Merge branch 'main' into security/frontend-cves

frontend/editor/src/core/components/shared/FileSelectorPicker.tsx

@@ -270,14 +270,12 @@ export function FileSelectorPicker({
               skipAuthRedirect: true,
             } as any,
           );
-          const ct =
-            res.headers?.["content-type"] ||
+          const ct = (res.headers?.["content-type"] ||
             res.headers?.["Content-Type"] ||
-            "";
-          const disp =
-            res.headers?.["content-disposition"] ||
+            "") as string;
+          const disp = (res.headers?.["content-disposition"] ||
             res.headers?.["Content-Disposition"] ||
-            "";
+            "") as string;
           const files = await extractLatestFilesFromBundle(
             res.data as Blob,
             parseContentDispositionFilename(disp) || "shared-file",
@@ -294,14 +292,12 @@ export function FileSelectorPicker({
               skipAuthRedirect: true,
             } as any,
           );
-          const ct =
-            res.headers?.["content-type"] ||
+          const ct = (res.headers?.["content-type"] ||
             res.headers?.["Content-Type"] ||
-            "";
-          const disp =
-            res.headers?.["content-disposition"] ||
+            "") as string;
+          const disp = (res.headers?.["content-disposition"] ||
             res.headers?.["Content-Disposition"] ||
-            "";
+            "") as string;
           const files = await extractLatestFilesFromBundle(
             res.data as Blob,
             parseContentDispositionFilename(disp) || stub.name,

frontend/editor/src/core/contexts/FileManagerContext.tsx

@@ -1003,16 +1003,14 @@ export const FileManagerProvider: React.FC<FileManagerProviderProps> = ({
             skipAuthRedirect: true,
           } as any,
         );
-        const contentType =
-          (response.headers &&
-            (response.headers["content-type"] ||
-              response.headers["Content-Type"])) ||
-          "";
-        const disposition =
-          (response.headers &&
-            (response.headers["content-disposition"] ||
-              response.headers["Content-Disposition"])) ||
-          "";
+        const contentType = ((response.headers &&
+          (response.headers["content-type"] ||
+            response.headers["Content-Type"])) ||
+          "") as string;
+        const disposition = ((response.headers &&
+          (response.headers["content-disposition"] ||
+            response.headers["Content-Disposition"])) ||
+          "") as string;
         const filename =
           parseContentDispositionFilename(disposition) ||
           file.name ||

frontend/editor/src/core/contexts/FilesModalContext.tsx

@@ -184,16 +184,13 @@ export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
         skipAuthRedirect: true,
       } as any,
     );
-    const contentType =
-      (response.headers &&
-        (response.headers["content-type"] ||
-          response.headers["Content-Type"])) ||
-      "";
-    const disposition =
-      (response.headers &&
-        (response.headers["content-disposition"] ||
-          response.headers["Content-Disposition"])) ||
-      "";
+    const contentType = ((response.headers &&
+      (response.headers["content-type"] || response.headers["Content-Type"])) ||
+      "") as string;
+    const disposition = ((response.headers &&
+      (response.headers["content-disposition"] ||
+        response.headers["Content-Disposition"])) ||
+      "") as string;
     const filename =
       parseContentDispositionFilename(disposition) || "server-file";
     const blob = response.data as Blob;
@@ -210,16 +207,13 @@ export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
         skipAuthRedirect: true,
       } as any,
     );
-    const contentType =
-      (response.headers &&
-        (response.headers["content-type"] ||
-          response.headers["Content-Type"])) ||
-      "";
-    const disposition =
-      (response.headers &&
-        (response.headers["content-disposition"] ||
-          response.headers["Content-Disposition"])) ||
-      "";
+    const contentType = ((response.headers &&
+      (response.headers["content-type"] || response.headers["Content-Type"])) ||
+      "") as string;
+    const disposition = ((response.headers &&
+      (response.headers["content-disposition"] ||
+        response.headers["Content-Disposition"])) ||
+      "") as string;
     const filename =
       parseContentDispositionFilename(disposition) || "shared-file";
     const blob = response.data as Blob;

frontend/editor/src/core/services/signatureStorageService.ts

@@ -166,7 +166,9 @@ class SignatureStorageService {
 
             // Convert to data URL (base64) for both display and use
             const blob = new Blob([imageResponse.data], {
-              type: imageResponse.headers["content-type"] || "image/png",
+              type:
+                (imageResponse.headers["content-type"] as string) ||
+                "image/png",
             });
 
             const dataUrl = await new Promise<string>((resolve, reject) => {

frontend/editor/src/proprietary/routes/ShareLinkLoader.tsx

@@ -78,16 +78,14 @@ export default function ShareLinkLoader({ token }: ShareLinkLoaderProps) {
         );
         if (signal.aborted) return;
 
-        const contentType =
-          (response.headers &&
-            (response.headers["content-type"] ||
-              response.headers["Content-Type"])) ||
-          "";
-        const disposition =
-          (response.headers &&
-            (response.headers["content-disposition"] ||
-              response.headers["Content-Disposition"])) ||
-          "";
+        const contentType = ((response.headers &&
+          (response.headers["content-type"] ||
+            response.headers["Content-Type"])) ||
+          "") as string;
+        const disposition = ((response.headers &&
+          (response.headers["content-disposition"] ||
+            response.headers["Content-Disposition"])) ||
+          "") as string;
         const filename =
           parseContentDispositionFilename(disposition) || "shared-file";
         const blob = response.data as Blob;

frontend/editor/src/proprietary/services/shareLinkImport.ts

@@ -44,15 +44,13 @@ export async function downloadShareLink(token: string): Promise<{
     suppressErrorToast: true,
     skipAuthRedirect: true,
   });
-  const contentType =
-    (response.headers &&
-      (response.headers["content-type"] || response.headers["Content-Type"])) ||
-    "";
-  const disposition =
-    (response.headers &&
-      (response.headers["content-disposition"] ||
-        response.headers["Content-Disposition"])) ||
-    "";
+  const contentType = ((response.headers &&
+    (response.headers["content-type"] || response.headers["Content-Type"])) ||
+    "") as string;
+  const disposition = ((response.headers &&
+    (response.headers["content-disposition"] ||
+      response.headers["Content-Disposition"])) ||
+    "") as string;
   const filename =
     parseContentDispositionFilename(disposition) || "shared-file";
   const blob = response.data as Blob;

frontend/package.json

@@ -66,7 +66,7 @@
     "pdfjs-dist": "^5.4.149",
     "peerjs": "^1.5.5",
     "pixelmatch": "^7.1.0",
-    "posthog-js": "^1.268.0",
+    "posthog-js": "^1.393.4",
     "qrcode.react": "^4.2.0",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
@@ -132,7 +132,7 @@
     "@typescript-eslint/parser": "^8.61.1",
     "@typescript/native-preview": "7.0.0-dev.20260624.1",
     "@vitejs/plugin-react-swc": "^4.1.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.6",
     "dotenv": "^16.4.7",
     "dpdm": "^3.14.0",
     "eslint": "^10.0.2",
@@ -157,7 +157,7 @@
     "vite-plugin-compression2": "^2.5.3",
     "vite-plugin-static-copy": "^3.1.4",
     "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.6"
   },
   "depcheck": {
     "ignoreMatches": [
@@ -171,7 +171,11 @@
     "devalue": "^5.8.1",
     "tsconfck": {
       "typescript": "$typescript"
-    }
+    },
+    "form-data": "^4.0.6",
+    "protobufjs": "^7.6.3",
+    "esbuild": "^0.28.1",
+    "@babel/core": "^7.29.6"
   },
   "msw": {
     "workerDirectory": [