Merge pull request #24634 from overleaf/ii-flexible-group-licensing-replace-add-with-purchase

[web] Replace "add" with "buy" in FL

GitOrigin-RevId: 2c9aa50f138306a46ebfd8557d907c6c55d694bc

README.md

@@ -73,4 +73,4 @@ Please see the [CONTRIBUTING](CONTRIBUTING.md) file for information on contribut
 
 The code in this repository is released under the GNU AFFERO GENERAL PUBLIC LICENSE, version 3. A copy can be found in the [`LICENSE`](LICENSE) file.
 
-Copyright (c) Overleaf, 2014-2024.
+Copyright (c) Overleaf, 2014-2025.

develop/README.md

@@ -11,12 +11,6 @@ bin/build
 > [!NOTE]
 > If Docker is running out of RAM while building the services in parallel, create a `.env` file in this directory containing `COMPOSE_PARALLEL_LIMIT=1`.
 
-Next, initialize the database:
-
-```shell
-bin/init
-```
-
 Then start the services:
 
 ```shell

develop/bin/init

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-docker compose up --detach mongo
-curl --max-time 10 --retry 5 --retry-delay 5 --retry-all-errors --silent --output /dev/null localhost:27017
-docker compose exec mongo mongosh --eval "rs.initiate({ _id: 'overleaf', members: [{ _id: 0, host: 'mongo:27017' }] })"
-docker compose down mongo

develop/docker-compose.yml

@@ -88,12 +88,20 @@ services:
         - history-v1-buckets:/buckets
 
   mongo:
-    image: mongo:5
+    image: mongo:6.0
     command: --replSet overleaf
     ports:
       - "127.0.0.1:27017:27017" # for debugging
     volumes:
       - mongo-data:/data/db
+      - ../bin/shared/mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
+    environment:
+      MONGO_INITDB_DATABASE: sharelatex
+    extra_hosts:
+      # Required when using the automatic database setup for initializing the
+      # replica set. This override is not needed when running the setup after
+      # starting up mongo.
+      - mongo:127.0.0.1
 
   notifications:
     build:

docker-compose.yml

@@ -40,10 +40,6 @@ services:
             # Disables email confirmation requirement
             EMAIL_CONFIRMATION_DISABLED: 'true'
 
-            # temporary fix for LuaLaTex compiles
-            # see https://github.com/overleaf/overleaf/issues/695
-            TEXMFVAR: /var/lib/overleaf/tmp/texmf-var
-
             ## Set for SSL via nginx-proxy
             #VIRTUAL_HOST: 103.112.212.22
 
@@ -102,12 +98,12 @@ services:
 
     mongo:
         restart: always
-        image: mongo:5.0
+        image: mongo:6.0
         container_name: mongo
         command: '--replSet overleaf'
         volumes:
             - ~/mongo_data:/data/db
-            - ./mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
+            - ./bin/shared/mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
         environment:
           MONGO_INITDB_DATABASE: sharelatex
         extra_hosts:
@@ -115,7 +111,7 @@ services:
           # This override is not needed when running the setup after starting up mongo.
           - mongo:127.0.0.1
         healthcheck:
-            test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
+            test: echo 'db.stats().ok' | mongosh localhost:27017/test --quiet
             interval: 10s
             timeout: 10s
             retries: 5

libraries/access-token-encryptor/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/access-token-encryptor/buildscript.txt

@@ -5,6 +5,6 @@ access-token-encryptor
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/access-token-encryptor/package.json

@@ -21,7 +21,7 @@
   "devDependencies": {
     "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "sandboxed-module": "^2.0.4",
     "typescript": "^5.0.4"
   }

libraries/fetch-utils/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/fetch-utils/buildscript.txt

@@ -5,6 +5,6 @@ fetch-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/fetch-utils/index.js

@@ -95,6 +95,19 @@ async function fetchNothing(url, opts = {}) {
  * @throws {RequestFailedError} if the response has a non redirect status code or missing Location header
  */
 async function fetchRedirect(url, opts = {}) {
+  const { location } = await fetchRedirectWithResponse(url, opts)
+  return location
+}
+
+/**
+ * Make a request and extract the redirect from the response.
+ *
+ * @param {string | URL} url - request URL
+ * @param {object} opts - fetch options
+ * @return {Promise<{location: string, response: Response}>}
+ * @throws {RequestFailedError} if the response has a non redirect status code or missing Location header
+ */
+async function fetchRedirectWithResponse(url, opts = {}) {
   const { fetchOpts } = parseOpts(opts)
   fetchOpts.redirect = 'manual'
   const response = await performRequest(url, fetchOpts)
@@ -112,7 +125,7 @@ async function fetchRedirect(url, opts = {}) {
     )
   }
   await discardResponseBody(response)
-  return location
+  return { location, response }
 }
 
 /**
@@ -297,6 +310,7 @@ module.exports = {
   fetchStreamWithResponse,
   fetchNothing,
   fetchRedirect,
+  fetchRedirectWithResponse,
   fetchString,
   fetchStringWithResponse,
   RequestFailedError,

libraries/fetch-utils/package.json

@@ -20,8 +20,8 @@
     "body-parser": "^1.20.3",
     "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
-    "express": "^4.21.0",
-    "mocha": "^10.2.0",
+    "express": "^4.21.2",
+    "mocha": "^11.1.0",
     "typescript": "^5.0.4"
   },
   "dependencies": {

libraries/logger/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/logger/buildscript.txt

@@ -5,6 +5,6 @@ logger
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/logger/logging-manager.js

@@ -14,8 +14,10 @@ const LoggingManager = {
   initialize(name) {
     this.isProduction =
       (process.env.NODE_ENV || '').toLowerCase() === 'production'
+    const isTest = (process.env.NODE_ENV || '').toLowerCase() === 'test'
     this.defaultLevel =
-      process.env.LOG_LEVEL || (this.isProduction ? 'info' : 'debug')
+      process.env.LOG_LEVEL ||
+      (this.isProduction ? 'info' : isTest ? 'fatal' : 'debug')
     this.loggerName = name
     this.logger = bunyan.createLogger({
       name,

libraries/logger/package.json

@@ -27,7 +27,7 @@
   },
   "devDependencies": {
     "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "sandboxed-module": "^2.0.4",
     "sinon": "^9.2.4",
     "sinon-chai": "^3.7.0",

libraries/metrics/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/metrics/buildscript.txt

@@ -5,6 +5,6 @@ metrics
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/metrics/package.json

@@ -23,7 +23,7 @@
   "devDependencies": {
     "bunyan": "^1.0.0",
     "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "sandboxed-module": "^2.0.4",
     "sinon": "^9.2.4",
     "typescript": "^5.0.4"

libraries/mongo-utils/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/mongo-utils/buildscript.txt

@@ -5,6 +5,6 @@ mongo-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/mongo-utils/package.json

@@ -16,12 +16,12 @@
   "author": "Overleaf (https://www.overleaf.com)",
   "license": "AGPL-3.0-only",
   "dependencies": {
-    "mongodb": "6.10.0",
+    "mongodb": "6.12.0",
     "mongodb-legacy": "6.1.3"
   },
   "devDependencies": {
     "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "sandboxed-module": "^2.0.4",
     "sinon": "^9.2.4",
     "sinon-chai": "^3.7.0",

libraries/o-error/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/o-error/buildscript.txt

@@ -5,6 +5,6 @@ o-error
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/o-error/package.json

@@ -34,7 +34,7 @@
     "@types/chai": "^4.3.0",
     "@types/node": "^18.17.4",
     "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "typescript": "^5.0.4"
   }
 }

libraries/object-persistor/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/object-persistor/buildscript.txt

@@ -5,6 +5,6 @@ object-persistor
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/object-persistor/package.json

@@ -34,9 +34,9 @@
   "devDependencies": {
     "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "mock-fs": "^5.2.0",
-    "mongodb": "6.10.0",
+    "mongodb": "6.12.0",
     "sandboxed-module": "^2.0.4",
     "sinon": "^9.2.4",
     "sinon-chai": "^3.7.0",

libraries/object-persistor/src/PerProjectEncryptedS3Persistor.js

@@ -343,9 +343,10 @@ class PerProjectEncryptedS3Persistor extends S3Persistor {
   }
 
   async deleteDirectory(bucketName, path, continuationToken) {
+    // Let [Settings.pathToProjectFolder] validate the project path before deleting things.
+    const { projectFolder, dekPath } = this.#buildProjectPaths(bucketName, path)
     // Note: Listing/Deleting a prefix does not require SSE-C credentials.
     await super.deleteDirectory(bucketName, path, continuationToken)
-    const { projectFolder, dekPath } = this.#buildProjectPaths(bucketName, path)
     if (projectFolder === path) {
       await super.deleteObject(
         this.#settings.dataEncryptionKeyBucketName,
@@ -413,6 +414,16 @@ class CachedPerProjectEncryptedS3Persistor {
     return await this.sendStream(bucketName, path, fs.createReadStream(fsPath))
   }
 
+  /**
+   *
+   * @param {string} bucketName
+   * @param {string} path
+   * @return {Promise<number>}
+   */
+  async getObjectSize(bucketName, path) {
+    return await this.#parent.getObjectSize(bucketName, path)
+  }
+
   /**
    * @param {string} bucketName
    * @param {string} path

libraries/overleaf-editor-core/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/overleaf-editor-core/buildscript.txt

@@ -5,6 +5,6 @@ overleaf-editor-core
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/overleaf-editor-core/lib/change.js

@@ -100,6 +100,9 @@ class Change {
     )
   }
 
+  /**
+   * @return {Operation[]}
+   */
   getOperations() {
     return this.operations
   }
@@ -248,6 +251,24 @@ class Change {
    * @param {boolean} [opts.strict] - Do not ignore recoverable errors
    */
   applyTo(snapshot, opts = {}) {
+    // eslint-disable-next-line no-unused-vars
+    for (const operation of this.iterativelyApplyTo(snapshot, opts)) {
+      // Nothing to do: we're just consuming the iterator for the side effects
+    }
+  }
+
+  /**
+   * Generator that applies this change to a snapshot and yields each
+   * operation after it has been applied.
+   *
+   * Recoverable errors (caused by historical bad data) are ignored unless
+   * opts.strict is true
+   *
+   * @param {Snapshot} snapshot modified in place
+   * @param {object} opts
+   * @param {boolean} [opts.strict] - Do not ignore recoverable errors
+   */
+  *iterativelyApplyTo(snapshot, opts = {}) {
     assert.object(snapshot, 'bad snapshot')
 
     for (const operation of this.operations) {
@@ -261,6 +282,7 @@ class Change {
           throw err
         }
       }
+      yield operation
     }
 
     // update project version if present in change

libraries/overleaf-editor-core/lib/file_map.js

@@ -22,7 +22,7 @@ class NonUniquePathnameError extends PathnameError {
    * @param {string[]} pathnames
    */
   constructor(pathnames) {
-    super('pathnames are not unique: ' + pathnames, { pathnames })
+    super('pathnames are not unique', { pathnames })
     this.pathnames = pathnames
   }
 }
@@ -30,9 +30,13 @@ class NonUniquePathnameError extends PathnameError {
 class BadPathnameError extends PathnameError {
   /**
    * @param {string} pathname
+   * @param {string} reason
    */
-  constructor(pathname) {
-    super(pathname + ' is not a valid pathname', { pathname })
+  constructor(pathname, reason) {
+    if (pathname.length > 10) {
+      pathname = pathname.slice(0, 5) + '...' + pathname.slice(-5)
+    }
+    super('invalid pathname', { reason, pathname })
     this.pathname = pathname
   }
 }
@@ -42,7 +46,7 @@ class PathnameConflictError extends PathnameError {
    * @param {string} pathname
    */
   constructor(pathname) {
-    super(`pathname '${pathname}' conflicts with another file`, { pathname })
+    super('pathname conflicts with another file', { pathname })
     this.pathname = pathname
   }
 }
@@ -52,7 +56,7 @@ class FileNotFoundError extends PathnameError {
    * @param {string} pathname
    */
   constructor(pathname) {
-    super(`file ${pathname} does not exist`, { pathname })
+    super('file does not exist', { pathname })
     this.pathname = pathname
   }
 }
@@ -315,8 +319,9 @@ function checkPathnamesAreUnique(files) {
  */
 function checkPathname(pathname) {
   assert.nonEmptyString(pathname, 'bad pathname')
-  if (safePathname.isClean(pathname)) return
-  throw new FileMap.BadPathnameError(pathname)
+  const [isClean, reason] = safePathname.isCleanDebug(pathname)
+  if (isClean) return
+  throw new FileMap.BadPathnameError(pathname, reason)
 }
 
 /**

libraries/overleaf-editor-core/lib/operation/text_operation.js

@@ -56,18 +56,34 @@ class TextOperation extends EditOperation {
 
   constructor() {
     super()
-    // When an operation is applied to an input string, you can think of this as
-    // if an imaginary cursor runs over the entire string and skips over some
-    // parts, removes some parts and inserts characters at some positions. These
-    // actions (skip/remove/insert) are stored as an array in the "ops" property.
