⬆️(dependencies) Pin dependencies

♻️(backend) improve legacy AI translate prompt
The return of the legacy AI translate prompt is sometimes surrounded with a html code block. We improve the prompt to not return this surrounding code block.
2026-05-07 23:52:04 +02:00 · 2026-05-04 02:11:30 +00:00 · 2026-04-30 11:23:11 +02:00 · 2026-04-30 09:32:34 +02:00 · 2026-04-30 09:32:34 +02:00 · 2026-04-30 09:32:34 +02:00
48 changed files with 1340 additions and 575 deletions
--- a/.github/workflows/crowdin_download.yml
+++ b/.github/workflows/crowdin_download.yml
@@ -23,7 +23,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Create empty source files
        run: |
          touch src/backend/locale/django.pot
@@ -31,7 +31,7 @@ jobs:
          touch src/frontend/packages/i18n/locales/impress/translations-crowdin.json
      # crowdin workflow
      - name: crowdin action
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
        with:
          config: crowdin/config.yml
          upload_sources: false
@@ -51,7 +51,7 @@ jobs:
          CROWDIN_BASE_PATH: "../src/"
      # frontend i18n
      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -61,7 +61,7 @@ jobs:
        run: yarn i18n:deploy
      # Create a new PR
      - name: Create a new Pull Request with new translated strings
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
        with:
          commit-message: |
            🌐(i18n) update translated strings
--- a/.github/workflows/crowdin_upload.yml
+++ b/.github/workflows/crowdin_upload.yml
@@ -23,12 +23,12 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      # Backend i18n
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: "3.13.3"
+          python-version: "3.14.4"
          cache: "pip"
      - name: Upgrade pip and setuptools
        run: pip install --upgrade pip setuptools
@@ -36,7 +36,7 @@ jobs:
        run: pip install --user .
        working-directory: src/backend
      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -52,7 +52,7 @@ jobs:
          DJANGO_CONFIGURATION=Build python manage.py makemessages -a --keep-pot
      # frontend i18n
      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -62,7 +62,7 @@ jobs:
        run: yarn i18n:extract
      # crowdin workflow
      - name: crowdin action
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
        with:
          config: crowdin/config.yml
          upload_sources: true
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -23,16 +23,16 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        id: front-node_modules
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
      - name: Setup Node.js
        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ inputs.node_version }}
      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
        run: cd src/frontend/ && yarn install --frozen-lockfile
      - name: Cache install frontend
        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -53,10 +53,10 @@ jobs:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -64,7 +64,7 @@ jobs:

      - name: Setup Node.js
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ inputs.node_version }}

@@ -82,7 +82,7 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -68,7 +68,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview')
    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@main
+      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
        id: notify
        with:
          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -47,20 +47,20 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      - name: Login to DockerHub
        if: ${{ inputs.should_push }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: ${{ inputs.image_name }}
      - name: Generate platform-specific tags
@@ -87,7 +87,7 @@ jobs:
      #     trivyignores: ./.github/.trivyignore
      - name: Build and push (amd64)
        if: ${{ inputs.should_push }}||${{ vars.TRIVY_SCAN_ENABLED }} != 'true'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.file }}
@@ -102,7 +102,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
      - name: Build and push (arm64)
        if: ${{ inputs.should_push }}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.file }}
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -36,15 +36,15 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: "22.x"
+          node-version: "24.x"

      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -52,7 +52,7 @@ jobs:

      - name: Restore Playwright browsers cache
        id: playwright-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('src/frontend/yarn.lock', 'src/frontend/apps/e2e/yarn.lock') }}
@@ -67,7 +67,7 @@ jobs:

      - name: Save Playwright browsers cache
        if: steps.playwright-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.cache/ms-playwright
          key: ${{ steps.playwright-cache.outputs.cache-primary-key }}
@@ -78,15 +78,15 @@ jobs:
    timeout-minutes: ${{ inputs.timeout-minutes }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: "22.x"
+          node-version: "24.x"

      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -96,7 +96,7 @@ jobs:
        run: cat env.d/development/common.e2e >> env.d/development/common.local

      - name: Restore Playwright browsers cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('src/frontend/yarn.lock', 'src/frontend/apps/e2e/yarn.lock') }}
@@ -111,7 +111,7 @@ jobs:
      - name: Restore last-run cache
        if: ${{ github.run_attempt > 1 }}
        id: restore-last-run
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: src/frontend/apps/e2e/test-results/.last-run.json
          key: playwright-last-run-${{ github.run_id }}-${{ inputs.browser-name }}
@@ -138,14 +138,14 @@ jobs:

      - name: Save last-run cache
        if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: src/frontend/apps/e2e/test-results/.last-run.json
          key: playwright-last-run-${{ github.run_id }}-${{ inputs.browser-name }}

      - name: Upload last-run artifact
        if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: playwright-instance-last-run-${{ inputs.browser-name }}
          path: src/frontend/apps/e2e/test-results/.last-run.json
@@ -153,7 +153,7 @@ jobs:
          if-no-files-found: warn
          retention-days: 7

-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: playwright-${{ inputs.browser-name }}-report
--- a/.github/workflows/ghcr.yml
+++ b/.github/workflows/ghcr.yml
@@ -25,14 +25,14 @@ jobs:
      packages: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}/backend
          tags: |
@@ -42,13 +42,13 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=sha
      - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: .
          target: backend-production
@@ -71,14 +71,14 @@ jobs:
      packages: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}/frontend
          tags: |
@@ -88,13 +88,13 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=sha
      - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: .
          file: ./src/frontend/Dockerfile
@@ -120,14 +120,14 @@ jobs:
      packages: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}/y-provider
          tags: |
@@ -137,13 +137,13 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=sha
      - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: .
          file: ./src/frontend/servers/y-provider/Dockerfile
--- a/.github/workflows/helmfile-linter.yaml
+++ b/.github/workflows/helmfile-linter.yaml
@@ -15,7 +15,7 @@ jobs:
    steps:
    -
      name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
    -
      name: Helmfile lint
      shell: bash
--- a/.github/workflows/impress-frontend.yml
+++ b/.github/workflows/impress-frontend.yml
@@ -26,15 +26,15 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: "22.x"
+          node-version: "24.x"

      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -50,14 +50,14 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: "22.x"
+          node-version: "24.x"
      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -91,11 +91,11 @@ jobs:
      issues: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Detect relevant changes
        id: changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
        with:
          filters: |
            lock:
@@ -104,7 +104,7 @@ jobs:
              - 'src/frontend/apps/impress/**'

      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
@@ -112,13 +112,13 @@ jobs:

      - name: Setup Node.js
        if: steps.changes.outputs.lock == 'true' || steps.changes.outputs.app == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: "22.x"
+          node-version: "24.x"

      - name: Check bundle size changes
        if: steps.changes.outputs.lock == 'true' || steps.changes.outputs.app == 'true'
-        uses: preactjs/compressed-size-action@v2
+        uses: preactjs/compressed-size-action@66325aad6443cb7cf89c4bfcd414aea2367cda94 # v2
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
          build-script: "app:build"
@@ -139,14 +139,14 @@ jobs:
      contents: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: "22.x"
+          node-version: "24.x"
      - name: Restore the frontend cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: "src/frontend/**/node_modules"
          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
--- a/.github/workflows/impress.yml
+++ b/.github/workflows/impress.yml
@@ -22,7 +22,7 @@ jobs:
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - name: show
@@ -49,7 +49,7 @@ jobs:
      github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -59,7 +59,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -73,7 +73,7 @@ jobs:
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Install codespell
        run: pip install --user codespell
      - name: Check for typos
@@ -95,11 +95,11 @@ jobs:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: "3.13.3"
+          python-version: "3.14.4"
          cache: "pip"
      - name: Upgrade pip and setuptools
        run: pip install --upgrade pip setuptools
@@ -122,7 +122,7 @@ jobs:

    services:
      postgres:
-        image: postgres:16
+        image: postgres:18
        env:
          POSTGRES_DB: impress
          POSTGRES_USER: dinum
@@ -149,7 +149,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Create writable /data
        run: |
@@ -157,7 +157,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -193,9 +193,9 @@ jobs:
            mc version enable impress/impress-media-storage"

      - name: Install Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: "3.13.3"
+          python-version: "3.14.4"
          cache: "pip"

      - name: Install development dependencies
--- a/.github/workflows/label_preview.yml
+++ b/.github/workflows/label_preview.yml
@@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-latest
    if: contains(github.event.pull_request.labels.*.name, 'preview')
    steps:
-      - uses: thollander/actions-comment-pull-request@v3
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3
        with:
          message: |
            :rocket: Preview will be available at [https://${{ github.event.pull_request.number }}-docs.ppr-docs.beta.numerique.gouv.fr/](https://${{ github.event.pull_request.number }}-docs.ppr-docs.beta.numerique.gouv.fr/)
--- a/.github/workflows/release-helm-chart.yaml
+++ b/.github/workflows/release-helm-chart.yaml
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

@@ -23,12 +23,12 @@ jobs:
        run: rm -rf ./src/helm/extra

      - name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@add-overwrite-option
+        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
        with:
          charts_dir: ./src/helm
          token: ${{ secrets.GITHUB_TOKEN }}
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to

 - ✨(backend) create a dedicated endpoint to update document content 
 - ⚡️(backend) stream s3 file content with a dedicated endpoint
+- ✨(backend) allow to use new ai feature using mistral sdk

 ### Changed

@@ -18,6 +19,8 @@ and this project adheres to
 - ♿️(frontend) structure correctly 5xx error alerts #2128
 - ♿️(frontend) make doc search result labels uniquely identifiable #2212
 - ⬆️(backend) upgrade docspec to v3.0.x and adapt converter API #2220
+- ✨(backend) make forward auth request uri header configurable #2241
+- ♿️(frontend) fix sidebar resize handle for screen readers #2122

 ### Fixed

@@ -28,6 +31,8 @@ and this project adheres to
 - 🐛(frontend) fix interlinking modal clipping #2213
 - 🛂(frontend) fix cannot manage member on small screen #2226
 - 🐛(backend) load jwks url when OIDC_RS_PRIVATE_KEY_STR is set
+- 🐛(backend) Prevent moving document to its own descendant or self #2208
+- 🐛(backend) return 400 when restoring a non-deleted document #2225

 ### Removed

@@ -201,6 +206,7 @@ and this project adheres to

 ### Fixed

+- 🐛(backend) enforce emoji validation for reactions #1965
 - 🐛(frontend) analytic feature flags problem #1953
 - 🐛(frontend) fix home collapsing panel #1954
 - 🐛(frontend) fix disabled color on icon Dropdown #1950
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -33,6 +33,9 @@ Other changes:
 - The deprecated endpoint `/api/v1.0/documents/<document_id>/descendants` is removed. The search endpoint should be used instead.
 - Upgrade docspec dependency to version >= 3.0.0
  The docspec service has changed since version 3.0.0, we ware now compatible with this version and not with version 2.x.x anymore
+- It is now possible to use the Mistral SDK instead of the OpenAI for the AI features. If your provider is compatible with the mistral API, we encourage you to use it.
+- `AI_API_KEY` settings is renamed in `OPENAI_SDK_API_KEY` and is only used to congiure the OpenAi sdk
+- `AI_BASE_URL` settings is renamed in `OPENAI_SDK_BASE_URL` and is only used to congiure the OpenAi sdk

 ## [4.6.0] - 2026-02-27

--- a/docs/env.md
+++ b/docs/env.md
@@ -9,14 +9,16 @@ These are the environment variables you can set for the `impress-backend` contai
 | Option                                          | Description                                                                                                                                                                | default                                                                 |
 | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
 | AI_ALLOW_REACH_FROM                             | Users that can use AI must be this level. options are "public", "authenticated", "restricted"                                                                              | authenticated                                                           |
-| AI_API_KEY                                      | AI key to be used for AI Base url                                                                                                                                          |                                                                         |
-| AI_BASE_URL                                     | OpenAI compatible AI base url                                                                                                                                              |                                                                         |
-| AI_BOT                                          | Information to give to the frontend about the AI bot                                          | { "name": "Docs AI", "color": "#8bc6ff" } 
+| OPENAI_SDK_API_KEY                              | AI key to be used by the OpenAI python SDK                                                                                                                                 |                                                                         |
+| OPENAI_SDK_BASE_URL                             | OpenAI compatible AI base url                                                                                                                                              |                                                                         |
+| MISTRAL_SDK_API_KEY                             | AI key to be used by the Mistral python SDK /!\ Mistral sdk can be used only in async mode with uvicorn /!\                                                                |                                                                         |
+| MISTRAL_SDK_BASE_URL                            | Mistral compatible AI base url                                                                                                                                             |                                                                         |
+| AI_BOT                                          | Information to give to the frontend about the AI bot                                                                                                                       | { "name": "Docs AI", "color": "#8bc6ff" }                               |
 | AI_FEATURE_ENABLED                              | Enable AI options                                                                                                                                                          | false                                                                   |
-| AI_FEATURE_BLOCKNOTE_ENABLED                    | Enable Blocknote AI options                                                                                                                                                          | false                                                                   |
-| AI_FEATURE_LEGACY_ENABLED                       | Enable legacyAI options                                                                                                                                                          | true                                                                    |
+| AI_FEATURE_BLOCKNOTE_ENABLED                    | Enable Blocknote AI options                                                                                                                                                | false                                                                   |
+| AI_FEATURE_LEGACY_ENABLED                       | Enable legacyAI options                                                                                                                                                    | true                                                                    |
 | AI_MODEL                                        | AI Model to use                                                                                                                                                            |                                                                         |
-| AI_VERCEL_SDK_VERSION                            | The vercel AI SDK version used                                                                                                                                                             | 6                                                                        |
+| AI_VERCEL_SDK_VERSION                            | The vercel AI SDK version used                                                                                                                                            | 6                                                                       |
 | ALLOW_LOGOUT_GET_METHOD                         | Allow get logout method                                                                                                                                                    | true                                                                    |
 | API_USERS_LIST_LIMIT                            | Limit on API users                                                                                                                                                         | 5                                                                       |
 | API_USERS_LIST_THROTTLE_RATE_BURST              | Throttle rate for api on burst                                                                                                                                             | 30/minute                                                               |
@@ -91,6 +93,7 @@ These are the environment variables you can set for the `impress-backend` contai
 | MALWARE_DETECTION_BACKEND                       | The malware detection backend use from the django-lasuite package                                                                                                          | lasuite.malware_detection.backends.dummy.DummyBackend                   |
 | MALWARE_DETECTION_PARAMETERS                    | A dict containing all the parameters to initiate the malware detection backend                                                                                             | {"callback_path": "core.malware_detection.malware_detection_callback",} |
 | MEDIA_BASE_URL                                  |                                                                                                                                                                            |                                                                         |
+| MEDIA_AUTH_ORIGINAL_URL_HEADER                  | Parameter containing the original request URL, as seen at the media auth endpoint, in CGI/WSGI form (HTTP_HEADER_NAME_ALL_CAPS_WITH_UNDERSCORES)                           | HTTP_X_ORIGINAL_URL                                                     |
 | NO_WEBSOCKET_CACHE_TIMEOUT                      | Cache used to store current editor session key when only users without websocket are editing a document                                                                    | 120                                                                     |
 | OIDC_ALLOW_DUPLICATE_EMAILS                     | Allow duplicate emails                                                                                                                                                     | false                                                                   |
 | OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | OIDC extra auth parameters                                                                                                                                                 | {}                                                                      |
--- a/env.d/development/common
+++ b/env.d/development/common
@@ -71,14 +71,6 @@ OIDC_RS_ALLOWED_AUDIENCES=""
 # User reconciliation
 USER_RECONCILIATION_FORM_URL=http://localhost:3000

-# AI
-AI_FEATURE_ENABLED=true
-AI_FEATURE_BLOCKNOTE_ENABLED=true
-AI_FEATURE_LEGACY_ENABLED=true
-AI_BASE_URL=https://openaiendpoint.com
-AI_API_KEY=password
-AI_MODEL=llama
-
 # Collaboration
 COLLABORATION_API_URL=http://y-provider-development:4444/collaboration/api/
 COLLABORATION_BACKEND_BASE_URL=http://app-dev:8000
--- a/src/backend/core/api/serializers.py
+++ b/src/backend/core/api/serializers.py
@@ -13,12 +13,13 @@ from django.utils.functional import lazy
 from django.utils.text import slugify
 from django.utils.translation import gettext_lazy as _

+import emoji
 import magic
 from rest_framework import serializers

 from core import choices, enums, models, validators
 from core.services import mime_types
-from core.services.ai_services import AI_ACTIONS
+from core.services.ai_services.legacy import AI_ACTIONS
 from core.services.converter_services import (
    ConversionError,
    Converter,
@@ -875,6 +876,12 @@ class ReactionSerializer(serializers.ModelSerializer):
        ]
        read_only_fields = ["id", "created_at", "users"]

+    def validate_emoji(self, value):
+        """Ensure the reaction is a single emoji."""
+        if not emoji.is_emoji(value):
+            raise serializers.ValidationError("Reaction must be a single valid emoji.")
+        return value
+

 class CommentSerializer(serializers.ModelSerializer):
    """Serialize comments (nested under a thread) with reactions and abilities."""
--- a/src/backend/core/api/viewsets.py
+++ b/src/backend/core/api/viewsets.py
@@ -44,11 +44,13 @@ from rest_framework import filters, status, viewsets
 from rest_framework import response as drf_response
 from rest_framework.permissions import AllowAny
 from rest_framework.views import APIView
+from treebeard.exceptions import InvalidMoveToDescendant

 from core import authentication, choices, enums, models
 from core.api.filters import remove_accents
 from core.services import mime_types
-from core.services.ai_services import AIService
+from core.services.ai_services.blocknote import AIService
+from core.services.ai_services.legacy import get_legacy_ai_service
 from core.services.collaboration_services import CollaborationService
 from core.services.converter_services import (
    ConversionError,
@@ -961,7 +963,13 @@ class DocumentViewSet(
                status=status.HTTP_400_BAD_REQUEST,
            )

-        document.move(target_document, pos=position)
+        try:
+            document.move(target_document, pos=position)
+        except InvalidMoveToDescendant:
+            return drf.response.Response(
+                {"target_document_id": "Cannot move a document to its own descendant."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )

        # Make sure we have at least one owner
        if (
@@ -989,7 +997,10 @@ class DocumentViewSet(
        Restore a soft-deleted document if it was deleted less than x days ago.
        """
        document = self.get_object()
-        document.restore()
+        try:
+            document.restore()
+        except RuntimeError as err:
+            raise drf.exceptions.ValidationError({"detail": str(err)}) from err

        return drf_response.Response(
            {"detail": "Document has been successfully restored."},
@@ -1752,10 +1763,13 @@ class DocumentViewSet(

    def _auth_get_original_url(self, request):
        """
-        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
+        Extracts and parses the original URL from the configured parameter header.
        Raises PermissionDenied if the header is missing.

