Selecting password auth failed with a generic "Unauthorized" for users
who signed up via OAuth or passkey, with no way to set one.
Detect the missing password and email the existing reset link from the
signing dialog and security settings. Require a 2FA code and rate limit
update-password.
Upgrade to Node 24 LTS, using the alpine 3.23 tag to handle issues with
streaming zip files on 24.16 which hangs npm ci.
Pin npm to 11.19.1 for min-release-age-exclude support.
Slim the runner image by dropping dev deps, the react-email CLI, and
esbuild,
none of which run in production.
Install turbo from the lockfile version instead of a hardcoded one.
`/api/health` and `/api/certificate-status` reported the cert as
available when `NEXT_PRIVATE_SIGNING_TRANSPORT` was unset, even though
sealing defaults to the local P12 and fails if it is missing,
unreadable, or expired.
Disable autocapture and person profiles for anonymous users, and
redact signing tokens from captured URLs.
Manually wire exception capture into the signing, editor and embed
flows with recipient/envelope context for debugging recipient-reported
issues.
Track activation events (webhooks, api tokens, direct links, embed
sessions) server-side with org attribution, and drop client events
already tracked in-app.
Use our fork of `skia-canvas` for rendering which handles
encoding characters correctly with the caveat font and other
similar fonts that can group glyphs like ligatures.
This resolves issues with pdf text extraction where characters
were unable to be extracted due to lacking any data within the cmaps.
Previously attempting to complete a document which is already completed
you'd get a generic error toast. Now when completing a document that you
have already completed you are redirected to the completed page.
Handles cases where two mutations managed to fire racing eachother.
## Description
Adds a copy button next to the show/hide toggle for the license key in
the admin panel license card (Admin Panel → Stats).
- Ghost button matching the existing eye-toggle styling (`h-6 w-6`,
`CopyIcon`)
- Uses the standard `useCopyToClipboard` + toast pattern (same as
`template-direct-link-badge.tsx`)
- Copies the key regardless of masked/visible state
New translation strings will be picked up by the next `chore: extract
translations` run.
## Before / After
> Screenshots taken against a locally mocked ACTIVE license (the mock is
not part of this PR).
## Testing
- `npx tsc --noEmit -p apps/remix` clean
- `biome check` clean
- Smoke-tested in browser: clicking the button fires the "Copied to
clipboard" toast (visible in the screenshot above)
Currently direct templates can be created without the required
signatures fields for signers.
This means that the document can be fully signed by everyone but will
ultimately fail the sealing step which leaves the document in an
unrecoverable state.
Move PostHog init out of the React tree so the client tree matches
the server render (mismatched useIds could abort hydration, leaving
dead event handlers). Also expose the CSP nonce so Radix scroll-lock
styles aren't blocked.
## Description
This MR improves the real-time validation experience on the signup page.
Currently, both the email and password fields validate only on blur,
causing users to continue seeing error messages even after correcting
their input until they click outside the field.
This update switches the React Hook Form configuration from mode:
'onBlur' to mode: 'onChange', ensuring validations update immediately as
the user types.
This results in a smoother and less confusing signup experience.
## Related Issue
Fixes#2200
## Changes Made
- Updated React Hook Form configuration in the signup form from:
- mode: 'onBlur' ➜ mode: 'onChange'
- Ensures real-time validation for email and password fields
- No schema or logic changes — only validation trigger updated
## Testing Performed
- Manually tested the signup page for:
- Real-time password rule updates
- Real-time email validation feedback
- Error disappearance immediately after correcting input
## Checklist
- [x] I have tested these changes locally and they work as expected.
- [ ] I have added/updated tests that prove the effectiveness of these
changes.
- [x] I have updated the documentation to reflect these changes, if
applicable.
- [x] I have followed the project's coding style guidelines.
- [x] I have addressed the code review feedback from the previous
submission, if applicable.
## Additional Notes
This is a small UX-focused improvement; the validation schema remains
unchanged.
Co-authored-by: Catalin Pit <catalinpit@gmail.com>
Catalin Pit
Durgesh Shekhawat
Lucas Smith
Konrad
David Nguyen
Rodrigo Flávio
Christopher Ryan
Ephraim Duncan
Tanushree AhirandCatalin Pit