=com`. If not defined, anonymous binding is used.
+
+- `OVERLEAF_LDAP_BIND_CREDENTIALS`
+    * Password for `OVERLEAF_LDAP_BIND_DN`.
+
+- `OVERLEAF_LDAP_BIND_PROPERTY`
+    * Property of the user to bind against the client, defaults to `dn`.
+
+- `OVERLEAF_LDAP_SEARCH_BASE` **(required)**
+    * The base DN from which to search for users. E.g., `ou=people,dc=example,dc=com`.
+
+- `OVERLEAF_LDAP_SEARCH_FILTER`
+    * LDAP search filter with which to find a user. Use the literal '{{username}}' to have the given username be interpolated in for the LDAP search.
+
+      - Example: `(|(uid={{username}})(mail={{username}}))` (user can login with email or with login name).
+      - Example: `(sAMAccountName={{username}})` (Active Directory).
+
+- `OVERLEAF_LDAP_SEARCH_SCOPE`
+    * The scope of the search can be `base`, `one`, or `sub` (default).
+
+- `OVERLEAF_LDAP_SEARCH_ATTRIBUTES`
+    * JSON array of attributes to fetch from the LDAP server, e.g., `["uid", "mail", "givenName", "sn"]`.
+      By default, all attributes are fetched.
+
+- `OVERLEAF_LDAP_STARTTLS`
+    * If `true`, LDAP over TLS is used.
+
+- `OVERLEAF_LDAP_TLS_OPTS_CA_PATH`
+    * Path to the file containing the CA certificate used to verify the LDAP server's SSL/TLS certificate. If there are multiple certificates, then
+      it can be a JSON array of paths to the certificates. The files must be accessible to the docker container.
+
+      - Example (one certificate): `/overleaf/certs/ldap_ca_cert.pem`
+      - Example (multiple certificates): `["/overleaf/certs/ldap_ca_cert1.pem", "/overleaf/certs/ldap_ca_cert2.pem"]`
+
+- `OVERLEAF_LDAP_TLS_OPTS_REJECT_UNAUTH`
+    * If `true`, the server certificate is verified against the list of supplied CAs.
+
+- `OVERLEAF_LDAP_CACHE`
+    * If `true`, then up to 100 credentials at a time will be cached for 5 minutes.
+
+- `OVERLEAF_LDAP_TIMEOUT`
+    * How long the client should let operations live for before timing out, ms (Default: Infinity).
+
+- `OVERLEAF_LDAP_CONNECT_TIMEOUT`
+    * How long the client should wait before timing out on TCP connections, ms (Default: OS default).
+
+- `OVERLEAF_LDAP_IS_ADMIN_ATT` and `OVERLEAF_LDAP_IS_ADMIN_ATT_VALUE`
+    * When both environment variables are set, the login process updates `user.isAdmin = true` if the LDAP profile contains the attribute specified by
+     `OVERLEAF_LDAP_IS_ADMIN_ATT` and its value either matches `OVERLEAF_LDAP_IS_ADMIN_ATT_VALUE` or is an array containing `OVERLEAF_LDAP_IS_ADMIN_ATT_VALUE`,
+      otherwise `user.isAdmin` is set to `false`. If either of these variables is not set, then the admin status is only set to `true` during admin user
+      creation in Launchpad.
+
+The following five variables are used to configure how user contacts are retrieved from the LDAP server.
+
+- `OVERLEAF_LDAP_CONTACTS_FILTER`
+    * The filter used to search for users in the LDAP server to be loaded into contacts. The placeholder '{{userProperty}}' within the filter is replaced with the value of
+    the property specified by `OVERLEAF_LDAP_CONTACTS_PROPERTY` from the LDAP user initiating the search. If not defined, no users are retrieved from the LDAP server into contacts.
+
+- `OVERLEAF_LDAP_CONTACTS_SEARCH_BASE`
+    * Specifies the base DN from which to start searching for the contacts. Defaults to `OVERLEAF_LDAP_SEARCH_BASE`.
+
+- `OVERLEAF_LDAP_CONTACTS_SEARCH_SCOPE`
+    * The scope of the search can be `base`, `one`, or `sub` (default).
+
+- `OVERLEAF_LDAP_CONTACTS_PROPERTY`
+    * Specifies the property of the user object that will replace the '{{userProperty}}' placeholder in the `OVERLEAF_LDAP_CONTACTS_FILTER`.
+
+- `OVERLEAF_LDAP_CONTACTS_NON_LDAP_VALUE`
+    * Specifies the value of the `OVERLEAF_LDAP_CONTACTS_PROPERTY` if the search is initiated by a non-LDAP user. If this variable is not defined, the resulting filter
+      will match nothing. The value `*` can be used as a wildcard.
+
+<details>
+<summary><h5>Example</h5></summary>
+
+    OVERLEAF_LDAP_CONTACTS_FILTER=(gidNumber={{userProperty}})
+    OVERLEAF_LDAP_CONTACTS_PROPERTY=gidNumber
+    OVERLEAF_LDAP_CONTACTS_NON_LDAP_VALUE=1000
+
+The above example results in loading into the contacts of the current LDAP user all LDAP users who have the same UNIX `gid`. Non-LDAP users will have all LDAP users with UNIX `gid=1000` in their contacts.
+
+</details>
+
+
+<details>
+<summary><h4>Sample variables.env file</h4></summary>
+
+```
+OVERLEAF_APP_NAME="Our Overleaf Instance"
+
+ENABLED_LINKED_FILE_TYPES=project_file,project_output_file
+
+# Enables Thumbnail generation using ImageMagick
+ENABLE_CONVERSIONS=true
+
+# Disables email confirmation requirement
+EMAIL_CONFIRMATION_DISABLED=true
+
+## Nginx
+# NGINX_WORKER_PROCESSES=4
+# NGINX_WORKER_CONNECTIONS=768
+
+## Set for TLS via nginx-proxy
+# OVERLEAF_BEHIND_PROXY=true
+# OVERLEAF_SECURE_COOKIE=true
+
+OVERLEAF_SITE_URL=http://my-overleaf-instance.com
+OVERLEAF_NAV_TITLE=Our Overleaf Instance
+# OVERLEAF_HEADER_IMAGE_URL=http://somewhere.com/mylogo.png
+OVERLEAF_ADMIN_EMAIL=support@example.com
+
+OVERLEAF_LEFT_FOOTER=[{"text": "Contact your support team", "url": "mailto:support@example.com"}]
+OVERLEAF_RIGHT_FOOTER=[{"text":"Hello, I am on the Right", "url":"https://github.com/yu-i-i/overleaf-cep"}]
+
+OVERLEAF_EMAIL_FROM_ADDRESS=team@example.com
+OVERLEAF_EMAIL_SMTP_HOST=smtp.example.com
+OVERLEAF_EMAIL_SMTP_PORT=587
+OVERLEAF_EMAIL_SMTP_SECURE=false
+# OVERLEAF_EMAIL_SMTP_USER=
+# OVERLEAF_EMAIL_SMTP_PASS=
+# OVERLEAF_EMAIL_SMTP_NAME=
+OVERLEAF_EMAIL_SMTP_LOGGER=false
+OVERLEAF_EMAIL_SMTP_TLS_REJECT_UNAUTH=true
+OVERLEAF_EMAIL_SMTP_IGNORE_TLS=false
+OVERLEAF_CUSTOM_EMAIL_FOOTER=This system is run by department x
+
+OVERLEAF_PROXY_LEARN=true
+NAV_HIDE_POWERED_BY=true
+
+#################
+## LDAP for CE ##
+#################
+
+EXTERNAL_AUTH=ldap
+OVERLEAF_LDAP_URL=ldap://ldap.example.com:389
+OVERLEAF_LDAP_STARTTLS=true
+OVERLEAF_LDAP_TLS_OPTS_CA_PATH=/overleaf/certs/ldap_ca_cert.pem
+OVERLEAF_LDAP_SEARCH_BASE=ou=people,dc=example,dc=com
+OVERLEAF_LDAP_SEARCH_FILTER=(|(uid={{username}})(mail={{username}}))
+OVERLEAF_LDAP_BIND_DN=cn=ldap_reader,dc=example,dc=com
+OVERLEAF_LDAP_BIND_CREDENTIALS=GoodNewsEveryone
+OVERLEAF_LDAP_EMAIL_ATT=mail
+OVERLEAF_LDAP_FIRST_NAME_ATT=givenName
+OVERLEAF_LDAP_LAST_NAME_ATT=sn
+# OVERLEAF_LDAP_NAME_ATT=cn
+OVERLEAF_LDAP_SEARCH_ATTRIBUTES=["uid", "sn", "givenName", "mail"]
+
+OVERLEAF_LDAP_UPDATE_USER_DETAILS_ON_LOGIN=true
+
+OVERLEAF_LDAP_PLACEHOLDER='Username or email address'
+
+OVERLEAF_LDAP_IS_ADMIN_ATT=mail
+OVERLEAF_LDAP_IS_ADMIN_ATT_VALUE=admin@example.com
+
+OVERLEAF_LDAP_CONTACTS_FILTER=(gidNumber={{userProperty}})
+OVERLEAF_LDAP_CONTACTS_PROPERTY=gidNumber
+OVERLEAF_LDAP_CONTACTS_NON_LDAP_VALUE='*'
+```
+</details>
+
+<details>
+<summary><i>Deprecated variables</i></summary>
+
+**These variables will be removed soon**, use `OVERLEAF_LDAP_IS_ADMIN_ATT` and `OVERLEAF_LDAP_IS_ADMIN_ATT_VALUE` instead.
+
+The following variables are used to determine if the user has admin rights.
+Please note: the user gains admin status if the search result is not empty, not when the user is explicitly included in the search results.
+
+- `OVERLEAF_LDAP_ADMIN_SEARCH_BASE`
+    * Specifies the base DN from which to start searching for the admin group. If this variable is defined,
+    `OVERLEAF_LDAP_ADMIN_SEARCH_FILTER` must also be defined for the search to function properly.
+
+- `OVERLEAF_LDAP_ADMIN_SEARCH_FILTER`
+    * Defines the LDAP search filter used to identify the admin group. The placeholder `{{dn}}` within the filter
+      is replaced with the value of the property specified by `OVERLEAF_LDAP_ADMIN_DN_PROPERTY`. The placeholder `{{username}}` is also supported.
+
+- `OVERLEAF_LDAP_ADMIN_DN_PROPERTY`
+    * Specifies the property of the user object that will replace the '{{dn}}' placeholder
+      in the `OVERLEAF_LDAP_ADMIN_SEARCH_FILTER`, defaults to `dn`.
+
+- `OVERLEAF_LDAP_ADMIN_SEARCH_SCOPE`
+    * The scope of the LDAP search can be `base`, `one`, or `sub` (default)
+
+<details>
+<summary><h5>Example</h5></summary>
+
+In the following example admins are members of a group `admins`, the objectClass of the entry `admins` is `groupOfNames`:
+
+    OVERLEAF_LDAP_ADMIN_SEARCH_BASE='cn=admins,ou=group,dc=example,dc=com'
+    OVERLEAF_LDAP_ADMIN_SEARCH_FILTER='(member={{dn}})'
+
+In the following example admins are members of a group 'admins', the objectClass of the entry `admins` is `posixGroup`:
+
+    OVERLEAF_LDAP_ADMIN_SEARCH_BASE='cn=admins,ou=group,dc=example,dc=com'
+    OVERLEAF_LDAP_ADMIN_SEARCH_FILTER='(memberUid={{username}})'
+
+In the following example admins are users with UNIX gid=1234:
+
+    OVERLEAF_LDAP_ADMIN_SEARCH_BASE='ou=people,dc=example,dc=com'
+    OVERLEAF_LDAP_ADMIN_SEARCH_FILTER='(&(gidNumber=1234)(uid={{username}}))'
+
+In the following example admin is the user with `uid=someuser`:
+
+    OVERLEAF_LDAP_ADMIN_SEARCH_BASE='ou=people,dc=example,dc=com'
+    OVERLEAF_LDAP_ADMIN_SEARCH_FILTER='(&(uid=someuser)(uid={{username}}))'
+
+The filter
+
+    OVERLEAF_LDAP_ADMIN_SEARCH_FILTER='(uid=someuser)'
+
+where `someuser` is the uid of an existing user, will always produce a non-empty search result.
+As a result, **every user will be granted admin rights**, not just `someuser`, as one might expect.
+
+</details>
+</details>
+</details>
+
+<details>
+<summary><h3>SAML Authentication</h3></summary>
+
+Internally, Overleaf SAML module uses the [passport-saml](https://github.com/node-saml/passport-saml) library, most of the following
+configuration options are passed through to `passport-saml`. If you are having issues configuring SAML, it is worth reading the README
+for `passport-saml` to get a feel for the configuration it expects.
+
+When using the SAML authentication method, a user is redirected to the Identity Provider (IdP) authentication site.
+If the IdP successfully authenticates the user, the Overleaf users database is checked for a record containing a `samlIdentifiers` field structured as follows:
+
+```
+samlIdentifiers: [
+  {
+    externalUserId: "...",
+    providerId: "1",
+    userIdAttribute: "..."
+  }
+]
+```
+The `externalUserId` must match the value of the property specified by `userIdAttribute` in the user profile returned by the IdP server.
+
+If no matching record is found, the database is searched for a user with the primary email address matching the email in the IdP user profile:
+
+- If such a user is found, the `hashedPassword` field is deleted to disable local authentication, and the `samlIdentifiers` field is added.
+- If no matching user is found, a new user is created with the email address and `samlIdentifiers` from the IdP profile.
+
+**Note:** Currently, only one SAML IdP is supported. The `providerId` field in `samlIdentifiers` is fixed to `'1'`.
+
+#### Environment Variables
+
+- `OVERLEAF_SAML_IDENTITY_SERVICE_NAME`
+    * Display name for the identity service, used on the login page (default: `Log in with SAML IdP`).
+
+- `OVERLEAF_SAML_USER_ID_FIELD`
+    * The value of this attribute will be used by Overleaf as the external user ID, defaults to `nameID`.
+
+- `OVERLEAF_SAML_EMAIL_FIELD`
+    * Name of the Email field in user profile, defaults to `nameID`.
+
+- `OVERLEAF_SAML_FIRST_NAME_FIELD`
+    * Name of the firstName field in user profile, defaults to `givenName`.
+
+- `OVERLEAF_SAML_LAST_NAME_FIELD`
+    * Name of the lastName field in user profile, defaults to `lastName`
+
+- `OVERLEAF_SAML_UPDATE_USER_DETAILS_ON_LOGIN`
+    * If set to `true`, updates the user `first_name` and `last_name` field on login,
+      and turn off the user details form on `/user/settings` page.
+
+- `OVERLEAF_SAML_ENTRYPOINT` **(required)**
+    * Entrypoint URL for the SAML identity service.
+
+      - Example: `https://idp.example.com/simplesaml/saml2/idp/SSOService.php`
+      - Azure Example: `https://login.microsoftonline.com/8b26b46a-6dd3-45c7-a104-f883f4db1f6b/saml2`
+
+- `OVERLEAF_SAML_ISSUER` **(required)**
+    * The Issuer name.
+
+- `OVERLEAF_SAML_AUDIENCE`
+    * Expected saml response Audience, defaults to value of `OVERLEAF_SAML_ISSUER`.
+
+- `OVERLEAF_SAML_IDP_CERT` **(required)**
+    * Path to a file containing the Identity Provider's public certificate, used to validate the signatures of incoming SAML responses. If the Identity Provider has multiple valid signing certificates, then
+      it can be a JSON array of paths to the certificates.
+
+        - Example (one certificate): `/overleaf/certs/idp_cert.pem`
+        - Example (multiple certificates): `["/overleaf/certs/idp_cert.pem", "/overleaf/certs/idp_cert_old.pem"]`
+
+- `OVERLEAF_SAML_PUBLIC_CERT`
+    * Path to a file containing public signing certificate used to embed in auth requests in order for the IdP to validate the signatures of the incoming SAML Request. It's required when setting up the [metadata endpoint](#metadata-for-the-identity-provider)
+      when the strategy is configured with a `OVERLEAF_SAML_PRIVATE_KEY`. A JSON array of paths to certificates can be provided to support certificate rotation. When supplying an array of certificates, the first entry in the array should match the
+      current `OVERLEAF_SAML_PRIVATE_KEY`. Additional entries in the array can be used to publish upcoming certificates to IdPs before changing the `OVERLEAF_SAML_PRIVATE_KEY`.
+
+- `OVERLEAF_SAML_PRIVATE_KEY`
+    * Path to a file containing a PEM-formatted private key matching the `OVERLEAF_SAML_PUBLIC_CERT` used to sign auth requests sent by passport-saml.
