Lucie GermainandClaude Opus 4.8
d2c848320e
* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via the patched referer-parser (web) plus many dev/build consumers. Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0 (security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0 (yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0, but the local patch still declared ^4.1.0. Align the patch's declared range with the resolution. Addresses Jakob's review comment on #34695 (discussion_r3440549168). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Make patched-parent realignment a mandatory Type B step in yarn-security-update skill The patch-realignment instruction was a soft 'for consistency' parenthetical; a session reading the rule acted only on 'use a resolution' and dropped the patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too; load-nyc-config uses js-yaml.load(), which is 4.x-compatible. Drop the js-yaml and mocha dependency edits from the referer-parser patch: editing a patched package's dependencies has no effect on resolution, so the scoped resolution is the entire fix. Update the yarn-security-update skill to match (patched parents route to Type B; do not edit the patch). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Combine js-yaml resolutions into a single global override Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and @istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every js-yaml consumer should reach the security floor and none needs an older major, so the global override is equivalent and tidier (reviewer request). Note the scoped-vs-global tradeoff in the yarn-security-update skill. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7
An open-source online real-time collaborative LaTeX editor.
Wiki • Server Pro • Contributing • Mailing List • Authors • License
Figure 1: A screenshot of a project being edited in Overleaf Community Edition.
Community Edition
Overleaf is an open-source online real-time collaborative LaTeX editor. We run a hosted version at www.overleaf.com, but you can also run your own local version, and contribute to the development of Overleaf.
Caution
Overleaf Community Edition is intended for use in environments where all users are trusted. Community Edition is not appropriate for scenarios where isolation of users is required due to Sandbox Compiles not being available. When not using Sandboxed Compiles, users have full read and write access to the
sharelatexcontainer resources (filesystem, network, environment variables) when running LaTeX compiles.
For more information on Sandbox Compiles check out our documentation.
Enterprise
If you want help installing and maintaining Overleaf in your lab or workplace, we offer an officially supported version called Overleaf Server Pro. It also includes more features for security (SSO with LDAP or SAML), administration and collaboration (e.g. tracked changes). Find out more!
Keeping up to date
Sign up to the mailing list to get updates on Overleaf releases and development.
Installation
We have detailed installation instructions in the Overleaf Toolkit.
Upgrading
If you are upgrading from a previous version of Overleaf, please see the Release Notes section on the Wiki for all of the versions between your current version and the version you are upgrading to.
Overleaf Docker Image
This repo contains two dockerfiles, Dockerfile-base, which builds the
sharelatex/sharelatex-base image, and Dockerfile which builds the
sharelatex/sharelatex (or "community") image.
The Base image generally contains the basic dependencies like wget, plus texlive.
We split this out because it's a pretty heavy set of
dependencies, and it's nice to not have to rebuild all of that every time.
The sharelatex/sharelatex image extends the base image and adds the actual Overleaf code
and services.
Use make build-base and make build-community from server-ce/ to build these images.
We use the Phusion base-image
(which is extended by our base image) to provide us with a VM-like container
in which to run the Overleaf services. Baseimage uses the runit service
manager to manage services, and we add our init-scripts from the server-ce/runit
folder.
Contributing
Please see the CONTRIBUTING file for information on contributing to the development of Overleaf.
Authors
License
The code in this repository is released under the GNU AFFERO GENERAL PUBLIC LICENSE, version 3. A copy can be found in the LICENSE file.
Copyright (c) Overleaf, 2014-2025.