-        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        The original url is passed by reverse proxy in the header specified by the
+        MEDIA_AUTH_ORIGINAL_URL_HEADER setting.
+
+        For nginx (the default) this is set to HTTP_X_ORIGINAL_URL.
        See corresponding ingress configuration in Helm chart and read about the
        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
        is configured to do this.
@@ -1766,9 +1780,14 @@ class DocumentViewSet(
        reasons.
        """
        # Extract the original URL from the request header
-        original_url = request.META.get("HTTP_X_ORIGINAL_URL")
+        original_url = request.META.get(settings.MEDIA_AUTH_ORIGINAL_URL_HEADER)
        if not original_url:
-            logger.debug("Missing HTTP_X_ORIGINAL_URL header in subrequest")
+            logger.debug(
+                "Missing %s header in subrequest. "
+                "Maybe you need to set MEDIA_AUTH_ORIGINAL_URL_HEADER correctly for your ingress"
+                " proxy.",
+                settings.MEDIA_AUTH_ORIGINAL_URL_HEADER,
+            )
            raise drf.exceptions.PermissionDenied()

        logger.debug("Original url: '%s'", original_url)
@@ -2115,13 +2134,16 @@ class DocumentViewSet(
        # Check permissions first
        self.get_object()

+        if not settings.AI_FEATURE_ENABLED or not settings.AI_FEATURE_LEGACY_ENABLED:
+            raise ValidationError("AI feature is not enabled.")
+
        serializer = serializers.AITransformSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)

        text = serializer.validated_data["text"]
        action = serializer.validated_data["action"]

-        response = AIService().transform(text, action)
+        response = get_legacy_ai_service().transform(text, action)

        return drf.response.Response(response, status=drf.status.HTTP_200_OK)

@@ -2143,13 +2165,16 @@ class DocumentViewSet(
        # Check permissions first
        self.get_object()

+        if not settings.AI_FEATURE_ENABLED or not settings.AI_FEATURE_LEGACY_ENABLED:
+            raise ValidationError("AI feature is not enabled.")
+
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)

        text = serializer.validated_data["text"]
        language = serializer.validated_data["language"]

-        response = AIService().translate(text, language)
+        response = get_legacy_ai_service().translate(text, language)

        return drf.response.Response(response, status=drf.status.HTTP_200_OK)

@@ -2260,7 +2285,7 @@ class DocumentViewSet(
        GET /api/v1.0/documents/<resource_id>/cors-proxy
        Act like a proxy to fetch external resources and bypass CORS restrictions.
        """
-        url = request.query_params.get("url")
+        url = request.query_params.get("url", "").strip()
        if not url:
            return drf.response.Response(
                {"detail": "Missing 'url' query parameter"},
--- a/src/backend/core/factories.py
+++ b/src/backend/core/factories.py
@@ -231,9 +231,10 @@ class ReactionFactory(factory.django.DjangoModelFactory):

    class Meta:
        model = models.Reaction
+        skip_postgeneration_save = True

    comment = factory.SubFactory(CommentFactory)
-    emoji = "test"
+    emoji = factory.Faker("emoji")

    @factory.post_generation
    def users(self, create, extracted, **kwargs):
--- a/src/backend/core/services/ai_services/blocknote.py
+++ b/src/backend/core/services/ai_services/blocknote.py
@@ -7,15 +7,17 @@ import os
 import queue
 import threading
 from collections.abc import AsyncIterator, Iterator
+from functools import cache
 from typing import Any, Dict, Union

 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured

 from langfuse import get_client
-from langfuse.openai import OpenAI as OpenAI_Langfuse
 from pydantic_ai import Agent, DeferredToolRequests
+from pydantic_ai.models.mistral import MistralModel
 from pydantic_ai.models.openai import OpenAIChatModel
+from pydantic_ai.providers.mistral import MistralProvider
 from pydantic_ai.providers.openai import OpenAIProvider
 from pydantic_ai.tools import ToolDefinition
 from pydantic_ai.toolsets.external import ExternalToolset
@@ -24,13 +26,6 @@ from pydantic_ai.ui.vercel_ai import VercelAIAdapter
 from pydantic_ai.ui.vercel_ai.request_types import RequestData, TextUIPart, UIMessage
 from rest_framework.request import Request

-from core import enums
-
-if settings.LANGFUSE_PUBLIC_KEY:
-    OpenAI = OpenAI_Langfuse
-else:
-    from openai import OpenAI
-
 log = logging.getLogger(__name__)

 BLOCKNOTE_TOOL_STRICT_PROMPT = """
@@ -64,50 +59,6 @@ IDs ALWAYS end with "$". Use ids EXACTLY as provided.
 Return ONLY the JSON tool input. No prose, no markdown.
 """

-AI_ACTIONS = {
-    "prompt": (
-        "Answer the prompt using markdown formatting for structure and emphasis. "
-        "Return the content directly without wrapping it in code blocks or markdown delimiters. "
-        "Preserve the language and markdown formatting. "
-        "Do not provide any other information. "
-        "Preserve the language."
-    ),
-    "correct": (
-        "Correct grammar and spelling of the markdown text, "
-        "preserving language and markdown formatting. "
-        "Do not provide any other information. "
-        "Preserve the language."
-    ),
-    "rephrase": (
-        "Rephrase the given markdown text, "
-        "preserving language and markdown formatting. "
-        "Do not provide any other information. "
-        "Preserve the language."
-    ),
-    "summarize": (
-        "Summarize the markdown text, preserving language and markdown formatting. "
-        "Do not provide any other information. "
-        "Preserve the language."
-    ),
-    "beautify": (
-        "Add formatting to the text to make it more readable. "
-        "Do not provide any other information. "
-        "Preserve the language."
-    ),
-    "emojify": (
-        "Add emojis to the important parts of the text. "
-        "Do not provide any other information. "
-        "Preserve the language."
-    ),
-}
-
-AI_TRANSLATE = (
-    "Keep the same html structure and formatting. "
-    "Translate the content in the html to the specified language {language:s}. "
-    "Check the translation for accuracy and make any necessary corrections. "
-    "Do not provide any other information."
-)
-

 def convert_async_generator_to_sync(async_gen: AsyncIterator[str]) -> Iterator[str]:
    """Convert an async generator to a sync generator."""
@@ -143,46 +94,40 @@ def convert_async_generator_to_sync(async_gen: AsyncIterator[str]) -> Iterator[s
        thread.join()


-class AIService:
-    """Service class for AI-related operations."""
-
-    def __init__(self):
-        """Ensure that the AI configuration is set properly."""
-        if (
-            settings.AI_BASE_URL is None
-            or settings.AI_API_KEY is None
-            or settings.AI_MODEL is None
-        ):
-            raise ImproperlyConfigured("AI configuration not set")
-        self.client = OpenAI(base_url=settings.AI_BASE_URL, api_key=settings.AI_API_KEY)
-
-    def call_ai_api(self, system_content, text):
-        """Helper method to call the OpenAI API and process the response."""
-        response = self.client.chat.completions.create(
-            model=settings.AI_MODEL,
-            messages=[
-                {"role": "system", "content": system_content},
-                {"role": "user", "content": text},
-            ],
+@cache
+def configure_pydantic_model_provider() -> OpenAIChatModel | MistralModel:
+    """Configure a pydantic Model and return it."""
+    if (
+        settings.OPENAI_SDK_API_KEY
+        and settings.OPENAI_SDK_BASE_URL
+        and settings.AI_MODEL
+    ):
+        return OpenAIChatModel(
+            settings.AI_MODEL,
+            provider=OpenAIProvider(
+                api_key=settings.OPENAI_SDK_API_KEY,
+                base_url=settings.OPENAI_SDK_BASE_URL,
+            ),
        )

-        content = response.choices[0].message.content
+    if (
+        settings.MISTRAL_SDK_API_KEY
+        and settings.MISTRAL_SDK_BASE_URL
+        and settings.AI_MODEL
+    ):
+        return MistralModel(
+            settings.AI_MODEL,
+            provider=MistralProvider(
+                api_key=settings.MISTRAL_SDK_API_KEY,
+                base_url=settings.MISTRAL_SDK_BASE_URL,
+            ),
+        )

-        if not content:
-            raise RuntimeError("AI response does not contain an answer")
+    raise ImproperlyConfigured("AI configuration not set")

-        return {"answer": content}

-    def transform(self, text, action):
-        """Transform text based on specified action."""
-        system_content = AI_ACTIONS[action]
-        return self.call_ai_api(system_content, text)
-
-    def translate(self, text, language):
-        """Translate text to a specified language."""
-        language_display = enums.ALL_LANGUAGES.get(language, language)
-        system_content = AI_TRANSLATE.format(language=language_display)
-        return self.call_ai_api(system_content, text)
+class AIService:
+    """Service class for AI-related operations."""

    @staticmethod
    def inject_document_state_messages(
@@ -324,13 +269,9 @@ class AIService:
            langfuse.auth_check()
            Agent.instrument_all()

-        model = OpenAIChatModel(
-            settings.AI_MODEL,
-            provider=OpenAIProvider(
-                base_url=settings.AI_BASE_URL, api_key=settings.AI_API_KEY
-            ),
+        agent = Agent(
+            configure_pydantic_model_provider(), instrument=instrument_enabled
        )
-        agent = Agent(model, instrument=instrument_enabled)

        accept = request.META.get("HTTP_ACCEPT", SSE_CONTENT_TYPE)

--- a/src/backend/core/services/ai_services/legacy.py
+++ b/src/backend/core/services/ai_services/legacy.py
@@ -0,0 +1,201 @@
+"""Module dedicated to the legacy ai services."""
+
+import logging
+from abc import ABC, abstractmethod
+from functools import cache
+
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+
+from langfuse import get_client, observe
+from langfuse.openai import OpenAI as OpenAI_Langfuse
+from mistralai import Mistral
+
+from core import enums
+
+if settings.LANGFUSE_PUBLIC_KEY:
+    OpenAI = OpenAI_Langfuse
+else:
+    from openai import OpenAI
+
+log = logging.getLogger(__name__)
+
+AI_ACTIONS = {
+    "prompt": (
+        "Answer the prompt using markdown formatting for structure and emphasis. "
+        "Return the content directly without wrapping it in code blocks or markdown delimiters. "
+        "Preserve the language and markdown formatting. "
+        "Do not provide any other information. "
+        "Preserve the language."
+    ),
+    "correct": (
+        "Correct grammar and spelling of the markdown text, "
+        "preserving language and markdown formatting. "
+        "Do not provide any other information. "
+        "Preserve the language."
+    ),
+    "rephrase": (
+        "Rephrase the given markdown text, "
+        "preserving language and markdown formatting. "
+        "Do not provide any other information. "
+        "Preserve the language."
+    ),
+    "summarize": (
+        "Summarize the markdown text, preserving language and markdown formatting. "
+        "Do not provide any other information. "
+        "Preserve the language."
+    ),
+    "beautify": (
+        "Add formatting to the text to make it more readable. "
+        "Do not provide any other information. "
+        "Preserve the language."
+    ),
+    "emojify": (
+        "Add emojis to the important parts of the text. "
+        "Do not provide any other information. "
+        "Preserve the language."
+    ),
+}
+
+AI_TRANSLATE = (
+    "Keep the same html structure and formatting. "
+    "Translate the content in the html to the specified language {language:s}. "
+    "Check the translation for accuracy and make any necessary corrections. "
+    "Do not provide any other information. "
+    "Return the content directly without wrapping it in code blocks or markdown delimiters."
+)
+
+
+class LegacyAiClient(ABC):
+    """abstract class for legacy client."""
+
+    @abstractmethod
+    def call_ai_api(self, system_content, text) -> str:
+        """Abstract method call_ai_api."""
+
+
+class LegacyAiServiceMistralClient(LegacyAiClient):
+    """ai_service using mistral sdk for the legacy ai feature."""
+
+    def __init__(self):
+        """Configure mistral sdk"""
+        if (
+            not settings.MISTRAL_SDK_API_KEY
+            or not settings.MISTRAL_SDK_BASE_URL
+            or not settings.AI_MODEL
+        ):
+            raise ImproperlyConfigured("Mistral sdk configuration not set")
+
+        self.client = Mistral(
+            api_key=settings.MISTRAL_SDK_API_KEY,
+            server_url=settings.MISTRAL_SDK_BASE_URL,
+        )
+
+    @observe(as_type="generation")
+    def call_ai_api(self, system_content, text) -> str:
+        langfuse = None
+        messages = [
+            {"role": "system", "content": system_content},
+            {"role": "user", "content": text},
+        ]
+        if settings.LANGFUSE_PUBLIC_KEY:
+            langfuse = get_client()
+            langfuse.auth_check()
+
+            langfuse.update_current_generation(
+                input=messages,
+                model=settings.AI_MODEL,
+            )
+
+        response = self.client.chat.complete(
+            model=settings.AI_MODEL,
+            messages=messages,
+            stream=False,
+        )
+
+        if langfuse:
+            langfuse.update_current_generation(
+                usage_details={
+                    "input": response.usage.prompt_tokens,
+                    "output": response.usage.completion_tokens,
+                },
+                output=response.choices[0].message.content,
+            )
+
+        return response.choices[0].message.content
+
+
+class LegacyAiServiceOpenAiClient(LegacyAiClient):
+    """ai_service using OpenAI client for the legacy ai feature."""
+
+    def __init__(self):
+        """configure OpenAI client."""
+        if (
+            not settings.OPENAI_SDK_BASE_URL
+            or not settings.OPENAI_SDK_API_KEY
+            or not settings.AI_MODEL
+        ):
+            raise ImproperlyConfigured("OpenAI configuration not set")
+        self.client = OpenAI(
+            base_url=settings.OPENAI_SDK_BASE_URL, api_key=settings.OPENAI_SDK_API_KEY
+        )
+
+    def call_ai_api(self, system_content, text) -> str:
+        response = self.client.chat.completions.create(
+            model=settings.AI_MODEL,
+            messages=[
+                {"role": "system", "content": system_content},
+                {"role": "user", "content": text},
+            ],
+        )
+
+        return response.choices[0].message.content
+
+
+class LegacyAIService:
+    """Legacy ai service used by transform and translate actions."""
+
+    def __init__(self, ai_client: LegacyAiClient):
+        """Assign client to the service."""
+        self.ai_client = ai_client
+
+    def call_ai_api(self, system_content, text):
+        """Helper method to call the OpenAI API and process the response."""
+
+        content = self.ai_client.call_ai_api(system_content, text)
+
+        if not content:
+            raise RuntimeError("AI response does not contain an answer")
+
+        return {"answer": content}
+
+    def transform(self, text, action):
+        """Transform text based on specified action."""
+        system_content = AI_ACTIONS[action]
+        return self.call_ai_api(system_content, text)
+
+    def translate(self, text, language):
+        """Translate text to a specified language."""
+        language_display = enums.ALL_LANGUAGES.get(language, language)
+        system_content = AI_TRANSLATE.format(language=language_display)
+        return self.call_ai_api(system_content, text)
+
+
+@cache
+def get_legacy_ai_service() -> LegacyAIService:
+    """Helper responsible to correctly instantiate and configure legacy ai service."""
+
+    ai_client = None
+
+    if settings.MISTRAL_SDK_API_KEY:
+        ai_client = LegacyAiServiceMistralClient()
+
+    if settings.OPENAI_SDK_API_KEY:
+        ai_client = LegacyAiServiceOpenAiClient()
+
+    if not ai_client:
+        raise ImproperlyConfigured(
+            "trying to configure legacy ai_service but missing client configuration."
+        )
+
+    return LegacyAIService(ai_client)
--- a/src/backend/core/tests/documents/test_api_documents_ai_proxy.py
+++ b/src/backend/core/tests/documents/test_api_documents_ai_proxy.py
@@ -11,6 +11,7 @@ import pytest
 from rest_framework.test import APIClient

 from core import factories
+from core.services.ai_services.blocknote import configure_pydantic_model_provider
 from core.tests.conftest import TEAM, USER, VIA

 pytestmark = pytest.mark.django_db
@@ -20,13 +21,14 @@ pytestmark = pytest.mark.django_db
 def ai_settings(settings):
    """Fixture to set AI settings."""
    settings.AI_MODEL = "llama"
-    settings.AI_BASE_URL = "http://localhost-ai:12345/"
-    settings.AI_API_KEY = "test-key"
+    settings.OPENAI_SDK_BASE_URL = "http://localhost-ai:12345/"
+    settings.OPENAI_SDK_API_KEY = "test-key"
    settings.AI_FEATURE_ENABLED = True
    settings.AI_FEATURE_BLOCKNOTE_ENABLED = True
    settings.AI_FEATURE_LEGACY_ENABLED = True
    settings.LANGFUSE_PUBLIC_KEY = None
    settings.AI_VERCEL_SDK_VERSION = 6
+    configure_pydantic_model_provider.cache_clear()


@override_settings(
@@ -65,7 +67,7 @@ def test_api_documents_ai_proxy_anonymous_forbidden(reach, role):


@override_settings(AI_ALLOW_REACH_FROM="public")
-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_api_documents_ai_proxy_anonymous_success(mock_stream):
    """
    Anonymous users should be able to request AI proxy to a document
@@ -149,7 +151,7 @@ def test_api_documents_ai_proxy_authenticated_forbidden(reach, role):
        ("public", "editor"),
    ],
 )
-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_api_documents_ai_proxy_authenticated_success(mock_stream, reach, role):
    """
    Authenticated users should be able to request AI proxy to a document
@@ -205,7 +207,7 @@ def test_api_documents_ai_proxy_reader(via, mock_user_teams):

@pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
@pytest.mark.parametrize("via", VIA)
-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_api_documents_ai_proxy_success(mock_stream, via, role, mock_user_teams):
    """Users with sufficient permissions should be able to request AI proxy."""
    user = factories.UserFactory()
@@ -266,7 +268,7 @@ def test_api_documents_ai_proxy_ai_feature_disabled(settings, setting_to_disable


@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_api_documents_ai_proxy_throttling_document(mock_stream):
    """
    Throttling per document should be triggered on the AI proxy endpoint.
@@ -304,7 +306,7 @@ def test_api_documents_ai_proxy_throttling_document(mock_stream):