+
+- `OVERLEAF_SAML_DECRYPTION_CERT`
+    *  Path to a file containing public certificate, used for the [metadata endpoint](#metadata-for-the-identity-provider).
+
+- `OVERLEAF_SAML_DECRYPTION_PVK`
+    * Path to a file containing private key  matching the `OVERLEAF_SAML_DECRYPTION_CERT` that will be used to attempt to decrypt any encrypted assertions that are received.
+
+- `OVERLEAF_SAML_SIGNATURE_ALGORITHM`
+    * Optionally set the signature algorithm for signing requests,
+          valid values are 'sha1' (default), 'sha256' (prefered), 'sha512' (most secure, check if your IdP supports it).
+
+- `OVERLEAF_SAML_ADDITIONAL_PARAMS`
+    * JSON dictionary of additional query params to add to all requests.
+
+- `OVERLEAF_SAML_ADDITIONAL_AUTHORIZE_PARAMS`
+    * JSON dictionary of additional query params to add to 'authorize' requests.
+
+        - Example: `{"some_key": "some_value"}`
+
+- `OVERLEAF_SAML_IDENTIFIER_FORMAT`
+    * Name identifier format to request from the identity provider (default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`).
+      If using `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, ensure the `OVERLEAF_SAML_EMAIL_FIELD` envirionment variable is defined.
+      If `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` is required, you must also define the `OVERLEAF_SAML_ID_FIELD` environment variable,
+      which can, for example, be set to the user's email address.
+
+- `OVERLEAF_SAML_ACCEPTED_CLOCK_SKEW_MS`
+    * Time in milliseconds of skew that is acceptable between client and server when checking OnBefore and NotOnOrAfter assertion
+          condition validity timestamps. Setting to -1 will disable checking these conditions entirely. Default is 0.
+
+- `OVERLEAF_SAML_ATTRIBUTE_CONSUMING_SERVICE_INDEX`
+    * `AttributeConsumingServiceIndex` attribute to add to AuthnRequest to instruct the IdP which attribute set to attach
+          to the response ([link](http://blog.aniljohn.com/2014/01/data-minimization-front-channel-saml-attribute-requests.html)).
+
+- `OVERLEAF_SAML_AUTHN_CONTEXT`
+    * JSON array of name identifier format values to request auth context. Default: `["urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"]`.
+
+- `OVERLEAF_SAML_FORCE_AUTHN`
+    * If `true`, the initial SAML request from the service provider specifies that the IdP should force re-authentication of the user,
+          even if they possess a valid session.
+
+- `OVERLEAF_SAML_DISABLE_REQUESTED_AUTHN_CONTEXT`
+    * If `true`, do not request a specific auth context. For example, you can this this to `true` to allow additional contexts such as password-less logins (`urn:oasis:names:tc:SAML:2.0:ac:classes:X509`). Support for additional contexts is dependant on your IdP.
+
+- `OVERLEAF_SAML_AUTHN_REQUEST_BINDING`
+    * If set to `HTTP-POST`, will request authentication from IdP via HTTP POST binding, otherwise defaults to HTTP-Redirect.
+
+- `OVERLEAF_SAML_VALIDATE_IN_RESPONSE_TO`
+    * If `always`, then InResponseTo will be validated from incoming SAML responses.
+    * If `never`, then InResponseTo  won't be validated (default).
+    * If `ifPresent`, then InResponseTo will only be validated if present in the incoming SAML response.
+
+- `OVERLEAF_SAML_WANT_ASSERTIONS_SIGNED` and `OVERLEAF_SAML_WANT_AUTHN_RESPONSE_SIGNED`
+    * When set to `true` (default), Overleaf expects the SAML Assertions, respectively the entire SAML Authentication Response, to be signed by the IdP.
+      When both options are `false`, at least one of the assertions or the response must be signed.
+
+- `OVERLEAF_SAML_REQUEST_ID_EXPIRATION_PERIOD_MS`
+    * Defines the expiration time when a Request ID generated for a SAML request will not be valid if seen
+          in a SAML response in the `InResponseTo` field. Default: 28800000 (8 hours).
+
+- `OVERLEAF_SAML_LOGOUT_URL`
+    * base address to call with logout requests (default: `entryPoint`).
+
+      - Example: `https://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php`
+
+- `OVERLEAF_SAML_ADDITIONAL_LOGOUT_PARAMS`
+    * JSON dictionary of additional query params to add to 'logout' requests.
+
+- `OVERLEAF_SAML_IS_ADMIN_FIELD` and `OVERLEAF_SAML_IS_ADMIN_FIELD_VALUE`
+    * When both environment variables are set, the login process updates `user.isAdmin = true` if the profile returned by the SAML IdP contains the attribute specified by
+     `OVERLEAF_SAML_IS_ADMIN_FIELD` and its value either matches `OVERLEAF_SAML_IS_ADMIN_FIELD_VALUE` or is an array containing `OVERLEAF_SAML_IS_ADMIN_FIELD_VALUE`,
+      otherwise `user.isAdmin` is set to `false`. If either of these variables is not set, then the admin status is only set to `true` during admin user
+      creation in Launchpad.
+
+#### Metadata for the Identity Provider
+
+The current version of Overleaf CE includes and endpoint to retrieve Service Provider Metadata: `http://my-overleaf-instance.com/saml/meta`
+
+The Identity Provider will need to be configured to recognize the Overleaf server as a "Service Provider". Consult the documentation for your SAML server for instructions on how to do this.
+
+Below is an example of appropriate Service Provider metadata:
+
+<details>
+<summary><h5>ol-meta.xml</h5></summary>
+
+```
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+                  xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+                  entityID="MyOverleaf"
+                  ID="_b508c83b7dda452f5b269383fb391107116f8f57">
+  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo>
+        <ds:X509Data>
+          <ds:X509Certificate>MII...
+[skipped]
+</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <KeyDescriptor use="encryption">
+      <ds:KeyInfo>
+        <ds:X509Data>
+          <ds:X509Certificate>MII...
+[skipped]
+</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+      <EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
+      <EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
+      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
+      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+    </KeyDescriptor>
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                         Location="https://my-overleaf-instance.com/saml/logout/callback"/>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <AssertionConsumerService index="1"
+                              isDefault="true"
+                              Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                              Location="https://my-overleaf-instance.com/saml/login/callback"/>
+  </SPSSODescriptor>
+</EntityDescriptor>
+
+```
+</details>
+
+Note the certificates, `AssertionConsumerService.Location`, `SingleLogoutService.Location` and `EntityDescriptor.entityID`
+and set as appropriate in your IdP configuration, or send the metadata file to the IdP admin.
+
+<details>
+<summary><h4>Sample variables.env file</h4></summary>
+
+```
+OVERLEAF_APP_NAME="Our Overleaf Instance"
+
+ENABLED_LINKED_FILE_TYPES=project_file,project_output_file
+
+# Enables Thumbnail generation using ImageMagick
+ENABLE_CONVERSIONS=true
+
+# Disables email confirmation requirement
+EMAIL_CONFIRMATION_DISABLED=true
+
+## Nginx
+# NGINX_WORKER_PROCESSES=4
+# NGINX_WORKER_CONNECTIONS=768
+
+## Set for TLS via nginx-proxy
+# OVERLEAF_BEHIND_PROXY=true
+# OVERLEAF_SECURE_COOKIE=true
+
+OVERLEAF_SITE_URL=http://my-overleaf-instance.com
+OVERLEAF_NAV_TITLE=Our Overleaf Instance
+# OVERLEAF_HEADER_IMAGE_URL=http://somewhere.com/mylogo.png
+OVERLEAF_ADMIN_EMAIL=support@example.com
+
+OVERLEAF_LEFT_FOOTER=[{"text": "Contact your support team", "url": "mailto:support@example.com"}]
+OVERLEAF_RIGHT_FOOTER=[{"text":"Hello, I am on the Right", "url":"https://github.com/yu-i-i/overleaf-cep"}]
+
+OVERLEAF_EMAIL_FROM_ADDRESS=team@example.com
+OVERLEAF_EMAIL_SMTP_HOST=smtp.example.com
+OVERLEAF_EMAIL_SMTP_PORT=587
+OVERLEAF_EMAIL_SMTP_SECURE=false
+# OVERLEAF_EMAIL_SMTP_USER=
+# OVERLEAF_EMAIL_SMTP_PASS=
+# OVERLEAF_EMAIL_SMTP_NAME=
+OVERLEAF_EMAIL_SMTP_LOGGER=false
+OVERLEAF_EMAIL_SMTP_TLS_REJECT_UNAUTH=true
+OVERLEAF_EMAIL_SMTP_IGNORE_TLS=false
+OVERLEAF_CUSTOM_EMAIL_FOOTER=This system is run by department x
+
+OVERLEAF_PROXY_LEARN=true
+NAV_HIDE_POWERED_BY=true
+
+#################
+## SAML for CE ##
+#################
+
+EXTERNAL_AUTH=saml
+OVERLEAF_SAML_IDENTITY_SERVICE_NAME='Log in with My IdP'
+OVERLEAF_SAML_EMAIL_FIELD=mail
+OVERLEAF_SAML_FIRST_NAME_FIELD=givenName
+OVERLEAF_SAML_LAST_NAME_FIELD=sn
+OVERLEAF_SAML_ENTRYPOINT=https://idp.example.com/simplesamlphp/saml2/idp/SSOService.php
+OVERLEAF_SAML_CALLBACK_URL=https://my-overleaf-instance.com/saml/login/callback
+OVERLEAF_SAML_LOGOUT_URL=https://idp.example.com/simplesamlphp/saml2/idp/SingleLogoutService.php
+OVERLEAF_SAML_LOGOUT_CALLBACK_URL=https://my-overleaf-instance.com/saml/logout/callback
+OVERLEAF_SAML_ISSUER=MyOverleaf
+OVERLEAF_SAML_IDP_CERT=/overleaf/certs/idp_cert.pem
+OVERLEAF_SAML_PUBLIC_CERT=/overleaf/certs/myol_cert.pem
+OVERLEAF_SAML_PRIVATE_KEY=/overleaf/certs/myol_key.pem
+OVERLEAF_SAML_DECRYPTION_CERT=/overleaf/certs/myol_decr_cert.pem
+OVERLEAF_SAML_DECRYPTION_PVK=/overleaf/certs/myol_decr_key.pem
+OVERLEAF_SAML_IS_ADMIN_FIELD=mail
+OVERLEAF_SAML_IS_ADMIN_FIELD_VALUE=overleaf.admin@example.com
+```
+</details>
+</details>
+
+<details>
+<summary><h3>OIDC Authentication</h3></summary>
+
+Internally, Overleaf OIDC module uses the [passport-openidconnect](https://github.com/jaredhanson/passport-openidconnect) library.
+If you are having issues configuring OpenID Connect, it is worth reading the README for `passport-openidconnect` to get a feel for the configuration it expects.
+
+
+When using the OIDC authentication method, a user is redirected to the Identity Provider (IdP) authentication site.
+If the IdP successfully authenticates the user, the Overleaf users database is checked for a record containing a `thirdPartyIdentifiers` field structured as follows:
+
+```
+thirdPartyIdentifiers: [
+  {
+    externalUserId: "...",
+    externalData: null,
+    providerId: "..."
+  }
+]
+```
+
+The `externalUserId` must match the user ID in the profile returned by the IdP server (see the `OVERLEAF_OIDC_USER_ID_FIELD` environment variable), and `providerId`
+must match the ID of the OIDC provider (see the `OVERLEAF_OIDC_PROVIDER_ID`).
+
+If no matching record is found, the database is searched for a user with the primary email address matching the email in the IdP user profile:
+- If such a user is found, the `thirdPartyIdentifiers` field is updated.
+- If no matching user is found, a new user is created with the email address and `thirdPartyIdentifiers` from the IdP profile.
+
+In both cases, the user is said to be 'linked' to the external OIDC user. The user can be unlinked from the OIDC provider on the `/user/settings` page.
+
+
+#### Environment Variables
+
+The values of the following five required variables can be found using `.well-known/openid-configuration` endpoint of your OpenID Provider (OP).
+
+- `OVERLEAF_OIDC_ISSUER` **(required)**
+
+- `OVERLEAF_OIDC_AUTHORIZATION_URL` **(required)**
+
+- `OVERLEAF_OIDC_TOKEN_URL` **(required)**
+
+- `OVERLEAF_OIDC_USER_INFO_URL` **(required)**
+
+- `OVERLEAF_OIDC_LOGOUT_URL` **(required)**
+
+The values of the following two required variables will be provided by the admin of your OP
+
+- `OVERLEAF_OIDC_CLIENT_ID` **(required)**
+
+- `OVERLEAF_OIDC_CLIENT_SECRET` **(required)**
+
+- `OVERLEAF_OIDC_SCOPE`
+    * Default: `openid profile email`
+
+- `OVERLEAF_OIDC_PROVIDER_ID`
+    * Arbitrary ID of the OP, defaults to `oidc`.
+
+- `OVERLEAF_OIDC_PROVIDER_NAME`
+    * The name of the OP, used in the `Linked Accounts` section of the `/user/settings` page, defaults to `OIDC Provider`.
+
+- `OVERLEAF_OIDC_IDENTITY_SERVICE_NAME`
+    * Display name for the identity service, used on the login page (default: `Log in with $OVERLEAF_OIDC_PROVIDER_NAME`).
+
+- `OVERLEAF_OIDC_PROVIDER_DESCRIPTION`
+    * Description of OP, used in the `Linked Accounts` section (default: `Log in with $OVERLEAF_OIDC_PROVIDER_NAME`).
+
+- `OVERLEAF_OIDC_PROVIDER_INFO_LINK`
+    * `Learn more` URL in the OP description, default: no `Learn more` link in the description.
+
+- `OVERLEAF_OIDC_PROVIDER_HIDE_NOT_LINKED`
+    * Do not show OP on the `/user/settings` page, if the user's account is not linked with the OP, default `false`.
+
+- `OVERLEAF_OIDC_USER_ID_FIELD`
+    * The value of this attribute will be used by Overleaf as the external user ID, defaults to `id`.
+      Other possible reasonable values are `email` and `username` (corresponding to `preferred_username` OIDC claim).
+
+- `OVERLEAF_OIDC_UPDATE_USER_DETAILS_ON_LOGIN`
+    * If set to `true`, updates the user `first_name` and `last_name` field on login,
+      and disables the user details form on `/user/settings` page.
+
+- `OVERLEAF_OIDC_IS_ADMIN_FIELD` and `OVERLEAF_OIDC_IS_ADMIN_FIELD_VALUE`
+    * When both environment variables are set, the login process updates `user.isAdmin = true` if the profile returned by the OP contains the attribute specified by
+      `OVERLEAF_OIDC_IS_ADMIN_FIELD` and its value matches `OVERLEAF_OIDC_IS_ADMIN_FIELD_VALUE`, otherwise `user.isAdmin` is set to `false`.
+      If `OVERLEAF_OIDC_IS_ADMIN_FIELD` is `email` then the value of the attribute `emails[0].value` is used for match checking.
+
+The redirect URL for your OpenID Provider is `https://my-overleaf-instance.com/oidc/login/callback`.