-    /** @type {ScanOp[]} */
+
+    /**
+     * When an operation is applied to an input string, you can think of this as
+     * if an imaginary cursor runs over the entire string and skips over some
+     * parts, removes some parts and inserts characters at some positions. These
+     * actions (skip/remove/insert) are stored as an array in the "ops" property.
+     * @type {ScanOp[]}
+     */
     this.ops = []
-    // An operation's baseLength is the length of every string the operation
-    // can be applied to.
+
+    /**
+     * An operation's baseLength is the length of every string the operation
+     * can be applied to.
+     */
     this.baseLength = 0
-    // The targetLength is the length of every string that results from applying
-    // the operation on a valid input string.
+
+    /**
+     * The targetLength is the length of every string that results from applying
+     * the operation on a valid input string.
+     */
     this.targetLength = 0
+
+    /**
+     * The expected content hash after this operation is applied
+     *
+     * @type {string | null}
+     */
+    this.contentHash = null
   }
 
   /**
@@ -223,7 +239,12 @@ class TextOperation extends EditOperation {
    * @returns {RawTextOperation}
    */
   toJSON() {
-    return { textOperation: this.ops.map(op => op.toJSON()) }
+    /** @type {RawTextOperation} */
+    const json = { textOperation: this.ops.map(op => op.toJSON()) }
+    if (this.contentHash != null) {
+      json.contentHash = this.contentHash
+    }
+    return json
   }
 
   /**
@@ -231,7 +252,7 @@ class TextOperation extends EditOperation {
    * @param {RawTextOperation} obj
    * @returns {TextOperation}
    */
-  static fromJSON = function ({ textOperation: ops }) {
+  static fromJSON = function ({ textOperation: ops, contentHash }) {
     const o = new TextOperation()
     for (const op of ops) {
       if (isRetain(op)) {
@@ -250,6 +271,9 @@ class TextOperation extends EditOperation {
         throw new UnprocessableError('unknown operation: ' + JSON.stringify(op))
       }
     }
+    if (contentHash != null) {
+      o.contentHash = contentHash
+    }
     return o
   }
 

libraries/overleaf-editor-core/lib/safe_pathname.js

@@ -64,17 +64,57 @@ function cleanPart(filename) {
  * @return {String}
  */
 exports.clean = function (pathname) {
+  return exports.cleanDebug(pathname)[0]
+}
+
+/**
+ * See clean
+ * @param {string} pathname
+ * @return {[string,string]}
+ */
+exports.cleanDebug = function (pathname) {
+  let prev = pathname
+  let reason = ''
+
+  /**
+   * @param {string} label
+   */
+  function recordReasonIfChanged(label) {
+    if (pathname === prev) return
+    if (reason) reason += ','
+    reason += label
+    prev = pathname
+  }
   pathname = path.normalize(pathname)
-  pathname = pathname.replace(/\\/g, '/') // workaround for IE
-  pathname = pathname.replace(/\/+/g, '/') // no multiple slashes
-  pathname = pathname.replace(/^(\/.*)$/, '_$1') // no leading /
-  pathname = pathname.replace(/^(.+)\/$/, '$1') // no trailing /
-  pathname = pathname.replace(/^ *(.*)$/, '$1') // no leading spaces
-  pathname = pathname.replace(/^(.*[^ ]) *$/, '$1') // no trailing spaces
+  recordReasonIfChanged('normalize')
+
+  pathname = pathname.replace(/\\/g, '/')
+  recordReasonIfChanged('workaround for IE')
+
+  pathname = pathname.replace(/\/+/g, '/')
+  recordReasonIfChanged('no multiple slashes')
+
+  pathname = pathname.replace(/^(\/.*)$/, '_$1')
+  recordReasonIfChanged('no leading /')
+
+  pathname = pathname.replace(/^(.+)\/$/, '$1')
+  recordReasonIfChanged('no trailing /')
+
+  pathname = pathname.replace(/^ *(.*)$/, '$1')
+  recordReasonIfChanged('no leading spaces')
+
+  pathname = pathname.replace(/^(.*[^ ]) *$/, '$1')
+  recordReasonIfChanged('no trailing spaces')
+
   if (pathname.length === 0) pathname = '_'
+  recordReasonIfChanged('empty')
+
   pathname = pathname.split('/').map(cleanPart).join('/')
+  recordReasonIfChanged('cleanPart')
+
   pathname = pathname.replace(BLOCKED_FILE_RX, '@$1')
-  return pathname
+  recordReasonIfChanged('BLOCKED_FILE_RX')
+  return [pathname, reason]
 }
 
 /**
@@ -84,9 +124,19 @@ exports.clean = function (pathname) {
  * @return {Boolean}
  */
 exports.isClean = function pathnameIsClean(pathname) {
-  return (
-    exports.clean(pathname) === pathname &&
-    pathname.length <= MAX_PATH &&
-    pathname.length > 0
-  )
+  return exports.isCleanDebug(pathname)[0]
+}
+
+/**
+ * A pathname is clean (see clean) and not too long.
+ *
+ * @param {string} pathname
+ * @return {[boolean,string]}
+ */
+exports.isCleanDebug = function (pathname) {
+  if (pathname.length > MAX_PATH) return [false, 'MAX_PATH']
+  if (pathname.length === 0) return [false, 'empty']
+  const [cleanPathname, reason] = exports.cleanDebug(pathname)
+  if (cleanPathname !== pathname) return [false, reason]
+  return [true, '']
 }

libraries/overleaf-editor-core/lib/snapshot.js

@@ -224,7 +224,7 @@ class Snapshot {
    *
    * @param {string} kind see {File#load}
    * @param {ReadonlyBlobStore} blobStore
-   * @return {Promise<Object>} an object where keys are the pathnames and
+   * @return {Promise<Record<string, File>>} an object where keys are the pathnames and
    * values are the files in the snapshot
    */
   async loadFiles(kind, blobStore) {

libraries/overleaf-editor-core/lib/types.ts

@@ -132,6 +132,7 @@ export type RawScanOp = RawInsertOp | RawRemoveOp | RawRetainOp
 
 export type RawTextOperation = {
   textOperation: RawScanOp[]
+  contentHash?: string
 }
 
 export type RawAddCommentOperation = {

libraries/overleaf-editor-core/package.json

@@ -20,7 +20,7 @@
     "@types/check-types": "^7.3.7",
     "@types/path-browserify": "^1.0.2",
     "chai": "^3.3.0",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "sinon": "^9.2.4",
     "typescript": "^5.0.4"
   },

libraries/overleaf-editor-core/test/safe_pathname.test.js

@@ -5,10 +5,11 @@ const ot = require('..')
 const safePathname = ot.safePathname
 
 describe('safePathname', function () {
-  function expectClean(input, output) {
+  function expectClean(input, output, reason = '') {
     // check expected output and also idempotency
-    const cleanedInput = safePathname.clean(input)
+    const [cleanedInput, gotReason] = safePathname.cleanDebug(input)
     expect(cleanedInput).to.equal(output)
+    expect(gotReason).to.equal(reason)
     expect(safePathname.clean(cleanedInput)).to.equal(cleanedInput)
     expect(safePathname.isClean(cleanedInput)).to.be.true
   }
@@ -22,44 +23,56 @@ describe('safePathname', function () {
     expect(safePathname.isClean('rm -rf /')).to.be.falsy
 
     // replace invalid characters with underscores
-    expectClean('test-s*\u0001\u0002m\u0007st\u0008.jpg', 'test-s___m_st_.jpg')
+    expectClean(
+      'test-s*\u0001\u0002m\u0007st\u0008.jpg',
+      'test-s___m_st_.jpg',
+      'cleanPart'
+    )
 
     // keep slashes, normalize paths, replace ..
-    expectClean('./foo', 'foo')
-    expectClean('../foo', '__/foo')
-    expectClean('foo/./bar', 'foo/bar')
-    expectClean('foo/../bar', 'bar')
-    expectClean('../../tricky/foo.bar', '__/__/tricky/foo.bar')
-    expectClean('foo/../../tricky/foo.bar', '__/tricky/foo.bar')
-    expectClean('foo/bar/../../tricky/foo.bar', 'tricky/foo.bar')
-    expectClean('foo/bar/baz/../../tricky/foo.bar', 'foo/tricky/foo.bar')
+    expectClean('./foo', 'foo', 'normalize')
+    expectClean('../foo', '__/foo', 'cleanPart')
+    expectClean('foo/./bar', 'foo/bar', 'normalize')
+    expectClean('foo/../bar', 'bar', 'normalize')
+    expectClean('../../tricky/foo.bar', '__/__/tricky/foo.bar', 'cleanPart')
+    expectClean(
+      'foo/../../tricky/foo.bar',
+      '__/tricky/foo.bar',
+      'normalize,cleanPart'
+    )
+    expectClean('foo/bar/../../tricky/foo.bar', 'tricky/foo.bar', 'normalize')
+    expectClean(
+      'foo/bar/baz/../../tricky/foo.bar',
+      'foo/tricky/foo.bar',
+      'normalize'
+    )
 
     // remove illegal chars even when there is no extension
-    expectClean('**foo', '__foo')
+    expectClean('**foo', '__foo', 'cleanPart')
 
     // remove windows file paths
-    expectClean('c:\\temp\\foo.txt', 'c:/temp/foo.txt')
+    expectClean('c:\\temp\\foo.txt', 'c:/temp/foo.txt', 'workaround for IE')
 
     // do not allow a leading slash (relative paths only)
-    expectClean('/foo', '_/foo')
-    expectClean('//foo', '_/foo')
+    expectClean('/foo', '_/foo', 'no leading /')
+    expectClean('//foo', '_/foo', 'normalize,no leading /')
 
     // do not allow multiple leading slashes
-    expectClean('//foo', '_/foo')
+    expectClean('//foo', '_/foo', 'normalize,no leading /')
 
     // do not allow a trailing slash
-    expectClean('/', '_')
-    expectClean('foo/', 'foo')
-    expectClean('foo.tex/', 'foo.tex')
+    expectClean('/', '_', 'no leading /,no trailing /')
+    expectClean('foo/', 'foo', 'no trailing /')
+    expectClean('foo.tex/', 'foo.tex', 'no trailing /')
 
     // do not allow multiple trailing slashes
-    expectClean('//', '_')
-    expectClean('///', '_')
-    expectClean('foo//', 'foo')
+    expectClean('//', '_', 'normalize,no leading /,no trailing /')
+    expectClean('///', '_', 'normalize,no leading /,no trailing /')
+    expectClean('foo//', 'foo', 'normalize,no trailing /')
 
     // file and folder names that consist of . and .. are not OK
-    expectClean('.', '_')
-    expectClean('..', '__')
+    expectClean('.', '_', 'cleanPart')
+    expectClean('..', '__', 'cleanPart')
     // we will allow name with more dots e.g. ... and ....
     expectClean('...', '...')
     expectClean('....', '....')
@@ -82,10 +95,10 @@ describe('safePathname', function () {
     expectClean('a b.png', 'a b.png')
 
     // leading and trailing spaces are not OK
-    expectClean(' foo', 'foo')
-    expectClean('  foo', 'foo')
-    expectClean('foo ', 'foo')
-    expectClean('foo  ', 'foo')
+    expectClean(' foo', 'foo', 'no leading spaces')
+    expectClean('  foo', 'foo', 'no leading spaces')
+    expectClean('foo ', 'foo', 'no trailing spaces')
+    expectClean('foo  ', 'foo', 'no trailing spaces')
 
     // reserved file names on Windows should not be OK, but we already have
     // some in the old system, so have to allow them for now
@@ -100,14 +113,14 @@ describe('safePathname', function () {
     // there's no particular reason to allow multiple slashes; sometimes people
     // seem to rename files to URLs (https://domain/path) in an attempt to
     // upload a file, and this results in an empty directory name
-    expectClean('foo//bar.png', 'foo/bar.png')
-    expectClean('foo///bar.png', 'foo/bar.png')
+    expectClean('foo//bar.png', 'foo/bar.png', 'normalize')
+    expectClean('foo///bar.png', 'foo/bar.png', 'normalize')
 
     // Check javascript property handling
     expectClean('foo/prototype', 'foo/prototype') // OK as part of a pathname
     expectClean('prototype/test.txt', 'prototype/test.txt')
-    expectClean('prototype', '@prototype') // not OK as whole pathname
-    expectClean('hasOwnProperty', '@hasOwnProperty')
-    expectClean('**proto**', '@__proto__')
+    expectClean('prototype', '@prototype', 'BLOCKED_FILE_RX') // not OK as whole pathname
+    expectClean('hasOwnProperty', '@hasOwnProperty', 'BLOCKED_FILE_RX')
+    expectClean('**proto**', '@__proto__', 'cleanPart,BLOCKED_FILE_RX')
   })
 })

libraries/promise-utils/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/promise-utils/buildscript.txt

@@ -5,6 +5,6 @@ promise-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/promise-utils/index.js

@@ -13,6 +13,7 @@ module.exports = {
   expressify,
   expressifyErrorHandler,
   promiseMapWithLimit,
+  promiseMapSettledWithLimit,
 }
 
 /**
@@ -264,3 +265,19 @@ async function promiseMapWithLimit(concurrency, array, fn) {
   const limit = pLimit(concurrency)
   return await Promise.all(array.map(x => limit(() => fn(x))))
 }
+
+/**
+ * Map values in `array` with the async function `fn`
+ *
+ * Limit the number of unresolved promises to `concurrency`.