@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_api_documents_ai_proxy_throttling_user(mock_stream):
    """
    Throttling per user should be triggered on the AI proxy endpoint.
@@ -339,7 +341,7 @@ def test_api_documents_ai_proxy_throttling_user(mock_stream):
    }


-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_api_documents_ai_proxy_returns_streaming_response(mock_stream):
    """AI proxy should return a StreamingHttpResponse with correct headers."""
    user = factories.UserFactory()
--- a/src/backend/core/tests/documents/test_api_documents_ai_transform.py
+++ b/src/backend/core/tests/documents/test_api_documents_ai_transform.py
@@ -2,47 +2,62 @@
 Test AI transform API endpoint for users in impress's core app.
 """

-import random
 from unittest.mock import MagicMock, patch

-from django.test import override_settings
-
 import pytest
 from rest_framework.test import APIClient

 from core import factories
+from core.services.ai_services.legacy import get_legacy_ai_service
 from core.tests.conftest import TEAM, USER, VIA

 pytestmark = pytest.mark.django_db


@pytest.fixture
-def ai_settings():
+def ai_settings(settings):
    """Fixture to set AI settings."""
-    with override_settings(
-        AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="llama"
-    ):
-        yield
+    settings.AI_FEATURE_ENABLED = True
+    settings.AI_FEATURE_LEGACY_ENABLED = True
+    settings.OPENAI_SDK_BASE_URL = "http://example.com"
+    settings.OPENAI_SDK_API_KEY = "test-key"
+    settings.AI_MODEL = "llama"
+
+
+@pytest.fixture(autouse=True)
+def clear_openai_client_config():
+    """Clear the _configure_legacy_openai_client cache"""
+    get_legacy_ai_service.cache_clear()


-@override_settings(
-    AI_ALLOW_REACH_FROM=random.choice(["public", "authenticated", "restricted"])
-)
@pytest.mark.parametrize(
-    "reach, role",
+    "reach, role, ai_allow_reach_from",
    [
-        ("restricted", "reader"),
-        ("restricted", "editor"),
-        ("authenticated", "reader"),
-        ("authenticated", "editor"),
-        ("public", "reader"),
+        ("restricted", "reader", "public"),
+        ("restricted", "reader", "authenticated"),
+        ("restricted", "reader", "restricted"),
+        ("restricted", "editor", "public"),
+        ("restricted", "editor", "authenticated"),
+        ("restricted", "editor", "restricted"),
+        ("authenticated", "reader", "public"),
+        ("authenticated", "reader", "authenticated"),
+        ("authenticated", "reader", "restricted"),
+        ("authenticated", "editor", "public"),
+        ("authenticated", "editor", "authenticated"),
+        ("authenticated", "editor", "restricted"),
+        ("public", "reader", "public"),
+        ("public", "reader", "authenticated"),
+        ("public", "reader", "restricted"),
    ],
 )
-def test_api_documents_ai_transform_anonymous_forbidden(reach, role):
+def test_api_documents_ai_transform_anonymous_forbidden(
+    reach, role, ai_allow_reach_from, settings
+):
    """
    Anonymous users should not be able to request AI transform if the link reach
    and role don't allow it.
    """
+    settings.AI_ALLOW_REACH_FROM = ai_allow_reach_from
    document = factories.DocumentFactory(link_reach=reach, link_role=role)

    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
@@ -54,14 +69,14 @@ def test_api_documents_ai_transform_anonymous_forbidden(reach, role):
    }


-@override_settings(AI_ALLOW_REACH_FROM="public")
@pytest.mark.usefixtures("ai_settings")
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_anonymous_success(mock_create):
+def test_api_documents_ai_transform_anonymous_success(mock_create, settings):
    """
    Anonymous users should be able to request AI transform to a document
    if the link reach and role permit it.
    """
+    settings.AI_ALLOW_REACH_FROM = "public"
    document = factories.DocumentFactory(link_reach="public", link_role="editor")

    mock_create.return_value = MagicMock(
@@ -88,14 +103,17 @@ def test_api_documents_ai_transform_anonymous_success(mock_create):
    )


-@override_settings(AI_ALLOW_REACH_FROM=random.choice(["authenticated", "restricted"]))
@pytest.mark.usefixtures("ai_settings")
+@pytest.mark.parametrize("ai_allow_reach_from", ["authenticated", "restricted"])
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_anonymous_limited_by_setting(mock_create):
+def test_api_documents_ai_transform_anonymous_limited_by_setting(
+    mock_create, ai_allow_reach_from, settings
+):
    """
    Anonymous users should be able to request AI transform to a document
    if the link reach and role permit it.
    """
+    settings.AI_ALLOW_REACH_FROM = ai_allow_reach_from
    document = factories.DocumentFactory(link_reach="public", link_role="editor")

    answer = '{"answer": "Salut"}'
@@ -176,8 +194,8 @@ def test_api_documents_ai_transform_authenticated_success(mock_create, reach, ro
                "role": "system",
                "content": (
                    "Answer the prompt using markdown formatting for structure and emphasis. "
-                    "Return the content directly without wrapping it in code blocks or markdown delimiters. "
-                    "Preserve the language and markdown formatting. "
+                    "Return the content directly without wrapping it in code blocks or markdown "
+                    "delimiters. Preserve the language and markdown formatting. "
                    "Do not provide any other information. "
                    "Preserve the language."
                ),
@@ -253,8 +271,8 @@ def test_api_documents_ai_transform_success(mock_create, via, role, mock_user_te
                "role": "system",
                "content": (
                    "Answer the prompt using markdown formatting for structure and emphasis. "
-                    "Return the content directly without wrapping it in code blocks or markdown delimiters. "
-                    "Preserve the language and markdown formatting. "
+                    "Return the content directly without wrapping it in code blocks or markdown "
+                    "delimiters. Preserve the language and markdown formatting. "
                    "Do not provide any other information. "
                    "Preserve the language."
                ),
@@ -264,6 +282,7 @@ def test_api_documents_ai_transform_success(mock_create, via, role, mock_user_te
    )


+@pytest.mark.usefixtures("ai_settings")
 def test_api_documents_ai_transform_empty_text():
    """The text should not be empty when requesting AI transform."""
    user = factories.UserFactory()
@@ -280,6 +299,7 @@ def test_api_documents_ai_transform_empty_text():
    assert response.json() == {"text": ["This field may not be blank."]}


+@pytest.mark.usefixtures("ai_settings")
 def test_api_documents_ai_transform_invalid_action():
    """The action should valid when requesting AI transform."""
    user = factories.UserFactory()
@@ -296,14 +316,14 @@ def test_api_documents_ai_transform_invalid_action():
    assert response.json() == {"action": ['"invalid" is not a valid choice.']}


-@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
@pytest.mark.usefixtures("ai_settings")
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_throttling_document(mock_create):
+def test_api_documents_ai_transform_throttling_document(mock_create, settings):
    """
    Throttling per document should be triggered on the AI transform endpoint.
    For full throttle class test see: `test_api_utils_ai_document_rate_throttles`
    """
+    settings.AI_DOCUMENT_RATE_THROTTLE_RATES = {"minute": 3, "hour": 6, "day": 10}
    client = APIClient()
    document = factories.DocumentFactory(link_reach="public", link_role="editor")

@@ -329,14 +349,14 @@ def test_api_documents_ai_transform_throttling_document(mock_create):
    }


-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
@pytest.mark.usefixtures("ai_settings")
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_throttling_user(mock_create):
+def test_api_documents_ai_transform_throttling_user(mock_create, settings):
    """
    Throttling per user should be triggered on the AI transform endpoint.
    For full throttle class test see: `test_api_utils_ai_user_rate_throttles`
    """
+    settings.AI_USER_RATE_THROTTLE_RATES = {"minute": 3, "hour": 6, "day": 10}
    user = factories.UserFactory()
    client = APIClient()
    client.force_login(user)
--- a/src/backend/core/tests/documents/test_api_documents_ai_translate.py
+++ b/src/backend/core/tests/documents/test_api_documents_ai_translate.py
@@ -2,27 +2,32 @@
 Test AI translate API endpoint for users in impress's core app.
 """

-import random
 from unittest.mock import MagicMock, patch

-from django.test import override_settings
-
 import pytest
 from rest_framework.test import APIClient

 from core import factories
+from core.services.ai_services.legacy import get_legacy_ai_service
 from core.tests.conftest import TEAM, USER, VIA

 pytestmark = pytest.mark.django_db


@pytest.fixture
-def ai_settings():
+def ai_settings(settings):
    """Fixture to set AI settings."""
-    with override_settings(
-        AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="llama"
-    ):
-        yield
+    settings.AI_FEATURE_ENABLED = True
+    settings.AI_FEATURE_LEGACY_ENABLED = True
+    settings.OPENAI_SDK_BASE_URL = "http://example.com"
+    settings.OPENAI_SDK_API_KEY = "test-key"
+    settings.AI_MODEL = "llama"
+
+
+@pytest.fixture(autouse=True)
+def clear_openai_client_config():
+    "clear the configure_legacy_openai_client cache"
+    get_legacy_ai_service.cache_clear()


 def test_api_documents_ai_translate_viewset_options_metadata():
@@ -45,24 +50,34 @@ def test_api_documents_ai_translate_viewset_options_metadata():
    }


-@override_settings(
-    AI_ALLOW_REACH_FROM=random.choice(["public", "authenticated", "restricted"])
-)
@pytest.mark.parametrize(
-    "reach, role",
+    "reach, role, ai_allow_reach_from",
    [
-        ("restricted", "reader"),
-        ("restricted", "editor"),
-        ("authenticated", "reader"),
-        ("authenticated", "editor"),
-        ("public", "reader"),
+        ("restricted", "reader", "public"),
+        ("restricted", "reader", "authenticated"),
+        ("restricted", "reader", "restricted"),
+        ("restricted", "editor", "public"),
+        ("restricted", "editor", "authenticated"),
+        ("restricted", "editor", "restricted"),
+        ("authenticated", "reader", "public"),
+        ("authenticated", "reader", "authenticated"),
+        ("authenticated", "reader", "restricted"),
+        ("authenticated", "editor", "public"),
+        ("authenticated", "editor", "authenticated"),
+        ("authenticated", "editor", "restricted"),
+        ("public", "reader", "public"),
+        ("public", "reader", "authenticated"),
+        ("public", "reader", "restricted"),
    ],
 )
-def test_api_documents_ai_translate_anonymous_forbidden(reach, role):
+def test_api_documents_ai_translate_anonymous_forbidden(
+    reach, role, ai_allow_reach_from, settings
+):
    """
    Anonymous users should not be able to request AI translate if the link reach
    and role don't allow it.
    """
+    settings.AI_ALLOW_REACH_FROM = ai_allow_reach_from
    document = factories.DocumentFactory(link_reach=reach, link_role=role)

    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
@@ -74,14 +89,14 @@ def test_api_documents_ai_translate_anonymous_forbidden(reach, role):
    }


-@override_settings(AI_ALLOW_REACH_FROM="public")
@pytest.mark.usefixtures("ai_settings")
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_anonymous_success(mock_create):
+def test_api_documents_ai_translate_anonymous_success(mock_create, settings):
    """
    Anonymous users should be able to request AI translate to a document
    if the link reach and role permit it.
    """
+    settings.AI_ALLOW_REACH_FROM = "public"
    document = factories.DocumentFactory(link_reach="public", link_role="editor")

    mock_create.return_value = MagicMock(
@@ -102,7 +117,9 @@ def test_api_documents_ai_translate_anonymous_success(mock_create):
                    "Keep the same html structure and formatting. "
                    "Translate the content in the html to the specified language Spanish. "
                    "Check the translation for accuracy and make any necessary corrections. "
-                    "Do not provide any other information."
+                    "Do not provide any other information. "
+                    "Return the content directly without wrapping it in code blocks or markdown "
+                    "delimiters."
                ),
            },
            {"role": "user", "content": "Hello"},
@@ -110,14 +127,17 @@ def test_api_documents_ai_translate_anonymous_success(mock_create):
    )


-@override_settings(AI_ALLOW_REACH_FROM=random.choice(["authenticated", "restricted"]))
@pytest.mark.usefixtures("ai_settings")
+@pytest.mark.parametrize("ai_allow_reach_from", ["authenticated", "restricted"])
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_anonymous_limited_by_setting(mock_create):
+def test_api_documents_ai_translate_anonymous_limited_by_setting(
+    mock_create, ai_allow_reach_from, settings
+):
    """
    Anonymous users should be able to request AI translate to a document
    if the link reach and role permit it.
    """
+    settings.AI_ALLOW_REACH_FROM = ai_allow_reach_from
    document = factories.DocumentFactory(link_reach="public", link_role="editor")

    answer = '{"answer": "Salut"}'
@@ -201,7 +221,9 @@ def test_api_documents_ai_translate_authenticated_success(mock_create, reach, ro
                    "Translate the content in the html to the "
                    "specified language Colombian Spanish. "
                    "Check the translation for accuracy and make any necessary corrections. "
-                    "Do not provide any other information."
+                    "Do not provide any other information. "
+                    "Return the content directly without wrapping it in code blocks or markdown "
+                    "delimiters."
                ),
            },
            {"role": "user", "content": "Hello"},
@@ -278,7 +300,9 @@ def test_api_documents_ai_translate_success(mock_create, via, role, mock_user_te
                    "Translate the content in the html to the "
                    "specified language Colombian Spanish. "
                    "Check the translation for accuracy and make any necessary corrections. "
-                    "Do not provide any other information."
+                    "Do not provide any other information. "
+                    "Return the content directly without wrapping it in code blocks or markdown "
+                    "delimiters."
                ),
            },
            {"role": "user", "content": "Hello"},
@@ -286,6 +310,7 @@ def test_api_documents_ai_translate_success(mock_create, via, role, mock_user_te
    )


+@pytest.mark.usefixtures("ai_settings")
 def test_api_documents_ai_translate_empty_text():
    """The text should not be empty when requesting AI translate."""
    user = factories.UserFactory()
@@ -302,6 +327,7 @@ def test_api_documents_ai_translate_empty_text():
    assert response.json() == {"text": ["This field may not be blank."]}


+@pytest.mark.usefixtures("ai_settings")
 def test_api_documents_ai_translate_invalid_action():
    """The action should valid when requesting AI translate."""
    user = factories.UserFactory()
@@ -318,14 +344,14 @@ def test_api_documents_ai_translate_invalid_action():
    assert response.json() == {"language": ['"invalid" is not a valid choice.']}


-@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
@pytest.mark.usefixtures("ai_settings")
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_throttling_document(mock_create):
+def test_api_documents_ai_translate_throttling_document(mock_create, settings):
    """
    Throttling per document should be triggered on the AI translate endpoint.
    For full throttle class test see: `test_api_utils_ai_document_rate_throttles`
    """
+    settings.AI_DOCUMENT_RATE_THROTTLE_RATES = {"minute": 3, "hour": 6, "day": 10}
    client = APIClient()
    document = factories.DocumentFactory(link_reach="public", link_role="editor")

@@ -351,14 +377,14 @@ def test_api_documents_ai_translate_throttling_document(mock_create):
    }


-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
@pytest.mark.usefixtures("ai_settings")
@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_throttling_user(mock_create):
+def test_api_documents_ai_translate_throttling_user(mock_create, settings):
    """
    Throttling per user should be triggered on the AI translate endpoint.
    For full throttle class test see: `test_api_utils_ai_user_rate_throttles`
    """
+    settings.AI_USER_RATE_THROTTLE_RATES = {"minute": 3, "hour": 6, "day": 10}
    user = factories.UserFactory()
    client = APIClient()
    client.force_login(user)
--- a/src/backend/core/tests/documents/test_api_documents_comments.py
+++ b/src/backend/core/tests/documents/test_api_documents_comments.py
@@ -644,11 +644,13 @@ def test_create_reaction_anonymous_user_public_document(link_role):
    document = factories.DocumentFactory(link_reach="public", link_role=link_role)
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 401

@@ -664,12 +666,14 @@ def test_create_reaction_authenticated_user_public_document():
    )
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 403

@@ -684,17 +688,19 @@ def test_create_reaction_authenticated_user_accessible_public_document():
    )
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 201

    assert models.Reaction.objects.filter(
-        comment=comment, emoji="test", users__in=[user]
+        comment=comment, emoji=reaction.emoji, users__in=[user]
    ).exists()


@@ -709,12 +715,14 @@ def test_create_reaction_authenticated_user_connected_document_link_role_reader(
    )
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 403

@@ -737,17 +745,19 @@ def test_create_reaction_authenticated_user_connected_document(link_role):
    )
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 201

    assert models.Reaction.objects.filter(
-        comment=comment, emoji="test", users__in=[user]
+        comment=comment, emoji=reaction.emoji, users__in=[user]
    ).exists()


@@ -760,12 +770,14 @@ def test_create_reaction_authenticated_user_restricted_accessible_document():
    document = factories.DocumentFactory(link_reach="restricted")
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 403

@@ -781,12 +793,14 @@ def test_create_reaction_authenticated_user_restricted_accessible_document_role_
    )
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 403

@@ -806,26 +820,70 @@ def test_create_reaction_authenticated_user_restricted_accessible_document_role_
    document = factories.DocumentFactory(link_reach="restricted", users=[(user, role)])
    thread = factories.ThreadFactory(document=document)
    comment = factories.CommentFactory(thread=thread)
+    reaction = factories.ReactionFactory(comment=comment)
+
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
+        {"emoji": reaction.emoji},
    )
    assert response.status_code == 201

    assert models.Reaction.objects.filter(
-        comment=comment, emoji="test", users__in=[user]
+        comment=comment, emoji=reaction.emoji, users__in=[user]
    ).exists()

+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
+        f"comments/{comment.id!s}/reactions/",
+        {"emoji": reaction.emoji},
+    )
+    assert response.status_code == 400
+    assert response.json() == {"user_already_reacted": True}
+
+
+def test_create_reaction_invalid_emoji():
+    """Users should not be able to submit non-emojis as reactions."""
+    user = factories.UserFactory()
+    document = factories.DocumentFactory(
+        link_reach="restricted", users=[(user, models.RoleChoices.COMMENTER)]
+    )
+    thread = factories.ThreadFactory(document=document)
+    comment = factories.CommentFactory(thread=thread)
+
+    client = APIClient()
+    client.force_login(user)
+
    response = client.post(
        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
        f"comments/{comment.id!s}/reactions/",
        {"emoji": "test"},
    )
    assert response.status_code == 400
-    assert response.json() == {"user_already_reacted": True}
+    assert "Reaction must be a single valid emoji." in str(response.json())
+
+
+def test_create_reaction_multiple_emojis():
+    """Users should not be able to submit multiple emojis as a single reaction."""
+    user = factories.UserFactory()
+    document = factories.DocumentFactory(
+        link_reach="restricted", users=[(user, models.RoleChoices.COMMENTER)]
+    )
+    thread = factories.ThreadFactory(document=document)
+    comment = factories.CommentFactory(thread=thread)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
+        f"comments/{comment.id!s}/reactions/",
+        {"emoji": "🐛🐛"},
+    )
+    assert response.status_code == 400
+    assert "Reaction must be a single valid emoji." in str(response.json())