+
+<details>
+<summary><h4>Sample variables.env file</h4></summary>
+
+```
+OVERLEAF_APP_NAME="Our Overleaf Instance"
+
+ENABLED_LINKED_FILE_TYPES=project_file,project_output_file
+
+# Enables Thumbnail generation using ImageMagick
+ENABLE_CONVERSIONS=true
+
+# Disables email confirmation requirement
+EMAIL_CONFIRMATION_DISABLED=true
+
+## Nginx
+# NGINX_WORKER_PROCESSES=4
+# NGINX_WORKER_CONNECTIONS=768
+
+## Set for TLS via nginx-proxy
+# OVERLEAF_BEHIND_PROXY=true
+# OVERLEAF_SECURE_COOKIE=true
+
+OVERLEAF_SITE_URL=http://my-overleaf-instance.com
+OVERLEAF_NAV_TITLE=Our Overleaf Instance
+# OVERLEAF_HEADER_IMAGE_URL=http://somewhere.com/mylogo.png
+OVERLEAF_ADMIN_EMAIL=support@example.com
+
+OVERLEAF_LEFT_FOOTER=[{"text": "Contact your support team", "url": "mailto:support@example.com"}]
+OVERLEAF_RIGHT_FOOTER=[{"text":"Hello, I am on the Right", "url":"https://github.com/yu-i-i/overleaf-cep"}]
+
+OVERLEAF_EMAIL_FROM_ADDRESS=team@example.com
+OVERLEAF_EMAIL_SMTP_HOST=smtp.example.com
+OVERLEAF_EMAIL_SMTP_PORT=587
+OVERLEAF_EMAIL_SMTP_SECURE=false
+# OVERLEAF_EMAIL_SMTP_USER=
+# OVERLEAF_EMAIL_SMTP_PASS=
+# OVERLEAF_EMAIL_SMTP_NAME=
+OVERLEAF_EMAIL_SMTP_LOGGER=false
+OVERLEAF_EMAIL_SMTP_TLS_REJECT_UNAUTH=true
+OVERLEAF_EMAIL_SMTP_IGNORE_TLS=false
+OVERLEAF_CUSTOM_EMAIL_FOOTER=This system is run by department x
+
+OVERLEAF_PROXY_LEARN=true
+NAV_HIDE_POWERED_BY=true
+
+#################
+## OIDC for CE ##
+#################
+
+EXTERNAL_AUTH=oidc
+
+OVERLEAF_OIDC_PROVIDER_ID=oidc
+OVERLEAF_OIDC_ISSUER=https://keycloak.provider.com/realms/example
+OVERLEAF_OIDC_AUTHORIZATION_URL=https://keycloak.provider.com/realms/example/protocol/openid-connect/auth
+OVERLEAF_OIDC_TOKEN_URL=https://keycloak.provider.com/realms/example/protocol/openid-connect/token
+OVERLEAF_OIDC_USER_INFO_URL=https://keycloak.provider.com/realms/example/protocol/openid-connect/userinfo
+OVERLEAF_OIDC_LOGOUT_URL=https://keycloak.provider.com/realms/example/protocol/openid-connect/logout
+OVERLEAF_OIDC_CLIENT_ID=Overleaf-OIDC
+OVERLEAF_OIDC_CLIENT_SECRET=DoNotUseThisATGgaAcTgCcATgGATTACAagGtTCaGcGTAG
+OVERLEAF_OIDC_IDENTITY_SERVICE_NAME='Log in with Keycloak OIDC Provider'
+OVERLEAF_OIDC_PROVIDER_NAME=OIDC Keycloak Provider
+OVERLEAF_OIDC_PROVIDER_INFO_LINK=https://openid.net
+OVERLEAF_OIDC_IS_ADMIN_FIELD=email
+OVERLEAF_OIDC_IS_ADMIN_FIELD_VALUE=overleaf.admin@example.com
+OVERLEAF_OIDC_UPDATE_USER_DETAILS_ON_LOGIN=false
+```
+</details>
+</details>

 ## Overleaf Docker Image

@@ -60,17 +902,14 @@ in which to run the Overleaf services. Baseimage uses the `runit` service
 manager to manage services, and we add our init-scripts from the `server-ce/runit`
 folder.

-
-## Contributing
-
-Please see the [CONTRIBUTING](CONTRIBUTING.md) file for information on contributing to the development of Overleaf.
-
 ## Authors

 [The Overleaf Team](https://www.overleaf.com/about)
+<br>
+Extensions for CE by: [yu-i-i](https://github.com/yu-i-i/overleaf-cep)

 ## License

 The code in this repository is released under the GNU AFFERO GENERAL PUBLIC LICENSE, version 3. A copy can be found in the [`LICENSE`](LICENSE) file.

-Copyright (c) Overleaf, 2014-2024.
+Copyright (c) Overleaf, 2014-2025.
@@ -11,12 +11,6 @@ bin/build
 > [!NOTE]
 > If Docker is running out of RAM while building the services in parallel, create a `.env` file in this directory containing `COMPOSE_PARALLEL_LIMIT=1`.

-Next, initialize the database:
-
-```shell
-bin/init
-```
-
 Then start the services:

 ```shell
@@ -83,6 +77,7 @@ each service:
 | `filestore`        | 9235 |
 | `notifications`    | 9236 |
 | `real-time`        | 9237 |
+| `references`       | 9238 |
 | `history-v1`       | 9239 |
 | `project-history`  | 9240 |

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-docker compose up --detach mongo
-curl --max-time 10 --retry 5 --retry-delay 5 --retry-all-errors --silent --output /dev/null localhost:27017
-docker compose exec mongo mongosh --eval "rs.initiate({ _id: 'overleaf', members: [{ _id: 0, host: 'mongo:27017' }] })"
-docker compose down mongo
@@ -13,6 +13,7 @@ NOTIFICATIONS_HOST=notifications
 PROJECT_HISTORY_HOST=project-history
 REALTIME_HOST=real-time
 REDIS_HOST=redis
+REFERENCES_HOST=references
 SESSION_SECRET=foo
 WEBPACK_HOST=webpack
 WEB_API_PASSWORD=overleaf
@@ -112,6 +112,17 @@ services:
      - ../services/real-time/app.js:/overleaf/services/real-time/app.js
      - ../services/real-time/config:/overleaf/services/real-time/config

+  references:
+    command: ["node", "--watch", "app.js"]
+    environment:
+      - NODE_OPTIONS=--inspect=0.0.0.0:9229
+    ports:
+      - "127.0.0.1:9238:9229"
+    volumes:
+      - ../services/references/app:/overleaf/services/references/app
+      - ../services/references/config:/overleaf/services/references/config
+      - ../services/references/app.js:/overleaf/services/references/app.js
+
  web:
    command: ["node", "--watch", "app.js", "--watch-locales"]
    environment:
@@ -88,12 +88,20 @@ services:
        - history-v1-buckets:/buckets

  mongo:
-    image: mongo:5
+    image: mongo:6.0
    command: --replSet overleaf
    ports:
      - "127.0.0.1:27017:27017" # for debugging
    volumes:
      - mongo-data:/data/db
+      - ../bin/shared/mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
+    environment:
+      MONGO_INITDB_DATABASE: sharelatex
+    extra_hosts:
+      # Required when using the automatic database setup for initializing the
+      # replica set. This override is not needed when running the setup after
+      # starting up mongo.
+      - mongo:127.0.0.1

  notifications:
    build:
@@ -123,6 +131,13 @@ services:
    volumes:
      - redis-data:/data

+  references:
+    build:
+      context: ..
+      dockerfile: services/references/Dockerfile
+    env_file:
+      - dev.env
+
  web:
    build:
      context: ..
@@ -153,6 +168,7 @@ services:
      - notifications
      - project-history
      - real-time
+      - references

  webpack:
    build:
@@ -40,10 +40,6 @@ services:
            # Disables email confirmation requirement
            EMAIL_CONFIRMATION_DISABLED: 'true'

-            # temporary fix for LuaLaTex compiles
-            # see https://github.com/overleaf/overleaf/issues/695
-            TEXMFVAR: /var/lib/overleaf/tmp/texmf-var
-
            ## Set for SSL via nginx-proxy
            #VIRTUAL_HOST: 103.112.212.22

@@ -102,12 +98,12 @@ services:

    mongo:
        restart: always
-        image: mongo:5.0
+        image: mongo:6.0
        container_name: mongo
        command: '--replSet overleaf'
        volumes:
            - ~/mongo_data:/data/db
-            - ./mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
+            - ./bin/shared/mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
        environment:
          MONGO_INITDB_DATABASE: sharelatex
        extra_hosts:
@@ -115,7 +111,7 @@ services:
          # This override is not needed when running the setup after starting up mongo.
          - mongo:127.0.0.1
        healthcheck:
-            test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
+            test: echo 'db.stats().ok' | mongosh localhost:27017/test --quiet
            interval: 10s
            timeout: 10s
            retries: 5
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ access-token-encryptor
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -21,7 +21,7 @@
  "devDependencies": {
    "chai": "^4.3.6",
    "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "sandboxed-module": "^2.0.4",
    "typescript": "^5.0.4"
  }
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ fetch-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -95,6 +95,19 @@ async function fetchNothing(url, opts = {}) {
 * @throws {RequestFailedError} if the response has a non redirect status code or missing Location header
 */
 async function fetchRedirect(url, opts = {}) {
+  const { location } = await fetchRedirectWithResponse(url, opts)
+  return location
+}
+
+/**
+ * Make a request and extract the redirect from the response.
+ *
+ * @param {string | URL} url - request URL
+ * @param {object} opts - fetch options
+ * @return {Promise<{location: string, response: Response}>}
+ * @throws {RequestFailedError} if the response has a non redirect status code or missing Location header
+ */
+async function fetchRedirectWithResponse(url, opts = {}) {
  const { fetchOpts } = parseOpts(opts)
  fetchOpts.redirect = 'manual'
  const response = await performRequest(url, fetchOpts)
@@ -112,7 +125,7 @@ async function fetchRedirect(url, opts = {}) {
    )
  }
  await discardResponseBody(response)
-  return location
+  return { location, response }
 }

 /**
@@ -297,6 +310,7 @@ module.exports = {
  fetchStreamWithResponse,
  fetchNothing,
  fetchRedirect,
+  fetchRedirectWithResponse,
  fetchString,
  fetchStringWithResponse,
  RequestFailedError,
@@ -20,8 +20,8 @@
    "body-parser": "^1.20.3",
    "chai": "^4.3.6",
    "chai-as-promised": "^7.1.1",
-    "express": "^4.21.0",
-    "mocha": "^10.2.0",
+    "express": "^4.21.2",
+    "mocha": "^11.1.0",
    "typescript": "^5.0.4"
  },
  "dependencies": {
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ logger
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -14,8 +14,10 @@ const LoggingManager = {
  initialize(name) {
    this.isProduction =
      (process.env.NODE_ENV || '').toLowerCase() === 'production'
+    const isTest = (process.env.NODE_ENV || '').toLowerCase() === 'test'
    this.defaultLevel =
-      process.env.LOG_LEVEL || (this.isProduction ? 'info' : 'debug')
+      process.env.LOG_LEVEL ||
+      (this.isProduction ? 'info' : isTest ? 'fatal' : 'debug')
    this.loggerName = name
    this.logger = bunyan.createLogger({
      name,
@@ -27,7 +27,7 @@
  },
  "devDependencies": {
    "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "sandboxed-module": "^2.0.4",
    "sinon": "^9.2.4",
    "sinon-chai": "^3.7.0",
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ metrics
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -23,7 +23,7 @@
  "devDependencies": {
    "bunyan": "^1.0.0",
    "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "sandboxed-module": "^2.0.4",
    "sinon": "^9.2.4",
    "typescript": "^5.0.4"
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ mongo-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -16,12 +16,12 @@
  "author": "Overleaf (https://www.overleaf.com)",
  "license": "AGPL-3.0-only",
  "dependencies": {
-    "mongodb": "6.10.0",
+    "mongodb": "6.12.0",
    "mongodb-legacy": "6.1.3"
  },
  "devDependencies": {
    "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "sandboxed-module": "^2.0.4",
    "sinon": "^9.2.4",
    "sinon-chai": "^3.7.0",
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ o-error
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -34,7 +34,7 @@
    "@types/chai": "^4.3.0",
    "@types/node": "^18.17.4",
    "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "typescript": "^5.0.4"
  }
 }
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ object-persistor
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -34,9 +34,9 @@
  "devDependencies": {
    "chai": "^4.3.6",
    "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "mock-fs": "^5.2.0",
-    "mongodb": "6.10.0",
+    "mongodb": "6.12.0",
    "sandboxed-module": "^2.0.4",
    "sinon": "^9.2.4",
    "sinon-chai": "^3.7.0",
@@ -343,9 +343,10 @@ class PerProjectEncryptedS3Persistor extends S3Persistor {
  }

  async deleteDirectory(bucketName, path, continuationToken) {
+    // Let [Settings.pathToProjectFolder] validate the project path before deleting things.
+    const { projectFolder, dekPath } = this.#buildProjectPaths(bucketName, path)
    // Note: Listing/Deleting a prefix does not require SSE-C credentials.
    await super.deleteDirectory(bucketName, path, continuationToken)
-    const { projectFolder, dekPath } = this.#buildProjectPaths(bucketName, path)
    if (projectFolder === path) {
      await super.deleteObject(
        this.#settings.dataEncryptionKeyBucketName,
@@ -413,6 +414,16 @@ class CachedPerProjectEncryptedS3Persistor {
    return await this.sendStream(bucketName, path, fs.createReadStream(fsPath))
  }

+  /**
+   *
+   * @param {string} bucketName
+   * @param {string} path
+   * @return {Promise<number>}
+   */
+  async getObjectSize(bucketName, path) {
+    return await this.#parent.getObjectSize(bucketName, path)
+  }
+
  /**
   * @param {string} bucketName
   * @param {string} path
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ overleaf-editor-core
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -100,6 +100,9 @@ class Change {
    )
  }

+  /**
+   * @return {Operation[]}
+   */
  getOperations() {
    return this.operations
  }
@@ -248,6 +251,24 @@ class Change {
   * @param {boolean} [opts.strict] - Do not ignore recoverable errors
   */
  applyTo(snapshot, opts = {}) {
+    // eslint-disable-next-line no-unused-vars
+    for (const operation of this.iterativelyApplyTo(snapshot, opts)) {
+      // Nothing to do: we're just consuming the iterator for the side effects
+    }
+  }
+
+  /**
+   * Generator that applies this change to a snapshot and yields each
+   * operation after it has been applied.
+   *
+   * Recoverable errors (caused by historical bad data) are ignored unless
+   * opts.strict is true
+   *
+   * @param {Snapshot} snapshot modified in place
+   * @param {object} opts
+   * @param {boolean} [opts.strict] - Do not ignore recoverable errors
+   */
+  *iterativelyApplyTo(snapshot, opts = {}) {
    assert.object(snapshot, 'bad snapshot')

    for (const operation of this.operations) {
@@ -261,6 +282,7 @@ class Change {
          throw err
        }
      }
+      yield operation
    }

    // update project version if present in change
@@ -22,7 +22,7 @@ class NonUniquePathnameError extends PathnameError {
   * @param {string[]} pathnames
   */
  constructor(pathnames) {
-    super('pathnames are not unique: ' + pathnames, { pathnames })
+    super('pathnames are not unique', { pathnames })
    this.pathnames = pathnames
  }
 }
@@ -30,9 +30,13 @@ class NonUniquePathnameError extends PathnameError {
 class BadPathnameError extends PathnameError {
  /**
   * @param {string} pathname
+   * @param {string} reason
   */
-  constructor(pathname) {
-    super(pathname + ' is not a valid pathname', { pathname })
+  constructor(pathname, reason) {
+    if (pathname.length > 10) {
+      pathname = pathname.slice(0, 5) + '...' + pathname.slice(-5)
+    }
+    super('invalid pathname', { reason, pathname })
    this.pathname = pathname
  }
 }
@@ -42,7 +46,7 @@ class PathnameConflictError extends PathnameError {
   * @param {string} pathname
   */
  constructor(pathname) {
-    super(`pathname '${pathname}' conflicts with another file`, { pathname })
+    super('pathname conflicts with another file', { pathname })
    this.pathname = pathname
  }
 }
@@ -52,7 +56,7 @@ class FileNotFoundError extends PathnameError {
   * @param {string} pathname
   */
  constructor(pathname) {
-    super(`file ${pathname} does not exist`, { pathname })
+    super('file does not exist', { pathname })
    this.pathname = pathname
  }
 }
@@ -315,8 +319,9 @@ function checkPathnamesAreUnique(files) {
 */
 function checkPathname(pathname) {
  assert.nonEmptyString(pathname, 'bad pathname')
-  if (safePathname.isClean(pathname)) return
-  throw new FileMap.BadPathnameError(pathname)
+  const [isClean, reason] = safePathname.isCleanDebug(pathname)
+  if (isClean) return
+  throw new FileMap.BadPathnameError(pathname, reason)
 }

 /**
@@ -56,18 +56,34 @@ class TextOperation extends EditOperation {

  constructor() {
    super()
-    // When an operation is applied to an input string, you can think of this as
-    // if an imaginary cursor runs over the entire string and skips over some
-    // parts, removes some parts and inserts characters at some positions. These
-    // actions (skip/remove/insert) are stored as an array in the "ops" property.
-    /** @type {ScanOp[]} */
+
+    /**
+     * When an operation is applied to an input string, you can think of this as
+     * if an imaginary cursor runs over the entire string and skips over some
+     * parts, removes some parts and inserts characters at some positions. These
+     * actions (skip/remove/insert) are stored as an array in the "ops" property.
+     * @type {ScanOp[]}
+     */
    this.ops = []
-    // An operation's baseLength is the length of every string the operation
-    // can be applied to.
+
+    /**
+     * An operation's baseLength is the length of every string the operation
+     * can be applied to.