+ *
+ * @template T, U
+ * @param {number} concurrency
+ * @param {Array<T>} array
+ * @param {(T) => Promise<U>} fn
+ * @return {Promise<Array<PromiseSettledResult<U>>>}
+ */
+function promiseMapSettledWithLimit(concurrency, array, fn) {
+  const limit = pLimit(concurrency)
+  return Promise.allSettled(array.map(x => limit(() => fn(x))))
+}

libraries/promise-utils/package.json

@@ -18,7 +18,7 @@
   "devDependencies": {
     "chai": "^4.3.10",
     "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "typescript": "^5.0.4"
   },
   "dependencies": {

libraries/ranges-tracker/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/ranges-tracker/buildscript.txt

@@ -5,6 +5,6 @@ ranges-tracker
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/ranges-tracker/index.cjs

@@ -145,11 +145,7 @@ class RangesTracker {
   }
 
   removeChangeId(changeId) {
-    const change = this.getChange(changeId)
-    if (change == null) {
-      return
-    }
-    this._removeChange(change)
+    this.removeChangeIds([changeId])
   }
 
   removeChangeIds(ids) {
@@ -316,7 +312,7 @@ class RangesTracker {
     const movedChanges = []
     const removeChanges = []
     const newChanges = []
-
+    const trackedDeletesAtOpPosition = []
     for (let i = 0; i < this.changes.length; i++) {
       change = this.changes[i]
       const changeStart = change.op.p
@@ -327,13 +323,15 @@ class RangesTracker {
           change.op.p += opLength
           movedChanges.push(change)
         } else if (opStart === changeStart) {
-          // If we are undoing, then we want to cancel any existing delete ranges if we can.
-          // Check if the insert matches the start of the delete, and just remove it from the delete instead if so.
           if (
+            !alreadyMerged &&
             undoing &&
             change.op.d.length >= op.i.length &&
             change.op.d.slice(0, op.i.length) === op.i
           ) {
+            // If we are undoing, then we want to reject any existing tracked delete if we can.
+            // Check if the insert matches the start of the delete, and just
+            // remove it from the delete instead if so.
             change.op.d = change.op.d.slice(op.i.length)
             change.op.p += op.i.length
             if (change.op.d === '') {
@@ -342,9 +340,25 @@ class RangesTracker {
               movedChanges.push(change)
             }
             alreadyMerged = true
+
+            // Any tracked delete that came before this tracked delete
+            // rejection was moved after the incoming insert. Move them back
+            // so that they appear before the tracked delete rejection.
+            for (const trackedDelete of trackedDeletesAtOpPosition) {
+              trackedDelete.op.p -= opLength
+            }
           } else {
+            // We're not rejecting that tracked delete. Move it after the
+            // insert.
             change.op.p += opLength
             movedChanges.push(change)
+
+            // Keep track of tracked deletes that are at the same position as the
+            // insert. If we find a tracked delete to reject, we'll want to
+            // reposition them.
+            if (!alreadyMerged) {
+              trackedDeletesAtOpPosition.push(change)
+            }
           }
         }
       } else if (change.op.i != null) {
@@ -624,9 +638,11 @@ class RangesTracker {
   }
 
   _addOp(op, metadata) {
+    // Don't take a reference to the existing op since we'll modify this in place with future changes
+    op = this._clone(op)
     const change = {
       id: this.newId(),
-      op: this._clone(op), // Don't take a reference to the existing op since we'll modify this in place with future changes
+      op,
       metadata: this._clone(metadata),
     }
     this.changes.push(change)
@@ -649,7 +665,7 @@ class RangesTracker {
   }
 
   _removeChange(change) {
-    this.changes = this.changes.filter(c => c.id !== change.id)
+    this.changes = this.changes.filter(c => c !== change)
     this._markAsDirty(change, 'change', 'removed')
   }
 

libraries/ranges-tracker/package.json

@@ -20,7 +20,7 @@
   },
   "devDependencies": {
     "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "typescript": "^5.0.4"
   }
 }

libraries/ranges-tracker/test/unit/ranges-tracker-test.js

@@ -4,6 +4,7 @@ const RangesTracker = require('../..')
 describe('RangesTracker', function () {
   describe('with duplicate change ids', function () {
     beforeEach(function () {
+      this.comments = []
       this.changes = [
         { id: 'id1', op: { p: 1, i: 'hello' } },
         { id: 'id2', op: { p: 10, i: 'world' } },
@@ -26,4 +27,199 @@ describe('RangesTracker', function () {
       expect(this.rangesTracker.changes).to.deep.equal([this.changes[2]])
     })
   })
+
+  describe('with duplicate tracked insert ids', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 10, i: 'one' } },
+        { id: 'id1', op: { p: 20, i: 'two' } },
+        { id: 'id1', op: { p: 30, d: 'three' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it("deleting one tracked insert doesn't delete the others", function () {
+      this.rangesTracker.applyOp({ p: 20, d: 'two' })
+      expect(this.rangesTracker.changes).to.deep.equal([
+        this.changes[0],
+        this.changes[2],
+      ])
+    })
+  })
+
+  describe('with duplicate tracked delete ids', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 10, d: 'one' } },
+        { id: 'id1', op: { p: 20, d: 'two' } },
+        { id: 'id1', op: { p: 30, d: 'three' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('deleting over tracked deletes in tracked changes mode removes the tracked deletes covered', function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 15,
+        d: '567890123456789012345',
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([
+        { p: 10, d: 'one' },
+        { p: 15, d: '56789two0123456789three012345' },
+      ])
+    })
+
+    it('a tracked delete between two tracked deletes joins them into a single tracked delete', function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 20,
+        d: '0123456789',
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([
+        { p: 10, d: 'one' },
+        { p: 20, d: 'two0123456789three' },
+      ])
+    })
+
+    it("rejecting one tracked delete doesn't reject the others", function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 20,
+        i: 'two',
+        u: true,
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([
+        { p: 10, d: 'one' },
+        { p: 33, d: 'three' },
+      ])
+    })
+
+    it("rejecting all tracked deletes doesn't introduce tracked inserts", function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp({
+        p: 10,
+        i: 'one',
+        u: true,
+      })
+      this.rangesTracker.applyOp({
+        p: 23,
+        i: 'two',
+        u: true,
+      })
+      this.rangesTracker.applyOp({
+        p: 36,
+        i: 'three',
+        u: true,
+      })
+      expect(this.rangesTracker.changes.map(c => c.op)).to.deep.equal([])
+    })
+  })
+
+  describe('with multiple tracked deletes at the same position', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 33, d: 'before' } },
+        { id: 'id2', op: { p: 50, d: 'right before' } },
+        { id: 'id3', op: { p: 50, d: 'this one' } },
+        { id: 'id4', op: { p: 50, d: 'right after' } },
+        { id: 'id5', op: { p: 75, d: 'long after' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('preserves the text order when rejecting changes', function () {
+      this.rangesTracker.applyOp(
+        { p: 50, i: 'this one', u: true },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes).to.deep.equal([
+        { id: 'id1', op: { p: 33, d: 'before' } },
+        { id: 'id2', op: { p: 50, d: 'right before' } },
+        { id: 'id4', op: { p: 58, d: 'right after' } },
+        { id: 'id5', op: { p: 83, d: 'long after' } },
+      ])
+    })
+
+    it('moves all tracked deletes after the insert if not rejecting changes', function () {
+      this.rangesTracker.applyOp(
+        { p: 50, i: 'some other text', u: true, orderedRejections: true },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes).to.deep.equal([
+        { id: 'id1', op: { p: 33, d: 'before' } },
+        { id: 'id2', op: { p: 65, d: 'right before' } },
+        { id: 'id3', op: { p: 65, d: 'this one' } },
+        { id: 'id4', op: { p: 65, d: 'right after' } },
+        { id: 'id5', op: { p: 90, d: 'long after' } },
+      ])
+    })
+  })
+
+  describe('with multiple tracked deletes at the same position with the same content', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        { id: 'id1', op: { p: 10, d: 'cat' } },
+        { id: 'id2', op: { p: 10, d: 'giraffe' } },
+        { id: 'id3', op: { p: 10, d: 'cat' } },
+        { id: 'id4', op: { p: 10, d: 'giraffe' } },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('removes only the first matching tracked delete', function () {
+      this.rangesTracker.applyOp(
+        { p: 10, i: 'giraffe', u: true },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes).to.deep.equal([
+        { id: 'id1', op: { p: 10, d: 'cat' } },
+        { id: 'id3', op: { p: 17, d: 'cat' } },
+        { id: 'id4', op: { p: 17, d: 'giraffe' } },
+      ])
+    })
+  })
+
+  describe('with a tracked insert at the same position as a tracked delete', function () {
+    beforeEach(function () {
+      this.comments = []
+      this.changes = [
+        {
+          id: 'id1',
+          op: { p: 5, d: 'before' },
+          metadata: { user_id: 'user-id' },
+        },
+        {
+          id: 'id2',
+          op: { p: 10, d: 'delete' },
+          metadata: { user_id: 'user-id' },
+        },
+        {
+          id: 'id3',
+          op: { p: 10, i: 'insert' },
+          metadata: { user_id: 'user-id' },
+        },
+      ]
+      this.rangesTracker = new RangesTracker(this.changes, this.comments)
+    })
+
+    it('places a tracked insert at the same position before both the delete and the insert', function () {
+      this.rangesTracker.track_changes = true
+      this.rangesTracker.applyOp(
+        { p: 10, i: 'incoming' },
+        { user_id: 'user-id' }
+      )
+      expect(this.rangesTracker.changes.map(change => change.op)).to.deep.equal(
+        [
+          { p: 5, d: 'before' },
+          { p: 10, i: 'incoming' },
+          { p: 18, d: 'delete' },
+          { p: 18, i: 'insert' },
+        ]
+      )
+    })
+  })
 })

libraries/redis-wrapper/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/redis-wrapper/buildscript.txt

@@ -5,6 +5,6 @@ redis-wrapper
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/redis-wrapper/package.json

@@ -35,7 +35,7 @@
     "@overleaf/logger": "*",
     "@overleaf/o-error": "*",
     "chai": "^4.3.6",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "sandboxed-module": "^2.0.4",
     "sinon": "^9.2.4",
     "typescript": "^5.0.4"

libraries/settings/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/settings/buildscript.txt

@@ -5,6 +5,6 @@ settings
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/settings/package.json

@@ -15,7 +15,7 @@
     "types:check": "tsc --noEmit"
   },
   "devDependencies": {
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "typescript": "^5.0.4"
   }
 }

libraries/stream-utils/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

libraries/stream-utils/buildscript.txt

@@ -5,6 +5,6 @@ stream-utils
 --env-pass-through=
 --esmock-loader=False
 --is-library=True
---node-version=20.18.0
+--node-version=20.18.2
 --public-repo=False
 --script-version=4.5.0

libraries/stream-utils/package.json

@@ -18,7 +18,7 @@
   "devDependencies": {
     "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.1.0",
     "typescript": "^5.0.4"
   }
 }

package.json

@@ -26,6 +26,9 @@
     "typescript": "^5.5.4"
   },
   "overrides": {
+    "cross-env": {
+      "cross-spawn": "^7.0.6"
+    },
     "fetch-mock": {
       "path-to-regexp": "3.3.0"
     },
@@ -70,6 +73,7 @@
     "services/third-party-datastore",
     "services/third-party-references",
     "services/tpdsworker",
-    "services/web"
+    "services/web",
+    "tools/saas-e2e"
   ]
 }

server-ce/.dockerignore

@@ -1,6 +1,7 @@
 .DS_Store
 .git/
 services/git-bridge
+server-ce/server-ce
 server-ce/test
 
 # omit scripts with extra dependencies

server-ce/Dockerfile-base

@@ -10,7 +10,7 @@ ENV TEXMFVAR=/var/lib/overleaf/tmp/texmf-var
 
 # Update to ensure dependencies are updated
 # ------------------------------------------
-ENV REBUILT_AFTER="2024-15-10"
+ENV REBUILT_AFTER="2025-03-27"
 
 # Install dependencies
 # --------------------

server-ce/Makefile

@@ -1,6 +1,7 @@
 # Makefile
 
 MONOREPO_ROOT := ../
+HERE=$(shell pwd)
 export MONOREPO_REVISION := $(shell git rev-parse HEAD)
 export BRANCH_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
 export OVERLEAF_BASE_BRANCH ?= sharelatex/sharelatex-base:$(BRANCH_NAME)
@@ -40,5 +41,25 @@ build-community:
 	  --tag $(OVERLEAF_BRANCH) \
 	  $(MONOREPO_ROOT)
 
+SHELLCHECK_OPTS = \
+	--shell=bash \
+	--external-sources \
+	--exclude=SC1091
+SHELLCHECK_COLOR := $(if $(CI),--color=never,--color)
+SHELLCHECK_FILES := { git ls-files "*.sh" -z; git grep -Plz "\A\#\!.*bash"; } | sort -zu
 
-.PHONY: all build-base build-community
+shellcheck:
+	@$(SHELLCHECK_FILES) | xargs -0 -r docker run --rm -v $(HERE):/mnt -w /mnt \
+		koalaman/shellcheck:stable $(SHELLCHECK_OPTS) $(SHELLCHECK_COLOR)
+
+shellcheck_fix:
+	@$(SHELLCHECK_FILES) | while IFS= read -r -d '' file; do \
+		diff=$$(docker run --rm -v $(HERE):/mnt -w /mnt koalaman/shellcheck:stable $(SHELLCHECK_OPTS) --format=diff "$$file" 2>/dev/null); \
+		if [ -n "$$diff" ] && ! echo "$$diff" | patch -p1 >/dev/null 2>&1; then echo "\033[31m$$file\033[0m"; \
+		elif [ -n "$$diff" ]; then echo "$$file"; \
+		else echo "\033[2m$$file\033[0m"; fi \
+	done
+
+.PHONY: all \
+	build-base build-community \
+	shellcheck shellcheck_fix

server-ce/bin/shared

@@ -0,0 +1 @@
+../../bin/shared/

server-ce/config/custom-environment-variables.json

@@ -1,5 +1,6 @@
 {
   "databaseUrl": "HISTORY_CONNECTION_STRING",
+  "databaseUrlReadOnly": "HISTORY_FOLLOWER_CONNECTION_STRING",
   "herokuDatabaseUrl": "DATABASE_URL",
   "databasePoolMin": "DATABASE_POOL_MIN",
   "databasePoolMax": "DATABASE_POOL_MAX",

server-ce/config/settings.js

@@ -335,6 +335,10 @@ if (process.env.OVERLEAF_LOGIN_SUPPORT_TEXT != null) {
   settings.nav.login_support_text = process.env.OVERLEAF_LOGIN_SUPPORT_TEXT
 }
 
+if (process.env.OVERLEAF_LOGIN_SUPPORT_TITLE != null) {
+  settings.nav.login_support_title = process.env.OVERLEAF_LOGIN_SUPPORT_TITLE
+}
+
 // Sending Email
 // -------------
 //

server-ce/genScript.js

@@ -12,6 +12,10 @@ switch (process.argv.pop()) {
       console.log('pushd', `services/${service.name}`)
       switch (service.name) {
         case 'web':
+          // precompile pug in background
+          console.log('npm run precompile-pug &')
+          console.log('pug_precompile=$!')
