Merge pull request #2705 from nxglabs/sync-to-public_repo-31391986146

[nxglabs]

Merge pull request #2704 from nxglabs/raktima-patch-main-7

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
open-sign	Error		Aug 10, 2026 2:47pm

[Copilot]

Pull request overview

This PR appears to sync/merge upstream changes into the public repository, primarily updating Node/JS dependencies (including security-focused overrides) and expanding the PDF request/signing flow UI logic (public template + access-code/OTP related behavior), along with i18n string updates.

Changes:

• Bump/downgrade several dependencies (e.g., axios, parse/parse-server, multer) and add multiple overrides entries in both server and client packages.
• Add substantial logic to PdfRequestFiles.jsx around template fetching, subscription checks, OTP handling, and access-code verification.
• Update access-code related translations across locales (min length wording + new show/hide strings in EN).

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
apps/OpenSignServer/package.json	Dependency and overrides updates impacting runtime/toolchain requirements.
apps/OpenSignServer/package-lock.json	Lockfile updates reflecting new dependency graph and engine constraints.
apps/OpenSign/src/pages/PdfRequestFiles.jsx	Large behavioral changes for public template/signing flow, OTP, and access-code verification.
apps/OpenSign/src/components/pdf/SignerListPlace.jsx	Minor formatting-only change.
apps/OpenSign/public/locales/*/translation.json	Access-code text updates (min length wording), plus EN show/hide labels.
apps/OpenSign/package.json	Client dependency bumps and new overrides entries.

Files not reviewed (1)

• apps/OpenSignServer/package-lock.json: Generated file

Suppressed comments (3)

apps/OpenSign/src/pages/PdfRequestFiles.jsx:304

• handleNavigation is defined with no parameters, but it's being called with res.plan here. If the plan is not used for navigation, call the function without arguments (or update handleNavigation to accept/use the plan).

        handleNavigation(res.plan);

apps/OpenSignServer/package.json:88

• parse@8.1.0 (and the new overrides like undici@7.29.0 / brace-expansion@5.x) require Node >= 20, but this package still declares support for Node 18. This mismatch can lead to installs/builds failing or runtime incompatibilities for Node 18 users.

  "overrides": {
    "brace-expansion": ">=2.1.2",
    "ws": "$ws",
    "parse": "$parse",
    "form-data": "$form-data",
    "@parse/push-adapter": "$@parse/push-adapter",
    "fast-xml-builder": "1.2.0",
    "protobufjs": ">=7.6.3",
    "tmp": ">=0.2.7",
    "decompress": "npm:@xhmikosr/decompress@^11.1.4",
    "tar": "^7.5.19",
    "websocket-driver": ">=0.7.5",
    "js-yaml": "^3.15.0",
    "lodash": "^4.18.0",
    "undici": "^7.29.0"
  },
  "engines": {
    "node": "18 || 20 || 22"
  }

apps/OpenSign/package.json:161

• This app depends on parse@^8.1.0 and overrides undici@^7.29.0, which require Node >= 20, but engines.node still lists Node 18. That can break local dev/CI environments that follow the declared Node 18 support.

  "overrides": {
    "brace-expansion": ">=2.1.2",
    "tmp": "$tmp",
    "react": "$react",
    "react-dom": "$react-dom",
    "form-data": ">=4.0.6",
    "js-yaml": "^3.15.0",
    "undici": "^7.29.0",
    "fast-uri": "^3.1.5"
  },
  "engines": {
    "node": "18 || 20 || 22"
  }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.