+     */
    this.baseLength = 0
-    // The targetLength is the length of every string that results from applying
-    // the operation on a valid input string.
+
+    /**
+     * The targetLength is the length of every string that results from applying
+     * the operation on a valid input string.
+     */
    this.targetLength = 0
+
+    /**
+     * The expected content hash after this operation is applied
+     *
+     * @type {string | null}
+     */
+    this.contentHash = null
  }

  /**
@@ -223,7 +239,12 @@ class TextOperation extends EditOperation {
   * @returns {RawTextOperation}
   */
  toJSON() {
-    return { textOperation: this.ops.map(op => op.toJSON()) }
+    /** @type {RawTextOperation} */
+    const json = { textOperation: this.ops.map(op => op.toJSON()) }
+    if (this.contentHash != null) {
+      json.contentHash = this.contentHash
+    }
+    return json
  }

  /**
@@ -231,7 +252,7 @@ class TextOperation extends EditOperation {
   * @param {RawTextOperation} obj
   * @returns {TextOperation}
   */
-  static fromJSON = function ({ textOperation: ops }) {
+  static fromJSON = function ({ textOperation: ops, contentHash }) {
    const o = new TextOperation()
    for (const op of ops) {
      if (isRetain(op)) {
@@ -250,6 +271,9 @@ class TextOperation extends EditOperation {
        throw new UnprocessableError('unknown operation: ' + JSON.stringify(op))
      }
    }
+    if (contentHash != null) {
+      o.contentHash = contentHash
+    }
    return o
  }

@@ -64,17 +64,57 @@ function cleanPart(filename) {
 * @return {String}
 */
 exports.clean = function (pathname) {
+  return exports.cleanDebug(pathname)[0]
+}
+
+/**
+ * See clean
+ * @param {string} pathname
+ * @return {[string,string]}
+ */
+exports.cleanDebug = function (pathname) {
+  let prev = pathname
+  let reason = ''
+
+  /**
+   * @param {string} label
+   */
+  function recordReasonIfChanged(label) {
+    if (pathname === prev) return
+    if (reason) reason += ','
+    reason += label
+    prev = pathname
+  }
  pathname = path.normalize(pathname)
-  pathname = pathname.replace(/\\/g, '/') // workaround for IE
-  pathname = pathname.replace(/\/+/g, '/') // no multiple slashes
-  pathname = pathname.replace(/^(\/.*)$/, '_$1') // no leading /
-  pathname = pathname.replace(/^(.+)\/$/, '$1') // no trailing /
-  pathname = pathname.replace(/^ *(.*)$/, '$1') // no leading spaces
-  pathname = pathname.replace(/^(.*[^ ]) *$/, '$1') // no trailing spaces
+  recordReasonIfChanged('normalize')
+
+  pathname = pathname.replace(/\\/g, '/')
+  recordReasonIfChanged('workaround for IE')
+
+  pathname = pathname.replace(/\/+/g, '/')
+  recordReasonIfChanged('no multiple slashes')
+
+  pathname = pathname.replace(/^(\/.*)$/, '_$1')
+  recordReasonIfChanged('no leading /')
+
+  pathname = pathname.replace(/^(.+)\/$/, '$1')
+  recordReasonIfChanged('no trailing /')
+
+  pathname = pathname.replace(/^ *(.*)$/, '$1')
+  recordReasonIfChanged('no leading spaces')
+
+  pathname = pathname.replace(/^(.*[^ ]) *$/, '$1')
+  recordReasonIfChanged('no trailing spaces')
+
  if (pathname.length === 0) pathname = '_'
+  recordReasonIfChanged('empty')
+
  pathname = pathname.split('/').map(cleanPart).join('/')
+  recordReasonIfChanged('cleanPart')
+
  pathname = pathname.replace(BLOCKED_FILE_RX, '@$1')
-  return pathname
+  recordReasonIfChanged('BLOCKED_FILE_RX')
+  return [pathname, reason]
 }

 /**
@@ -84,9 +124,19 @@ exports.clean = function (pathname) {
 * @return {Boolean}
 */
 exports.isClean = function pathnameIsClean(pathname) {
-  return (
-    exports.clean(pathname) === pathname &&
-    pathname.length <= MAX_PATH &&
-    pathname.length > 0
-  )
+  return exports.isCleanDebug(pathname)[0]
+}
+
+/**
+ * A pathname is clean (see clean) and not too long.
+ *
+ * @param {string} pathname
+ * @return {[boolean,string]}
+ */
+exports.isCleanDebug = function (pathname) {
+  if (pathname.length > MAX_PATH) return [false, 'MAX_PATH']
+  if (pathname.length === 0) return [false, 'empty']
+  const [cleanPathname, reason] = exports.cleanDebug(pathname)
+  if (cleanPathname !== pathname) return [false, reason]
+  return [true, '']
 }
@@ -224,7 +224,7 @@ class Snapshot {
   *
   * @param {string} kind see {File#load}
   * @param {ReadonlyBlobStore} blobStore
-   * @return {Promise<Object>} an object where keys are the pathnames and
+   * @return {Promise<Record<string, File>>} an object where keys are the pathnames and
   * values are the files in the snapshot
   */
  async loadFiles(kind, blobStore) {
@@ -132,6 +132,7 @@ export type RawScanOp = RawInsertOp | RawRemoveOp | RawRetainOp

 export type RawTextOperation = {
  textOperation: RawScanOp[]
+  contentHash?: string
 }

 export type RawAddCommentOperation = {
@@ -20,7 +20,7 @@
    "@types/check-types": "^7.3.7",
    "@types/path-browserify": "^1.0.2",
    "chai": "^3.3.0",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "sinon": "^9.2.4",
    "typescript": "^5.0.4"
  },
@@ -5,10 +5,11 @@ const ot = require('..')
 const safePathname = ot.safePathname

 describe('safePathname', function () {
-  function expectClean(input, output) {
+  function expectClean(input, output, reason = '') {
    // check expected output and also idempotency
-    const cleanedInput = safePathname.clean(input)
+    const [cleanedInput, gotReason] = safePathname.cleanDebug(input)
    expect(cleanedInput).to.equal(output)
+    expect(gotReason).to.equal(reason)
    expect(safePathname.clean(cleanedInput)).to.equal(cleanedInput)
    expect(safePathname.isClean(cleanedInput)).to.be.true
  }
@@ -22,44 +23,56 @@ describe('safePathname', function () {
    expect(safePathname.isClean('rm -rf /')).to.be.falsy

    // replace invalid characters with underscores
-    expectClean('test-s*\u0001\u0002m\u0007st\u0008.jpg', 'test-s___m_st_.jpg')
+    expectClean(
+      'test-s*\u0001\u0002m\u0007st\u0008.jpg',
+      'test-s___m_st_.jpg',
+      'cleanPart'
+    )

    // keep slashes, normalize paths, replace ..
-    expectClean('./foo', 'foo')
-    expectClean('../foo', '__/foo')
-    expectClean('foo/./bar', 'foo/bar')
-    expectClean('foo/../bar', 'bar')
-    expectClean('../../tricky/foo.bar', '__/__/tricky/foo.bar')
-    expectClean('foo/../../tricky/foo.bar', '__/tricky/foo.bar')
-    expectClean('foo/bar/../../tricky/foo.bar', 'tricky/foo.bar')
-    expectClean('foo/bar/baz/../../tricky/foo.bar', 'foo/tricky/foo.bar')
+    expectClean('./foo', 'foo', 'normalize')
+    expectClean('../foo', '__/foo', 'cleanPart')
+    expectClean('foo/./bar', 'foo/bar', 'normalize')
+    expectClean('foo/../bar', 'bar', 'normalize')
+    expectClean('../../tricky/foo.bar', '__/__/tricky/foo.bar', 'cleanPart')
+    expectClean(
+      'foo/../../tricky/foo.bar',
+      '__/tricky/foo.bar',
+      'normalize,cleanPart'
+    )
+    expectClean('foo/bar/../../tricky/foo.bar', 'tricky/foo.bar', 'normalize')
+    expectClean(
+      'foo/bar/baz/../../tricky/foo.bar',
+      'foo/tricky/foo.bar',
+      'normalize'
+    )

    // remove illegal chars even when there is no extension
-    expectClean('**foo', '__foo')
+    expectClean('**foo', '__foo', 'cleanPart')

    // remove windows file paths
-    expectClean('c:\\temp\\foo.txt', 'c:/temp/foo.txt')
+    expectClean('c:\\temp\\foo.txt', 'c:/temp/foo.txt', 'workaround for IE')

    // do not allow a leading slash (relative paths only)
-    expectClean('/foo', '_/foo')
-    expectClean('//foo', '_/foo')
+    expectClean('/foo', '_/foo', 'no leading /')
+    expectClean('//foo', '_/foo', 'normalize,no leading /')

    // do not allow multiple leading slashes
-    expectClean('//foo', '_/foo')
+    expectClean('//foo', '_/foo', 'normalize,no leading /')

    // do not allow a trailing slash
-    expectClean('/', '_')
-    expectClean('foo/', 'foo')
-    expectClean('foo.tex/', 'foo.tex')
+    expectClean('/', '_', 'no leading /,no trailing /')
+    expectClean('foo/', 'foo', 'no trailing /')
+    expectClean('foo.tex/', 'foo.tex', 'no trailing /')

    // do not allow multiple trailing slashes
-    expectClean('//', '_')
-    expectClean('///', '_')
-    expectClean('foo//', 'foo')
+    expectClean('//', '_', 'normalize,no leading /,no trailing /')
+    expectClean('///', '_', 'normalize,no leading /,no trailing /')
+    expectClean('foo//', 'foo', 'normalize,no trailing /')

    // file and folder names that consist of . and .. are not OK
-    expectClean('.', '_')
-    expectClean('..', '__')
+    expectClean('.', '_', 'cleanPart')
+    expectClean('..', '__', 'cleanPart')
    // we will allow name with more dots e.g. ... and ....
    expectClean('...', '...')
    expectClean('....', '....')
@@ -82,10 +95,10 @@ describe('safePathname', function () {
    expectClean('a b.png', 'a b.png')

    // leading and trailing spaces are not OK
-    expectClean(' foo', 'foo')
-    expectClean('  foo', 'foo')
-    expectClean('foo ', 'foo')
-    expectClean('foo  ', 'foo')
+    expectClean(' foo', 'foo', 'no leading spaces')
+    expectClean('  foo', 'foo', 'no leading spaces')
+    expectClean('foo ', 'foo', 'no trailing spaces')
+    expectClean('foo  ', 'foo', 'no trailing spaces')

    // reserved file names on Windows should not be OK, but we already have
    // some in the old system, so have to allow them for now
@@ -100,14 +113,14 @@ describe('safePathname', function () {
    // there's no particular reason to allow multiple slashes; sometimes people
    // seem to rename files to URLs (https://domain/path) in an attempt to
    // upload a file, and this results in an empty directory name
-    expectClean('foo//bar.png', 'foo/bar.png')
-    expectClean('foo///bar.png', 'foo/bar.png')
+    expectClean('foo//bar.png', 'foo/bar.png', 'normalize')
+    expectClean('foo///bar.png', 'foo/bar.png', 'normalize')

    // Check javascript property handling
    expectClean('foo/prototype', 'foo/prototype') // OK as part of a pathname
    expectClean('prototype/test.txt', 'prototype/test.txt')
-    expectClean('prototype', '@prototype') // not OK as whole pathname
-    expectClean('hasOwnProperty', '@hasOwnProperty')
-    expectClean('**proto**', '@__proto__')
+    expectClean('prototype', '@prototype', 'BLOCKED_FILE_RX') // not OK as whole pathname
+    expectClean('hasOwnProperty', '@hasOwnProperty', 'BLOCKED_FILE_RX')
+    expectClean('**proto**', '@__proto__', 'cleanPart,BLOCKED_FILE_RX')
  })
 })
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ promise-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -13,6 +13,7 @@ module.exports = {
  expressify,
  expressifyErrorHandler,
  promiseMapWithLimit,
+  promiseMapSettledWithLimit,
 }

 /**
@@ -264,3 +265,19 @@ async function promiseMapWithLimit(concurrency, array, fn) {
  const limit = pLimit(concurrency)
  return await Promise.all(array.map(x => limit(() => fn(x))))
 }
+
+/**
+ * Map values in `array` with the async function `fn`
+ *
+ * Limit the number of unresolved promises to `concurrency`.
+ *
+ * @template T, U
+ * @param {number} concurrency
+ * @param {Array<T>} array
+ * @param {(T) => Promise<U>} fn
+ * @return {Promise<Array<PromiseSettledResult<U>>>}
+ */
+function promiseMapSettledWithLimit(concurrency, array, fn) {
+  const limit = pLimit(concurrency)
+  return Promise.allSettled(array.map(x => limit(() => fn(x))))
+}
@@ -18,7 +18,7 @@
  "devDependencies": {
    "chai": "^4.3.10",
    "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "typescript": "^5.0.4"
  },
  "dependencies": {
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ ranges-tracker
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -145,11 +145,7 @@ class RangesTracker {
  }

  removeChangeId(changeId) {
-    const change = this.getChange(changeId)
-    if (change == null) {
-      return
-    }
-    this._removeChange(change)
+    this.removeChangeIds([changeId])
  }

  removeChangeIds(ids) {
@@ -316,7 +312,7 @@ class RangesTracker {
    const movedChanges = []
    const removeChanges = []
    const newChanges = []
-
+    const trackedDeletesAtOpPosition = []
    for (let i = 0; i < this.changes.length; i++) {
      change = this.changes[i]
      const changeStart = change.op.p
@@ -327,13 +323,15 @@ class RangesTracker {
          change.op.p += opLength
          movedChanges.push(change)
        } else if (opStart === changeStart) {
-          // If we are undoing, then we want to cancel any existing delete ranges if we can.
-          // Check if the insert matches the start of the delete, and just remove it from the delete instead if so.
          if (
+            !alreadyMerged &&
            undoing &&
            change.op.d.length >= op.i.length &&
            change.op.d.slice(0, op.i.length) === op.i
          ) {
+            // If we are undoing, then we want to reject any existing tracked delete if we can.
+            // Check if the insert matches the start of the delete, and just
+            // remove it from the delete instead if so.
            change.op.d = change.op.d.slice(op.i.length)
            change.op.p += op.i.length
            if (change.op.d === '') {
@@ -342,9 +340,25 @@ class RangesTracker {
              movedChanges.push(change)
            }
            alreadyMerged = true
+
+            // Any tracked delete that came before this tracked delete
+            // rejection was moved after the incoming insert. Move them back
+            // so that they appear before the tracked delete rejection.
+            for (const trackedDelete of trackedDeletesAtOpPosition) {
+              trackedDelete.op.p -= opLength
+            }
          } else {
+            // We're not rejecting that tracked delete. Move it after the
+            // insert.
            change.op.p += opLength
            movedChanges.push(change)
+
+            // Keep track of tracked deletes that are at the same position as the
+            // insert. If we find a tracked delete to reject, we'll want to
+            // reposition them.