+
           // Avoid downloading of cypress
           console.log('export CYPRESS_INSTALL_BINARY=0')
 
@@ -21,8 +25,9 @@ switch (process.argv.pop()) {
           console.log('npm run webpack:production')
           // uninstall webpack and frontend dependencies
           console.log('npm install --omit=dev')
-          // precompile pug
-          console.log('npm run precompile-pug')
+
+          // Wait for pug precompile to finish
+          console.log('wait "$pug_precompile"')
           break
         default:
           console.log(`echo ${service.name} does not require a compilation`)

server-ce/hotfix/4.2.9/Dockerfile

@@ -0,0 +1 @@
+FROM sharelatex/sharelatex:4.2.8

server-ce/hotfix/5.3.1/Dockerfile

@@ -0,0 +1,14 @@
+FROM sharelatex/sharelatex:5.3.0
+
+# Update copyright year
+COPY pr_22950.patch .
+RUN patch -p0 < pr_22950.patch && rm pr_22950.patch
+
+
+# Update Mongoose
+RUN npm install mongoose@^8.9.5 --save -w services/web \
+  && npm install mongodb@6.12.0 --save \
+    -w services/chat -w services/contacts -w services/docstore \
+    -w services/history-v1 -w libraries/mongo-utils \
+  && npm install mongodb@6.12.0 --save \
+  && rm -rf /root/.cache /root/.npm $(find /tmp/ -mindepth 1 -maxdepth 1)

server-ce/hotfix/5.3.1/pr_22950.patch

@@ -0,0 +1,33 @@
+--- services/web/app/views/layout/thin-footer-bootstrap-5.pug
++++ services/web/app/views/layout/thin-footer-bootstrap-5.pug
+@@ -7,7 +7,7 @@ footer.site-footer
+ 				if !settings.nav.hide_powered_by
+ 					li
+ 						//- year of Server Pro release, static
+-						| © 2024
++						| © 2025
+ 						|
+ 						a(href='https://www.overleaf.com/for/enterprises') Powered by Overleaf
+
+--- services/web/app/views/layout/thin-footer.pug
++++ services/web/app/views/layout/thin-footer.pug
+@@ -9,7 +9,7 @@ footer.site-footer
+ 				else if !settings.nav.hide_powered_by
+ 					li
+ 						//- year of Server Pro release, static
+-						| © 2024
++						| © 2025
+ 						|
+ 						a(href='https://www.overleaf.com/for/enterprises') Powered by Overleaf
+
+--- services/web/frontend/js/features/ui/components/bootstrap-5/footer/thin-footer.tsx
++++ services/web/frontend/js/features/ui/components/bootstrap-5/footer/thin-footer.tsx
+@@ -60,7 +60,7 @@ function ThinFooter({
+             {showPoweredBy ? (
+               <>
+                 <li>
+-                  {/* year of Server Pro release, static */}© 2024{' '}
++                  {/* year of Server Pro release, static */}© 2025{' '}
+                   <a href="https://www.overleaf.com/for/enterprises">
+                     Powered by Overleaf
+                   </a>

server-ce/hotfix/5.3.2/Dockerfile

@@ -0,0 +1 @@
+FROM sharelatex/sharelatex:5.3.1

server-ce/hotfix/5.3.3/Dockerfile

@@ -0,0 +1 @@
+FROM sharelatex/sharelatex:5.3.2

server-ce/init_scripts/100_set_docker_host_ipaddress.sh

@@ -2,4 +2,4 @@
 set -e -o pipefail
 
 # See the bottom of http://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach
-echo "`route -n | awk '/UG[ \t]/{print $2}'` dockerhost" >> /etc/hosts
+echo "$(route -n | awk '/UG[ \t]/{print $2}') dockerhost" >> /etc/hosts

server-ce/init_scripts/200_nginx_config_template.sh

@@ -26,6 +26,7 @@ if [ -f "${nginx_template_file}" ]; then
   # Note the single-quotes, they are important.
   # This is a pass-list of env-vars that envsubst
   # should operate on.
+  # shellcheck disable=SC2016
   envsubst '
     ${NGINX_KEEPALIVE_TIMEOUT}
     ${NGINX_WORKER_CONNECTIONS}

server-ce/mongodb-init-replica-set.js

@@ -1 +0,0 @@
-rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })

server-ce/nginx/clsi-nginx.conf

@@ -30,7 +30,7 @@ server {
       application/pdf pdf;
   }
   # handle output files for specific users
-  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
     alias /var/lib/overleaf/data/output/$1-$2/generated-files/$3/output.$4;
   }
   # handle .blg files for specific users
@@ -38,7 +38,7 @@ server {
     alias /var/lib/overleaf/data/output/$1-$2/generated-files/$3/$4.blg;
   }
   # handle output files for anonymous users
-  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
     alias /var/lib/overleaf/data/output/$1/generated-files/$2/output.$3;
   }
   # handle .blg files for anonymous users

server-ce/nginx/overleaf.conf

@@ -47,12 +47,12 @@ server {
 	}
 
   # handle output files for specific users
-  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
 		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
 		proxy_http_version 1.1;
   }
   # handle output files for anonymous users
-  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
 		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
 		proxy_http_version 1.1;
   }

server-ce/runit/clsi-overleaf/run

@@ -11,7 +11,7 @@ fi
 if [ -e '/var/run/docker.sock' ]; then
   echo ">> Setting permissions on docker socket"
   DOCKER_GROUP=$(stat -c '%g' /var/run/docker.sock)
-  groupadd --non-unique --gid ${DOCKER_GROUP} dockeronhost
+  groupadd --non-unique --gid "${DOCKER_GROUP}" dockeronhost
   usermod -aG dockeronhost www-data
 fi
 

server-ce/test/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20.18.0
+FROM node:20.18.2
 RUN curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - \
 &&  echo \
       "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \

server-ce/test/Makefile

@@ -44,7 +44,7 @@ prefetch_custom_compose_pull:
 
 prefetch_custom: prefetch_custom_texlive
 prefetch_custom_texlive:
-	echo -n "$$ALL_TEX_LIVE_DOCKER_IMAGES" | xargs -d, -I% \
+	echo "$$ALL_TEX_LIVE_DOCKER_IMAGES" | tr ',' '\n' | xargs -I% \
 	sh -exc 'tag=%; re_tag=quay.io/sharelatex/$${tag#*/*/}; docker pull $$tag; docker tag $$tag $$re_tag'
 
 prefetch_custom: prefetch_old

server-ce/test/admin.spec.ts

@@ -127,10 +127,12 @@ describe('admin panel', function () {
       testProjectName = `project-${uuid()}`
       deletedProjectName = `deleted-project-${uuid()}`
       login(user1)
-      cy.visit('/project')
-      createProject(testProjectName).then(id => (testProjectId = id))
-      cy.visit('/project')
-      createProject(deletedProjectName).then(id => (projectToDeleteId = id))
+      createProject(testProjectName, { open: false }).then(
+        id => (testProjectId = id)
+      )
+      createProject(deletedProjectName, { open: false }).then(
+        id => (projectToDeleteId = id)
+      )
     })
 
     describe('manage site', () => {

server-ce/test/create-and-compile-project.spec.ts

@@ -1,5 +1,8 @@
 import { ensureUserExists, login } from './helpers/login'
-import { createProject } from './helpers/project'
+import {
+  createProject,
+  openProjectViaInviteNotification,
+} from './helpers/project'
 import { isExcludedBySharding, startWith } from './helpers/config'
 import { throttledRecompile } from './helpers/compile'
 
@@ -11,10 +14,7 @@ describe('Project creation and compilation', function () {
 
   it('users can create project and compile it', function () {
     login('user@example.com')
-    cy.visit('/project')
-    // this is the first project created, the welcome screen is displayed instead of the project list
     createProject('test-project')
-    cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
     const recompile = throttledRecompile()
     cy.findByText('\\maketitle').parent().click()
     cy.findByText('\\maketitle').parent().type('\n\\section{{}Test Section}')
@@ -26,8 +26,8 @@ describe('Project creation and compilation', function () {
     const fileName = `test-${Date.now()}.md`
     const markdownContent = '# Markdown title'
     login('user@example.com')
-    cy.visit('/project')
     createProject('test-project')
+
     // FIXME: Add aria-label maybe? or at least data-test-id
     cy.findByText('New file').click({ force: true })
     cy.findByRole('dialog').within(() => {
@@ -50,12 +50,10 @@ describe('Project creation and compilation', function () {
     const targetProjectName = `${sourceProjectName}-target`
     login('user@example.com')
 
-    cy.visit('/project')
-    createProject(sourceProjectName, { type: 'Example Project' }).as(
-      'sourceProjectId'
-    )
-
-    cy.visit('/project')
+    createProject(sourceProjectName, {
+      type: 'Example Project',
+      open: false,
+    }).as('sourceProjectId')
     createProject(targetProjectName)
 
     // link the image from `projectName` into this project
@@ -80,13 +78,10 @@ describe('Project creation and compilation', function () {
     const sourceProjectName = `test-project-${Date.now()}`
     const targetProjectName = `${sourceProjectName}-target`
     login('user@example.com')
-
-    cy.visit('/project')
-    createProject(sourceProjectName, { type: 'Example Project' }).as(
-      'sourceProjectId'
-    )
-
-    cy.visit('/project')
+    createProject(sourceProjectName, {
+      type: 'Example Project',
+      open: false,
+    }).as('sourceProjectId')
     createProject(targetProjectName).as('targetProjectId')
 
     // link the image from `projectName` into this project
@@ -100,8 +95,11 @@ describe('Project creation and compilation', function () {
 
     cy.findByText('Share').click()
     cy.findByRole('dialog').within(() => {
-      cy.get('input').type('collaborator@example.com,')
-      cy.findByText('Share').click({ force: true })
+      cy.findByTestId('collaborator-email-input').type(
+        'collaborator@example.com,'
+      )
+      cy.findByText('Invite').click({ force: true })
+      cy.findByText('Invite not yet accepted.')