 # Delete reaction
--- a/src/backend/core/tests/documents/test_api_documents_cors_proxy.py
+++ b/src/backend/core/tests/documents/test_api_documents_cors_proxy.py
@@ -55,6 +55,31 @@ def test_api_docs_cors_proxy_valid_url(mock_getaddrinfo):
    assert response.streaming_content


+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+@responses.activate
+def test_api_docs_cors_proxy_url_with_surrounding_whitespace(mock_getaddrinfo):
+    """
+    URLs with leading or trailing whitespace must still be proxied successfully,
+    otherwise images whose `src` has stray whitespace are missing from the PDF export.
+    """
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
+    client = APIClient()
+    url_to_fetch = "https://external-url.com/assets/logo-gouv.png"
+    responses.get(url_to_fetch, body=b"", status=200, content_type="image/png")
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url=   {url_to_fetch}   "
+    )
+    assert response.status_code == 200
+    assert response.headers["Content-Type"] == "image/png"
+    assert response.streaming_content
+
+
 def test_api_docs_cors_proxy_without_url_query_string():
    """Test the CORS proxy API for documents without a URL query string."""
    document = factories.DocumentFactory(link_reach="public")
--- a/src/backend/core/tests/documents/test_api_documents_media_auth.py
+++ b/src/backend/core/tests/documents/test_api_documents_media_auth.py
@@ -6,7 +6,6 @@ from io import BytesIO
 from urllib.parse import urlparse
 from uuid import uuid4

-from django.conf import settings
 from django.core.files.storage import default_storage
 from django.utils import timezone

@@ -37,7 +36,7 @@ def test_api_documents_media_auth_unkown_document():
    assert models.Document.objects.exists() is False


-def test_api_documents_media_auth_anonymous_public():
+def test_api_documents_media_auth_anonymous_public(settings):
    """Anonymous users should be able to retrieve attachments linked to a public document"""
    document_id = uuid4()
    filename = f"{uuid4()!s}.jpg"
@@ -139,7 +138,7 @@ def test_api_documents_media_auth_anonymous_authenticated_or_restricted(reach):
    assert "Authorization" not in response


-def test_api_documents_media_auth_anonymous_attachments():
+def test_api_documents_media_auth_anonymous_attachments(settings):
    """
    Declaring a media key as original attachment on a document to which
    a user has access should give them access to the attachment file
@@ -202,7 +201,9 @@ def test_api_documents_media_auth_anonymous_attachments():


@pytest.mark.parametrize("reach", ["public", "authenticated"])
-def test_api_documents_media_auth_authenticated_public_or_authenticated(reach):
+def test_api_documents_media_auth_authenticated_public_or_authenticated(
+    reach, settings
+):
    """
    Authenticated users who are not related to a document should be able to retrieve
    attachments related to a document with public or authenticated link reach.
@@ -284,7 +285,7 @@ def test_api_documents_media_auth_authenticated_restricted():


@pytest.mark.parametrize("via", VIA)
-def test_api_documents_media_auth_related(via, mock_user_teams):
+def test_api_documents_media_auth_related(via, mock_user_teams, settings):
    """
    Users who have a specific access to a document, whatever the role, should be able to
    retrieve related attachments.
@@ -368,7 +369,7 @@ def test_api_documents_media_auth_not_ready_status():
    assert response.status_code == 403


-def test_api_documents_media_auth_missing_status_metadata():
+def test_api_documents_media_auth_missing_status_metadata(settings):
    """Attachments without status metadata should be considered as ready"""
    document_id = uuid4()
    filename = f"{uuid4()!s}.jpg"
@@ -412,3 +413,51 @@ def test_api_documents_media_auth_missing_status_metadata():
        timeout=1,
    )
    assert response.content.decode("utf-8") == "my prose"
+
+
+def test_api_documents_media_auth_anonymous_public_custom_origin_header(settings):
+    """Changing the setting MEDIA_AUTH_ORIGINAL_URL_HEADER to match other header should work"""
+    settings.MEDIA_AUTH_ORIGINAL_URL_HEADER = "HTTP_X_FORWARDED_URI"
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    key = f"{document_id!s}/attachments/{filename:s}"
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+        Metadata={"status": DocumentAttachmentStatus.READY},
+    )
+
+    factories.DocumentFactory(id=document_id, link_reach="public", attachments=[key])
+
+    original_url = f"http://localhost/media/{key:s}"
+    now = timezone.now()
+    with freeze_time(now):
+        response = APIClient().get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_FORWARDED_URI=original_url
+        )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"
--- a/src/backend/core/tests/documents/test_api_documents_move.py
+++ b/src/backend/core/tests/documents/test_api_documents_move.py
@@ -438,3 +438,92 @@ def test_api_documents_move_authenticated_deleted_target_as_sibling(position):
    # Verify that the document has not moved
    document.refresh_from_db()
    assert document.is_root() is True
+
+
+@pytest.mark.parametrize("position", enums.MoveNodePositionChoices.values)
+def test_api_documents_move_to_descendant(position):
+    """
+    Moving a document to one of its descendants should return a validation error.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Create a hierarchy: parent -> child -> grandchild
+    parent = factories.DocumentFactory(users=[(user, "owner")])
+    child = factories.DocumentFactory(parent=parent, users=[(user, "owner")])
+    grandchild = factories.DocumentFactory(parent=child, users=[(user, "owner")])
+
+    # Try moving parent to child (descendant)
+    response = client.post(
+        f"/api/v1.0/documents/{parent.id!s}/move/",
+        data={"target_document_id": str(child.id), "position": position},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Cannot move a document to its own descendant."
+    }
+
+    # Try moving parent to grandchild
+    response = client.post(
+        f"/api/v1.0/documents/{parent.id!s}/move/",
+        data={"target_document_id": str(grandchild.id), "position": position},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Cannot move a document to its own descendant."
+    }
+
+    # Try moving child to grandchild (still descendant)
+    response = client.post(
+        f"/api/v1.0/documents/{child.id!s}/move/",
+        data={"target_document_id": str(grandchild.id), "position": position},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Cannot move a document to its own descendant."
+    }
+
+    # Ensure documents have not moved
+    parent.refresh_from_db()
+    child.refresh_from_db()
+    grandchild.refresh_from_db()
+    assert parent.is_root() is True
+    assert child.is_child_of(parent) is True
+    assert grandchild.is_child_of(child) is True
+
+
+@pytest.mark.parametrize(
+    "position",
+    [
+        enums.MoveNodePositionChoices.FIRST_CHILD,
+        enums.MoveNodePositionChoices.LAST_CHILD,
+    ],
+)
+def test_api_documents_move_to_self(position):
+    """
+    Moving a document to itself should return a validation error.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[(user, "owner")])
+
+    # Try moving document to itself
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(document.id), "position": position},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Cannot move a document to its own descendant."
+    }
+
+    # Ensure document has not moved
+    document.refresh_from_db()
+    assert document.is_root() is True
--- a/src/backend/core/tests/documents/test_api_documents_restore.py
+++ b/src/backend/core/tests/documents/test_api_documents_restore.py
@@ -124,3 +124,22 @@ def test_api_documents_restore_authenticated_owner_expired():

    assert response.status_code == 404
    assert response.json() == {"detail": "Not found."}
+
+
+def test_api_documents_restore_authenticated_owner_not_deleted():
+    """Restoring a document that is not deleted should return a 400 error."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
+
+    response = client.post(f"/api/v1.0/documents/{document.id!s}/restore/")
+
+    assert response.status_code == 400
+    assert response.json() == {"detail": "This document is not deleted."}
+
+    document.refresh_from_db()
+    assert document.deleted_at is None
+    assert document.ancestors_deleted_at is None
--- a/src/backend/core/tests/documents/test_api_documents_search_descendants.py
+++ b/src/backend/core/tests/documents/test_api_documents_search_descendants.py
@@ -68,8 +68,8 @@ def test_api_documents_search_descendants_list_anonymous_public_standalone():
            },
            {
                "abilities": child1.get_abilities(AnonymousUser()),
-                "ancestors_link_reach": document.link_reach,
-                "ancestors_link_role": document.link_role,
+                "ancestors_link_reach": child1.ancestors_link_reach,
+                "ancestors_link_role": child1.ancestors_link_role,
                "computed_link_reach": child1.computed_link_reach,
                "computed_link_role": child1.computed_link_role,
                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
@@ -91,10 +91,8 @@ def test_api_documents_search_descendants_list_anonymous_public_standalone():
            },
            {
                "abilities": grand_child.get_abilities(AnonymousUser()),
-                "ancestors_link_reach": document.link_reach,
-                "ancestors_link_role": document.link_role
-                if (child1.link_reach == "public" and child1.link_role == "editor")
-                else document.link_role,
+                "ancestors_link_reach": grand_child.ancestors_link_reach,
+                "ancestors_link_role": grand_child.ancestors_link_role,
                "computed_link_reach": "public",
                "computed_link_role": grand_child.computed_link_role,
                "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
@@ -116,8 +114,8 @@ def test_api_documents_search_descendants_list_anonymous_public_standalone():
            },
            {
                "abilities": child2.get_abilities(AnonymousUser()),
-                "ancestors_link_reach": document.link_reach,
-                "ancestors_link_role": document.link_role,
+                "ancestors_link_reach": child2.ancestors_link_reach,
+                "ancestors_link_role": child2.ancestors_link_role,
                "computed_link_reach": "public",
                "computed_link_role": child2.computed_link_role,
                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
@@ -180,7 +178,7 @@ def test_api_documents_search_descendants_list_anonymous_public_parent():
                # the search should include the parent document itself
                "abilities": document.get_abilities(AnonymousUser()),
                "ancestors_link_reach": "public",
-                "ancestors_link_role": grand_parent.link_role,
+                "ancestors_link_role": document.ancestors_link_role,
                "computed_link_reach": document.computed_link_reach,
                "computed_link_role": document.computed_link_role,
                "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
@@ -203,7 +201,7 @@ def test_api_documents_search_descendants_list_anonymous_public_parent():
            {
                "abilities": child1.get_abilities(AnonymousUser()),
                "ancestors_link_reach": "public",
-                "ancestors_link_role": grand_parent.link_role,
+                "ancestors_link_role": child1.ancestors_link_role,
                "computed_link_reach": child1.computed_link_reach,
                "computed_link_role": child1.computed_link_role,
                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
@@ -249,7 +247,7 @@ def test_api_documents_search_descendants_list_anonymous_public_parent():
            {
                "abilities": child2.get_abilities(AnonymousUser()),
                "ancestors_link_reach": "public",
-                "ancestors_link_role": grand_parent.link_role,
+                "ancestors_link_role": child2.ancestors_link_role,
                "computed_link_reach": "public",
                "computed_link_role": child2.computed_link_role,
                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
@@ -327,7 +325,7 @@ def test_api_documents_search_descendants_list_authenticated_unrelated_public_or
            {
                "abilities": child1.get_abilities(user),
                "ancestors_link_reach": reach,
-                "ancestors_link_role": document.link_role,
+                "ancestors_link_role": child1.ancestors_link_role,
                "computed_link_reach": child1.computed_link_reach,
                "computed_link_role": child1.computed_link_role,
                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
@@ -350,7 +348,7 @@ def test_api_documents_search_descendants_list_authenticated_unrelated_public_or
            {
                "abilities": grand_child.get_abilities(user),
                "ancestors_link_reach": reach,
-                "ancestors_link_role": document.link_role,
+                "ancestors_link_role": grand_child.ancestors_link_role,
                "computed_link_reach": grand_child.computed_link_reach,
                "computed_link_role": grand_child.computed_link_role,
                "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
@@ -373,7 +371,7 @@ def test_api_documents_search_descendants_list_authenticated_unrelated_public_or
            {
                "abilities": child2.get_abilities(user),
                "ancestors_link_reach": reach,
-                "ancestors_link_role": document.link_role,
+                "ancestors_link_role": child2.ancestors_link_role,
                "computed_link_reach": child2.computed_link_reach,
                "computed_link_role": child2.computed_link_role,
                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
@@ -437,7 +435,7 @@ def test_api_documents_search_descendants_list_authenticated_public_or_authentic
            {
                "abilities": child1.get_abilities(user),
                "ancestors_link_reach": reach,
-                "ancestors_link_role": grand_parent.link_role,
+                "ancestors_link_role": child1.ancestors_link_role,
                "computed_link_reach": child1.computed_link_reach,
                "computed_link_role": child1.computed_link_role,
                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
@@ -460,7 +458,7 @@ def test_api_documents_search_descendants_list_authenticated_public_or_authentic
            {
                "abilities": grand_child.get_abilities(user),
                "ancestors_link_reach": reach,
-                "ancestors_link_role": grand_parent.link_role,
+                "ancestors_link_role": grand_child.ancestors_link_role,
                "computed_link_reach": grand_child.computed_link_reach,
                "computed_link_role": grand_child.computed_link_role,
                "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
@@ -483,7 +481,7 @@ def test_api_documents_search_descendants_list_authenticated_public_or_authentic
            {
                "abilities": child2.get_abilities(user),
                "ancestors_link_reach": reach,
-                "ancestors_link_role": grand_parent.link_role,
+                "ancestors_link_role": child2.ancestors_link_role,
                "computed_link_reach": child2.computed_link_reach,
                "computed_link_role": child2.computed_link_role,
                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
--- a/src/backend/core/tests/external_api/test_external_api_documents_ai.py
+++ b/src/backend/core/tests/external_api/test_external_api_documents_ai.py
@@ -14,6 +14,7 @@ import pytest
 from rest_framework.test import APIClient

 from core import factories, models
+from core.services.ai_services.legacy import get_legacy_ai_service
 from core.tests.documents.test_api_documents_ai_proxy import (  # pylint: disable=unused-import
    ai_settings,
 )
@@ -23,6 +24,12 @@ pytestmark = pytest.mark.django_db
 # pylint: disable=unused-argument


+@pytest.fixture(autouse=True)
+def clear_openai_client_config():
+    """Clear the configure_legacy_openai_client cache."""
+    get_legacy_ai_service.cache_clear()
+
+
 def test_external_api_documents_ai_transform_not_allowed(
    user_token, resource_server_backend, user_specific_sub
 ):
@@ -219,7 +226,9 @@ def test_external_api_documents_ai_translate_can_be_allowed(
                    "Translate the content in the html to the "
                    "specified language Colombian Spanish. "
                    "Check the translation for accuracy and make any necessary corrections. "
-                    "Do not provide any other information."
+                    "Do not provide any other information. "
+                    "Return the content directly without wrapping it in code blocks or markdown "
+                    "delimiters."
                ),
            },
            {"role": "user", "content": "Hello"},
@@ -241,7 +250,7 @@ def test_external_api_documents_ai_translate_can_be_allowed(
    }
 )
@pytest.mark.usefixtures("ai_settings")
-@patch("core.services.ai_services.AIService.stream")
+@patch("core.services.ai_services.blocknote.AIService.stream")
 def test_external_api_documents_ai_proxy_can_be_allowed(
    mock_stream, user_token, resource_server_backend, user_specific_sub
 ):
--- a/src/backend/core/tests/test_services_ai_services.py
+++ b/src/backend/core/tests/test_services_ai_services.py
@@ -10,14 +10,23 @@ from django.core.exceptions import ImproperlyConfigured
 from django.test.utils import override_settings

 import pytest
-from openai import OpenAIError
+from mistralai import Mistral
+from openai import OpenAI, OpenAIError
+from pydantic_ai.models.mistral import MistralModel
+from pydantic_ai.models.openai import OpenAIChatModel
 from pydantic_ai.ui.vercel_ai.request_types import TextUIPart, UIMessage

-from core.services.ai_services import (
+from core.services.ai_services.blocknote import (
    BLOCKNOTE_TOOL_STRICT_PROMPT,
    AIService,
+    configure_pydantic_model_provider,
    convert_async_generator_to_sync,
 )
+from core.services.ai_services.legacy import (
+    LegacyAiServiceMistralClient,
+    LegacyAiServiceOpenAiClient,
+    get_legacy_ai_service,
+)

 pytestmark = pytest.mark.django_db

@@ -26,35 +35,129 @@ pytestmark = pytest.mark.django_db
 def ai_settings(settings):
    """Fixture to set AI settings."""
    settings.AI_MODEL = "llama"
-    settings.AI_BASE_URL = "http://example.com"
-    settings.AI_API_KEY = "test-key"
+    settings.OPENAI_SDK_BASE_URL = "http://example.com"
+    settings.OPENAI_SDK_API_KEY = "test-key"
    settings.AI_FEATURE_ENABLED = True
    settings.AI_FEATURE_BLOCKNOTE_ENABLED = True
    settings.AI_FEATURE_LEGACY_ENABLED = True
    settings.LANGFUSE_PUBLIC_KEY = None
    settings.AI_VERCEL_SDK_VERSION = 6
+    yield
+    configure_pydantic_model_provider.cache_clear()
+    get_legacy_ai_service.cache_clear()