+            if (!alreadyMerged) {
+              trackedDeletesAtOpPosition.push(change)
+            }
          }
        }
      } else if (change.op.i != null) {
@@ -624,9 +638,11 @@ class RangesTracker {
  }

  _addOp(op, metadata) {
+    // Don't take a reference to the existing op since we'll modify this in place with future changes
+    op = this._clone(op)
    const change = {
      id: this.newId(),
-      op: this._clone(op), // Don't take a reference to the existing op since we'll modify this in place with future changes
+      op,
      metadata: this._clone(metadata),
    }
    this.changes.push(change)
@@ -649,7 +665,7 @@ class RangesTracker {
  }

  _removeChange(change) {
-    this.changes = this.changes.filter(c => c.id !== change.id)
+    this.changes = this.changes.filter(c => c !== change)
    this._markAsDirty(change, 'change', 'removed')
  }

@@ -20,7 +20,7 @@
  },
  "devDependencies": {
    "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "typescript": "^5.0.4"
  }
 }
@@ -4,6 +4,7 @@ const RangesTracker = require('../..')
 describe('RangesTracker', function () {
  describe('with duplicate change ids', function () {
    beforeEach(function () {
+      this.comments = []
      this.changes = [
        { id: 'id1', op: { p: 1, i: 'hello' } },
        { id: 'id2', op: { p: 10, i: 'world' } },
@@ -26,4 +27,199 @@ describe('RangesTracker', function () {
      expect(this.rangesTracker.changes).to.deep.equal([this.changes[2]])
    })
  })
+
+  describe('with duplicate tracked insert ids', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 10, i: 'one' } },
+        { id: 'id1', op: { p: 20, i: 'two' } },
+        { id: 'id1', op: { p: 30, d: 'three' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it("deleting one tracked insert doesn't delete the others", function () {
+      this.rangesTracker.applyOp({ p: 20, d: 'two' })
+      expect(this.rangesTracker.changes).to.deep.equal([
+        this.changes[0],
+        this.changes[2],
+      ])
+    })
+  })
+
+  describe('with duplicate tracked delete ids', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 10, d: 'one' } },
+        { id: 'id1', op: { p: 20, d: 'two' } },
+        { id: 'id1', op: { p: 30, d: 'three' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('deleting over tracked deletes in tracked changes mode removes the tracked deletes covered', function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 15,
+        d: '567890123456789012345',
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([
+        { p: 10, d: 'one' },
+        { p: 15, d: '56789two0123456789three012345' },
+      ])
+    })
+
+    it('a tracked delete between two tracked deletes joins them into a single tracked delete', function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 20,
+        d: '0123456789',
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([
+        { p: 10, d: 'one' },
+        { p: 20, d: 'two0123456789three' },
+      ])
+    })
+
+    it("rejecting one tracked delete doesn't reject the others", function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 20,
+        i: 'two',
+        u: true,
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([
+        { p: 10, d: 'one' },
+        { p: 33, d: 'three' },
+      ])
+    })
+
+    it("rejecting all tracked deletes doesn't introduce tracked inserts", function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 10,
+        i: 'one',
+        u: true,
+      })
+      this.rangesTracker.applyOp({
+        p: 23,
+        i: 'two',
+        u: true,
+      })
+      this.rangesTracker.applyOp({
+        p: 36,
+        i: 'three',
+        u: true,
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([])
+    })
+  })
+
+  describe('with multiple tracked deletes at the same position', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 33, d: 'before' } },
+        { id: 'id2', op: { p: 50, d: 'right before' } },
+        { id: 'id3', op: { p: 50, d: 'this one' } },
+        { id: 'id4', op: { p: 50, d: 'right after' } },
+        { id: 'id5', op: { p: 75, d: 'long after' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('preserves the text order when rejecting changes', function () {
+      this.rangesTracker.applyOp(
+        { p: 50, i: 'this one', u: true },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes).to.deep.equal([
+        { id: 'id1', op: { p: 33, d: 'before' } },
+        { id: 'id2', op: { p: 50, d: 'right before' } },
+        { id: 'id4', op: { p: 58, d: 'right after' } },
+        { id: 'id5', op: { p: 83, d: 'long after' } },
+      ])
+    })
+
+    it('moves all tracked deletes after the insert if not rejecting changes', function () {
+      this.rangesTracker.applyOp(
+        { p: 50, i: 'some other text', u: true, orderedRejections: true },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes).to.deep.equal([
+        { id: 'id1', op: { p: 33, d: 'before' } },
+        { id: 'id2', op: { p: 65, d: 'right before' } },
+        { id: 'id3', op: { p: 65, d: 'this one' } },
+        { id: 'id4', op: { p: 65, d: 'right after' } },
+        { id: 'id5', op: { p: 90, d: 'long after' } },
+      ])
+    })
+  })
+
+  describe('with multiple tracked deletes at the same position with the same content', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 10, d: 'cat' } },
+        { id: 'id2', op: { p: 10, d: 'giraffe' } },
+        { id: 'id3', op: { p: 10, d: 'cat' } },
+        { id: 'id4', op: { p: 10, d: 'giraffe' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('removes only the first matching tracked delete', function () {
+      this.rangesTracker.applyOp(
+        { p: 10, i: 'giraffe', u: true },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes).to.deep.equal([
+        { id: 'id1', op: { p: 10, d: 'cat' } },
+        { id: 'id3', op: { p: 17, d: 'cat' } },
+        { id: 'id4', op: { p: 17, d: 'giraffe' } },
+      ])
+    })
+  })
+
+  describe('with a tracked insert at the same position as a tracked delete', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        {
+          id: 'id1',
+          op: { p: 5, d: 'before' },
+          metadata: { user_id: 'user-id' },
+        },
+        {
+          id: 'id2',
+          op: { p: 10, d: 'delete' },
+          metadata: { user_id: 'user-id' },
+        },
+        {
+          id: 'id3',
+          op: { p: 10, i: 'insert' },
+          metadata: { user_id: 'user-id' },
+        },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('places a tracked insert at the same position before both the delete and the insert', function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp(
+        { p: 10, i: 'incoming' },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes.map(change => change.op)).to.deep.equal(
+        [
+          { p: 5, d: 'before' },
+          { p: 10, i: 'incoming' },
+          { p: 18, d: 'delete' },
+          { p: 18, i: 'insert' },
+        ]
+      )
+    })
+  })
 })
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ redis-wrapper
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -35,7 +35,7 @@
    "@overleaf/logger": "*",
    "@overleaf/o-error": "*",
    "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "sandboxed-module": "^2.0.4",
    "sinon": "^9.2.4",
    "typescript": "^5.0.4"
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ settings
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -15,7 +15,7 @@
    "types:check": "tsc --noEmit"
  },
  "devDependencies": {
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "typescript": "^5.0.4"
  }
 }
@@ -1 +1 @@
-20.18.0
+20.18.2
@@ -5,6 +5,6 @@ stream-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
--node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0
@@ -18,7 +18,7 @@
  "devDependencies": {
    "chai": "^4.3.6",
    "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
    "typescript": "^5.0.4"
  }
 }
@@ -26,6 +26,9 @@
    "typescript": "^5.5.4"
  },
  "overrides": {
+    "cross-env": {
+      "cross-spawn": "^7.0.6"
+    },
    "fetch-mock": {
      "path-to-regexp": "3.3.0"
    },
@@ -70,6 +73,7 @@
    "services/third-party-datastore",
    "services/third-party-references",
    "services/tpdsworker",
-    "services/web"
+    "services/web",
+    "tools/saas-e2e"
  ]
 }
@@ -0,0 +1,23 @@
+diff --git a/node_modules/@node-saml/node-saml/lib/saml.js b/node_modules/@node-saml/node-saml/lib/saml.js
+index fba15b9..a5778cb 100644
+--- a/node_modules/@node-saml/node-saml/lib/saml.js
+++ b/node_modules/@node-saml/node-saml/lib/saml.js
+@@ -336,7 +336,8 @@ class SAML {
+         const requestOrResponse = request || response;
+         (0, utility_1.assertRequired)(requestOrResponse, "either request or response is required");
+         let buffer;
+-        if (this.options.skipRequestCompression) {
+       // logout requestOrResponse must be compressed anyway
+        if (this.options.skipRequestCompression && operation !== "logout") {
+             buffer = Buffer.from(requestOrResponse, "utf8");
+         }
+         else {
+@@ -495,7 +496,7 @@ class SAML {
+         try {
+             xml = Buffer.from(container.SAMLResponse, "base64").toString("utf8");
+             doc = await (0, xml_1.parseDomFromString)(xml);
+-            const inResponseToNodes = xml_1.xpath.selectAttributes(doc, "/*[local-name()='Response']/@InResponseTo");
+            const inResponseToNodes = xml_1.xpath.selectAttributes(doc, "/*[local-name()='Response' or local-name()='LogoutResponse']/@InResponseTo");
+             if (inResponseToNodes) {
+                 inResponseTo = inResponseToNodes.length ? inResponseToNodes[0].nodeValue : null;
+                 await this.validateInResponseTo(inResponseTo);
@@ -0,0 +1,64 @@
+diff --git a/node_modules/ldapauth-fork/lib/ldapauth.js b/node_modules/ldapauth-fork/lib/ldapauth.js
+index 85ecf36a8b..a7d07e0f78 100644
+--- a/node_modules/ldapauth-fork/lib/ldapauth.js
+++ b/node_modules/ldapauth-fork/lib/ldapauth.js
+@@ -69,6 +69,7 @@ function LdapAuth(opts) {
+   this.opts.bindProperty || (this.opts.bindProperty = 'dn');
+   this.opts.groupSearchScope || (this.opts.groupSearchScope = 'sub');
+   this.opts.groupDnProperty || (this.opts.groupDnProperty = 'dn');
+  this.opts.tlsStarted = false;
+
+   EventEmitter.call(this);
+
+@@ -108,21 +109,7 @@ function LdapAuth(opts) {
+   this._userClient.on('error', this._handleError.bind(this));
+
+   var self = this;
+-  if (this.opts.starttls) {
+-    // When starttls is enabled, this callback supplants the 'connect' callback
+-    this._adminClient.starttls(this.opts.tlsOptions, this._adminClient.controls, function(err) {
+-      if (err) {
+-        self._handleError(err);
+-      } else {
+-        self._onConnectAdmin();
+-      }
+-    });
+-    this._userClient.starttls(this.opts.tlsOptions, this._userClient.controls, function(err) {
+-      if (err) {
+-        self._handleError(err);
+-      }
+-    });
+-  } else if (opts.reconnect) {
+  if (opts.reconnect && !this.opts.starttls) {
+     this.once('_installReconnectListener', function() {
+       self.log && self.log.trace('install reconnect listener');
+       self._adminClient.on('connect', function() {
+@@ -384,6 +371,28 @@ LdapAuth.prototype._findGroups = function(user, callback) {
+  */
+ LdapAuth.prototype.authenticate = function(username, password, callback) {
+   var self = this;
+  if (this.opts.starttls && !this.opts.tlsStarted) {
+    // When starttls is enabled, this callback supplants the 'connect' callback
+    this._adminClient.starttls(this.opts.tlsOptions, this._adminClient.controls, function (err) {
+      if (err) {
+        self._handleError(err);
+      } else {
+        self._onConnectAdmin(function(){self._handleAuthenticate(username, password, callback);});
+      }
+    });
+    this._userClient.starttls(this.opts.tlsOptions, this._userClient.controls, function (err) {
+      if (err) {
+        self._handleError(err);
+      }
+    });
+  } else {
+    self._handleAuthenticate(username, password, callback);
+  }
+};
+
+LdapAuth.prototype._handleAuthenticate = function (username, password, callback) {
+  this.opts.tlsStarted = true;
+  var self = this;
+
+   if (typeof password === 'undefined' || password === null || password === '') {
+     return callback(new Error('no password given'));
@@ -1,6 +1,7 @@
 .DS_Store
 .git/
 services/git-bridge
+server-ce/server-ce
 server-ce/test

 # omit scripts with extra dependencies
@@ -10,7 +10,7 @@ ENV TEXMFVAR=/var/lib/overleaf/tmp/texmf-var

 # Update to ensure dependencies are updated
 # ------------------------------------------
-ENV REBUILT_AFTER="2024-15-10"
+ENV REBUILT_AFTER="2025-03-27"

 # Install dependencies
 # --------------------
@@ -1,6 +1,7 @@
 # Makefile

 MONOREPO_ROOT := ../
+HERE=$(shell pwd)
 export MONOREPO_REVISION := $(shell git rev-parse HEAD)
 export BRANCH_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
 export OVERLEAF_BASE_BRANCH ?= sharelatex/sharelatex-base:$(BRANCH_NAME)
@@ -40,5 +41,25 @@ build-community:
 	  --tag $(OVERLEAF_BRANCH) \
 	  $(MONOREPO_ROOT)

+SHELLCHECK_OPTS = \
+	--shell=bash \
+	--external-sources \
+	--exclude=SC1091
+SHELLCHECK_COLOR := $(if $(CI),--color=never,--color)
+SHELLCHECK_FILES := { git ls-files "*.sh" -z; git grep -Plz "\A\#\!.*bash"; } | sort -zu

-.PHONY: all build-base build-community
+shellcheck:
+	@$(SHELLCHECK_FILES) | xargs -0 -r docker run --rm -v $(HERE):/mnt -w /mnt \
+		koalaman/shellcheck:stable $(SHELLCHECK_OPTS) $(SHELLCHECK_COLOR)
+
+shellcheck_fix:
+	@$(SHELLCHECK_FILES) | while IFS= read -r -d '' file; do \
+		diff=$$(docker run --rm -v $(HERE):/mnt -w /mnt koalaman/shellcheck:stable $(SHELLCHECK_OPTS) --format=diff "$$file" 2>/dev/null); \
+		if [ -n "$$diff" ] && ! echo "$$diff" | patch -p1 >/dev/null 2>&1; then echo "\033[31m$$file\033[0m"; \
+		elif [ -n "$$diff" ]; then echo "$$file"; \
+		else echo "\033[2m$$file\033[0m"; fi \
+	done
+
+.PHONY: all \
+	build-base build-community \
+	shellcheck shellcheck_fix
@@ -0,0 +1 @@
+../../bin/shared/
@@ -1,5 +1,6 @@
 {
  "databaseUrl": "HISTORY_CONNECTION_STRING",
+  "databaseUrlReadOnly": "HISTORY_FOLLOWER_CONNECTION_STRING",
  "herokuDatabaseUrl": "DATABASE_URL",
  "databasePoolMin": "DATABASE_POOL_MIN",
  "databasePoolMax": "DATABASE_POOL_MAX",
@@ -9,5 +9,6 @@ export HISTORY_V1_HOST=127.0.0.1
 export NOTIFICATIONS_HOST=127.0.0.1
 export PROJECT_HISTORY_HOST=127.0.0.1
 export REALTIME_HOST=127.0.0.1
+export REFERENCES_HOST=127.0.0.1
 export WEB_HOST=127.0.0.1
 export WEB_API_HOST=127.0.0.1
@@ -335,6 +335,10 @@ if (process.env.OVERLEAF_LOGIN_SUPPORT_TEXT != null) {
  settings.nav.login_support_text = process.env.OVERLEAF_LOGIN_SUPPORT_TEXT
 }

+if (process.env.OVERLEAF_LOGIN_SUPPORT_TITLE != null) {
+  settings.nav.login_support_title = process.env.OVERLEAF_LOGIN_SUPPORT_TITLE
+}
+
 // Sending Email
 // -------------
 //
@@ -458,6 +462,35 @@ switch (process.env.OVERLEAF_FILESTORE_BACKEND) {
    }
 }

+// Overleaf Extended CE Compiler options to enable sandboxed compiles.
+// -----------
+if (process.env.SANDBOXED_COMPILES === 'true') {
+  settings.clsi = {
+    ...settings.clsi,
+    dockerRunner: true,
+    docker: {
+      image: process.env.TEX_LIVE_DOCKER_IMAGE,
+      user:  process.env.TEX_LIVE_DOCKER_USER || 'www-data',
+    }
+  }
+
+  if (settings.path == null) {
+    settings.path = {}
+  }
+  settings.path.synctexBaseDir = () => '/compile'
+  if (process.env.SANDBOXED_COMPILES_SIBLING_CONTAINERS === 'true') {
+    console.log('Using sibling containers for sandboxed compiles')
+    if (process.env.SANDBOXED_COMPILES_HOST_DIR) {
+      settings.path.sandboxedCompilesHostDir =
+        process.env.SANDBOXED_COMPILES_HOST_DIR
+    } else {
+      console.error(
+        'Sibling containers, but SANDBOXED_COMPILES_HOST_DIR not set'
+      )
+    }
+  }
+}
+
 // With lots of incoming and outgoing HTTP connections to different services,
 // sometimes long running, it is a good idea to increase the default number
 // of sockets that Node will hold open.
@@ -12,6 +12,10 @@ switch (process.argv.pop()) {
      console.log('pushd', `services/${service.name}`)
      switch (service.name) {
        case 'web':
+          // precompile pug in background
+          console.log('npm run precompile-pug &')
+          console.log('pug_precompile=$!')
+
          // Avoid downloading of cypress
          console.log('export CYPRESS_INSTALL_BINARY=0')

@@ -21,8 +25,9 @@ switch (process.argv.pop()) {
          console.log('npm run webpack:production')
          // uninstall webpack and frontend dependencies
          console.log('npm install --omit=dev')
-          // precompile pug
-          console.log('npm run precompile-pug')
+
+          // Wait for pug precompile to finish
+          console.log('wait "$pug_precompile"')
          break
        default:
          console.log(`echo ${service.name} does not require a compilation`)
@@ -0,0 +1 @@
+FROM sharelatex/sharelatex:4.2.8
@@ -0,0 +1,14 @@
+FROM sharelatex/sharelatex:5.3.0
+
+# Update copyright year
+COPY pr_22950.patch .