     })
 
     cy.visit('/project')
@@ -109,15 +107,7 @@ describe('Project creation and compilation', function () {
     cy.findByText('Log Out').click()
 
     login('collaborator@example.com')
-    cy.visit('/project')
-    cy.findByText(targetProjectName)
-      .parent()
-      .parent()
-      .within(() => {
-        cy.findByText('Join Project').click()
-      })
-    cy.findByText('Open Project').click()
-    cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
+    openProjectViaInviteNotification(targetProjectName)
     cy.get('@targetProjectId').then(targetProjectId => {
       cy.url().should('include', targetProjectId)
     })

server-ce/test/docker-compose.yml

@@ -35,10 +35,10 @@ services:
       MAILTRAP_PASSWORD: 'password-for-mailtrap'
 
   mongo:
-    image: mongo:5.0.17
+    image: mongo:6.0
     command: '--replSet overleaf'
     volumes:
-      - ../mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
+      - ../bin/shared/mongodb-init-replica-set.js:/docker-entrypoint-initdb.d/mongodb-init-replica-set.js
     environment:
       MONGO_INITDB_DATABASE: sharelatex
     extra_hosts:
@@ -46,7 +46,7 @@ services:
       # This override is not needed when running the setup after starting up mongo.
       - mongo:127.0.0.1
     healthcheck:
-      test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
+      test: echo 'db.stats().ok' | mongosh localhost:27017/test --quiet
       interval: 3s
       timeout: 3s
       retries: 30

server-ce/test/editor.spec.ts

@@ -1,7 +1,17 @@
-import { createProject } from './helpers/project'
+import {
+  createNewFile,
+  createProject,
+  enableLinkSharing,
+  openFile,
+  openProjectById,
+  openProjectViaLinkSharingAsUser,
+  toggleTrackChanges,
+} from './helpers/project'
 import { isExcludedBySharding, startWith } from './helpers/config'
 import { ensureUserExists, login } from './helpers/login'
 import { v4 as uuid } from 'uuid'
+import { beforeWithReRunOnTestRetry } from './helpers/beforeWithReRunOnTestRetry'
+import { prepareWaitForNextCompileSlot } from './helpers/compile'
 
 describe('editor', () => {
   if (isExcludedBySharding('PRO_DEFAULT_1')) return
@@ -9,187 +19,210 @@ describe('editor', () => {
   ensureUserExists({ email: 'user@example.com' })
   ensureUserExists({ email: 'collaborator@example.com' })
 
-  it('word dictionary and spelling', () => {
-    const fileName = 'test.tex'
-    const word = createRandomLetterString()
+  let projectName: string
+  let projectId: string
+  let recompile: () => void
+  let waitForCompileRateLimitCoolOff: (fn: () => void) => void
+  beforeWithReRunOnTestRetry(function () {
+    projectName = `project-${uuid()}`
     login('user@example.com')
-    cy.visit('/project')
-    createProject('test-project')
+    createProject(projectName, { type: 'Example Project', open: false }).then(
+      id => (projectId = id)
+    )
+    ;({ recompile, waitForCompileRateLimitCoolOff } =
+      prepareWaitForNextCompileSlot())
+  })
 
-    cy.log('create new project file')
-    cy.get('button').contains('New file').click({ force: true })
-    cy.findByRole('dialog').within(() => {
-      cy.get('input').clear()
-      cy.get('input').type(fileName)
-      cy.findByText('Create').click()
+  beforeEach(() => {
+    login('user@example.com')
+    waitForCompileRateLimitCoolOff(() => {
+      openProjectById(projectId)
     })
-    cy.findByText(fileName).click()
+  })
 
-    cy.log('edit project file')
-    // wait until we've switched to the newly created empty file
-    cy.get('.cm-line').should('have.length', 1)
-    cy.get('.cm-line').type(word)
+  describe('spelling', function () {
+    function changeSpellCheckLanguageTo(lng: string) {
+      cy.log(`change project language to '${lng}'`)
+      cy.get('button').contains('Menu').click()
+      cy.get('select[id=settings-menu-spellCheckLanguage]').select(lng)
+      cy.get('[id="left-menu"]').type('{esc}') // close left menu
+    }
 
-    cy.get('.ol-cm-spelling-error').should('exist')
-
-    cy.log('change project language')
-    cy.get('button').contains('Menu').click()
-    cy.get('select[id=settings-menu-spellCheckLanguage]').select('Spanish')
-    cy.get('[id="left-menu"]').type('{esc}') // close left menu
-
-    cy.log('add word to dictionary')
-    cy.get('.ol-cm-spelling-error').contains(word).rightclick()
-    cy.findByText('Add to Dictionary').click()
-    cy.get('.ol-cm-spelling-error').should('not.exist')
-
-    cy.log('remove word from dictionary')
-    cy.get('button').contains('Menu').click()
-    cy.get('button').contains('Edit').click()
-    cy.get('[id="dictionary-modal"').within(() => {
-      cy.findByText(word)
-        .parent()
-        .within(() => cy.get('button').click())
-
-      // the modal has 2 close buttons, this ensures the one with the visible label is
-      // clicked, otherwise it would need `force: true`
-      cy.get('.btn').contains('Close').click()
+    afterEach(function () {
+      changeSpellCheckLanguageTo('Off')
     })
 
-    cy.log('close left panel')
-    cy.get('[id="left-menu"]').type('{esc}')
+    it('word dictionary and spelling', () => {
+      changeSpellCheckLanguageTo('English (American)')
+      createNewFile()
+      const word = createRandomLetterString()
 
-    cy.log('rewrite word to force spelling error')
-    cy.get('.cm-line').type('{selectAll}{del}' + word + '{enter}')
+      cy.log('edit project file')
+      cy.get('.cm-line').type(word)
 
-    cy.get('.ol-cm-spelling-error').should('contain.text', word)
+      cy.get('.ol-cm-spelling-error').should('exist')
+
+      changeSpellCheckLanguageTo('Spanish')
+
+      cy.log('add word to dictionary')
+      cy.get('.ol-cm-spelling-error').contains(word).rightclick()
+      cy.findByText('Add to Dictionary').click()
+      cy.get('.ol-cm-spelling-error').should('not.exist')
+
+      cy.log('remove word from dictionary')
+      cy.get('button').contains('Menu').click()
+      cy.get('button').contains('Edit').click()
+      cy.get('[id="dictionary-modal"]').within(() => {
+        cy.findByText(word)
+          .parent()
+          .within(() => cy.get('button').click())
+
+        // the modal has 2 close buttons, this ensures the one with the visible label is
+        // clicked, otherwise it would need `force: true`
+        cy.get('.btn').contains('Close').click()
+      })
+
+      cy.log('close left panel')
+      cy.get('[id="left-menu"]').type('{esc}')
+
+      cy.log('rewrite word to force spelling error')
+      cy.get('.cm-line').type('{selectAll}{del}' + word + '{enter}')
+
+      cy.get('.ol-cm-spelling-error').should('contain.text', word)
+    })
   })
 
   describe('collaboration', () => {
-    let projectId: string
+    beforeWithReRunOnTestRetry(function () {
+      enableLinkSharing().then(({ linkSharingReadAndWrite }) => {
+        const email = 'collaborator@example.com'
+        login(email)
+        openProjectViaLinkSharingAsUser(
+          linkSharingReadAndWrite,
+          projectName,
+          email
+        )
+      })
 
-    beforeEach(() => {
       login('user@example.com')
-      cy.visit(`/project`)
-      createProject('test-editor', { type: 'Example Project' }).then(
-        (id: string) => {
-          projectId = id
-
-          cy.log('make project shareable')
-          cy.findByText('Share').click()
-          cy.findByText('Turn on link sharing').click()
-
-          cy.log('accept project invitation')
-          cy.findByText('Anyone with this link can edit this project')
-            .next()
-            .should('contain.text', 'http://') // wait for the link to appear
-            .then(el => {
-              const linkSharingReadAndWrite = el.text()
-              login('collaborator@example.com')
-              cy.visit(linkSharingReadAndWrite)
-              cy.get('button').contains('Join Project').click()
-              cy.log(
-                'navigate to project dashboard to avoid cross session requests from editor'
-              )
-              cy.visit('/project')
-            })
-
-          login('user@example.com')
-          cy.visit(`/project/${projectId}`)
-        }
-      )
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
     })
 
     it('track-changes', () => {
-      cy.log('enable track-changes for everyone')
-      cy.findByText('Review').click()
-      cy.get('.review-panel-toolbar-collapse-button').click() // make track-changes switches visible
+      cy.log('disable track-changes before populating doc')
+      toggleTrackChanges(false)
 
-      cy.intercept('POST', '**/track_changes').as('enableTrackChanges')
-      cy.findByText('Everyone')
-        .parent()
-        .within(() => cy.get('.input-switch').click())
-      cy.wait('@enableTrackChanges')
+      const fileName = createNewFile()
+      const oldContent = 'oldContent'
+      cy.get('.cm-line').type(`${oldContent}\n\nstatic`)
+
+      cy.log('recompile to force flush')
+      recompile()
+
+      cy.log('enable track-changes for everyone')
+      toggleTrackChanges(true)
 
       login('collaborator@example.com')
-      cy.visit(`/project/${projectId}`)
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
+      openFile(fileName, 'static')
 
       cy.log('make changes in main file')
       // cy.type() "clicks" in the center of the selected element before typing. This "click" discards the text as selected by the dblclick.
       // Go down to the lower level event based typing, the frontend tests in web use similar events.
       cy.get('.cm-editor').as('editor')
-      cy.get('@editor').findByText('\\maketitle').dblclick()
+      cy.get('@editor').findByText(oldContent).dblclick()
       cy.get('@editor').trigger('keydown', { key: 'Delete' })
       cy.get('@editor').trigger('keydown', { key: 'Enter' })
       cy.get('@editor').trigger('keydown', { key: 'Enter' })
 
       cy.log('recompile to force flush')
-      cy.findByText('Recompile').click()
+      recompile()
 
       login('user@example.com')
-      cy.visit(`/project/${projectId}`)
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
+      openFile(fileName, 'static')
 
       cy.log('reject changes')
-      cy.findByText('Review').click()
-      cy.get('.cm-content').should('not.contain.text', '\\maketitle')
-      cy.findByText('Reject').click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+      cy.get('.cm-content').should('not.contain.text', oldContent)
+      cy.findByText('Reject change').click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+
+      cy.log('recompile to force flush')
+      recompile()
 
       cy.log('verify the changes are applied')
-      cy.get('.cm-content').should('contain.text', '\\maketitle')
+      cy.get('.cm-content').should('contain.text', oldContent)
+
+      cy.log('disable track-changes for everyone again')
+      toggleTrackChanges(false)
     })
 
     it('track-changes rich text', () => {
-      cy.log('enable track-changes for everyone')
-      cy.findByText('Visual Editor').click()
-      cy.findByText('Review').click()
-      cy.get('.review-panel-toolbar-collapse-button').click() // make track-changes switches visible
+      cy.log('disable track-changes before populating doc')
+      toggleTrackChanges(false)
 
-      cy.intercept('POST', '**/track_changes').as('enableTrackChanges')
-      cy.findByText('Everyone')
-        .parent()
-        .within(() => cy.get('.input-switch').click())
-      cy.wait('@enableTrackChanges')
+      const fileName = createNewFile()
+      const oldContent = 'oldContent'
+      cy.get('.cm-line').type(`\\section{{}${oldContent}}\n\nstatic`)
+
+      cy.log('recompile to force flush')
+      recompile()
+
+      cy.log('enable track-changes for everyone')
+      toggleTrackChanges(true)
 
       login('collaborator@example.com')
-      cy.visit(`/project/${projectId}`)
-
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
       cy.log('enable visual editor and make changes in main file')
       cy.findByText('Visual Editor').click()
 
+      openFile(fileName, 'static')
+
       // cy.type() "clicks" in the center of the selected element before typing. This "click" discards the text as selected by the dblclick.