-# -- AIService.__init__ --
+# -- AIService configure sdk--


@pytest.mark.parametrize(
    "setting_name, setting_value",
    [
-        ("AI_BASE_URL", None),
-        ("AI_API_KEY", None),
+        ("OPENAI_SDK_BASE_URL", None),
+        ("OPENAI_SDK_API_KEY", None),
        ("AI_MODEL", None),
    ],
 )
-def test_services_ai_setting_missing(setting_name, setting_value, settings):
-    """Setting should be set"""
+def test_ai_services_configure_open_ai_leagcy_client_missing_settings(
+    setting_name, setting_value, settings
+):
+    """
+    An exception must be raised if an expected settings is missing to configure the openai sdk.
+    """
    setattr(settings, setting_name, setting_value)

    with pytest.raises(
        ImproperlyConfigured,
        match="AI configuration not set",
    ):
-        AIService()
+        LegacyAiServiceOpenAiClient()
+
+
+def test_ai_services_configure_open_ai_leagcy_client(settings):
+    """With all required settings the OpenAi legacy client should be configured."""
+    settings.AI_MODEL = "llama"
+    settings.OPENAI_SDK_BASE_URL = "http://example.com"
+    settings.OPENAI_SDK_API_KEY = "test-key"
+
+    legacy_openai_client = LegacyAiServiceOpenAiClient()
+
+    assert isinstance(legacy_openai_client.client, OpenAI)
+
+
+@pytest.mark.parametrize(
+    "setting_name, setting_value",
+    [
+        ("MISTRAL_SDK_BASE_URL", None),
+        ("MISTRAL_SDK_API_KEY", None),
+        ("AI_MODEL", None),
+    ],
+)
+def test_ai_services_configure_mistral_sdk_leagcy_client_missing_settings(
+    setting_name, setting_value, settings
+):
+    """
+    An exception must be raised if an expected settings is missing to configure the openai sdk.
+    """
+    settings.OPENAI_SDK_BASE_URL = None
+    settings.OPENAI_SDK_API_KEY = None
+    setattr(settings, setting_name, setting_value)
+
+    with pytest.raises(
+        ImproperlyConfigured,
+        match="Mistral sdk configuration not set",
+    ):
+        LegacyAiServiceMistralClient()
+
+
+def test_ai_services_configure_mistral_sdk_legacy_client(settings):
+    """With all required settings the Mistral sdk legacy client should be configured."""
+
+    settings.AI_MODEL = "llama"
+    settings.OPENAI_SDK_BASE_URL = None
+    settings.OPENAI_SDK_API_KEY = None
+    settings.MISTRAL_SDK_API_KEY = "mistreal-sdk-key"
+    settings.MISTRAL_SDK_BASE_URL = "https://mistral.base-url.com"
+
+    legacy_mistral_client = LegacyAiServiceMistralClient()
+
+    assert isinstance(legacy_mistral_client.client, Mistral)
+
+
+def test_ai_services_configure_pydantic_ai_model_openai(settings):
+    """When openai sdk settings are configured it should return an OpenAiChatModel."""
+    settings.AI_MODEL = "llama"
+    settings.OPENAI_SDK_BASE_URL = "http://example.com"
+    settings.OPENAI_SDK_API_KEY = "test-key"
+
+    pydantic_ai_model = configure_pydantic_model_provider()
+    assert isinstance(pydantic_ai_model, OpenAIChatModel)
+
+
+def test_ai_services_configure_pydantic_ai_model_mistral(settings):
+    """When mistral sdk settings are configured is should return a MistralModel."""
+    settings.AI_MODEL = "llama"
+    settings.OPENAI_SDK_BASE_URL = None
+    settings.OPENAI_SDK_API_KEY = None
+    settings.MISTRAL_SDK_API_KEY = "mistreal-sdk-key"
+    settings.MISTRAL_SDK_BASE_URL = "https://mistral.base-url.com"
+
+    pydantic_ai_model = configure_pydantic_model_provider()
+    assert isinstance(pydantic_ai_model, MistralModel)
+
+
+def test_ai_services_configure_pydantic_ai_model_no_settings(settings):
+    """When no settings are configured for a ai sdk it should raises an exception."""
+    settings.AI_MODEL = None
+    settings.OPENAI_SDK_BASE_URL = None
+    settings.OPENAI_SDK_API_KEY = None
+    settings.MISTRAL_SDK_API_KEY = None
+    settings.MISTRAL_SDK_BASE_URL = None
+
+    with pytest.raises(
+        ImproperlyConfigured,
+        match="AI configuration not set",
+    ):
+        configure_pydantic_model_provider()


 # -- AIService.transform --
@@ -73,7 +176,7 @@ def test_services_ai_client_error(mock_create):
        OpenAIError,
        match="Mocked client error",
    ):
-        AIService().transform("hello", "prompt")
+        get_legacy_ai_service().transform("hello", "prompt")


@override_settings(
@@ -91,7 +194,7 @@ def test_services_ai_client_invalid_response(mock_create):
        RuntimeError,
        match="AI response does not contain an answer",
    ):
-        AIService().transform("hello", "prompt")
+        get_legacy_ai_service().transform("hello", "prompt")


@override_settings(
@@ -105,7 +208,7 @@ def test_services_ai_success(mock_create):
        choices=[MagicMock(message=MagicMock(content="Salut"))]
    )

-    response = AIService().transform("hello", "prompt")
+    response = get_legacy_ai_service().transform("hello", "prompt")

    assert response == {"answer": "Salut"}

@@ -121,7 +224,7 @@ def test_services_ai_translate_success(mock_create):
        choices=[MagicMock(message=MagicMock(content="Bonjour"))]
    )

-    response = AIService().translate("<p>Hello</p>", "fr")
+    response = get_legacy_ai_service().translate("<p>Hello</p>", "fr")

    assert response == {"answer": "Bonjour"}
    call_args = mock_create.call_args
@@ -137,7 +240,7 @@ def test_services_ai_translate_unknown_language(mock_create):
        choices=[MagicMock(message=MagicMock(content="Translated"))]
    )

-    response = AIService().translate("<p>Hello</p>", "xx-unknown")
+    response = get_legacy_ai_service().translate("<p>Hello</p>", "xx-unknown")

    assert response == {"answer": "Translated"}
    call_args = mock_create.call_args
@@ -448,7 +551,7 @@ def test_services_ai_stream_defaults_to_sync(mock_build, monkeypatch):
 # -- AIService._build_async_stream --


-@patch("core.services.ai_services.VercelAIAdapter")
+@patch("core.services.ai_services.blocknote.VercelAIAdapter")
 def test_services_ai_build_async_stream(mock_adapter_cls):
    """_build_async_stream should build the pydantic-ai streaming pipeline."""

@@ -477,7 +580,7 @@ def test_services_ai_build_async_stream(mock_adapter_cls):
    mock_adapter_instance.encode_stream.assert_called_once()


-@patch("core.services.ai_services.VercelAIAdapter")
+@patch("core.services.ai_services.blocknote.VercelAIAdapter")
 def test_services_ai_build_async_stream_with_tool_definitions(mock_adapter_cls):
    """_build_async_stream should build an ExternalToolset when
    toolDefinitions are present in the request."""
@@ -514,7 +617,7 @@ def test_services_ai_build_async_stream_with_tool_definitions(mock_adapter_cls):
    assert len(call_kwargs["toolsets"]) == 1


-@patch("core.services.ai_services.VercelAIAdapter")
+@patch("core.services.ai_services.blocknote.VercelAIAdapter")
 def test_services_ai_build_async_stream_with_tool_definitions_required_system_prompt(
    mock_adapter_cls,
 ):
@@ -557,8 +660,8 @@ def test_services_ai_build_async_stream_with_tool_definitions_required_system_pr
    assert mock_run_input.messages[0].parts[0].text == BLOCKNOTE_TOOL_STRICT_PROMPT


-@patch("core.services.ai_services.Agent")
-@patch("core.services.ai_services.VercelAIAdapter")
+@patch("core.services.ai_services.blocknote.Agent")
+@patch("core.services.ai_services.blocknote.VercelAIAdapter")
 def test_services_ai_build_async_stream_langfuse_enabled(
    mock_adapter_cls, mock_agent_cls, settings
 ):
--- a/src/backend/impress/settings.py
+++ b/src/backend/impress/settings.py
@@ -130,6 +130,12 @@ class Base(Configuration):
        default=50, environ_name="SEARCH_INDEXER_QUERY_LIMIT", environ_prefix=None
    )

+    MEDIA_AUTH_ORIGINAL_URL_HEADER = values.Value(
+        default="HTTP_X_ORIGINAL_URL",
+        environ_name="MEDIA_AUTH_ORIGINAL_URL_HEADER",
+        environ_prefix=None,
+    )
+
    # Static files (CSS, JavaScript, Images)
    STATIC_URL = "/static/"
    STATIC_ROOT = os.path.join(DATA_DIR, "static")
@@ -802,8 +808,30 @@ class Base(Configuration):
        environ_name="AI_ALLOW_REACH_FROM",
        environ_prefix=None,
    )
-    AI_API_KEY = SecretFileValue(None, environ_name="AI_API_KEY", environ_prefix=None)
-    AI_BASE_URL = values.Value(None, environ_name="AI_BASE_URL", environ_prefix=None)
+
+    MISTRAL_SDK_BASE_URL = values.Value(
+        None, environ_name="MISTRAL_SDK_BASE_URL", environ_prefix=None
+    )
+    MISTRAL_SDK_API_KEY = SecretFileValue(
+        None, environ_name="MISTRAL_SDK_API_KEY", environ_prefix=None
+    )
+
+    OPENAI_SDK_API_KEY = SecretFileValue(
+        default=SecretFileValue(  # retrocompatibility
+            None,
+            environ_name="AI_API_KEY",
+            environ_prefix=None,
+        ),
+        environ_name="OPENAI_SDK_API_KEY",
+        environ_prefix=None,
+    )
+    OPENAI_SDK_BASE_URL = values.Value(
+        default=values.Value(  # retrocompatibility
+            None, environ_name="AI_BASE_URL", environ_prefix=None
+        ),
+        environ_name="OPENAI_SDK_BASE_URL",
+        environ_prefix=None,
+    )
    AI_BOT = values.DictValue(
        default={
            "name": _("Docs AI"),
@@ -1143,6 +1171,11 @@ class Base(Configuration):
                }
            )

+        if cls.OPENAI_SDK_API_KEY and cls.MISTRAL_SDK_API_KEY:
+            raise ValueError(
+                "Both OPENAI_SDK and MISTRAL_SDK parameters can not be set simultaneously."
+            )
+

 class Build(Base):
    """Settings used when the application is built.
--- a/src/backend/pyproject.toml
+++ b/src/backend/pyproject.toml
@@ -26,7 +26,7 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "beautifulsoup4==4.14.3",
-    "boto3==1.42.59",
+    "boto3==1.42.93",
    "Brotli==1.2.0",
    "celery[redis]==5.5.3",
    "django-configurations==2.5.1",
@@ -34,37 +34,39 @@ dependencies = [
    "django-countries==8.2.0",
    "django-csp==4.0",
    "django-filter==25.2",
-    "django-lasuite[all]==0.0.24",
+    "django-lasuite[all]==0.0.26",
    "django-parler==2.3",
    "django-redis==6.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
    "django<6.0.0",
    "django-treebeard<5.0.0",
-    "djangorestframework==3.16.1",
+    "djangorestframework==3.17.1",
    "django-waffle==5.0.0",
    "drf_spectacular==0.29.0",
-    "dockerflow==2026.1.26",
+    "dockerflow==2026.3.4",
    "easy_thumbnails==2.10.1",
+    "emoji==2.15.0",
    "factory_boy==3.3.3",
-    "gunicorn==25.1.0",
+    "gunicorn==25.3.0",
    "jsonschema==4.26.0",
    "langfuse==3.11.2",
    "lxml==6.1.0",
    "markdown==3.10.2",
+    "mistralai==1.12.4",
    "mozilla-django-oidc==5.0.2",
    "nested-multipart-parser==1.6.0",
-    "openai==2.24.0",
+    "openai==2.32.0",
    "psycopg[binary,pool]==3.3.3",
-    "pycrdt==0.12.47",
-    "pydantic==2.12.5",
+    "pycrdt==0.12.50",
+    "pydantic==2.13.3",
    "pydantic-ai-slim[openai,logfire,web]==1.58.0",
-    "PyJWT==2.12.0",
+    "PyJWT==2.12.1",
    "python-magic==0.4.27",
    "redis<6.0.0",
-    "requests==2.33.0",
-    "sentry-sdk==2.53.0",
-    "uvicorn==0.41.0",
+    "requests==2.33.1",
+    "sentry-sdk==2.58.0",
+    "uvicorn==0.45.0",
    "whitenoise==6.12.0",
 ]

@@ -78,21 +80,21 @@ dependencies = [
 dev = [
    "django-extensions==4.1",
    "django-test-migrations==1.5.0",
-    "drf-spectacular-sidecar==2026.3.1",
+    "drf-spectacular-sidecar==2026.4.14",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.10.0",
-    "pyfakefs==6.1.3",
+    "ipython==9.12.0",
+    "pyfakefs==6.2.0",
    "pylint-django==2.7.0",
    "pylint<4.0.0",
-    "pytest-cov==7.0.0",
+    "pytest-cov==7.1.0",
    "pytest-django==4.12.0",
-    "pytest==9.0.2",
+    "pytest==9.0.3",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
    "responses==0.26.0",
-    "ruff==0.15.4",
-    "types-requests==2.32.4.20260107",
+    "ruff==0.15.11",
+    "types-requests==2.33.0.20260408",
 ]

 [tool.setuptools]
--- a/src/frontend/Dockerfile
+++ b/src/frontend/Dockerfile
@@ -60,7 +60,7 @@ COPY --from=impress-builder /home/frontend/apps/impress/out /app
 FROM ${FRONTEND_IMAGE} AS frontend-source

 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:alpine3.22 AS frontend-production
+FROM nginxinc/nginx-unprivileged:alpine3.23 AS frontend-production

 # Upgrade system packages to install security updates
 USER root
--- a/src/frontend/apps/e2e/tests/app-impress/doc-ai.spec.ts
+++ b/src/frontend/apps/e2e/tests/app-impress/doc-ai.spec.ts
@@ -66,6 +66,8 @@ if (process.env.IS_INSTANCE !== 'true') {
          name: 'Albert AI',
          color: '#8bc6ff',
        },
+        AI_FEATURE_ENABLED: true,
+        AI_FEATURE_BLOCKNOTE_ENABLED: true,
      });

      await mockAIResponse(page);
@@ -131,6 +133,8 @@ if (process.env.IS_INSTANCE !== 'true') {
          name: 'Albert AI',
          color: '#8bc6ff',
        },
+        AI_FEATURE_ENABLED: true,
+        AI_FEATURE_BLOCKNOTE_ENABLED: true,
      });

      await mockAIResponse(page);
@@ -166,6 +170,11 @@ if (process.env.IS_INSTANCE !== 'true') {
      page,
      browserName,
    }) => {
+      await overrideConfig(page, {
+        AI_FEATURE_ENABLED: true,
+        AI_FEATURE_LEGACY_ENABLED: true,
+      });
+
      await page.route(/.*\/ai-translate\//, async (route) => {
        const request = route.request();
        if (request.method().includes('POST')) {
@@ -229,6 +238,11 @@ if (process.env.IS_INSTANCE !== 'true') {
        page,
        browserName,
      }) => {
+        await overrideConfig(page, {
+          AI_FEATURE_ENABLED: true,
+          AI_FEATURE_LEGACY_ENABLED: true,
+        });
+
        await mockedDocument(page, {
          accesses: [
            {
@@ -303,6 +317,11 @@ if (process.env.IS_INSTANCE !== 'true') {
    });

    test(`it checks ai_proxy ability`, async ({ page, browserName }) => {
+      await overrideConfig(page, {
+        AI_FEATURE_ENABLED: true,
+        AI_FEATURE_LEGACY_ENABLED: true,
+      });
+
      await mockedDocument(page, {
        accesses: [
          {
--- a/src/frontend/apps/e2e/tests/app-impress/doc-editor.spec.ts
+++ b/src/frontend/apps/e2e/tests/app-impress/doc-editor.spec.ts
@@ -65,19 +65,6 @@ test.describe('Doc Editor', () => {
      toolbar.locator('button[data-test="createLink"]'),
    ).toBeVisible();

-    /**
-     * Because of how Posthog is loaded and how auth session are
-     * saved, this assertion is not reliable on test instances
-     * We will dedicate a testcase to check the AI features
-     * on test instances with a specific setup
-     */
-    if (process.env.IS_INSTANCE !== 'true') {
-      // eslint-disable-next-line playwright/no-conditional-expect
-      await expect(
-        toolbar.getByRole('button', { name: 'Ask AI' }),
-      ).toBeVisible();
-    }
-
    await expect(
      toolbar.locator('button[data-test="comment-toolbar-button"]'),
    ).toBeVisible();
@@ -109,7 +96,6 @@ test.describe('Doc Editor', () => {

    await image.click();

-    await expect(toolbar.getByRole('button', { name: 'Ask AI' })).toBeHidden();
    await expect(
      toolbar.locator('button[data-test="comment-toolbar-button"]'),
    ).toBeHidden();
--- a/src/frontend/apps/e2e/tests/app-impress/doc-header.spec.ts
+++ b/src/frontend/apps/e2e/tests/app-impress/doc-header.spec.ts
@@ -501,7 +501,7 @@ test.describe('Doc Header', () => {
      browserName === 'webkit',
      'navigator.clipboard is not working with webkit and playwright',
    );
-    await mockedDocument(page, {
+    const uuid = await mockedDocument(page, {
      abilities: {
        destroy: false, // Means owner
        link_configuration: true,
@@ -534,9 +534,7 @@ test.describe('Doc Header', () => {
    const clipboardContent = await handle.jsonValue();

    const origin = await page.evaluate(() => window.location.origin);
-    expect(clipboardContent.trim()).toMatch(
-      `${origin}/docs/mocked-document-id/`,
-    );
+    expect(clipboardContent.trim()).toMatch(`${origin}/docs/${uuid}/`);
  });

  test('it pins a document', async ({ page, browserName }) => {
--- a/src/frontend/apps/e2e/tests/app-impress/language.spec.ts
+++ b/src/frontend/apps/e2e/tests/app-impress/language.spec.ts
@@ -131,7 +131,7 @@ test.describe('Language', () => {
    await waitForLanguageSwitch(page, TestLanguage.French);

    // Check for French 404 response
-    await check404Response('Pas trouvé.');
+    await check404Response('Non trouvé.');
  });

  test('it check translations of the slash menu when changing language', async ({
--- a/src/frontend/apps/e2e/tests/app-impress/utils-common.ts
+++ b/src/frontend/apps/e2e/tests/app-impress/utils-common.ts
@@ -13,8 +13,8 @@ export const CONFIG = {
    name: 'Docs AI',
    color: '#8bc6ff',
  },
-  AI_FEATURE_ENABLED: true,
-  AI_FEATURE_BLOCKNOTE_ENABLED: true,
+  AI_FEATURE_ENABLED: false,
+  AI_FEATURE_BLOCKNOTE_ENABLED: false,
  AI_FEATURE_LEGACY_ENABLED: true,
  API_USERS_SEARCH_QUERY_MIN_LENGTH: 3,
  CRISP_WEBSITE_ID: null,
@@ -137,13 +137,10 @@ export const createDoc = async (
      })
      .click();