+RUN patch -p0 < pr_22950.patch && rm pr_22950.patch
+
+
+# Update Mongoose
+RUN npm install mongoose@^8.9.5 --save -w services/web \
+  && npm install mongodb@6.12.0 --save \
+    -w services/chat -w services/contacts -w services/docstore \
+    -w services/history-v1 -w libraries/mongo-utils \
+  && npm install mongodb@6.12.0 --save \
+  && rm -rf /root/.cache /root/.npm $(find /tmp/ -mindepth 1 -maxdepth 1)
@@ -0,0 +1,33 @@
+--- services/web/app/views/layout/thin-footer-bootstrap-5.pug
+++ services/web/app/views/layout/thin-footer-bootstrap-5.pug
+@@ -7,7 +7,7 @@ footer.site-footer
+ 				if !settings.nav.hide_powered_by
+ 					li
+ 						//- year of Server Pro release, static
+-						| © 2024
+						| © 2025
+ 						|
+ 						a(href='https://www.overleaf.com/for/enterprises') Powered by Overleaf
+
+--- services/web/app/views/layout/thin-footer.pug
+++ services/web/app/views/layout/thin-footer.pug
+@@ -9,7 +9,7 @@ footer.site-footer
+ 				else if !settings.nav.hide_powered_by
+ 					li
+ 						//- year of Server Pro release, static
+-						| © 2024
+						| © 2025
+ 						|
+ 						a(href='https://www.overleaf.com/for/enterprises') Powered by Overleaf
+
+--- services/web/frontend/js/features/ui/components/bootstrap-5/footer/thin-footer.tsx
+++ services/web/frontend/js/features/ui/components/bootstrap-5/footer/thin-footer.tsx
+@@ -60,7 +60,7 @@ function ThinFooter({
+             {showPoweredBy ? (
+               <>
+                 <li>
+-                  {/* year of Server Pro release, static */}© 2024{' '}
+                  {/* year of Server Pro release, static */}© 2025{' '}
+                   <a href="https://www.overleaf.com/for/enterprises">
+                     Powered by Overleaf
+                   </a>
@@ -0,0 +1 @@
+FROM sharelatex/sharelatex:5.3.1
@@ -0,0 +1 @@
+FROM sharelatex/sharelatex:5.3.2
@@ -2,4 +2,4 @@
 set -e -o pipefail

 # See the bottom of http://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach
-echo "`route -n | awk '/UG[ \t]/{print $2}'` dockerhost" >> /etc/hosts
+echo "$(route -n | awk '/UG[ \t]/{print $2}') dockerhost" >> /etc/hosts
@@ -26,6 +26,7 @@ if [ -f "${nginx_template_file}" ]; then
  # Note the single-quotes, they are important.
  # This is a pass-list of env-vars that envsubst
  # should operate on.
+  # shellcheck disable=SC2016
  envsubst '
    ${NGINX_KEEPALIVE_TIMEOUT}
    ${NGINX_WORKER_CONNECTIONS}
@@ -1 +0,0 @@
-rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })
@@ -30,7 +30,7 @@ server {
      application/pdf pdf;
  }
  # handle output files for specific users
-  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
    alias /var/lib/overleaf/data/output/$1-$2/generated-files/$3/output.$4;
  }
  # handle .blg files for specific users
@@ -38,7 +38,7 @@ server {
    alias /var/lib/overleaf/data/output/$1-$2/generated-files/$3/$4.blg;
  }
  # handle output files for anonymous users
-  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
    alias /var/lib/overleaf/data/output/$1/generated-files/$2/output.$3;
  }
  # handle .blg files for anonymous users
@@ -47,12 +47,12 @@ server {
 	}

  # handle output files for specific users
-  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
 		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
 		proxy_http_version 1.1;
  }
  # handle output files for anonymous users
-  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
 		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
 		proxy_http_version 1.1;
  }
@@ -11,7 +11,7 @@ fi
 if [ -e '/var/run/docker.sock' ]; then
  echo ">> Setting permissions on docker socket"
  DOCKER_GROUP=$(stat -c '%g' /var/run/docker.sock)
-  groupadd --non-unique --gid ${DOCKER_GROUP} dockeronhost
+  groupadd --non-unique --gid "${DOCKER_GROUP}" dockeronhost
  usermod -aG dockeronhost www-data
 fi

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+NODE_PARAMS=""
+if [ "$DEBUG_NODE" == "true" ]; then
+    echo "running debug - references"
+    NODE_PARAMS="--inspect=0.0.0.0:30560"
+fi
+
+source /etc/overleaf/env.sh
+export LISTEN_ADDRESS=127.0.0.1
+
+exec /sbin/setuser www-data /usr/bin/node $NODE_PARAMS /overleaf/services/references/app.js >> /var/log/overleaf/references.log 2>&1
@@ -29,6 +29,9 @@ module.exports = [
  {
    name: 'project-history',
  },
+  {
+    name: 'references',
+  },
  {
    name: 'history-v1',
  },
@@ -1,4 +1,4 @@
-FROM node:20.18.0
+FROM node:20.18.2
 RUN curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - \
 &&  echo \
      "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
@@ -44,7 +44,7 @@ prefetch_custom_compose_pull:

 prefetch_custom: prefetch_custom_texlive
 prefetch_custom_texlive:
-	echo -n "$$ALL_TEX_LIVE_DOCKER_IMAGES" | xargs -d, -I% \
+	echo "$$ALL_TEX_LIVE_DOCKER_IMAGES" | tr ',' '\n' | xargs -I% \
 	sh -exc 'tag=%; re_tag=quay.io/sharelatex/$${tag#*/*/}; docker pull $$tag; docker tag $$tag $$re_tag'

 prefetch_custom: prefetch_old
@@ -127,10 +127,12 @@ describe('admin panel', function () {
      testProjectName = `project-${uuid()}`
      deletedProjectName = `deleted-project-${uuid()}`
      login(user1)
-      cy.visit('/project')
-      createProject(testProjectName).then(id => (testProjectId = id))
-      cy.visit('/project')
-      createProject(deletedProjectName).then(id => (projectToDeleteId = id))
+      createProject(testProjectName, { open: false }).then(
+        id => (testProjectId = id)
+      )
+      createProject(deletedProjectName, { open: false }).then(
+        id => (projectToDeleteId = id)
+      )
    })

    describe('manage site', () => {
@@ -1,5 +1,8 @@
 import { ensureUserExists, login } from './helpers/login'
-import { createProject } from './helpers/project'
+import {
+  createProject,
+  openProjectViaInviteNotification,
+} from './helpers/project'
 import { isExcludedBySharding, startWith } from './helpers/config'
 import { throttledRecompile } from './helpers/compile'

@@ -11,10 +14,7 @@ describe('Project creation and compilation', function () {

  it('users can create project and compile it', function () {
    login('user@example.com')
-    cy.visit('/project')
-    // this is the first project created, the welcome screen is displayed instead of the project list
    createProject('test-project')
-    cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
    const recompile = throttledRecompile()
    cy.findByText('\\maketitle').parent().click()
    cy.findByText('\\maketitle').parent().type('\n\\section{{}Test Section}')
@@ -26,8 +26,8 @@ describe('Project creation and compilation', function () {
    const fileName = `test-${Date.now()}.md`
    const markdownContent = '# Markdown title'
    login('user@example.com')
-    cy.visit('/project')
    createProject('test-project')
+
    // FIXME: Add aria-label maybe? or at least data-test-id
    cy.findByText('New file').click({ force: true })
    cy.findByRole('dialog').within(() => {
@@ -50,12 +50,10 @@ describe('Project creation and compilation', function () {
    const targetProjectName = `${sourceProjectName}-target`
    login('user@example.com')

-    cy.visit('/project')
-    createProject(sourceProjectName, { type: 'Example Project' }).as(
-      'sourceProjectId'
-    )
-
-    cy.visit('/project')
+    createProject(sourceProjectName, {
+      type: 'Example Project',
+      open: false,
+    }).as('sourceProjectId')
    createProject(targetProjectName)

    // link the image from `projectName` into this project
@@ -80,13 +78,10 @@ describe('Project creation and compilation', function () {
    const sourceProjectName = `test-project-${Date.now()}`
    const targetProjectName = `${sourceProjectName}-target`
    login('user@example.com')
-
-    cy.visit('/project')
-    createProject(sourceProjectName, { type: 'Example Project' }).as(
-      'sourceProjectId'
-    )
-
-    cy.visit('/project')
+    createProject(sourceProjectName, {
+      type: 'Example Project',
+      open: false,
+    }).as('sourceProjectId')
    createProject(targetProjectName).as('targetProjectId')

    // link the image from `projectName` into this project
@@ -100,8 +95,11 @@ describe('Project creation and compilation', function () {

    cy.findByText('Share').click()
    cy.findByRole('dialog').within(() => {
-      cy.get('input').type('collaborator@example.com,')
-      cy.findByText('Share').click({ force: true })
+      cy.findByTestId('collaborator-email-input').type(
+        'collaborator@example.com,'
+      )
+      cy.findByText('Invite').click({ force: true })
+      cy.findByText('Invite not yet accepted.')
    })

    cy.visit('/project')
@@ -109,15 +107,7 @@ describe('Project creation and compilation', function () {
    cy.findByText('Log Out').click()

    login('collaborator@example.com')
-    cy.visit('/project')
-    cy.findByText(targetProjectName)
-      .parent()
-      .parent()
-      .within(() => {
-        cy.findByText('Join Project').click()
-      })
-    cy.findByText('Open Project').click()
-    cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
+    openProjectViaInviteNotification(targetProjectName)
    cy.get('@targetProjectId').then(targetProjectId => {
      cy.url().should('include', targetProjectId)
    })
@@ -35,10 +35,10 @@ services:
      MAILTRAP_PASSWORD: 'password-for-mailtrap'

  mongo:
-    image: mongo:5.0.17
+    image: mongo:6.0
    command: '--replSet overleaf'
    volumes:
-      - ../mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
+      - ../bin/shared/mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
    environment:
      MONGO_INITDB_DATABASE: sharelatex
    extra_hosts:
@@ -46,7 +46,7 @@ services:
      # This override is not needed when running the setup after starting up mongo.
      - mongo:127.0.0.1
    healthcheck:
-      test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
+      test: echo 'db.stats().ok' | mongosh localhost:27017/test --quiet
      interval: 3s
      timeout: 3s
      retries: 30
@@ -1,7 +1,17 @@
-import { createProject } from './helpers/project'
+import {
+  createNewFile,
+  createProject,
+  enableLinkSharing,
+  openFile,
+  openProjectById,
+  openProjectViaLinkSharingAsUser,
+  toggleTrackChanges,
+} from './helpers/project'
 import { isExcludedBySharding, startWith } from './helpers/config'
 import { ensureUserExists, login } from './helpers/login'
 import { v4 as uuid } from 'uuid'
+import { beforeWithReRunOnTestRetry } from './helpers/beforeWithReRunOnTestRetry'
+import { prepareWaitForNextCompileSlot } from './helpers/compile'

 describe('editor', () => {
  if (isExcludedBySharding('PRO_DEFAULT_1')) return
@@ -9,187 +19,210 @@ describe('editor', () => {
  ensureUserExists({ email: 'user@example.com' })
  ensureUserExists({ email: 'collaborator@example.com' })

-  it('word dictionary and spelling', () => {
-    const fileName = 'test.tex'
-    const word = createRandomLetterString()
+  let projectName: string
+  let projectId: string
+  let recompile: () => void
+  let waitForCompileRateLimitCoolOff: (fn: () => void) => void
+  beforeWithReRunOnTestRetry(function () {
+    projectName = `project-${uuid()}`
    login('user@example.com')
-    cy.visit('/project')
-    createProject('test-project')
+    createProject(projectName, { type: 'Example Project', open: false }).then(
+      id => (projectId = id)
+    )
+    ;({ recompile, waitForCompileRateLimitCoolOff } =
+      prepareWaitForNextCompileSlot())
+  })

-    cy.log('create new project file')
-    cy.get('button').contains('New file').click({ force: true })
-    cy.findByRole('dialog').within(() => {
-      cy.get('input').clear()
-      cy.get('input').type(fileName)
-      cy.findByText('Create').click()
+  beforeEach(() => {
+    login('user@example.com')
+    waitForCompileRateLimitCoolOff(() => {
+      openProjectById(projectId)
    })
-    cy.findByText(fileName).click()
+  })

-    cy.log('edit project file')
-    // wait until we've switched to the newly created empty file
-    cy.get('.cm-line').should('have.length', 1)
-    cy.get('.cm-line').type(word)
+  describe('spelling', function () {
+    function changeSpellCheckLanguageTo(lng: string) {
+      cy.log(`change project language to '${lng}'`)
+      cy.get('button').contains('Menu').click()
+      cy.get('select[id=settings-menu-spellCheckLanguage]').select(lng)
+      cy.get('[id="left-menu"]').type('{esc}') // close left menu
+    }

-    cy.get('.ol-cm-spelling-error').should('exist')
-
-    cy.log('change project language')
-    cy.get('button').contains('Menu').click()
-    cy.get('select[id=settings-menu-spellCheckLanguage]').select('Spanish')
-    cy.get('[id="left-menu"]').type('{esc}') // close left menu
-
-    cy.log('add word to dictionary')
-    cy.get('.ol-cm-spelling-error').contains(word).rightclick()
-    cy.findByText('Add to Dictionary').click()
-    cy.get('.ol-cm-spelling-error').should('not.exist')
-
-    cy.log('remove word from dictionary')
-    cy.get('button').contains('Menu').click()
-    cy.get('button').contains('Edit').click()
-    cy.get('[id="dictionary-modal"').within(() => {
-      cy.findByText(word)
-        .parent()
-        .within(() => cy.get('button').click())
-
-      // the modal has 2 close buttons, this ensures the one with the visible label is
-      // clicked, otherwise it would need `force: true`
-      cy.get('.btn').contains('Close').click()
+    afterEach(function () {
+      changeSpellCheckLanguageTo('Off')
    })

-    cy.log('close left panel')
-    cy.get('[id="left-menu"]').type('{esc}')
+    it('word dictionary and spelling', () => {
+      changeSpellCheckLanguageTo('English (American)')
+      createNewFile()
+      const word = createRandomLetterString()

-    cy.log('rewrite word to force spelling error')
-    cy.get('.cm-line').type('{selectAll}{del}' + word + '{enter}')
+      cy.log('edit project file')
+      cy.get('.cm-line').type(word)

-    cy.get('.ol-cm-spelling-error').should('contain.text', word)
+      cy.get('.ol-cm-spelling-error').should('exist')
+
+      changeSpellCheckLanguageTo('Spanish')
+
+      cy.log('add word to dictionary')
+      cy.get('.ol-cm-spelling-error').contains(word).rightclick()
+      cy.findByText('Add to Dictionary').click()
+      cy.get('.ol-cm-spelling-error').should('not.exist')
+
+      cy.log('remove word from dictionary')
+      cy.get('button').contains('Menu').click()
+      cy.get('button').contains('Edit').click()
+      cy.get('[id="dictionary-modal"]').within(() => {
+        cy.findByText(word)
+          .parent()
+          .within(() => cy.get('button').click())
+
+        // the modal has 2 close buttons, this ensures the one with the visible label is
+        // clicked, otherwise it would need `force: true`
+        cy.get('.btn').contains('Close').click()
+      })
+
+      cy.log('close left panel')
+      cy.get('[id="left-menu"]').type('{esc}')
+
+      cy.log('rewrite word to force spelling error')
+      cy.get('.cm-line').type('{selectAll}{del}' + word + '{enter}')
+
+      cy.get('.ol-cm-spelling-error').should('contain.text', word)
+    })
  })

  describe('collaboration', () => {
-    let projectId: string
+    beforeWithReRunOnTestRetry(function () {
+      enableLinkSharing().then(({ linkSharingReadAndWrite }) => {
+        const email = 'collaborator@example.com'
+        login(email)
+        openProjectViaLinkSharingAsUser(
+          linkSharingReadAndWrite,
+          projectName,
+          email
+        )
+      })

-    beforeEach(() => {
      login('user@example.com')
-      cy.visit(`/project`)
-      createProject('test-editor', { type: 'Example Project' }).then(
-        (id: string) => {
-          projectId = id
-
-          cy.log('make project shareable')
-          cy.findByText('Share').click()
-          cy.findByText('Turn on link sharing').click()
-
-          cy.log('accept project invitation')
-          cy.findByText('Anyone with this link can edit this project')
-            .next()
-            .should('contain.text', 'http://') // wait for the link to appear
-            .then(el => {
-              const linkSharingReadAndWrite = el.text()
-              login('collaborator@example.com')
-              cy.visit(linkSharingReadAndWrite)
-              cy.get('button').contains('Join Project').click()
-              cy.log(
-                'navigate to project dashboard to avoid cross session requests from editor'
-              )
-              cy.visit('/project')
-            })
-
-          login('user@example.com')
-          cy.visit(`/project/${projectId}`)
-        }
-      )
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
    })

    it('track-changes', () => {
-      cy.log('enable track-changes for everyone')
-      cy.findByText('Review').click()
-      cy.get('.review-panel-toolbar-collapse-button').click() // make track-changes switches visible
+      cy.log('disable track-changes before populating doc')
+      toggleTrackChanges(false)

-      cy.intercept('POST', '**/track_changes').as('enableTrackChanges')
-      cy.findByText('Everyone')
-        .parent()
-        .within(() => cy.get('.input-switch').click())
-      cy.wait('@enableTrackChanges')
+      const fileName = createNewFile()
+      const oldContent = 'oldContent'
+      cy.get('.cm-line').type(`${oldContent}\n\nstatic`)
+
+      cy.log('recompile to force flush')
+      recompile()
+
+      cy.log('enable track-changes for everyone')
+      toggleTrackChanges(true)

      login('collaborator@example.com')
-      cy.visit(`/project/${projectId}`)
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
+      openFile(fileName, 'static')

      cy.log('make changes in main file')
      // cy.type() "clicks" in the center of the selected element before typing. This "click" discards the text as selected by the dblclick.