       // Go down to the lower level event based typing, the frontend tests in web use similar events.
       cy.get('.cm-editor').as('editor')
-      cy.get('@editor').contains('Introduction').dblclick()
+      cy.get('@editor').findByText(oldContent).dblclick()
       cy.get('@editor').trigger('keydown', { key: 'Delete' })
       cy.get('@editor').trigger('keydown', { key: 'Enter' })
       cy.get('@editor').trigger('keydown', { key: 'Enter' })
 
       cy.log('recompile to force flush')
-      cy.findByText('Recompile').click()
+      recompile()
 
       login('user@example.com')
-      cy.visit(`/project/${projectId}`)
+      waitForCompileRateLimitCoolOff(() => {
+        openProjectById(projectId)
+      })
+      openFile(fileName, 'static')
 
       cy.log('reject changes')
-      cy.findByText('Review').click()
-      cy.get('.cm-content').should('not.contain.text', 'Introduction')
-      cy.findAllByText('Reject').first().click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+      cy.get('.cm-content').should('not.contain.text', oldContent)
+      cy.findAllByText('Reject change').first().click({ force: true })
+      cy.contains('.toolbar-item', 'Review').click()
+
+      cy.log('recompile to force flush')
+      recompile()
 
       cy.log('verify the changes are applied in the visual editor')
       cy.findByText('Visual Editor').click()
-      cy.get('.cm-content').should('contain.text', 'Introduction')
+      cy.get('.cm-content').should('contain.text', oldContent)
+
+      cy.log('disable track-changes for everyone again')
+      toggleTrackChanges(false)
     })
   })
 
   describe('editor', () => {
-    beforeEach(() => {
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(`project-${uuid()}`, { type: 'Example Project' })
-      // wait until the main document is rendered
-      cy.findByText(/Loading/).should('not.exist')
-      cy.findByText(/Your Paper/)
-    })
-
     it('renders jpg', () => {
       cy.findByTestId('file-tree').findByText('frog.jpg').click()
       cy.get('[alt="frog.jpg"]')
@@ -199,39 +232,41 @@ describe('editor', () => {
     })
 
     it('symbol palette', () => {
+      createNewFile()
+
       cy.get('button[aria-label="Toggle Symbol Palette"]').click({
         force: true,
       })
       cy.get('button').contains('𝜉').click()
       cy.get('.cm-content').should('contain.text', '\\xi')
+
+      cy.log('recompile to force flush and avoid "unsaved changes" prompt')
+      recompile()
     })
   })
 
   describe('add new file to project', () => {
-    let projectName: string
-
     beforeEach(() => {
-      projectName = `project-${uuid()}`
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(projectName, { type: 'Example Project' })
       cy.get('button').contains('New file').click({ force: true })
     })
 
     it('can upload file', () => {
+      const name = `${uuid()}.txt`
+      const content = `Test File Content ${name}`
       cy.get('button').contains('Upload').click({ force: true })
       cy.get('input[type=file]')
         .first()
         .selectFile(
           {
-            contents: Cypress.Buffer.from('Test File Content'),
-            fileName: 'file.txt',
+            contents: Cypress.Buffer.from(content),
+            fileName: name,
             lastModified: Date.now(),
           },
           { force: true }
         )
-      cy.findByTestId('file-tree').findByText('file.txt').click({ force: true })
-      cy.findByText('Test File Content')
+      // force: The file-tree pane is too narrow to display the full name.
+      cy.findByTestId('file-tree').findByText(name).click({ force: true })
+      cy.findByText(content)
     })
 
     it('should not display import from URL', () => {
@@ -240,13 +275,7 @@ describe('editor', () => {
   })
 
   describe('left menu', () => {
-    let projectName: string
-
     beforeEach(() => {
-      projectName = `project-${uuid()}`
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(projectName, { type: 'Example Project' })
       cy.get('button').contains('Menu').click()
     })
 
@@ -292,13 +321,6 @@ describe('editor', () => {
   })
 
   describe('layout selector', () => {
-    let projectId: string
-    beforeEach(() => {
-      login('user@example.com')
-      cy.visit(`/project`)
-      createProject(`project-${uuid()}`, { type: 'Example Project' })
-    })
-
     it('show editor only and switch between editor and pdf', () => {
       cy.get('.pdf-viewer').should('be.visible')
       cy.get('.cm-editor').should('be.visible')

server-ce/test/external-auth.spec.ts

@@ -32,6 +32,9 @@ describe('SAML', () => {
       cy.get('button[type="submit"]').click()
     })
 
+    cy.log('wait for login to finish')
+    cy.url().should('contain', '/project')
+
     createProject('via SAML')
   })
 })
@@ -62,6 +65,9 @@ describe('LDAP', () => {
     cy.get('input[name="password"]').type('fry')
     cy.get('button[type="submit"]').click()
 
+    cy.log('wait for login to finish')
+    cy.url().should('contain', '/project')
+
     createProject('via LDAP')
   })
 })

server-ce/test/git-bridge.spec.ts

@@ -4,6 +4,8 @@ import { ensureUserExists, login } from './helpers/login'
 import {
   createProject,
   enableLinkSharing,
+  openProjectByName,
+  openProjectViaLinkSharingAsUser,
   shareProjectByEmailAndAcceptInviteViaDash,
 } from './helpers/project'
 
@@ -20,7 +22,12 @@ describe('git-bridge', function () {
     V1_HISTORY_URL: 'http://sharelatex:3100/api',
   }
 
-  const gitBridgePublicHost = new URL(Cypress.config().baseUrl!).host
+  function gitURL(projectId: string) {
+    const url = new URL(Cypress.config().baseUrl!)
+    url.username = 'git'
+    url.pathname = `/git/${projectId}`
+    return url
+  }
 
   describe('enabled in Server Pro', function () {
     if (isExcludedBySharding('PRO_CUSTOM_1')) return
@@ -77,16 +84,13 @@ describe('git-bridge', function () {
 
     it('should render the git-bridge UI in the editor', function () {
       maybeClearAllTokens()
-      cy.visit('/project')
       createProject('git').as('projectId')
       cy.get('header').findByText('Menu').click()
       cy.findByText('Sync')
       cy.findByText('Git').click()
-      cy.findByRole('dialog').within(() => {
+      cy.findByTestId('git-bridge-modal').within(() => {
         cy.get('@projectId').then(id => {
-          cy.get('code').contains(
-            `git clone http://git@${gitBridgePublicHost}/git/${id}`
-          )
+          cy.get('code').contains(`git clone ${gitURL(id.toString())}`)
         })
         cy.findByRole('button', {
           name: 'Generate token',
@@ -98,11 +102,9 @@ describe('git-bridge', function () {
       cy.url().then(url => cy.visit(url))
       cy.get('header').findByText('Menu').click()
       cy.findByText('Git').click()
-      cy.findByRole('dialog').within(() => {
+      cy.findByTestId('git-bridge-modal').within(() => {
         cy.get('@projectId').then(id => {
-          cy.get('code').contains(
-            `git clone http://git@${gitBridgePublicHost}/git/${id}`
-          )
+          cy.get('code').contains(`git clone ${gitURL(id.toString())}`)
         })
         cy.findByText('Generate token').should('not.exist')
         cy.findByText(/generate a new one in Account Settings/)
@@ -120,15 +122,13 @@ describe('git-bridge', function () {
 
       let projectName: string
       beforeEach(() => {
-        cy.visit('/project')
         projectName = uuid()
-        createProject(projectName).as('projectId')
+        createProject(projectName, { open: false }).as('projectId')
       })
 
       it('should expose r/w interface to owner', () => {
         maybeClearAllTokens()
-        cy.visit('/project')
-        cy.findByText(projectName).click()
+        openProjectByName(projectName)
         checkGitAccess('readAndWrite')
       })
 
@@ -136,11 +136,10 @@ describe('git-bridge', function () {
         shareProjectByEmailAndAcceptInviteViaDash(
           projectName,
           'collaborator-rw@example.com',
-          'Can edit'
+          'Editor'
         )
         maybeClearAllTokens()
-        cy.visit('/project')
-        cy.findByText(projectName).click()
+        openProjectByName(projectName)
         checkGitAccess('readAndWrite')
       })
 
@@ -148,32 +147,39 @@ describe('git-bridge', function () {
         shareProjectByEmailAndAcceptInviteViaDash(
           projectName,
           'collaborator-ro@example.com',
-          'Read only'
+          'Viewer'
         )
         maybeClearAllTokens()
-        cy.visit('/project')
-        cy.findByText(projectName).click()
+        openProjectByName(projectName)
         checkGitAccess('readOnly')
       })
 
       it('should expose r/w interface to link-sharing r/w collaborator', () => {
+        openProjectByName(projectName)
         enableLinkSharing().then(({ linkSharingReadAndWrite }) => {
-          login('collaborator-link-rw@example.com')
+          const email = 'collaborator-link-rw@example.com'
+          login(email)
           maybeClearAllTokens()
-          cy.visit(linkSharingReadAndWrite)
-          cy.findByText(projectName) // wait for lazy loading
-          cy.findByText('Join Project').click()
+          openProjectViaLinkSharingAsUser(
+            linkSharingReadAndWrite,
+            projectName,
+            email
+          )
           checkGitAccess('readAndWrite')
         })
       })
 
       it('should expose r/o interface to link-sharing r/o collaborator', () => {
+        openProjectByName(projectName)
         enableLinkSharing().then(({ linkSharingReadOnly }) => {
-          login('collaborator-link-ro@example.com')
+          const email = 'collaborator-link-ro@example.com'
+          login(email)
           maybeClearAllTokens()
-          cy.visit(linkSharingReadOnly)
-          cy.findByText(projectName) // wait for lazy loading
-          cy.findByText('Join Project').click()
+          openProjectViaLinkSharingAsUser(
+            linkSharingReadOnly,
+            projectName,
+            email
+          )
           checkGitAccess('readOnly')
         })
       })
@@ -186,10 +192,8 @@ describe('git-bridge', function () {
       cy.findByText('Sync')
       cy.findByText('Git').click()
       cy.get('@projectId').then(projectId => {
-        cy.findByRole('dialog').within(() => {
-          cy.get('code').contains(
-            `git clone http://git@${gitBridgePublicHost}/git/${projectId}`
-          )
+        cy.findByTestId('git-bridge-modal').within(() => {
+          cy.get('code').contains(`git clone ${gitURL(projectId.toString())}`)
         })
         cy.findByRole('button', {
           name: 'Generate token',
@@ -202,7 +206,7 @@ describe('git-bridge', function () {
             // close Git modal
             cy.findAllByText('Close').last().click()
             // close editor menu
-            cy.get('#left-menu-modal').click()
+            cy.get('.left-menu-modal-backdrop').click()
 
             const fs = new LightningFS('fs')
             const dir = `/${projectId}`
@@ -229,9 +233,11 @@ describe('git-bridge', function () {
               dir,
               fs,
             }
+            const url = gitURL(projectId.toString())
+            url.username = '' // basic auth is specified separately.
             const httpOptions = {
               http,
-              url: `http://sharelatex/git/${projectId}`,
+              url: url.toString(),
               headers: {
                 Authorization: `Basic ${Buffer.from(`git:${token}`).toString('base64')}`,
               },
@@ -363,7 +369,6 @@ Hello world
     })
     it('should not render the git-bridge UI in the editor', function () {
       login('user@example.com')
-      cy.visit('/project')
       createProject('maybe git')
       cy.get('header').findByText('Menu').click()
       cy.findByText('Word Count') // wait for lazy loading

server-ce/test/graceful-shutdown.spec.ts

@@ -31,8 +31,6 @@ describe('GracefulShutdown', function () {
   it('should display banner and flush changes out of redis', () => {
     bringServerProBackUp()
     login(USER)
-
-    cy.visit('/project')
     createProject(PROJECT_NAME).then(id => {
       projectId = id
     })

server-ce/test/helpers/compile.ts

@@ -4,22 +4,37 @@
  * This helper takes into account that other UI interactions take time. We can deduce that latency from the fixed delay (3s minus other latency). This can bring down the effective waiting time to 0s.
  */
 export function throttledRecompile() {
+  const { queueReset, recompile } = prepareWaitForNextCompileSlot()
+  queueReset()
+  return recompile
+}
+
+export function prepareWaitForNextCompileSlot() {
   let lastCompile = 0
   function queueReset() {
     cy.then(() => {
       lastCompile = Date.now()
     })
   }
-
-  queueReset()
-  return () =>
+  function waitForCompileRateLimitCoolOff(triggerCompile: () => void) {
     cy.then(() => {
-      cy.log('Recompile without hitting rate-limit')
+      cy.log('Wait for recompile rate-limit to cool off')
       const msSinceLastCompile = Date.now() - lastCompile
       cy.wait(Math.max(0, 1_000 - msSinceLastCompile))
-      cy.findByText('Recompile').click()
       queueReset()
-      cy.log('Wait for recompile to finish')
-      cy.findByText('Recompile')
+      triggerCompile()
+      cy.log('Wait for compile to finish')
+      cy.findByText('Recompile').should('be.visible')
     })
+  }
+  function recompile() {
+    waitForCompileRateLimitCoolOff(() => {
+      cy.findByText('Recompile').click()
+    })
+  }
+  return {
+    queueReset,
+    waitForCompileRateLimitCoolOff,
+    recompile,
+  }
 }

server-ce/test/helpers/login.ts

@@ -68,7 +68,8 @@ export function login(username: string, password = DEFAULT_PASSWORD) {
     {
       cacheAcrossSpecs: true,
       async validate() {
-        cy.request({ url: '/project', followRedirect: false }).then(
+        // Hit a cheap endpoint that is behind AuthenticationController.requireLogin().
+        cy.request({ url: '/user/personal_info', followRedirect: false }).then(
           response => {
             expect(response.status).to.equal(200)
           }

server-ce/test/helpers/project.ts

@@ -1,16 +1,40 @@
 import { login } from './login'
 import { openEmail } from './email'
+import { v4 as uuid } from 'uuid'
 
 export function createProject(
   name: string,
   {
     type = 'Blank Project',
     newProjectButtonMatcher = /new project/i,
+    open = true,
   }: {
     type?: 'Blank Project' | 'Example Project'
     newProjectButtonMatcher?: RegExp
+    open?: boolean
   } = {}
 ): Cypress.Chainable<string> {
+  cy.url().then(url => {
+    if (!url.endsWith('/project')) {
+      cy.visit('/project')
+    }
+  })
+  const interceptId = uuid()
+  let projectId = ''
+  if (!open) {
+    cy.then(() => {
+      // Register intercept just before creating the project, otherwise we might
+      // intercept a request from a prior createProject invocation.