-    await page.waitForURL('**/docs/**', {
-      timeout: 10000,
-      waitUntil: 'networkidle',
-    });
-
    const input = page.getByLabel('Document title');
-    await expect(input).toBeVisible();
+    await expect(input).toBeVisible({
+      timeout: 10000,
+    });
    await expect(input).toHaveText('');

    await input.fill(randomDocs[i]);
@@ -251,6 +248,7 @@ export const waitForResponseCreateDoc = (page: Page) => {

 export const mockedDocument = async (page: Page, data: object) => {
  // document/[ID]/ or document/[ID]/tree/ routes
+  const uuid = crypto.randomUUID();
  await page.route(/.*\/documents\/[^/]+\/(?:$|tree\/.*)/, async (route) => {
    const request = route.request();
    if (request.method().includes('GET') && !request.url().includes('page=')) {
@@ -259,7 +257,7 @@ export const mockedDocument = async (page: Page, data: object) => {
      };
      await route.fulfill({
        json: {
-          id: 'mocked-document-id',
+          id: uuid,
          title: 'Mocked document',
          path: '000000',
          abilities: {
@@ -304,6 +302,8 @@ export const mockedDocument = async (page: Page, data: object) => {
      await route.continue();
    }
  });
+
+  return uuid;
 };

 export const mockedListDocs = async (page: Page, data: object[] = []) => {
--- a/src/frontend/apps/impress/next.config.js
+++ b/src/frontend/apps/impress/next.config.js
@@ -6,6 +6,7 @@ const buildId = crypto.randomBytes(256).toString('hex').slice(0, 8);

 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  allowedDevOrigins: ['docs.127.0.0.1.nip.io'],
  output: 'export',
  trailingSlash: true,
  images: {
--- a/src/frontend/apps/impress/package.json
+++ b/src/frontend/apps/impress/package.json
@@ -76,7 +76,7 @@
    "react-select": "5.10.2",
    "styled-components": "6.3.12",
    "use-debounce": "10.1.0",
-    "uuid": "13.0.0",
+    "uuid": "14.0.0",
    "y-protocols": "1.0.7",
    "yjs": "*",
    "zod": "4.3.6",
--- a/src/frontend/apps/impress/src/features/left-panel/components/ResizableLeftPanel.tsx
+++ b/src/frontend/apps/impress/src/features/left-panel/components/ResizableLeftPanel.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from 'react';
+import { useTranslation } from 'react-i18next';
 import {
  ImperativePanelHandle,
  Panel,
@@ -15,6 +16,27 @@ const pxToPercent = (px: number) => {
  return (px / window.innerWidth) * 100;
 };

+const RESIZE_HANDLE_ID = 'left-panel-resize-handle';
+
+const getValueLabel = (
+  current: number,
+  min: number,
+  max: number,
+  t: (key: string) => string,
+): string => {
+  if (max <= min) {
+    return t('Sidebar width: medium');
+  }
+  const ratio = (current - min) / (max - min);
+  if (ratio < 1 / 3) {
+    return t('Sidebar width: narrow');
+  }
+  if (ratio < 2 / 3) {
+    return t('Sidebar width: medium');
+  }
+  return t('Sidebar width: wide');
+};
+
 type ResizableLeftPanelProps = {
  leftPanel: React.ReactNode;
  children: React.ReactNode;
@@ -28,6 +50,7 @@ export const ResizableLeftPanel = ({
  minPanelSizePx = 300,
  maxPanelSizePx = 450,
 }: ResizableLeftPanelProps) => {
+  const { t } = useTranslation();
  const { isDesktop } = useResponsiveStore();
  const { isPanelOpen } = useLeftPanelStore();
  const ref = useRef<ImperativePanelHandle>(null);
@@ -96,6 +119,24 @@ export const ResizableLeftPanel = ({
    };
  }, [isDesktop]);

+  /**
+   * Workaround: NVDA does not enter focus mode for role="separator"
+   * (https://github.com/nvaccess/nvda/issues/11403), so arrow keys are
+   * intercepted by browse-mode navigation and never reach the handle.
+   * Changing the role to "slider" makes NVDA reliably switch to focus
+   * mode, restoring progressive keyboard resize with arrow keys.
+   *
+   * Note: PanelResizeHandle does not expose a ref (no RefAttributes in its
+   * type definition), so we use id + getElementById as the only viable option.
+   * Only role needs to be overridden here; aria-* props are passed directly.
+   */
+  useEffect(() => {
+    if (!isPanelOpen) {
+      return;
+    }
+    document.getElementById(RESIZE_HANDLE_ID)?.setAttribute('role', 'slider');
+  }, [isPanelOpen]);
+
  const handleResize = (sizePercent: number) => {
    const widthPx = (sizePercent / 100) * window.innerWidth;
    savedWidthPxRef.current = widthPx;
@@ -103,7 +144,7 @@ export const ResizableLeftPanel = ({
  };

  return (
-    <PanelGroup direction="horizontal">
+    <PanelGroup direction="horizontal" keyboardResizeBy={1}>
      <Panel
        ref={ref}
        className="--docs--resizable-left-panel"
@@ -132,6 +173,18 @@ export const ResizableLeftPanel = ({
      </Panel>
      {isPanelOpen && (
        <PanelResizeHandle
+          id={RESIZE_HANDLE_ID}
+          aria-label={t('Resize sidebar')}
+          aria-orientation="horizontal"
+          aria-valuemin={Math.round(minPanelSizePercent)}
+          aria-valuemax={Math.round(maxPanelSizePercent)}
+          aria-valuenow={Math.round(panelSizePercent)}
+          aria-valuetext={getValueLabel(
+            panelSizePercent,
+            minPanelSizePercent,
+            maxPanelSizePercent,
+            t,
+          )}
          style={{
            borderRightWidth: '1px',
            borderRightStyle: 'solid',
--- a/src/frontend/package.json
+++ b/src/frontend/package.json
@@ -36,12 +36,12 @@
    "@types/react": "19.2.14",
    "@types/react-dom": "19.2.3",
    "eslint": "10.1.0",
-    "glob": "13.0.6",
+    "postcss": "8.5.10",
    "prosemirror-view": "1.41.7",
    "react": "19.2.4",
    "react-dom": "19.2.4",
-    "serialize-javascript": "7.0.5",
    "typescript": "5.9.3",
+    "uuid": "14.0.0",
    "wrap-ansi": "10.0.0",
    "yjs": "13.6.30"
  },
--- a/src/frontend/servers/y-provider/package.json
+++ b/src/frontend/servers/y-provider/package.json
@@ -25,7 +25,7 @@
    "cors": "2.8.6",
    "express": "5.2.1",
    "express-ws": "5.0.2",
-    "uuid": "13.0.0",
+    "uuid": "14.0.0",
    "y-protocols": "1.0.7",
    "yjs": "*"
  },
--- a/src/frontend/yarn.lock
+++ b/src/frontend/yarn.lock
@@ -2302,6 +2302,18 @@
  dependencies:
    "@swc/helpers" "^0.5.0"

+"@isaacs/cliui@^8.0.2":
+  version "8.0.2"
+  resolved "https://registry.yarnpkg.com/@isaacs/cliui/-/cliui-8.0.2.tgz#b37667b7bc181c168782259bab42474fbf52b550"
+  integrity sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==
+  dependencies:
+    string-width "^5.1.2"
+    string-width-cjs "npm:string-width@^4.2.0"
+    strip-ansi "^7.0.1"
+    strip-ansi-cjs "npm:strip-ansi@^6.0.1"
+    wrap-ansi "^8.1.0"
+    wrap-ansi-cjs "npm:wrap-ansi@^7.0.0"
+
 "@istanbuljs/load-nyc-config@^1.0.0":
  version "1.1.0"
  resolved "https://registry.yarnpkg.com/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz#fd3db1d59ecf7cf121e80650bb86712f9b55eced"
@@ -3290,6 +3302,11 @@
    "@noble/hashes" "^2.0.1"
    error-causes "^3.0.2"

+"@pkgjs/parseargs@^0.11.0":
+  version "0.11.0"
+  resolved "https://registry.yarnpkg.com/@pkgjs/parseargs/-/parseargs-0.11.0.tgz#a77ea742fab25775145434eb1d2328cf5013ac33"
+  integrity sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==
+
 "@pkgr/core@^0.2.9":
  version "0.2.9"
  resolved "https://registry.yarnpkg.com/@pkgr/core/-/core-0.2.9.tgz#d229a7b7f9dac167a156992ef23c7f023653f53b"
@@ -6152,87 +6169,87 @@
  resolved "https://registry.yarnpkg.com/@remirror/core-constants/-/core-constants-3.0.0.tgz#96fdb89d25c62e7b6a5d08caf0ce5114370e3b8f"
  integrity sha512-42aWfPrimMfDKDi4YegyS7x+/0tlzaqwPQCULLanv3DMIlu96KTJR0fM5isWX2UViOqlGnX6YFgqWepcX+XMNg==

-"@rolldown/binding-android-arm64@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.11.tgz#25a584227ed97239fd564451c0db2c359751b42a"
-  integrity sha512-SJ+/g+xNnOh6NqYxD0V3uVN4W3VfnrGsC9/hoglicgTNfABFG9JjISvkkU0dNY84MNHLWyOgxP9v9Y9pX4S7+A==
+"@rolldown/binding-android-arm64@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.12.tgz#4e6af08b89da02596cc5da4b105082b68673ffec"
+  integrity sha512-pv1y2Fv0JybcykuiiD3qBOBdz6RteYojRFY1d+b95WVuzx211CRh+ytI/+9iVyWQ6koTh5dawe4S/yRfOFjgaA==

-"@rolldown/binding-darwin-arm64@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.11.tgz#dcfa96c4d8c7baa47f5b90294ce8ebf1b0b1dbf9"
-  integrity sha512-7WQgR8SfOPwmDZGFkThUvsmd/nwAWv91oCO4I5LS7RKrssPZmOt7jONN0cW17ydGC1n/+puol1IpoieKqQidmg==
+"@rolldown/binding-darwin-arm64@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.12.tgz#a06890f4c9b48ff0fc97edbedfc762bef7cffd73"
+  integrity sha512-cFYr6zTG/3PXXF3pUO+umXxt1wkRK/0AYT8lDwuqvRC+LuKYWSAQAQZjCWDQpAH172ZV6ieYrNnFzVVcnSflAg==

-"@rolldown/binding-darwin-x64@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.11.tgz#6e751ea2067cacee0c94f0e8b087761dde62f9ea"
-  integrity sha512-39Ks6UvIHq4rEogIfQBoBRusj0Q0nPVWIvqmwBLaT6aqQGIakHdESBVOPRRLacy4WwUPIx4ZKzfZ9PMW+IeyUQ==
+"@rolldown/binding-darwin-x64@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.12.tgz#eddf6aa3ed3509171fe21711f1e8ec8e0fd7ec49"
+  integrity sha512-ZCsYknnHzeXYps0lGBz8JrF37GpE9bFVefrlmDrAQhOEi4IOIlcoU1+FwHEtyXGx2VkYAvhu7dyBf75EJQffBw==

-"@rolldown/binding-freebsd-x64@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.11.tgz#b7582b959398c5871034b94ba0a8ecde0425a8e7"
-  integrity sha512-jfsm0ZHfhiqrvWjJAmzsqiIFPz5e7mAoCOPBNTcNgkiid/LaFKiq92+0ojH+nmJmKYkre4t71BWXUZDNp7vsag==
+"@rolldown/binding-freebsd-x64@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.12.tgz#2102dfed19fd1f1b53435fcaaf0bc61129a266a3"
+  integrity sha512-dMLeprcVsyJsKolRXyoTH3NL6qtsT0Y2xeuEA8WQJquWFXkEC4bcu1rLZZSnZRMtAqwtrF/Ib9Ddtpa/Gkge9Q==

-"@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.11.tgz#3b8c5e071d6a0ed1cb1880c1948c6fece553502a"
-  integrity sha512-zjQaUtSyq1nVe3nxmlSCuR96T1LPlpvmJ0SZy0WJFEsV4kFbXcq2u68L4E6O0XeFj4aex9bEauqjW8UQBeAvfQ==
+"@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.12.tgz#b2c13f40e990fd1e1935492850536c768c961a0f"
+  integrity sha512-YqWjAgGC/9M1lz3GR1r1rP79nMgo3mQiiA+Hfo+pvKFK1fAJ1bCi0ZQVh8noOqNacuY1qIcfyVfP6HoyBRZ85Q==

-"@rolldown/binding-linux-arm64-gnu@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.11.tgz#2533165620137b077ae4ede92b752a63cd85cfcb"
-  integrity sha512-WMW1yE6IOnehTcFE9eipFkm3XN63zypWlrJQ2iF7NrQ9b2LDRjumFoOGJE8RJJTJCTBAdmLMnJ8uVitACUUo1Q==
+"@rolldown/binding-linux-arm64-gnu@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.12.tgz#32ca9f77c1e76b2913b3d53d2029dc171c0532d6"
+  integrity sha512-/I5AS4cIroLpslsmzXfwbe5OmWvSsrFuEw3mwvbQ1kDxJ822hFHIx+vsN/TAzNVyepI/j/GSzrtCIwQPeKCLIg==

-"@rolldown/binding-linux-arm64-musl@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.11.tgz#b04cf5b806a012027a4e8b139e0f86b2ff7621c0"
-  integrity sha512-jfndI9tsfm4APzjNt6QdBkYwre5lRPUgHeDHoI7ydKUuJvz3lZeCfMsI56BZj+7BYqiKsJm7cfd/6KYV7ubrBg==
+"@rolldown/binding-linux-arm64-musl@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.12.tgz#f4337ddd52f0ed3ada2105b59ee1b757a2c4858c"
+  integrity sha512-V6/wZztnBqlx5hJQqNWwFdxIKN0m38p8Jas+VoSfgH54HSj9tKTt1dZvG6JRHcjh6D7TvrJPWFGaY9UBVOaWPw==

-"@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.11.tgz#bda9c11fe03482033d5dac6a943802b3e7579550"
-  integrity sha512-ZlFgw46NOAGMgcdvdYwAGu2Q+SLFA9LzbJLW+iyMOJyhj5wk6P3KEE9Gct4xWwSzFoPI7JCdYmYMzVtlgQ+zfw==
+"@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.12.tgz#22fdd14cb00ee8208c28a39bab7f28860ec6705d"
+  integrity sha512-AP3E9BpcUYliZCxa3w5Kwj9OtEVDYK6sVoUzy4vTOJsjPOgdaJZKFmN4oOlX0Wp0RPV2ETfmIra9x1xuayFB7g==

-"@rolldown/binding-linux-s390x-gnu@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.11.tgz#55daa2d35f92f62e958fc44e12db1c16e1f271c5"
-  integrity sha512-hIOYmuT6ofM4K04XAZd3OzMySEO4K0/nc9+jmNcxNAxRi6c5UWpqfw3KMFV4MVFWL+jQsSh+bGw2VqmaPMTLyw==
+"@rolldown/binding-linux-s390x-gnu@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.12.tgz#838215096d1de6d3d509e0410801cb7cda8161ff"
+  integrity sha512-nWwpvUSPkoFmZo0kQazZYOrT7J5DGOJ/+QHHzjvNlooDZED8oH82Yg67HvehPPLAg5fUff7TfWFHQS8IV1n3og==

-"@rolldown/binding-linux-x64-gnu@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.11.tgz#8ca1abf607bbe2f7fdd6f6416192937dc9ea1e54"
-  integrity sha512-qXBQQO9OvkjjQPLdUVr7Nr2t3QTZI7s4KZtfw7HzBgjbmAPSFwSv4rmET9lLSgq3rH/ndA3ngv3Qb8l2njoPNA==
+"@rolldown/binding-linux-x64-gnu@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.12.tgz#f7d71d97f6bd43198596b26dc2cb364586e12673"
+  integrity sha512-RNrafz5bcwRy+O9e6P8Z/OCAJW/A+qtBczIqVYwTs14pf4iV1/+eKEjdOUta93q2TsT/FI0XYDP3TCky38LMAg==

-"@rolldown/binding-linux-x64-musl@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.11.tgz#36a52beee8ac97a79d1ed8f1b94fab677e3e4d11"
-  integrity sha512-/tpFfoSTzUkH9LPY+cYbqZBDyyX62w5fICq9qzsHLL8uTI6BHip3Q9Uzft0wylk/i8OOwKik8OxW+QAhDmzwmg==
+"@rolldown/binding-linux-x64-musl@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.12.tgz#a2ca737f01b0ad620c4c404ca176ea3e3ad804c3"
+  integrity sha512-Jpw/0iwoKWx3LJ2rc1yjFrj+T7iHZn2JDg1Yny1ma0luviFS4mhAIcd1LFNxK3EYu3DHWCps0ydXQ5i/rrJ2ig==

-"@rolldown/binding-openharmony-arm64@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.11.tgz#91c74fd23b3f3f3942fe4b3aefc9428ecbaa55fd"
-  integrity sha512-mcp3Rio2w72IvdZG0oQ4bM2c2oumtwHfUfKncUM6zGgz0KgPz4YmDPQfnXEiY5t3+KD/i8HG2rOB/LxdmieK2g==
+"@rolldown/binding-openharmony-arm64@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.12.tgz#f66317e29eafcc300bed7af8dddac26ab3b1bf82"
+  integrity sha512-vRugONE4yMfVn0+7lUKdKvN4D5YusEiPilaoO2sgUWpCvrncvWgPMzK00ZFFJuiPgLwgFNP5eSiUlv2tfc+lpA==

-"@rolldown/binding-wasm32-wasi@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.11.tgz#6520bafe57ff1cd2fb45f8f22b1cb6d57be44e79"
-  integrity sha512-LXk5Hii1Ph9asuGRjBuz8TUxdc1lWzB7nyfdoRgI0WGPZKmCxvlKk8KfYysqtr4MfGElu/f/pEQRh8fcEgkrWw==
+"@rolldown/binding-wasm32-wasi@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.12.tgz#8825523fdffa1f1dc4683be9650ffaa9e4a77f04"
+  integrity sha512-ykGiLr/6kkiHc0XnBfmFJuCjr5ZYKKofkx+chJWDjitX+KsJuAmrzWhwyOMSHzPhzOHOy7u9HlFoa5MoAOJ/Zg==
  dependencies:
    "@napi-rs/wasm-runtime" "^1.1.1"

-"@rolldown/binding-win32-arm64-msvc@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.11.tgz#73dd1c4737473c8270b61cd2e42b05a34453ffc0"
-  integrity sha512-dDwf5otnx0XgRY1yqxOC4ITizcdzS/8cQ3goOWv3jFAo4F+xQYni+hnMuO6+LssHHdJW7+OCVL3CoU4ycnh35Q==
+"@rolldown/binding-win32-arm64-msvc@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.12.tgz#4f3a17e3d68a58309c27c0930b0f7986ccabef47"
+  integrity sha512-5eOND4duWkwx1AzCxadcOrNeighiLwMInEADT0YM7xeEOOFcovWZCq8dadXgcRHSf3Ulh1kFo/qvzoFiCLOL1Q==