      // Go down to the lower level event based typing, the frontend tests in web use similar events.
      cy.get('.cm-editor').as('editor')
-      cy.get('@editor').findByText('\\maketitle').dblclick()
+      cy.get('@editor').findByText(oldContent).dblclick()
      cy.get('@editor').trigger('keydown', { key: 'Delete' })
      cy.get('@editor').trigger('keydown', { key: 'Enter' })
      cy.get('@editor').trigger('keydown', { key: 'Enter' })

      cy.log('recompile to force flush')
-      cy.findByText('Recompile').click()
+      recompile()

      login('user@example.com')
-      cy.visit(`/project/${projectId}`)
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
+      openFile(fileName, 'static')

      cy.log('reject changes')
-      cy.findByText('Review').click()
-      cy.get('.cm-content').should('not.contain.text', '\\maketitle')
-      cy.findByText('Reject').click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+      cy.get('.cm-content').should('not.contain.text', oldContent)
+      cy.findByText('Reject change').click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+
+      cy.log('recompile to force flush')
+      recompile()

      cy.log('verify the changes are applied')
-      cy.get('.cm-content').should('contain.text', '\\maketitle')
+      cy.get('.cm-content').should('contain.text', oldContent)
+
+      cy.log('disable track-changes for everyone again')
+      toggleTrackChanges(false)
    })

    it('track-changes rich text', () => {
-      cy.log('enable track-changes for everyone')
-      cy.findByText('Visual Editor').click()
-      cy.findByText('Review').click()
-      cy.get('.review-panel-toolbar-collapse-button').click() // make track-changes switches visible
+      cy.log('disable track-changes before populating doc')
+      toggleTrackChanges(false)

-      cy.intercept('POST', '**/track_changes').as('enableTrackChanges')
-      cy.findByText('Everyone')
-        .parent()
-        .within(() => cy.get('.input-switch').click())
-      cy.wait('@enableTrackChanges')
+      const fileName = createNewFile()
+      const oldContent = 'oldContent'
+      cy.get('.cm-line').type(`\\section{{}${oldContent}}\n\nstatic`)
+
+      cy.log('recompile to force flush')
+      recompile()
+
+      cy.log('enable track-changes for everyone')
+      toggleTrackChanges(true)

      login('collaborator@example.com')
-      cy.visit(`/project/${projectId}`)
-
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
      cy.log('enable visual editor and make changes in main file')
      cy.findByText('Visual Editor').click()

+      openFile(fileName, 'static')
+
      // cy.type() "clicks" in the center of the selected element before typing. This "click" discards the text as selected by the dblclick.
      // Go down to the lower level event based typing, the frontend tests in web use similar events.
      cy.get('.cm-editor').as('editor')
-      cy.get('@editor').contains('Introduction').dblclick()
+      cy.get('@editor').findByText(oldContent).dblclick()
      cy.get('@editor').trigger('keydown', { key: 'Delete' })
      cy.get('@editor').trigger('keydown', { key: 'Enter' })
      cy.get('@editor').trigger('keydown', { key: 'Enter' })

      cy.log('recompile to force flush')
-      cy.findByText('Recompile').click()
+      recompile()

      login('user@example.com')
-      cy.visit(`/project/${projectId}`)
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
+      openFile(fileName, 'static')

      cy.log('reject changes')
-      cy.findByText('Review').click()
-      cy.get('.cm-content').should('not.contain.text', 'Introduction')
-      cy.findAllByText('Reject').first().click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+      cy.get('.cm-content').should('not.contain.text', oldContent)
+      cy.findAllByText('Reject change').first().click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+
+      cy.log('recompile to force flush')
+      recompile()

      cy.log('verify the changes are applied in the visual editor')
      cy.findByText('Visual Editor').click()
-      cy.get('.cm-content').should('contain.text', 'Introduction')
+      cy.get('.cm-content').should('contain.text', oldContent)
+
+      cy.log('disable track-changes for everyone again')
+      toggleTrackChanges(false)
    })
  })

  describe('editor', () => {
-    beforeEach(() => {
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(`project-${uuid()}`, { type: 'Example Project' })
-      // wait until the main document is rendered
-      cy.findByText(/Loading/).should('not.exist')
-      cy.findByText(/Your Paper/)
-    })
-
    it('renders jpg', () => {
      cy.findByTestId('file-tree').findByText('frog.jpg').click()
      cy.get('[alt="frog.jpg"]')
@@ -199,39 +232,41 @@ describe('editor', () => {
    })

    it('symbol palette', () => {
+      createNewFile()
+
      cy.get('button[aria-label="Toggle Symbol Palette"]').click({
        force: true,
      })
      cy.get('button').contains('𝜉').click()
      cy.get('.cm-content').should('contain.text', '\\xi')
+
+      cy.log('recompile to force flush and avoid "unsaved changes" prompt')
+      recompile()
    })
  })

  describe('add new file to project', () => {
-    let projectName: string
-
    beforeEach(() => {
-      projectName = `project-${uuid()}`
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(projectName, { type: 'Example Project' })
      cy.get('button').contains('New file').click({ force: true })
    })

    it('can upload file', () => {
+      const name = `${uuid()}.txt`
+      const content = `Test File Content ${name}`
      cy.get('button').contains('Upload').click({ force: true })
      cy.get('input[type=file]')
        .first()
        .selectFile(
          {
-            contents: Cypress.Buffer.from('Test File Content'),
-            fileName: 'file.txt',
+            contents: Cypress.Buffer.from(content),
+            fileName: name,
            lastModified: Date.now(),
          },
          { force: true }
        )
-      cy.findByTestId('file-tree').findByText('file.txt').click({ force: true })
-      cy.findByText('Test File Content')
+      // force: The file-tree pane is too narrow to display the full name.
+      cy.findByTestId('file-tree').findByText(name).click({ force: true })
+      cy.findByText(content)
    })

    it('should not display import from URL', () => {
@@ -240,13 +275,7 @@ describe('editor', () => {
  })

  describe('left menu', () => {
-    let projectName: string
-
    beforeEach(() => {
-      projectName = `project-${uuid()}`
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(projectName, { type: 'Example Project' })
      cy.get('button').contains('Menu').click()
    })

@@ -292,13 +321,6 @@ describe('editor', () => {
  })

  describe('layout selector', () => {
-    let projectId: string
-    beforeEach(() => {
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(`project-${uuid()}`, { type: 'Example Project' })
-    })
-
    it('show editor only and switch between editor and pdf', () => {
      cy.get('.pdf-viewer').should('be.visible')
      cy.get('.cm-editor').should('be.visible')
@@ -32,6 +32,9 @@ describe('SAML', () => {
      cy.get('button[type="submit"]').click()
    })

+    cy.log('wait for login to finish')
+    cy.url().should('contain', '/project')
+
    createProject('via SAML')
  })
 })
@@ -62,6 +65,9 @@ describe('LDAP', () => {
    cy.get('input[name="password"]').type('fry')
    cy.get('button[type="submit"]').click()

+    cy.log('wait for login to finish')
+    cy.url().should('contain', '/project')
+
    createProject('via LDAP')
  })
 })
@@ -4,6 +4,8 @@ import { ensureUserExists, login } from './helpers/login'
 import {
  createProject,
  enableLinkSharing,
+  openProjectByName,
+  openProjectViaLinkSharingAsUser,
  shareProjectByEmailAndAcceptInviteViaDash,
 } from './helpers/project'

@@ -20,7 +22,12 @@ describe('git-bridge', function () {
    V1_HISTORY_URL: 'http://sharelatex:3100/api',
  }

-  const gitBridgePublicHost = new URL(Cypress.config().baseUrl!).host
+  function gitURL(projectId: string) {
+    const url = new URL(Cypress.config().baseUrl!)
+    url.username = 'git'
+    url.pathname = `/git/${projectId}`
+    return url
+  }

  describe('enabled in Server Pro', function () {
    if (isExcludedBySharding('PRO_CUSTOM_1')) return
@@ -77,16 +84,13 @@ describe('git-bridge', function () {

    it('should render the git-bridge UI in the editor', function () {
      maybeClearAllTokens()
-      cy.visit('/project')
      createProject('git').as('projectId')
      cy.get('header').findByText('Menu').click()
      cy.findByText('Sync')
      cy.findByText('Git').click()
-      cy.findByRole('dialog').within(() => {
+      cy.findByTestId('git-bridge-modal').within(() => {
        cy.get('@projectId').then(id => {
-          cy.get('code').contains(
-            `git clone http://git@${gitBridgePublicHost}/git/${id}`
-          )
+          cy.get('code').contains(`git clone ${gitURL(id.toString())}`)
        })
        cy.findByRole('button', {
          name: 'Generate token',
@@ -98,11 +102,9 @@ describe('git-bridge', function () {
      cy.url().then(url => cy.visit(url))
      cy.get('header').findByText('Menu').click()
      cy.findByText('Git').click()
-      cy.findByRole('dialog').within(() => {
+      cy.findByTestId('git-bridge-modal').within(() => {
        cy.get('@projectId').then(id => {
-          cy.get('code').contains(
-            `git clone http://git@${gitBridgePublicHost}/git/${id}`
-          )
+          cy.get('code').contains(`git clone ${gitURL(id.toString())}`)
        })
        cy.findByText('Generate token').should('not.exist')
        cy.findByText(/generate a new one in Account Settings/)
@@ -120,15 +122,13 @@ describe('git-bridge', function () {

      let projectName: string
      beforeEach(() => {
-        cy.visit('/project')
        projectName = uuid()
-        createProject(projectName).as('projectId')
+        createProject(projectName, { open: false }).as('projectId')
      })

      it('should expose r/w interface to owner', () => {
        maybeClearAllTokens()
-        cy.visit('/project')
-        cy.findByText(projectName).click()
+        openProjectByName(projectName)
        checkGitAccess('readAndWrite')
      })

@@ -136,11 +136,10 @@ describe('git-bridge', function () {
        shareProjectByEmailAndAcceptInviteViaDash(
          projectName,
          'collaborator-rw@example.com',
-          'Can edit'
+          'Editor'
        )
        maybeClearAllTokens()
-        cy.visit('/project')
-        cy.findByText(projectName).click()
+        openProjectByName(projectName)
        checkGitAccess('readAndWrite')
      })

@@ -148,32 +147,39 @@ describe('git-bridge', function () {
        shareProjectByEmailAndAcceptInviteViaDash(
          projectName,
          'collaborator-ro@example.com',
-          'Read only'
+          'Viewer'
        )
        maybeClearAllTokens()
-        cy.visit('/project')
-        cy.findByText(projectName).click()
+        openProjectByName(projectName)
        checkGitAccess('readOnly')
      })

      it('should expose r/w interface to link-sharing r/w collaborator', () => {
+        openProjectByName(projectName)
        enableLinkSharing().then(({ linkSharingReadAndWrite }) => {
-          login('collaborator-link-rw@example.com')
+          const email = 'collaborator-link-rw@example.com'
+          login(email)
          maybeClearAllTokens()
-          cy.visit(linkSharingReadAndWrite)
-          cy.findByText(projectName) // wait for lazy loading
-          cy.findByText('Join Project').click()
+          openProjectViaLinkSharingAsUser(
+            linkSharingReadAndWrite,
+            projectName,
+            email
+          )
          checkGitAccess('readAndWrite')
        })
      })

      it('should expose r/o interface to link-sharing r/o collaborator', () => {
+        openProjectByName(projectName)
        enableLinkSharing().then(({ linkSharingReadOnly }) => {
-          login('collaborator-link-ro@example.com')
+          const email = 'collaborator-link-ro@example.com'
+          login(email)
          maybeClearAllTokens()
-          cy.visit(linkSharingReadOnly)
-          cy.findByText(projectName) // wait for lazy loading
-          cy.findByText('Join Project').click()
+          openProjectViaLinkSharingAsUser(
+            linkSharingReadOnly,
+            projectName,
+            email
+          )
          checkGitAccess('readOnly')
        })
      })
@@ -186,10 +192,8 @@ describe('git-bridge', function () {
      cy.findByText('Sync')
      cy.findByText('Git').click()
      cy.get('@projectId').then(projectId => {
-        cy.findByRole('dialog').within(() => {
-          cy.get('code').contains(
-            `git clone http://git@${gitBridgePublicHost}/git/${projectId}`
-          )
+        cy.findByTestId('git-bridge-modal').within(() => {
+          cy.get('code').contains(`git clone ${gitURL(projectId.toString())}`)
        })
        cy.findByRole('button', {
          name: 'Generate token',
@@ -202,7 +206,7 @@ describe('git-bridge', function () {
            // close Git modal
            cy.findAllByText('Close').last().click()
            // close editor menu
-            cy.get('#left-menu-modal').click()
+            cy.get('.left-menu-modal-backdrop').click()

            const fs = new LightningFS('fs')
            const dir = `/${projectId}`
@@ -229,9 +233,11 @@ describe('git-bridge', function () {
              dir,
              fs,
            }
+            const url = gitURL(projectId.toString())
+            url.username = '' // basic auth is specified separately.
            const httpOptions = {
              http,
-              url: `http://sharelatex/git/${projectId}`,
+              url: url.toString(),
              headers: {
                Authorization: `Basic ${Buffer.from(`git:${token}`).toString('base64')}`,
              },
@@ -363,7 +369,6 @@ Hello world
    })
    it('should not render the git-bridge UI in the editor', function () {
      login('user@example.com')
-      cy.visit('/project')
      createProject('maybe git')
      cy.get('header').findByText('Menu').click()
      cy.findByText('Word Count') // wait for lazy loading
@@ -31,8 +31,6 @@ describe('GracefulShutdown', function () {
  it('should display banner and flush changes out of redis', () => {
    bringServerProBackUp()
    login(USER)
-
-    cy.visit('/project')
    createProject(PROJECT_NAME).then(id => {
      projectId = id
    })
@@ -4,22 +4,37 @@
 * This helper takes into account that other UI interactions take time. We can deduce that latency from the fixed delay (3s minus other latency). This can bring down the effective waiting time to 0s.
 */
 export function throttledRecompile() {
+  const { queueReset, recompile } = prepareWaitForNextCompileSlot()
+  queueReset()
+  return recompile
+}
+
+export function prepareWaitForNextCompileSlot() {
  let lastCompile = 0
  function queueReset() {
    cy.then(() => {
      lastCompile = Date.now()
    })
  }
-
-  queueReset()
-  return () =>
+  function waitForCompileRateLimitCoolOff(triggerCompile: () => void) {
    cy.then(() => {
-      cy.log('Recompile without hitting rate-limit')
+      cy.log('Wait for recompile rate-limit to cool off')
      const msSinceLastCompile = Date.now() - lastCompile
      cy.wait(Math.max(0, 1_000 - msSinceLastCompile))
-      cy.findByText('Recompile').click()
      queueReset()
-      cy.log('Wait for recompile to finish')
-      cy.findByText('Recompile')
+      triggerCompile()
+      cy.log('Wait for compile to finish')
+      cy.findByText('Recompile').should('be.visible')
    })
+  }
+  function recompile() {
+    waitForCompileRateLimitCoolOff(() => {
+      cy.findByText('Recompile').click()
+    })
+  }
+  return {
+    queueReset,
+    waitForCompileRateLimitCoolOff,
+    recompile,
+  }
 }
@@ -68,7 +68,8 @@ export function login(username: string, password = DEFAULT_PASSWORD) {
    {
      cacheAcrossSpecs: true,
      async validate() {
-        cy.request({ url: '/project', followRedirect: false }).then(
+        // Hit a cheap endpoint that is behind AuthenticationController.requireLogin().