+      cy.intercept(
+        { method: 'GET', url: /\/project\/[a-fA-F0-9]{24}$/, times: 1 },
+        req => {
+          projectId = req.url.split('/').pop()!
+          // Redirect back to the project dashboard, effectively reload the page.
+          req.redirect('/project')
+        }
+      ).as(interceptId)
+    })
+  }
   cy.findAllByRole('button').contains(newProjectButtonMatcher).click()
   // FIXME: This should only look in the left menu
   cy.findAllByText(type).first().click()
@@ -18,50 +42,99 @@ export function createProject(
     cy.get('input').type(name)
     cy.findByText('Create').click()
   })
-  return cy
-    .url()
-    .should('match', /\/project\/[a-fA-F0-9]{24}/)
-    .then(url => url.split('/').pop())
+  if (open) {
+    cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
+    waitForMainDocToLoad()
+    return cy
+      .url()
+      .should('match', /\/project\/[a-fA-F0-9]{24}/)
+      .then(url => url.split('/').pop())
+  } else {
+    const alias = `@${interceptId}` // IDEs do not like computed values in cy.wait().
+    cy.wait(alias)
+    return cy.then(() => projectId)
+  }
+}
+
+export function openProjectByName(projectName: string) {
+  cy.visit('/project')
+  cy.findByText(projectName).click()
+  waitForMainDocToLoad()
+}
+
+export function openProjectById(projectId: string) {
+  cy.visit(`/project/${projectId}`)
+  waitForMainDocToLoad()
+}
+
+export function openProjectViaLinkSharingAsAnon(url: string) {
+  cy.visit(url)
+  waitForMainDocToLoad()
+}
+
+export function openProjectViaLinkSharingAsUser(
+  url: string,
+  projectName: string,
+  email: string
+) {
+  cy.visit(url)
+  cy.findByText(projectName) // wait for lazy loading
+  cy.contains(`as ${email}`)
+  cy.findByText('OK, join project').click()
+  waitForMainDocToLoad()
+}
+
+export function openProjectViaInviteNotification(projectName: string) {
+  cy.visit('/project')
+  cy.findByText(projectName)
+    .parent()
+    .parent()
+    .within(() => {
+      cy.findByText('Join Project').click()
+    })
+  cy.findByText('Open Project').click()
+  cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
+  waitForMainDocToLoad()
 }
 
 function shareProjectByEmail(
   projectName: string,
   email: string,
-  level: 'Read only' | 'Can edit'
+  level: 'Viewer' | 'Editor'
 ) {
-  cy.visit('/project')
-  cy.findByText(projectName).click()
+  openProjectByName(projectName)
   cy.findByText('Share').click()
   cy.findByRole('dialog').within(() => {
-    cy.get('input').type(`${email},`)
-    cy.get('input')
+    cy.findByLabelText('Add people', { selector: 'input' }).type(`${email},`)
+    cy.findByLabelText('Add people', { selector: 'input' })
       .parents('form')
-      .within(() => cy.findByText('Can edit').parent().select(level))
-    cy.findByText('Share').click({ force: true })
+      .within(() => {
+        cy.findByTestId('add-collaborator-select')
+          .click()
+          .then(() => {
+            cy.findByText(level).click()
+          })
+      })
+    cy.findByText('Invite').click({ force: true })
+    cy.findByText('Invite not yet accepted.')
   })
 }
 
 export function shareProjectByEmailAndAcceptInviteViaDash(
   projectName: string,
   email: string,
-  level: 'Read only' | 'Can edit'
+  level: 'Viewer' | 'Editor'
 ) {
   shareProjectByEmail(projectName, email, level)
 
   login(email)
-  cy.visit('/project')
-  cy.findByText(new RegExp(projectName))
-    .parent()
-    .parent()
-    .within(() => {
-      cy.findByText('Join Project').click()
-    })
+  openProjectViaInviteNotification(projectName)
 }
 
 export function shareProjectByEmailAndAcceptInviteViaEmail(
   projectName: string,
   email: string,
-  level: 'Read only' | 'Can edit'
+  level: 'Viewer' | 'Editor'
 ) {
   shareProjectByEmail(projectName, email, level)
 
@@ -79,23 +152,27 @@ export function shareProjectByEmailAndAcceptInviteViaEmail(
   cy.findByText(/user would like you to join/)
   cy.contains(new RegExp(`You are accepting this invite as ${email}`))
   cy.findByText('Join Project').click()
+  waitForMainDocToLoad()
 }
 
 export function enableLinkSharing() {
   let linkSharingReadOnly: string
   let linkSharingReadAndWrite: string
+  const origin = new URL(Cypress.config().baseUrl!).origin
+
+  waitForMainDocToLoad()
 
   cy.findByText('Share').click()
   cy.findByText('Turn on link sharing').click()
   cy.findByText('Anyone with this link can view this project')
     .next()
-    .should('contain.text', 'http://sharelatex/')
+    .should('contain.text', origin + '/read')
     .then(el => {
       linkSharingReadOnly = el.text()
     })
   cy.findByText('Anyone with this link can edit this project')
     .next()
-    .should('contain.text', 'http://sharelatex/')
+    .should('contain.text', origin + '/')
     .then(el => {
       linkSharingReadAndWrite = el.text()
     })
@@ -104,3 +181,71 @@ export function enableLinkSharing() {
     return { linkSharingReadOnly, linkSharingReadAndWrite }
   })
 }
+
+export function waitForMainDocToLoad() {
+  cy.log('Wait for main doc to load; it will steal the focus after loading')
+  cy.get('.cm-content').should('contain.text', 'Introduction')
+}
+
+export function openFile(fileName: string, waitFor: string) {
+  // force: The file-tree pane is too narrow to display the full name.
+  cy.findByTestId('file-tree').findByText(fileName).click({ force: true })
+
+  // wait until we've switched to the selected file
+  cy.findByText('Loading…').should('not.exist')
+  cy.findByText(waitFor)
+}
+
+export function createNewFile() {
+  const fileName = `${uuid()}.tex`
+
+  cy.log('create new project file')
+  cy.get('button').contains('New file').click({ force: true })
+  cy.findByRole('dialog').within(() => {
+    cy.get('input').clear()
+    cy.get('input').type(fileName)
+    cy.findByText('Create').click()
+  })
+  // force: The file-tree pane is too narrow to display the full name.
+  cy.findByTestId('file-tree').findByText(fileName).click({ force: true })
+
+  // wait until we've switched to the newly created empty file
+  cy.findByText('Loading…').should('not.exist')
+  cy.get('.cm-line').should('have.length', 1)
+
+  return fileName
+}
+
+export function toggleTrackChanges(state: boolean) {
+  cy.findByText('Review').click()
+  cy.get('.track-changes-menu-button').then(el => {
+    // when the menu is expanded renders the `expand_more` icon,
+    // and the `chevron_right` icon when it's collapsed
+    if (!el.text().includes('expand_more')) {
+      el.click()
+    }
+  })
+
+  cy.findByText('Everyone')
+    .parent()
+    .within(() => {
+      cy.get('.form-check-input').then(el => {
+        if (el.prop('checked') === state) return
+
+        const id = uuid()
+        const alias = `@${id}`
+        cy.intercept({
+          method: 'POST',
+          url: '**/track_changes',
+          times: 1,
+        }).as(id)
+        if (state) {
+          cy.get('.form-check-input').check()
+        } else {
+          cy.get('.form-check-input').uncheck()
+        }
+        cy.wait(alias)
+      })
+    })
+  cy.contains('.toolbar-item', 'Review').click()
+}

server-ce/test/history.spec.ts

@@ -40,7 +40,6 @@ describe('History', function () {
   const CLASS_DELETION = 'ol-cm-deletion-marker'
 
   it('should support labels, comparison and download', () => {
-    cy.visit('/project')
     createProject('labels')
     const recompile = throttledRecompile()
 

server-ce/test/package-lock.json

@@ -12,10 +12,10 @@
         "@types/pdf-parse": "^1.1.4",
         "@types/uuid": "^9.0.8",
         "adm-zip": "^0.5.12",
-        "body-parser": "^1.20.2",
+        "body-parser": "^1.20.3",
         "celebrate": "^15.0.3",
         "cypress": "13.13.2",
-        "express": "^4.19.2",
+        "express": "^4.21.2",
         "isomorphic-git": "^1.25.10",
         "js-yaml": "^4.1.0",
         "pdf-parse": "^1.1.1",
@@ -609,9 +609,9 @@
       "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
     },
     "node_modules/body-parser": {
-      "version": "1.20.2",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",
-      "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==",
+      "version": "1.20.3",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
+      "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
       "dependencies": {
         "bytes": "3.1.2",
         "content-type": "~1.0.5",
@@ -621,7 +621,7 @@
         "http-errors": "2.0.0",
         "iconv-lite": "0.4.24",
         "on-finished": "2.4.1",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "raw-body": "2.5.2",
         "type-is": "~1.6.18",
         "unpipe": "1.0.0"
@@ -645,11 +645,11 @@
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
     "node_modules/body-parser/node_modules/qs": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz",
-      "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==",
+      "version": "6.13.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
+      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
       "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
       },
       "engines": {
         "node": ">=0.6"
@@ -718,6 +718,33 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.3.tgz",
+      "integrity": "sha512-YTd+6wGlNlPxSuri7Y6X8tY2dmm12UMH66RpKMhiX6rsk5wXXnYgbUcOt8kiS31/AjfoTOvCsE+w8nZQLQnzHA==",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "get-intrinsic": "^1.2.6"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/caseless": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz",
@@ -891,9 +918,9 @@
       }
     },
     "node_modules/cookie": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.1.tgz",
+      "integrity": "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==",
       "engines": {
         "node": ">= 0.6"
       }
@@ -920,9 +947,9 @@
       }
     },
     "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -1140,6 +1167,19 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="
     },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/ecc-jsbn": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
@@ -1160,9 +1200,9 @@
       "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
     },
     "node_modules/encodeurl": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
-      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "engines": {
         "node": ">= 0.8"
       }
@@ -1187,6 +1227,22 @@
         "node": ">=8.6"
       }
     },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/es-get-iterator": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/es-get-iterator/-/es-get-iterator-1.1.3.tgz",
@@ -1206,6 +1262,17 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -1266,36 +1333,36 @@
       }
     },
     "node_modules/express": {
-      "version": "4.19.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.19.2.tgz",
-      "integrity": "sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==",
+      "version": "4.21.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
+      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.2",
+        "body-parser": "1.20.3",
         "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.6.0",
+        "cookie": "0.7.1",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.2.0",
+        "finalhandler": "1.3.1",
         "fresh": "0.5.2",
         "http-errors": "2.0.0",
-        "merge-descriptors": "1.0.1",
+        "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.7",
+        "path-to-regexp": "0.1.12",
         "proxy-addr": "~2.0.7",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.18.0",
-        "serve-static": "1.15.0",
+        "send": "0.19.0",
+        "serve-static": "1.16.2",
         "setprototypeof": "1.2.0",
         "statuses": "2.0.1",
         "type-is": "~1.6.18",
@@ -1304,6 +1371,10 @@
       },
       "engines": {
         "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/express/node_modules/debug": {
@@ -1320,11 +1391,11 @@
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
     "node_modules/express/node_modules/qs": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz",
-      "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==",
+      "version": "6.13.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
+      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
       "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
       },
       "engines": {
         "node": ">=0.6"
@@ -1393,12 +1464,12 @@
       }
     },
     "node_modules/finalhandler": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.2.0.tgz",
-      "integrity": "sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.1.tgz",
+      "integrity": "sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==",
       "dependencies": {
         "debug": "2.6.9",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
@@ -1498,19 +1569,40 @@
       }
     },
     "node_modules/get-intrinsic": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.2.tgz",
-      "integrity": "sha512-0gSo4ml/0j98Y3lngkFEot/zhiCeWsbYIlZ+uZOVgzLyLaUw7wxUL+nCTP0XJvJg1AXulJRI3UJi8GsbDuxdGA==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
       "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
         "function-bind": "^1.1.2",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "hasown": "^2.0.0"
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/get-stream": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz",
@@ -1556,11 +1648,11 @@
       }
     },
     "node_modules/gopd": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
-      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
-      "dependencies": {
-        "get-intrinsic": "^1.1.3"
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -1598,21 +1690,10 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/has-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz",
-      "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/has-symbols": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
-      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
       "engines": {
         "node": ">= 0.4"
       },
@@ -1635,9 +1716,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz",
-      "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
       "dependencies": {
         "function-bind": "^1.1.2"
       },
@@ -2284,6 +2365,14 @@
         "lz-string": "bin/bin.js"
       }
     },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/media-typer": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -2293,9 +2382,12 @@
       }
     },
     "node_modules/merge-descriptors": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
-      "integrity": "sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w=="
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
     },
     "node_modules/merge-stream": {
       "version": "2.0.0",
@@ -2405,9 +2497,12 @@
       }
     },
     "node_modules/object-inspect": {
-      "version": "1.13.1",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz",
-      "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==",
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "engines": {
+        "node": ">= 0.4"
+      },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
@@ -2526,9 +2621,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
-      "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
+      "version": "0.1.12",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
+      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ=="
     },
     "node_modules/pdf-parse": {
       "version": "1.1.1",
@@ -2807,9 +2902,9 @@
       }
     },
     "node_modules/send": {
-      "version": "0.18.0",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz",
-      "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.0.tgz",
+      "integrity": "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==",
       "dependencies": {
         "debug": "2.6.9",
         "depd": "2.0.0",
@@ -2842,20 +2937,28 @@
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
+    "node_modules/send/node_modules/encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/send/node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
     },
     "node_modules/serve-static": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz",
-      "integrity": "sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.2.tgz",
+      "integrity": "sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==",
       "dependencies": {
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.18.0"
+        "send": "0.19.0"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2925,13 +3028,68 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
-      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
       "dependencies": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"

server-ce/test/package.json

@@ -15,10 +15,10 @@
     "@types/pdf-parse": "^1.1.4",
     "@types/uuid": "^9.0.8",
     "adm-zip": "^0.5.12",
-    "body-parser": "^1.20.2",
+    "body-parser": "^1.20.3",
     "celebrate": "^15.0.3",
     "cypress": "13.13.2",
-    "express": "^4.19.2",
+    "express": "^4.21.2",
     "isomorphic-git": "^1.25.10",
     "js-yaml": "^4.1.0",
     "pdf-parse": "^1.1.1",

server-ce/test/project-list.spec.ts

@@ -18,11 +18,11 @@ describe('Project List', () => {
   describe('user with no projects', () => {
     ensureUserExists({ email: WITHOUT_PROJECTS_USER })
 
-    it("'Import from Github' is not displayed in the welcome page", () => {
+    it("'Import from GitHub' is not displayed in the welcome page", () => {
       login(WITHOUT_PROJECTS_USER)
       cy.visit('/project')
       cy.findByText('Create a new project').click()
-      cy.findByText(/Import from Github/i).should('not.exist')
+      cy.findByText(/Import from GitHub/i).should('not.exist')
     })
   })
 
@@ -31,15 +31,15 @@ describe('Project List', () => {
     ensureUserExists({ email: REGULAR_USER })
 
     before(() => {
+      login(REGULAR_USER)
+      createProject(projectName, { type: 'Example Project', open: false })
+    })
+    beforeEach(function () {
       login(REGULAR_USER)
       cy.visit('/project')
-      createProject(projectName, { type: 'Example Project' })
     })
 
     it('Can download project sources', () => {
-      login(REGULAR_USER)
-      cy.visit('/project')
-
       findProjectRow(projectName).within(() =>
         cy.findByRole('button', { name: 'Download .zip file' }).click()
       )
@@ -51,9 +51,6 @@ describe('Project List', () => {
     })
 
     it('Can download project PDF', () => {
-      login(REGULAR_USER)
-      cy.visit('/project')
-
       findProjectRow(projectName).within(() =>
         cy.findByRole('button', { name: 'Download PDF' }).click()
       )
@@ -67,9 +64,6 @@ describe('Project List', () => {
 
     it('can assign and remove tags to projects', () => {
       const tagName = uuid().slice(0, 7) // long tag names are truncated in the UI, which affects selectors
-      login(REGULAR_USER)
-      cy.visit('/project')
-
       cy.log('select project')
       cy.get(`[aria-label="Select ${projectName}"]`).click()
 
@@ -90,9 +84,7 @@ describe('Project List', () => {
       cy.log('create a separate project to filter')
       const nonTaggedProjectName = `project-${uuid()}`
       login(REGULAR_USER)
-      cy.visit('/project')
-      createProject(nonTaggedProjectName)
-      cy.visit('/project')
+      createProject(nonTaggedProjectName, { open: false })
 
       cy.log('select project')
       cy.get(`[aria-label="Select ${projectName}"]`).click()

server-ce/test/project-sharing.spec.ts

@@ -4,6 +4,9 @@ import { ensureUserExists, login } from './helpers/login'
 import {
   createProject,
   enableLinkSharing,
+  openProjectByName,
+  openProjectViaLinkSharingAsAnon,
+  openProjectViaLinkSharingAsUser,
   shareProjectByEmailAndAcceptInviteViaDash,
   shareProjectByEmailAndAcceptInviteViaEmail,
 } from './helpers/project'
@@ -31,7 +34,6 @@ describe('Project Sharing', function () {
 
   function setupTestProject() {
     login('user@example.com')
-    cy.visit('/project')
     createProject(projectName)
 
     // Add chat message
@@ -152,16 +154,10 @@ describe('Project Sharing', function () {
 
     beforeEach(function () {
       login('user@example.com')
-      shareProjectByEmailAndAcceptInviteViaEmail(
-        projectName,
-        email,
-        'Read only'
-      )
+      shareProjectByEmailAndAcceptInviteViaEmail(projectName, email, 'Viewer')
     })
 
     it('should grant the collaborator read access', () => {
-      cy.visit('/project')
-      cy.findByText(projectName).click()
       expectFullReadOnlyAccess()
       expectProjectDashboardEntry()
     })
@@ -173,13 +169,12 @@ describe('Project Sharing', function () {
 
     beforeWithReRunOnTestRetry(function () {
       login('user@example.com')
-      shareProjectByEmailAndAcceptInviteViaDash(projectName, email, 'Read only')
+      shareProjectByEmailAndAcceptInviteViaDash(projectName, email, 'Viewer')
     })
 
     it('should grant the collaborator read access', () => {
       login(email)
-      cy.visit('/project')
-      cy.findByText(projectName).click()
+      openProjectByName(projectName)
       expectFullReadOnlyAccess()
       expectProjectDashboardEntry()
     })
@@ -191,13 +186,12 @@ describe('Project Sharing', function () {
 
     beforeWithReRunOnTestRetry(function () {
       login('user@example.com')
-      shareProjectByEmailAndAcceptInviteViaDash(projectName, email, 'Can edit')
+      shareProjectByEmailAndAcceptInviteViaDash(projectName, email, 'Editor')
     })
 
     it('should grant the collaborator write access', () => {
       login(email)
-      cy.visit('/project')
-      cy.findByText(projectName).click()
+      openProjectByName(projectName)
       expectReadAndWriteAccess()
       expectEditAuthoredAs('You')
       expectProjectDashboardEntry()
@@ -212,9 +206,11 @@ describe('Project Sharing', function () {
 
         it('should grant restricted read access', () => {
           login(email)
-          cy.visit(linkSharingReadOnly)
-          cy.findByText(projectName) // wait for lazy loading
-          cy.findByText('Join Project').click()
+          openProjectViaLinkSharingAsUser(
+            linkSharingReadOnly,
+            projectName,
+            email
+          )
           expectRestrictedReadOnlyAccess()
           expectProjectDashboardEntry()
         })
@@ -226,9 +222,11 @@ describe('Project Sharing', function () {
 
         it('should grant full write access', () => {
           login(email)
-          cy.visit(linkSharingReadAndWrite)
-          cy.findByText(projectName) // wait for lazy loading
-          cy.findByText('Join Project').click()
+          openProjectViaLinkSharingAsUser(
+            linkSharingReadAndWrite,
+            projectName,
+            email
+          )
           expectReadAndWriteAccess()
           expectEditAuthoredAs('You')
           expectProjectDashboardEntry()
@@ -272,7 +270,7 @@ describe('Project Sharing', function () {
           withDataDir: true,
         })
         it('should grant read access with read link', () => {
-          cy.visit(linkSharingReadOnly)
+          openProjectViaLinkSharingAsAnon(linkSharingReadOnly)
           expectRestrictedReadOnlyAccess()
         })
 
@@ -292,12 +290,12 @@ describe('Project Sharing', function () {
         })
 
         it('should grant read access with read link', () => {
-          cy.visit(linkSharingReadOnly)
+          openProjectViaLinkSharingAsAnon(linkSharingReadOnly)
           expectRestrictedReadOnlyAccess()
         })
 
         it('should grant write access with write link', () => {
-          cy.visit(linkSharingReadAndWrite)
+          openProjectViaLinkSharingAsAnon(linkSharingReadAndWrite)
           expectReadAndWriteAccess()
           expectEditAuthoredAs('Anonymous')
         })

server-ce/test/sandboxed-compiles.spec.ts

@@ -29,7 +29,6 @@ describe('SandboxedCompiles', function () {
     })
 
     it('should offer TexLive images and switch the compiler', function () {
-      cy.visit('/project')
       createProject('sandboxed')
       const recompile = throttledRecompile()
       cy.log('wait for compile')
@@ -46,7 +45,7 @@ describe('SandboxedCompiles', function () {
         .findByText('2023')
         .parent()
         .select('2022')
-      cy.get('#left-menu-modal').click()
+      cy.get('.left-menu-modal-backdrop').click()
 
       cy.log('Trigger compile with other TeX Live version')
       recompile()
@@ -66,7 +65,6 @@ describe('SandboxedCompiles', function () {
       let projectName: string
       beforeEach(function () {
         projectName = `Project ${uuid()}`
-        cy.visit('/project')
         createProject(projectName)
         const recompile = throttledRecompile()
         cy.findByText('\\maketitle').parent().click()
@@ -154,7 +152,6 @@ describe('SandboxedCompiles', function () {
   function checkRecompilesAfterErrors() {
     it('recompiles even if there are Latex errors', function () {
       login('user@example.com')
-      cy.visit('/project')
       createProject('test-project')
       const recompile = throttledRecompile()
       cy.findByText('\\maketitle').parent().click()
@@ -170,7 +167,6 @@ describe('SandboxedCompiles', function () {
 
   function checkXeTeX() {
     it('should be able to use XeLaTeX', function () {
-      cy.visit('/project')
       createProject('XeLaTeX')
       const recompile = throttledRecompile()
       cy.log('wait for compile')
@@ -187,7 +183,7 @@ describe('SandboxedCompiles', function () {
         .findByText('pdfLaTeX')
         .parent()
         .select('XeLaTeX')
-      cy.get('#left-menu-modal').click()
+      cy.get('.left-menu-modal-backdrop').click()
 
       cy.log('Trigger compile with other compiler')
       recompile()
@@ -204,14 +200,13 @@ describe('SandboxedCompiles', function () {
     })
 
     it('should not offer TexLive images and use default compiler', function () {
-      cy.visit('/project')
       createProject('sandboxed')
       cy.log('wait for compile')
       cy.get('.pdf-viewer').should('contain.text', 'sandboxed')
 
-      cy.log('Check which compiler version was used, expect 2024')
+      cy.log('Check which compiler version was used, expect 2025')
       cy.get('[aria-label="View logs"]').click()
-      cy.findByText(/This is pdfTeX, Version .+ \(TeX Live 2024\) /)
+      cy.findByText(/This is pdfTeX, Version .+ \(TeX Live 2025\) /)
 
       cy.log('Check that there is no TeX Live version toggle')
       cy.get('header').findByText('Menu').click()

server-ce/test/templates.spec.ts

@@ -64,7 +64,7 @@ describe('Templates', () => {
         .get('textarea')
         .type(description)
       cy.findByText('Publish').click()
-      cy.findByText('Publishing…').should('be.disabled')
+      cy.findByText('Publishing…').parent().should('be.disabled')
       cy.findByText('Publish').should('not.exist')
       cy.findByText('Unpublish', { timeout: 10_000 })
       cy.findByText('Republish')

server-ce/test/upgrading.spec.ts

@@ -1,7 +1,7 @@
 import { ensureUserExists, login } from './helpers/login'
 import { isExcludedBySharding, startWith } from './helpers/config'
 import { dockerCompose, runScript } from './helpers/hostAdminClient'
-import { createProject } from './helpers/project'
+import { createProject, openProjectByName } from './helpers/project'
 import { throttledRecompile } from './helpers/compile'
 import { v4 as uuid } from 'uuid'
 
@@ -38,8 +38,6 @@ describe('Upgrading', function () {
     before(() => {
       cy.log('Populate old instance')
       login(USER)
-
-      cy.visit('/project')
       createProject(PROJECT_NAME, {
         newProjectButtonMatcher: startOptions.newProjectButtonMatcher,
       })
@@ -59,7 +57,7 @@ describe('Upgrading', function () {
         recompile()
         cy.get('header').findByText('Menu').click()
         cy.findByText('Source').click()
-        cy.get('#left-menu-modal').click()
+        cy.get('.left-menu-modal-backdrop').click({ force: true })
       }
 
       cy.log('Check compile and history')
@@ -115,8 +113,7 @@ describe('Upgrading', function () {
     })
 
     it('should open the old project', () => {
-      cy.visit('/project')
-      cy.findByText(PROJECT_NAME).click()
+      openProjectByName(PROJECT_NAME)
 
       cy.url().should('match', /\/project\/[a-fA-F0-9]{24}/)
       cy.findByRole('navigation').within(() => {

services/chat/.nvmrc

@@ -1 +1 @@
-20.18.0
+20.18.2

services/chat/Dockerfile

@@ -2,7 +2,7 @@
 # Instead run bin/update_build_scripts from
 # https://github.com/overleaf/internal/
 
-FROM node:20.18.0 AS base
+FROM node:20.18.2 AS base
 
 WORKDIR /overleaf/services/chat