-"@rolldown/binding-win32-x64-msvc@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.11.tgz#4d922aa6dd6bf27c73eba93fec9a0aed62549095"
-  integrity sha512-LN4/skhSggybX71ews7dAj6r2geaMJfm3kMbK2KhFMg9B10AZXnKoLCVVgzhMHL0S+aKtr4p8QbAW8k+w95bAA==
+"@rolldown/binding-win32-x64-msvc@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.12.tgz#d762765d5660598a96b570b513f535c151272985"
+  integrity sha512-PyqoipaswDLAZtot351MLhrlrh6lcZPo2LSYE+VDxbVk24LVKAGOuE4hb8xZQmrPAuEtTZW8E6D2zc5EUZX4Lw==

-"@rolldown/pluginutils@1.0.0-rc.11":
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.11.tgz#110d8cc72990c4e36a79791eeafe7cca979e00c9"
-  integrity sha512-xQO9vbwBecJRv9EUcQ/y0dzSTJgA7Q6UVN7xp6B81+tBGSLVAK03yJ9NkJaUA7JFD91kbjxRSC/mDnmvXzbHoQ==
+"@rolldown/pluginutils@1.0.0-rc.12":
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.12.tgz#74163aec62fa51cee18d62709483963dceb3f6dc"
+  integrity sha512-HHMwmarRKvoFsJorqYlFeFRzXZqCt2ETQlEDOb9aqssrnVBB1/+xgTGtuTrIk5vzLNX1MjMtTf7W9z3tsSbrxw==

 "@rolldown/pluginutils@1.0.0-rc.7":
  version "1.0.0-rc.7"
@@ -9741,9 +9758,9 @@ domhandler@^5.0.2, domhandler@^5.0.3:
    domelementtype "^2.3.0"

 dompurify@^3.3.2:
-  version "3.3.3"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.3.3.tgz#680cae8af3e61320ddf3666a3bc843f7b291b2b6"
-  integrity sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==
+  version "3.4.0"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.0.tgz#b1fc33ebdadb373241621e0a30e4ad81573dfd0b"
+  integrity sha512-nolgK9JcaUXMSmW+j1yaSvaEaoXYHwWyGJlkoCTghc97KgGDDSnpoU/PlEnw63Ah+TGKFOyY+X5LnxaWbCSfXg==
  optionalDependencies:
    "@types/trusted-types" "^2.0.7"

@@ -9794,6 +9811,11 @@ dunder-proto@^1.0.0, dunder-proto@^1.0.1:
    es-errors "^1.3.0"
    gopd "^1.2.0"

+eastasianwidth@^0.2.0:
+  version "0.2.0"
+  resolved "https://registry.yarnpkg.com/eastasianwidth/-/eastasianwidth-0.2.0.tgz#696ce2ec0aa0e6ea93a397ffcf24aa7840c827cb"
+  integrity sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==
+
 ee-first@1.1.1:
  version "1.1.1"
  resolved "https://registry.yarnpkg.com/ee-first/-/ee-first-1.1.1.tgz#590c61156b0ae2f4f0255732a158b266bc56b21d"
@@ -10729,9 +10751,9 @@ flatted@^3.2.9, flatted@^3.3.3:
  integrity sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==

 follow-redirects@^1.15.11:
-  version "1.15.11"
-  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.11.tgz#777d73d72a92f8ec4d2e410eb47352a56b8e8340"
-  integrity sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.16.0.tgz#28474a159d3b9d11ef62050a14ed60e4df6d61bc"
+  integrity sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==

 fontkit@^2.0.2:
  version "2.0.4"
@@ -10755,6 +10777,14 @@ for-each@^0.3.3, for-each@^0.3.5:
  dependencies:
    is-callable "^1.2.7"

+foreground-child@^3.1.0:
+  version "3.3.1"
+  resolved "https://registry.yarnpkg.com/foreground-child/-/foreground-child-3.3.1.tgz#32e8e9ed1b68a3497befb9ac2b6adf92a638576f"
+  integrity sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==
+  dependencies:
+    cross-spawn "^7.0.6"
+    signal-exit "^4.0.1"
+
 form-data@^4.0.0:
  version "4.0.4"
  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.4.tgz#784cdcce0669a9d68e94d11ac4eea98088edd2c4"
@@ -10859,6 +10889,11 @@ fs-tree-diff@^2.0.1:
    path-posix "^1.0.0"
    symlink-or-copy "^1.1.8"

+fs.realpath@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/fs.realpath/-/fs.realpath-1.0.0.tgz#1504ad2523158caa40db4a2787cb01411994ea4f"
+  integrity sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==
+
 fsevents@2.3.2:
  version "2.3.2"
  resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-2.3.2.tgz#8a526f78b8fdf4623b709e0b975c52c24c02fd1a"
@@ -11016,7 +11051,19 @@ glob-to-regexp@^0.4.0, glob-to-regexp@^0.4.1:
  resolved "https://registry.yarnpkg.com/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz#c75297087c851b9a578bd217dd59a92f59fe546e"
  integrity sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==

-glob@13.0.6, glob@^10.5.0, glob@^13.0.6, glob@^7.1.3, glob@^7.1.4, glob@^7.1.6:
+glob@^10.5.0:
+  version "10.5.0"
+  resolved "https://registry.yarnpkg.com/glob/-/glob-10.5.0.tgz#8ec0355919cd3338c28428a23d4f24ecc5fe738c"
+  integrity sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==
+  dependencies:
+    foreground-child "^3.1.0"
+    jackspeak "^3.1.2"
+    minimatch "^9.0.4"
+    minipass "^7.1.2"
+    package-json-from-dist "^1.0.0"
+    path-scurry "^1.11.1"
+
+glob@^13.0.6:
  version "13.0.6"
  resolved "https://registry.yarnpkg.com/glob/-/glob-13.0.6.tgz#078666566a425147ccacfbd2e332deb66a2be71d"
  integrity sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==
@@ -11025,6 +11072,18 @@ glob@13.0.6, glob@^10.5.0, glob@^13.0.6, glob@^7.1.3, glob@^7.1.4, glob@^7.1.6:
    minipass "^7.1.3"
    path-scurry "^2.0.2"

+glob@^7.1.3, glob@^7.1.4, glob@^7.1.6:
+  version "7.2.3"
+  resolved "https://registry.yarnpkg.com/glob/-/glob-7.2.3.tgz#b8df0fb802bbfa8e89bd1d938b4e16578ed44f2b"
+  integrity sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==
+  dependencies:
+    fs.realpath "^1.0.0"
+    inflight "^1.0.4"
+    inherits "2"
+    minimatch "^3.1.1"
+    once "^1.3.0"
+    path-is-absolute "^1.0.0"
+
 global-modules@^2.0.0:
  version "2.0.0"
  resolved "https://registry.yarnpkg.com/global-modules/-/global-modules-2.0.0.tgz#997605ad2345f27f51539bea26574421215c7780"
@@ -11651,7 +11710,15 @@ indent-string@^4.0.0:
  resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-4.0.0.tgz#624f8f4497d619b2d9768531d58f4122854d7251"
  integrity sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==

-inherits@2.0.4, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.3, inherits@~2.0.4:
+inflight@^1.0.4:
+  version "1.0.6"
+  resolved "https://registry.yarnpkg.com/inflight/-/inflight-1.0.6.tgz#49bd6331d7d02d0c09bc910a1075ba8165b56df9"
+  integrity sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==
+  dependencies:
+    once "^1.3.0"
+    wrappy "1"
+
+inherits@2, inherits@2.0.4, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.3, inherits@~2.0.4:
  version "2.0.4"
  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c"
  integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
@@ -12043,6 +12110,15 @@ iterator.prototype@^1.1.4:
    has-symbols "^1.1.0"
    set-function-name "^2.0.2"

+jackspeak@^3.1.2:
+  version "3.4.3"
+  resolved "https://registry.yarnpkg.com/jackspeak/-/jackspeak-3.4.3.tgz#8833a9d89ab4acde6188942bd1c53b6390ed5a8a"
+  integrity sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==
+  dependencies:
+    "@isaacs/cliui" "^8.0.2"
+  optionalDependencies:
+    "@pkgjs/parseargs" "^0.11.0"
+
 jake@^10.8.5:
  version "10.9.4"
  resolved "https://registry.yarnpkg.com/jake/-/jake-10.9.4.tgz#d626da108c63d5cfb00ab5c25fadc7e0084af8e6"
@@ -12908,7 +12984,7 @@ lower-case@^2.0.2:
  dependencies:
    tslib "^2.0.3"

-lru-cache@^10.4.3:
+lru-cache@^10.2.0, lru-cache@^10.4.3:
  version "10.4.3"
  resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-10.4.3.tgz#410fc8a17b70e598013df257c2446b7f3383f119"
  integrity sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==
@@ -13555,7 +13631,7 @@ minimatch@^10.2.1, minimatch@^10.2.2, minimatch@^10.2.4, "minimatch@^9.0.3 || ^1
  dependencies:
    brace-expansion "^5.0.2"

-minimatch@^3.0.2, minimatch@^3.0.4, minimatch@^3.1.2:
+minimatch@^3.0.2, minimatch@^3.0.4, minimatch@^3.1.1, minimatch@^3.1.2:
  version "3.1.5"
  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.5.tgz#580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e"
  integrity sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==
@@ -13569,7 +13645,7 @@ minimatch@^5.0.1:
  dependencies:
    brace-expansion "^2.0.1"

-minimatch@^9.0.5:
+minimatch@^9.0.4, minimatch@^9.0.5:
  version "9.0.9"
  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-9.0.9.tgz#9b0cb9fcb78087f6fd7eababe2511c4d3d60574e"
  integrity sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==
@@ -13581,16 +13657,16 @@ minimist@^1.2.0, minimist@^1.2.5, minimist@^1.2.6:
  resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c"
  integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==

+"minipass@^5.0.0 || ^6.0.2 || ^7.0.0", minipass@^7.1.3:
+  version "7.1.3"
+  resolved "https://registry.yarnpkg.com/minipass/-/minipass-7.1.3.tgz#79389b4eb1bb2d003a9bba87d492f2bd37bdc65b"
+  integrity sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==
+
 minipass@^7.1.2:
  version "7.1.2"
  resolved "https://registry.yarnpkg.com/minipass/-/minipass-7.1.2.tgz#93a9626ce5e5e66bd4db86849e7515e92340a707"
  integrity sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==

-minipass@^7.1.3:
-  version "7.1.3"
-  resolved "https://registry.yarnpkg.com/minipass/-/minipass-7.1.3.tgz#79389b4eb1bb2d003a9bba87d492f2bd37bdc65b"
-  integrity sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==
-
 mktemp@~0.4.0:
  version "0.4.0"
  resolved "https://registry.yarnpkg.com/mktemp/-/mktemp-0.4.0.tgz#6d0515611c8a8c84e484aa2000129b98e981ff0b"
@@ -13616,7 +13692,7 @@ mylas@^2.1.9:
  resolved "https://registry.yarnpkg.com/mylas/-/mylas-2.1.13.tgz#1e23b37d58fdcc76e15d8a5ed23f9ae9fc0cbdf4"
  integrity sha512-+MrqnJRtxdF+xngFfUUkIMQrUUL0KsxbADUkn23Z/4ibGg192Q+z+CQyiYwvWTsYjJygmMR8+w3ZDa98Zh6ESg==

-nanoid@^3.3.11, nanoid@^3.3.6, nanoid@^3.3.7:
+nanoid@^3.3.11:
  version "3.3.11"
  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.11.tgz#4f4f112cefbe303202f2199838128936266d185b"
  integrity sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==
@@ -13837,7 +13913,7 @@ on-finished@^2.4.1:
  dependencies:
    ee-first "1.1.1"

-once@^1.4.0:
+once@^1.3.0, once@^1.4.0:
  version "1.4.0"
  resolved "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz#583b1aa775961d4b113ac17d9c50baef9dd76bd1"
  integrity sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==
@@ -13924,6 +14000,11 @@ p-try@^2.0.0:
  resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6"
  integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==

+package-json-from-dist@^1.0.0:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz#4f1471a010827a86f94cfd9b0727e36d267de505"
+  integrity sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==
+
 pako@^0.2.5:
  version "0.2.9"
  resolved "https://registry.yarnpkg.com/pako/-/pako-0.2.9.tgz#f3f7522f4ef782348da8161bad9ecfd51bf83a75"
@@ -13995,6 +14076,11 @@ path-exists@^4.0.0:
  resolved "https://registry.yarnpkg.com/path-exists/-/path-exists-4.0.0.tgz#513bdbe2d3b95d7762e8c1137efa195c6c61b5b3"
  integrity sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==

+path-is-absolute@^1.0.0:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/path-is-absolute/-/path-is-absolute-1.0.1.tgz#174b9268735534ffbc7ace6bf53a5a9e1b5c5f5f"
+  integrity sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==
+
 path-key@^3.0.0, path-key@^3.1.0:
  version "3.1.1"
  resolved "https://registry.yarnpkg.com/path-key/-/path-key-3.1.1.tgz#581f6ade658cbba65a0d3380de7753295054f375"
@@ -14010,6 +14096,14 @@ path-posix@^1.0.0:
  resolved "https://registry.yarnpkg.com/path-posix/-/path-posix-1.0.0.tgz#06b26113f56beab042545a23bfa88003ccac260f"
  integrity sha512-1gJ0WpNIiYcQydgg3Ed8KzvIqTsDpNwq+cjBCssvBtuTWjEqY1AW+i+OepiEMqDCzyro9B2sLAe4RBPajMYFiA==

+path-scurry@^1.11.1:
+  version "1.11.1"
+  resolved "https://registry.yarnpkg.com/path-scurry/-/path-scurry-1.11.1.tgz#7960a668888594a0720b12a911d1a742ab9f11d2"
+  integrity sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==
+  dependencies:
+    lru-cache "^10.2.0"
+    minipass "^5.0.0 || ^6.0.2 || ^7.0.0"
+
 path-scurry@^2.0.2:
  version "2.0.2"
  resolved "https://registry.yarnpkg.com/path-scurry/-/path-scurry-2.0.2.tgz#6be0d0ee02a10d9e0de7a98bae65e182c9061f85"
@@ -14089,7 +14183,7 @@ picomatch@^2.0.4, picomatch@^2.2.1, picomatch@^2.2.2, picomatch@^2.3.1:
  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.2.tgz#5a942915e26b372dc0f0e6753149a16e6b1c5601"
  integrity sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==

-picomatch@^4.0.2, picomatch@^4.0.3:
+picomatch@^4.0.2, picomatch@^4.0.3, picomatch@^4.0.4:
  version "4.0.4"
  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-4.0.4.tgz#fd6f5e00a143086e074dffe4c924b8fb293b0589"
  integrity sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==
@@ -14167,37 +14261,10 @@ postcss-value-parser@^4.0.2, postcss-value-parser@^4.1.0, postcss-value-parser@^
  resolved "https://registry.yarnpkg.com/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz#723c09920836ba6d3e5af019f92bc0971c02e514"
  integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==

-postcss@8.4.31:
-  version "8.4.31"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.31.tgz#92b451050a9f914da6755af352bdc0192508656d"
-  integrity sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==
-  dependencies:
-    nanoid "^3.3.6"
-    picocolors "^1.0.0"
-    source-map-js "^1.0.2"
-
-postcss@8.4.49:
-  version "8.4.49"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.49.tgz#4ea479048ab059ab3ae61d082190fabfd994fe19"
-  integrity sha512-OCVPnIObs4N29kxTjzLfUryOkvZEq+pf8jTF0lg8E7uETuWHA+v7j3c/xJmiqpX450191LlmZfUKkXxkTry7nA==
-  dependencies:
-    nanoid "^3.3.7"
-    picocolors "^1.1.1"
-    source-map-js "^1.2.1"
-
-postcss@^8.5.6:
-  version "8.5.6"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.6.tgz#2825006615a619b4f62a9e7426cc120b349a8f3c"
-  integrity sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==
-  dependencies:
-    nanoid "^3.3.11"
-    picocolors "^1.1.1"
-    source-map-js "^1.2.1"
-
-postcss@^8.5.8:
-  version "8.5.8"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.8.tgz#6230ecc8fb02e7a0f6982e53990937857e13f399"
-  integrity sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==
+postcss@8.4.31, postcss@8.4.49, postcss@8.5.10, postcss@^8.5.6, postcss@^8.5.8:
+  version "8.5.10"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.10.tgz#8992d8c30acf3f12169e7c09514a12fed7e48356"
+  integrity sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==
  dependencies:
    nanoid "^3.3.11"
    picocolors "^1.1.1"
@@ -14512,9 +14579,9 @@ prosemirror-view@1.41.7, prosemirror-view@^1.0.0, prosemirror-view@^1.1.0, prose
    prosemirror-transform "^1.1.0"

 protobufjs@^7.3.0:
-  version "7.5.4"
-  resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.4.tgz#885d31fe9c4b37f25d1bb600da30b1c5b37d286a"
-  integrity sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==
+  version "7.5.5"
+  resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96"
+  integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg==
  dependencies:
    "@protobufjs/aspromise" "^1.1.2"
    "@protobufjs/base64" "^1.1.2"
@@ -14624,6 +14691,13 @@ raf@^3.4.1:
  dependencies:
    performance-now "^2.1.0"

+randombytes@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/randombytes/-/randombytes-2.1.0.tgz#df6f84372f0270dc65cdf6291349ab7a473d4f2a"
+  integrity sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==
+  dependencies:
+    safe-buffer "^5.1.0"
+
 range-parser@^1.2.1:
  version "1.2.1"
  resolved "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.1.tgz#3cf37023d199e1c24d1a55b84800c2f3e6468031"
@@ -15457,29 +15531,29 @@ rimraf@^3.0.2:
  dependencies:
    glob "^7.1.3"

-rolldown@1.0.0-rc.11:
-  version "1.0.0-rc.11"
-  resolved "https://registry.yarnpkg.com/rolldown/-/rolldown-1.0.0-rc.11.tgz#6eaf091b1bbb5ed92e5302171a3d59f0d026d9c0"
-  integrity sha512-NRjoKMusSjfRbSYiH3VSumlkgFe7kYAa3pzVOsVYVFY3zb5d7nS+a3KGQ7hJKXuYWbzJKPVQ9Wxq2UvyK+ENpw==
+rolldown@1.0.0-rc.12:
+  version "1.0.0-rc.12"
+  resolved "https://registry.yarnpkg.com/rolldown/-/rolldown-1.0.0-rc.12.tgz#e226fa74a4c21c71a13f8e44f778f81d58853ad5"
+  integrity sha512-yP4USLIMYrwpPHEFB5JGH1uxhcslv6/hL0OyvTuY+3qlOSJvZ7ntYnoWpehBxufkgN0cvXxppuTu5hHa/zPh+A==
  dependencies:
    "@oxc-project/types" "=0.122.0"
-    "@rolldown/pluginutils" "1.0.0-rc.11"
+    "@rolldown/pluginutils" "1.0.0-rc.12"
  optionalDependencies:
-    "@rolldown/binding-android-arm64" "1.0.0-rc.11"
-    "@rolldown/binding-darwin-arm64" "1.0.0-rc.11"
-    "@rolldown/binding-darwin-x64" "1.0.0-rc.11"
-    "@rolldown/binding-freebsd-x64" "1.0.0-rc.11"
-    "@rolldown/binding-linux-arm-gnueabihf" "1.0.0-rc.11"
-    "@rolldown/binding-linux-arm64-gnu" "1.0.0-rc.11"
-    "@rolldown/binding-linux-arm64-musl" "1.0.0-rc.11"
-    "@rolldown/binding-linux-ppc64-gnu" "1.0.0-rc.11"
-    "@rolldown/binding-linux-s390x-gnu" "1.0.0-rc.11"
-    "@rolldown/binding-linux-x64-gnu" "1.0.0-rc.11"
-    "@rolldown/binding-linux-x64-musl" "1.0.0-rc.11"
-    "@rolldown/binding-openharmony-arm64" "1.0.0-rc.11"
-    "@rolldown/binding-wasm32-wasi" "1.0.0-rc.11"
-    "@rolldown/binding-win32-arm64-msvc" "1.0.0-rc.11"
-    "@rolldown/binding-win32-x64-msvc" "1.0.0-rc.11"
+    "@rolldown/binding-android-arm64" "1.0.0-rc.12"
+    "@rolldown/binding-darwin-arm64" "1.0.0-rc.12"
+    "@rolldown/binding-darwin-x64" "1.0.0-rc.12"
+    "@rolldown/binding-freebsd-x64" "1.0.0-rc.12"
+    "@rolldown/binding-linux-arm-gnueabihf" "1.0.0-rc.12"
+    "@rolldown/binding-linux-arm64-gnu" "1.0.0-rc.12"
+    "@rolldown/binding-linux-arm64-musl" "1.0.0-rc.12"
+    "@rolldown/binding-linux-ppc64-gnu" "1.0.0-rc.12"
+    "@rolldown/binding-linux-s390x-gnu" "1.0.0-rc.12"
+    "@rolldown/binding-linux-x64-gnu" "1.0.0-rc.12"
+    "@rolldown/binding-linux-x64-musl" "1.0.0-rc.12"
+    "@rolldown/binding-openharmony-arm64" "1.0.0-rc.12"
+    "@rolldown/binding-wasm32-wasi" "1.0.0-rc.12"
+    "@rolldown/binding-win32-arm64-msvc" "1.0.0-rc.12"
+    "@rolldown/binding-win32-x64-msvc" "1.0.0-rc.12"

 rollup@^2.43.1:
  version "2.80.0"
@@ -15576,7 +15650,7 @@ safe-array-concat@^1.1.3:
    has-symbols "^1.1.0"
    isarray "^2.0.5"

-safe-buffer@5.2.1, safe-buffer@~5.2.0:
+safe-buffer@5.2.1, safe-buffer@^5.1.0, safe-buffer@~5.2.0:
  version "5.2.1"
  resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
  integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
@@ -15667,10 +15741,12 @@ send@^1.1.0, send@^1.2.0:
    range-parser "^1.2.1"
    statuses "^2.0.1"

-serialize-javascript@7.0.5, serialize-javascript@^6.0.1:
-  version "7.0.5"
-  resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-7.0.5.tgz#c798cc0552ffbb08981914a42a8756e339d0d5b1"
-  integrity sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==
+serialize-javascript@^6.0.1:
+  version "6.0.2"
+  resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.2.tgz#defa1e055c83bf6d59ea805d8da862254eb6a6c2"
+  integrity sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==
+  dependencies:
+    randombytes "^2.1.0"

 serve-static@^2.2.0:
  version "2.2.0"
@@ -15882,7 +15958,7 @@ source-list-map@^2.0.0:
  resolved "https://registry.yarnpkg.com/source-list-map/-/source-list-map-2.0.1.tgz#3993bd873bfc48479cca9ea3a547835c7c154b34"
  integrity sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==

-source-map-js@^1.0.1, source-map-js@^1.0.2, source-map-js@^1.2.1:
+source-map-js@^1.0.1, source-map-js@^1.2.1:
  version "1.2.1"
  resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"
  integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==
@@ -16021,7 +16097,7 @@ string-length@^4.0.2:
    char-regex "^1.0.2"
    strip-ansi "^6.0.0"

-string-width@^4.2.0, string-width@^4.2.3:
+"string-width-cjs@npm:string-width@^4.2.0":
  version "4.2.3"
  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -16030,6 +16106,24 @@ string-width@^4.2.0, string-width@^4.2.3:
    is-fullwidth-code-point "^3.0.0"
    strip-ansi "^6.0.1"

+string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
+  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
+  dependencies:
+    emoji-regex "^8.0.0"
+    is-fullwidth-code-point "^3.0.0"
+    strip-ansi "^6.0.1"
+
+string-width@^5.1.2:
+  version "5.1.2"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-5.1.2.tgz#14f8daec6d81e7221d2a357e668cab73bdbca794"
+  integrity sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==
+  dependencies:
+    eastasianwidth "^0.2.0"
+    emoji-regex "^9.2.2"
+    strip-ansi "^7.0.1"
+
 string-width@^7.2.0:
  version "7.2.0"
  resolved "https://registry.yarnpkg.com/string-width/-/string-width-7.2.0.tgz#b5bb8e2165ce275d4d43476dd2700ad9091db6dc"
@@ -16146,6 +16240,13 @@ stringify-object@^3.3.0:
    is-obj "^1.0.1"
    is-regexp "^1.0.0"

+"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
+  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
+  dependencies:
+    ansi-regex "^5.0.1"
+
 strip-ansi@^6.0.0, strip-ansi@^6.0.1:
  version "6.0.1"
  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
@@ -16153,6 +16254,13 @@ strip-ansi@^6.0.0, strip-ansi@^6.0.1:
  dependencies:
    ansi-regex "^5.0.1"

+strip-ansi@^7.0.1, strip-ansi@^7.1.2:
+  version "7.2.0"
+  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.2.0.tgz#d22a269522836a627af8d04b5c3fd2c7fa3e32e3"
+  integrity sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==
+  dependencies:
+    ansi-regex "^6.2.2"
+
 strip-ansi@^7.1.0:
  version "7.1.2"
  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.1.2.tgz#132875abde678c7ea8d691533f2e7e22bb744dba"
@@ -16160,13 +16268,6 @@ strip-ansi@^7.1.0:
  dependencies:
    ansi-regex "^6.0.1"

-strip-ansi@^7.1.2:
-  version "7.2.0"
-  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.2.0.tgz#d22a269522836a627af8d04b5c3fd2c7fa3e32e3"
-  integrity sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==
-  dependencies:
-    ansi-regex "^6.2.2"
-
 strip-bom@^3.0.0:
  version "3.0.0"
  resolved "https://registry.yarnpkg.com/strip-bom/-/strip-bom-3.0.0.tgz#2334c18e9c759f7bdd56fdef7e9ae3d588e68ed3"
@@ -17089,20 +17190,10 @@ util-deprecate@^1.0.1, util-deprecate@^1.0.2, util-deprecate@~1.0.1:
  resolved "https://registry.yarnpkg.com/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"
  integrity sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==

-uuid@13.0.0:
-  version "13.0.0"
-  resolved "https://registry.yarnpkg.com/uuid/-/uuid-13.0.0.tgz#263dc341b19b4d755eb8fe36b78d95a6b65707e8"
-  integrity sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==
-
-uuid@^8.3.2:
-  version "8.3.2"
-  resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2"
-  integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==
-
-uuid@^9.0.0:
-  version "9.0.1"
-  resolved "https://registry.yarnpkg.com/uuid/-/uuid-9.0.1.tgz#e188d4c8853cc722220392c424cd637f32293f30"
-  integrity sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==
+uuid@14.0.0, uuid@^8.3.2, uuid@^9.0.0:
+  version "14.0.0"
+  resolved "https://registry.yarnpkg.com/uuid/-/uuid-14.0.0.tgz#0af883220163d264ffe0c084f6b8a89b9666966d"
+  integrity sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==

 v8-compile-cache-lib@^3.0.1:
  version "3.0.1"
@@ -17211,15 +17302,15 @@ vite-compatible-readable-stream@^3.6.1:
    string_decoder "^1.1.1"
    util-deprecate "^1.0.1"

-"vite@^6.0.0 || ^7.0.0 || ^8.0.0-0":
-  version "8.0.2"
-  resolved "https://registry.yarnpkg.com/vite/-/vite-8.0.2.tgz#fcee428eb0ad3d4aa9843d7f7ba981679bbe5edc"
-  integrity sha512-1gFhNi+bHhRE/qKZOJXACm6tX4bA3Isy9KuKF15AgSRuRazNBOJfdDemPBU16/mpMxApDPrWvZ08DcLPEoRnuA==
+vite@8.0.5, "vite@^6.0.0 || ^7.0.0 || ^8.0.0-0":
+  version "8.0.5"
+  resolved "https://registry.yarnpkg.com/vite/-/vite-8.0.5.tgz#5f8648997359e18dbc1a9e151ce55434ce5d8a2f"
+  integrity sha512-nmu43Qvq9UopTRfMx2jOYW5l16pb3iDC1JH6yMuPkpVbzK0k+L7dfsEDH4jRgYFmsg0sTAqkojoZgzLMlwHsCQ==
  dependencies:
    lightningcss "^1.32.0"
-    picomatch "^4.0.3"
+    picomatch "^4.0.4"
    postcss "^8.5.8"
-    rolldown "1.0.0-rc.11"
+    rolldown "1.0.0-rc.12"
    tinyglobby "^0.2.15"
  optionalDependencies:
    fsevents "~2.3.3"
@@ -17694,7 +17785,16 @@ workbox-window@7.1.0:
    "@types/trusted-types" "^2.0.2"
    workbox-core "7.1.0"

-wrap-ansi@10.0.0, wrap-ansi@^7.0.0, wrap-ansi@^9.0.0:
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
+  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
+  dependencies:
+    ansi-styles "^4.0.0"
+    string-width "^4.1.0"
+    strip-ansi "^6.0.0"
+
+wrap-ansi@10.0.0, wrap-ansi@^7.0.0, wrap-ansi@^8.1.0, wrap-ansi@^9.0.0:
  version "10.0.0"
  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-10.0.0.tgz#b83ddcc14dbc5596f1b07e153bf6f863c1acbb57"
  integrity sha512-SGcvg80f0wUy2/fXES19feHMz8E0JoXv2uNgHOu4Dgi2OrCy1lqwFYEJz1BLbDI0exjPMe/ZdzZ/YpGECBG/aQ==
--- a/src/helm/env.d/dev/values.impress.yaml.gotmpl
+++ b/src/helm/env.d/dev/values.impress.yaml.gotmpl
@@ -120,10 +120,6 @@ backend:
        python manage.py createsuperuser --email admin@example.com --password admin
    restartPolicy: Never

-  themeCustomization:
-    enabled: true
-    file_content: {{ readFile "./configuration/theme/demo.json" }}
-
  # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
  extraVolumeMounts:
    - name: certs
--- a/src/mail/yarn.lock
+++ b/src/mail/yarn.lock
@@ -538,9 +538,9 @@ leac@^0.6.0:
  integrity sha512-y+SqErxb8h7nE/fiEX07jsbuhrpO9lL8eca7/Y1nuWV2moNlXhyd59iDGcRf6moVyDMbmTNzL40SUyrFU/yDpg==

 lodash@^4.17.21:
-  version "4.17.23"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.23.tgz#f113b0378386103be4f6893388c73d0bde7f2c5a"
-  integrity sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==
+  version "4.18.0"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.18.0.tgz#dfd726f07ab2e39dd763de28fcf66e395c03e440"
+  integrity sha512-l1mfj2atMqndAHI3ls7XqPxEjV2J9ZkcNyHpoZA3r2T1LLwDB69jgkMWh71YKwhBbK0G2f4WSn05ahmQXVxupA==

 lower-case@^1.1.1:
  version "1.1.4"
@@ -998,10 +998,10 @@ peberminta@^0.9.0:
  resolved "https://registry.yarnpkg.com/peberminta/-/peberminta-0.9.0.tgz#8ec9bc0eb84b7d368126e71ce9033501dca2a352"
  integrity sha512-XIxfHpEuSJbITd1H3EeQwpcZbTLHc+VVr8ANI9t5sit565tsI4/xK3KWTUFE2e6QiangUkh3B0jihzmGnNrRsQ==

-picomatch@^2.0.4, picomatch@^2.2.1:
-  version "2.3.1"
-  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.1.tgz#3ba3833733646d9d3e4995946c1365a67fb07a42"
-  integrity sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==
+picomatch@2.3.2, picomatch@^2.0.4, picomatch@^2.2.1:
+  version "2.3.2"
+  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.2.tgz#5a942915e26b372dc0f0e6753149a16e6b1c5601"
+  integrity sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==

 proto-list@~1.2.1:
  version "1.2.4"
Author	SHA1	Message	Date
renovate[bot]	ec165e29a1	⬆️(dependencies) Pin dependencies	2026-05-04 02:11:30 +00:00
Manuel Raynaud	9568d12f68	♻️(backend) improve legacy AI translate prompt The return of the legacy AI translate prompt is sometimes surrounded with a html code block. We improve the prompt to not return this surrounding code block.	2026-04-30 11:23:11 +02:00
Manuel Raynaud	33a9e99d54	✨(backend) manage langfuse with the mistral sdk Langfuse was not working with the legacy client using the mistral sdk. We want to add the support of langfuse for it.	2026-04-30 09:32:34 +02:00
Manuel Raynaud	6cfc8990b9	♻️(backend) use mistral sdk with legacy ai feature We also want to use the mistral sdk with the legacy AI feature when this one is configured with the settings. In order to separate bot feature, they now live in their own module.	2026-04-30 09:32:34 +02:00
Manuel Raynaud	8c84dbf39a	♻️(frontend) all dev origins when using the tilt environment When developping using the tilt environment, we need to allow the domain docs.127.0.0.1.nip.io in the next configuration. Also the the customization is removed as it is not maintained.	2026-04-30 09:32:34 +02:00
Manuel Raynaud	b6efac3983	✨(backend) allow to use new ai feature using mistral sdk We give the possibility, for the new ai feature, to choose between using the OpenAI or Mistral sdk. For instances having access to the mistral infrastructure, using it is mor appropriated than using the openai compatible chat model.	2026-04-30 09:32:34 +02:00
Anthony LC	fa9d56d79b	🔒️(js) fix security warning Critical: - protobufjs CVE High: - lodash CVE - picomatch CVE - Vite CVE Moderate: - postcss CVE - uuid CVE - dompurify CVE - follow-redirects CVE	2026-04-29 15:04:58 +02:00
Manuel Raynaud	4fe508bba1	⬆️(docker) upgrade nginx image to last version We want to upgrade the frontend image using the last nginx version available in order to remove some fixed in version 1.29.7	2026-04-29 09:42:45 +02:00
Manuel Raynaud	487d0b12ca	✅(backend) fix flaky search descendants test One test about the search descendants test was flaky. It is because the link_reach and link_role were used to test the ancestors_link_(reach\|role). The properties ancestors_link_reach and ancestors_link_role should be used instead.	2026-04-29 09:18:05 +02:00
Anthony LC	9f1d4543e7	✅(e2e) adapt e2e test to fit translation upgrade We upgraded djangorestframework, which includes a change in the translation system. This change caused the e2e test for the app impress language to fail. To fix this, we updated the test to work with the new translation system.	2026-04-29 09:16:12 +02:00
renovate[bot]	c90280fb4d	⬆️(dependencies) update python dependencies	2026-04-29 09:16:12 +02:00
Cyril	a2860e8fe6	♿️(frontend) fix sidebar resize handle for screen readers Expose the handle as a slider so arrow keys work with NVDA	2026-04-29 07:12:10 +02:00
Mohamed El Amine BOUKERFA	cfd1fd00da	🐛(backend) Forbid restoring a non-deleted document Catch RuntimeError raised by Document.restore() and translate it into a DRF ValidationError so callers get a 400 instead of a 500, when trying to restore a non-deleted document. Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>	2026-04-28 14:53:30 +00:00
Mohamed El Amine BOUKERFA	ed663f2e1e	🐛(backend) Prevent moving document to its own descendant or self When attempting to move a document to itself or to any of its descendants, the server would crash with a 500 Internal Server Error. Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>	2026-04-28 14:13:42 +00:00
Mohamed El Amine BOUKERFA	99764b8e3e	🐛(backend) strip whitespace from media URLs in CORS proxy When exporting a document to PDF, having whitespace before or after the media URL causes the image to not be downloaded via the CORS proxy, resulting in missing images in the exported PDF. Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>	2026-04-28 13:47:16 +00:00
Mohamed El Amine BOUKERFA	37091ca804	🐛(backend) enforce emoji validation for reactions Validate emojis in ReactionSerializer (previously accepted any string), preventing multiple emojis or text uploads in a single reaction Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>	2026-04-28 13:10:04 +00:00
Erin	394fbc5537	✨(backend) make forward auth request uri header configurable In deployment, Traefik is used, not nginx, as an ingress. Traefik uses `X-Forwarded-Ur`i instead of `X-Original-Url`. This adds a setting which lets users adapt Docs to their ingress proxy of choice The settings name is MEDIA_AUTH_ORIGINAL_URL_HEADER Signed-off-by: Erin Shepherd <erin.shepherd@e43.eu>	2026-04-28 08:57:19 +00:00
Anthony LC	7df5aba991	✅(e2e) fix uuid not formatted correctly in mocked document We added a guard on the uuid format in our frontend requests, this guard broke some of our e2e tests because the mocked document id was not a valid uuid.	2026-04-28 09:08:30 +02:00
renovate[bot]	c464715158	⬆️(dependencies) update uuid to v14 [SECURITY]	2026-04-27 21:21:59 +00:00