+        cy.request({ url: '/user/personal_info', followRedirect: false }).then(
          response => {
            expect(response.status).to.equal(200)
          }
@@ -1,16 +1,40 @@
 import { login } from './login'
 import { openEmail } from './email'
+import { v4 as uuid } from 'uuid'

 export function createProject(
  name: string,
  {
    type = 'Blank Project',
    newProjectButtonMatcher = /new project/i,
+    open = true,
  }: {
    type?: 'Blank Project' | 'Example Project'
    newProjectButtonMatcher?: RegExp
+    open?: boolean
  } = {}
 ): Cypress.Chainable<string> {
+  cy.url().then(url => {
+    if (!url.endsWith('/project')) {
+      cy.visit('/project')
+    }
+  })
+  const interceptId = uuid()
+  let projectId = ''
+  if (!open) {
+    cy.then(() => {
+      // Register intercept just before creating the project, otherwise we might
+      // intercept a request from a prior createProject invocation.
+      cy.intercept(
+        { method: 'GET', url: /\/project\/[a-fA-F0-9]{24}$/, times: 1 },
+        req => {
+          projectId = req.url.split('/').pop()!
+          // Redirect back to the project dashboard, effectively reload the page.
+          req.redirect('/project')
+        }
+      ).as(interceptId)
+    })
+  }
  cy.findAllByRole('button').contains(newProjectButtonMatcher).click()
  // FIXME: This should only look in the left menu
  cy.findAllByText(type).first().click()
@@ -18,50 +42,99 @@ export function createProject(
    cy.get('input').type(name)
    cy.findByText('Create').click()
  })
-  return cy
-    .url()
-    .should('match', /\/project\/[a-fA-F0-9]{24}/)
-    .then(url => url.split('/').pop())
+  if (open) {
+    cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
+    waitForMainDocToLoad()
+    return cy
+      .url()
+      .should('match', /\/project\/[a-fA-F0-9]{24}/)
+      .then(url => url.split('/').pop())
+  } else {
+    const alias = `@${interceptId}` // IDEs do not like computed values in cy.wait().
+    cy.wait(alias)
+    return cy.then(() => projectId)
+  }
+}
+
+export function openProjectByName(projectName: string) {
+  cy.visit('/project')
+  cy.findByText(projectName).click()
+  waitForMainDocToLoad()
+}
+
+export function openProjectById(projectId: string) {
+  cy.visit(`/project/${projectId}`)
+  waitForMainDocToLoad()
+}
+
+export function openProjectViaLinkSharingAsAnon(url: string) {
+  cy.visit(url)
+  waitForMainDocToLoad()
+}
+
+export function openProjectViaLinkSharingAsUser(
+  url: string,
+  projectName: string,
+  email: string
+) {
+  cy.visit(url)
+  cy.findByText(projectName) // wait for lazy loading
+  cy.contains(`as ${email}`)
+  cy.findByText('OK, join project').click()
+  waitForMainDocToLoad()
+}
+
+export function openProjectViaInviteNotification(projectName: string) {
+  cy.visit('/project')
+  cy.findByText(projectName)
+    .parent()
+    .parent()
+    .within(() => {
+      cy.findByText('Join Project').click()
+    })
+  cy.findByText('Open Project').click()
+  cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
+  waitForMainDocToLoad()
 }

 function shareProjectByEmail(
  projectName: string,
  email: string,
-  level: 'Read only' | 'Can edit'
+  level: 'Viewer' | 'Editor'
 ) {
-  cy.visit('/project')
-  cy.findByText(projectName).click()
+  openProjectByName(projectName)
  cy.findByText('Share').click()
  cy.findByRole('dialog').within(() => {
-    cy.get('input').type(`${email},`)
-    cy.get('input')
+    cy.findByLabelText('Add people', { selector: 'input' }).type(`${email},`)
+    cy.findByLabelText('Add people', { selector: 'input' })
      .parents('form')
-      .within(() => cy.findByText('Can edit').parent().select(level))
-    cy.findByText('Share').click({ force: true })
+      .within(() => {
+        cy.findByTestId('add-collaborator-select')
+          .click()
+          .then(() => {
+            cy.findByText(level).click()
+          })
+      })
+    cy.findByText('Invite').click({ force: true })
+    cy.findByText('Invite not yet accepted.')
  })
 }

 export function shareProjectByEmailAndAcceptInviteViaDash(
  projectName: string,
  email: string,
-  level: 'Read only' | 'Can edit'
+  level: 'Viewer' | 'Editor'
 ) {
  shareProjectByEmail(projectName, email, level)

  login(email)
-  cy.visit('/project')
-  cy.findByText(new RegExp(projectName))
-    .parent()
-    .parent()
-    .within(() => {
-      cy.findByText('Join Project').click()
-    })
+  openProjectViaInviteNotification(projectName)
 }

 export function shareProjectByEmailAndAcceptInviteViaEmail(
  projectName: string,
  email: string,
-  level: 'Read only' | 'Can edit'
+  level: 'Viewer' | 'Editor'
 ) {
  shareProjectByEmail(projectName, email, level)

@@ -79,23 +152,27 @@ export function shareProjectByEmailAndAcceptInviteViaEmail(
  cy.findByText(/user would like you to join/)
  cy.contains(new RegExp(`You are accepting this invite as ${email}`))
  cy.findByText('Join Project').click()
+  waitForMainDocToLoad()
 }

 export function enableLinkSharing() {
  let linkSharingReadOnly: string
  let linkSharingReadAndWrite: string
+  const origin = new URL(Cypress.config().baseUrl!).origin
+
+  waitForMainDocToLoad()

  cy.findByText('Share').click()
  cy.findByText('Turn on link sharing').click()
  cy.findByText('Anyone with this link can view this project')
    .next()
-    .should('contain.text', 'http://sharelatex/')
+    .should('contain.text', origin + '/read')
    .then(el => {
      linkSharingReadOnly = el.text()
    })
  cy.findByText('Anyone with this link can edit this project')
    .next()
-    .should('contain.text', 'http://sharelatex/')
+    .should('contain.text', origin + '/')
    .then(el => {
      linkSharingReadAndWrite = el.text()
    })
@@ -104,3 +181,71 @@ export function enableLinkSharing() {
    return { linkSharingReadOnly, linkSharingReadAndWrite }
  })
 }
+
+export function waitForMainDocToLoad() {
+  cy.log('Wait for main doc to load; it will steal the focus after loading')
+  cy.get('.cm-content').should('contain.text', 'Introduction')
+}
+
+export function openFile(fileName: string, waitFor: string) {
+  // force: The file-tree pane is too narrow to display the full name.
+  cy.findByTestId('file-tree').findByText(fileName).click({ force: true })
+
+  // wait until we've switched to the selected file
+  cy.findByText('Loading…').should('not.exist')
+  cy.findByText(waitFor)
+}
+
+export function createNewFile() {
+  const fileName = `${uuid()}.tex`
+
+  cy.log('create new project file')
+  cy.get('button').contains('New file').click({ force: true })
+  cy.findByRole('dialog').within(() => {
+    cy.get('input').clear()
+    cy.get('input').type(fileName)
+    cy.findByText('Create').click()
+  })
+  // force: The file-tree pane is too narrow to display the full name.
+  cy.findByTestId('file-tree').findByText(fileName).click({ force: true })
+
+  // wait until we've switched to the newly created empty file
+  cy.findByText('Loading…').should('not.exist')
+  cy.get('.cm-line').should('have.length', 1)
+
+  return fileName
+}
+
+export function toggleTrackChanges(state: boolean) {
+  cy.findByText('Review').click()
+  cy.get('.track-changes-menu-button').then(el => {
+    // when the menu is expanded renders the `expand_more` icon,
+    // and the `chevron_right` icon when it's collapsed
+    if (!el.text().includes('expand_more')) {
+      el.click()
+    }
+  })
+
+  cy.findByText('Everyone')
+    .parent()
+    .within(() => {
+      cy.get('.form-check-input').then(el => {
+        if (el.prop('checked') === state) return
+
+        const id = uuid()
+        const alias = `@${id}`
+        cy.intercept({
+          method: 'POST',
+          url: '**/track_changes',
+          times: 1,
+        }).as(id)
+        if (state) {
+          cy.get('.form-check-input').check()
+        } else {
+          cy.get('.form-check-input').uncheck()
+        }
+        cy.wait(alias)
+      })
+    })
+  cy.contains('.toolbar-item', 'Review').click()
+}
@@ -40,7 +40,6 @@ describe('History', function () {
  const CLASS_DELETION = 'ol-cm-deletion-marker'

  it('should support labels, comparison and download', () => {
-    cy.visit('/project')
    createProject('labels')
    const recompile = throttledRecompile()

@@ -12,10 +12,10 @@
        "@types/pdf-parse": "^1.1.4",
        "@types/uuid": "^9.0.8",
        "adm-zip": "^0.5.12",
-        "body-parser": "^1.20.2",
+        "body-parser": "^1.20.3",
        "celebrate": "^15.0.3",
        "cypress": "13.13.2",
-        "express": "^4.19.2",
+        "express": "^4.21.2",
        "isomorphic-git": "^1.25.10",
        "js-yaml": "^4.1.0",
        "pdf-parse": "^1.1.1",
@@ -609,9 +609,9 @@
      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
    },
    "node_modules/body-parser": {
-      "version": "1.20.2",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",
-      "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==",
+      "version": "1.20.3",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
+      "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
      "dependencies": {
        "bytes": "3.1.2",
        "content-type": "~1.0.5",
@@ -621,7 +621,7 @@
        "http-errors": "2.0.0",
        "iconv-lite": "0.4.24",
        "on-finished": "2.4.1",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
        "raw-body": "2.5.2",
        "type-is": "~1.6.18",
        "unpipe": "1.0.0"
@@ -645,11 +645,11 @@
      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
    },
    "node_modules/body-parser/node_modules/qs": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz",
-      "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==",
+      "version": "6.13.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
+      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
      "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
      },
      "engines": {
        "node": ">=0.6"
@@ -718,6 +718,33 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.3.tgz",
+      "integrity": "sha512-YTd+6wGlNlPxSuri7Y6X8tY2dmm12UMH66RpKMhiX6rsk5wXXnYgbUcOt8kiS31/AjfoTOvCsE+w8nZQLQnzHA==",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "get-intrinsic": "^1.2.6"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/caseless": {
      "version": "0.12.0",
      "resolved": "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz",
@@ -891,9 +918,9 @@
      }
    },
    "node_modules/cookie": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.1.tgz",
+      "integrity": "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==",
      "engines": {
        "node": ">= 0.6"
      }
@@ -920,9 +947,9 @@
      }
    },
    "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
      "dependencies": {
        "path-key": "^3.1.0",
        "shebang-command": "^2.0.0",
@@ -1140,6 +1167,19 @@
      "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
      "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="
    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/ecc-jsbn": {
      "version": "0.1.2",
      "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
@@ -1160,9 +1200,9 @@
      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
    },
    "node_modules/encodeurl": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
-      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
      "engines": {
        "node": ">= 0.8"
      }
@@ -1187,6 +1227,22 @@
        "node": ">=8.6"
      }
    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/es-get-iterator": {
      "version": "1.1.3",
      "resolved": "https://registry.npmjs.org/es-get-iterator/-/es-get-iterator-1.1.3.tgz",
@@ -1206,6 +1262,17 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/escape-html": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -1266,36 +1333,36 @@
      }
    },
    "node_modules/express": {
-      "version": "4.19.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.19.2.tgz",
-      "integrity": "sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==",
+      "version": "4.21.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
+      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
      "dependencies": {
        "accepts": "~1.3.8",
        "array-flatten": "1.1.1",
-        "body-parser": "1.20.2",
+        "body-parser": "1.20.3",
        "content-disposition": "0.5.4",
        "content-type": "~1.0.4",
-        "cookie": "0.6.0",
+        "cookie": "0.7.1",
        "cookie-signature": "1.0.6",
        "debug": "2.6.9",
        "depd": "2.0.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
        "escape-html": "~1.0.3",
        "etag": "~1.8.1",
-        "finalhandler": "1.2.0",
+        "finalhandler": "1.3.1",
        "fresh": "0.5.2",
        "http-errors": "2.0.0",
-        "merge-descriptors": "1.0.1",
+        "merge-descriptors": "1.0.3",
        "methods": "~1.1.2",
        "on-finished": "2.4.1",
        "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.7",
+        "path-to-regexp": "0.1.12",
        "proxy-addr": "~2.0.7",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
        "range-parser": "~1.2.1",
        "safe-buffer": "5.2.1",
-        "send": "0.18.0",
-        "serve-static": "1.15.0",
+        "send": "0.19.0",
+        "serve-static": "1.16.2",
        "setprototypeof": "1.2.0",
        "statuses": "2.0.1",
        "type-is": "~1.6.18",
@@ -1304,6 +1371,10 @@
      },
      "engines": {
        "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/express/node_modules/debug": {
@@ -1320,11 +1391,11 @@
      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
    },
    "node_modules/express/node_modules/qs": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz",
-      "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==",
+      "version": "6.13.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
+      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
      "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
      },
      "engines": {
        "node": ">=0.6"
@@ -1393,12 +1464,12 @@
      }
    },
    "node_modules/finalhandler": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.2.0.tgz",
-      "integrity": "sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.1.tgz",
+      "integrity": "sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==",
      "dependencies": {
        "debug": "2.6.9",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
        "escape-html": "~1.0.3",
        "on-finished": "2.4.1",
        "parseurl": "~1.3.3",
@@ -1498,19 +1569,40 @@
      }
    },
    "node_modules/get-intrinsic": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.2.tgz",
-      "integrity": "sha512-0gSo4ml/0j98Y3lngkFEot/zhiCeWsbYIlZ+uZOVgzLyLaUw7wxUL+nCTP0XJvJg1AXulJRI3UJi8GsbDuxdGA==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
        "function-bind": "^1.1.2",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "hasown": "^2.0.0"
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
      },
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/get-stream": {
      "version": "5.2.0",
      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz",
@@ -1556,11 +1648,11 @@
      }
    },
    "node_modules/gopd": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
-      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
-      "dependencies": {
-        "get-intrinsic": "^1.1.3"
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "engines": {
+        "node": ">= 0.4"
      },
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
@@ -1598,21 +1690,10 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
-    "node_modules/has-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz",
-      "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
    "node_modules/has-symbols": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
-      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
      "engines": {
        "node": ">= 0.4"
      },
@@ -1635,9 +1716,9 @@
      }
    },
    "node_modules/hasown": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz",
-      "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
      "dependencies": {
        "function-bind": "^1.1.2"
      },
@@ -2284,6 +2365,14 @@
        "lz-string": "bin/bin.js"
      }
    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/media-typer": {
      "version": "0.3.0",
      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -2293,9 +2382,12 @@
      }
    },
    "node_modules/merge-descriptors": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
-      "integrity": "sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w=="
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
    },
    "node_modules/merge-stream": {
      "version": "2.0.0",
@@ -2405,9 +2497,12 @@
      }
    },
    "node_modules/object-inspect": {
-      "version": "1.13.1",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz",
-      "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==",
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "engines": {
+        "node": ">= 0.4"
+      },
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
@@ -2526,9 +2621,9 @@
      }
    },
    "node_modules/path-to-regexp": {
-      "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
-      "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
+      "version": "0.1.12",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
+      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ=="
    },
    "node_modules/pdf-parse": {
      "version": "1.1.1",
@@ -2807,9 +2902,9 @@
      }
    },
    "node_modules/send": {
-      "version": "0.18.0",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz",
-      "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.0.tgz",
+      "integrity": "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==",
      "dependencies": {
        "debug": "2.6.9",
        "depd": "2.0.0",
@@ -2842,20 +2937,28 @@
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
    },
+    "node_modules/send/node_modules/encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
    "node_modules/send/node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
    },
    "node_modules/serve-static": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz",
-      "integrity": "sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.2.tgz",
+      "integrity": "sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==",
      "dependencies": {
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
        "escape-html": "~1.0.3",
        "parseurl": "~1.3.3",
-        "send": "0.18.0"
+        "send": "0.19.0"
      },
      "engines": {
        "node": ">= 0.8.0"
@@ -2925,13 +3028,68 @@
      }
    },
    "node_modules/side-channel": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
-      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
      "dependencies": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
      },
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .18.0
 .18.2
				`@@ -1 +0,0 @@`
				`rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })`