🚸(frontend) remove blocking modal on save in Firefox

In firefox the request to save documents did not
complete when the user where closing is tab or browser.
To let the save request complete we added a blocking
modal, but it was not user friendly.
Now we removed the blocking modal and add "keepalive"
option to the fetch request to let the request complete
in background when the user close the tab or browser.

CHANGELOG.md

@@ -6,6 +6,29 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Added
+
+- ✨(backend) add documents/all endpoint with descendants #1553
+- ✅(export) add PDF regression tests #1762
+- 📝(docs) Add language configuration documentation #1757
+- 🔒(helm) Set default security context #1750
+- ✨(backend) use langfuse to monitor AI actions
+
+### Changed
+
+- ♿(frontend) improve accessibility:
+  - ♿(frontend) make html export accessible to screen reader users #1743
+
+### Fixed 
+
+- ✅(backend) reduce flakiness on backend test #1769
+- 🐛(backend) fix TRASHBIN_CUTOFF_DAYS type error #1778
+- 🚸(frontend) remove blocking modal on save in Firefox #1787
+
+### Security
+
+- 🔒️(backend) validate more strictly url used by cors-proxy endpoint #1768
+
 ## [4.3.0] - 2026-01-05
 
 ### Added
@@ -24,7 +47,7 @@ and this project adheres to
 
 - 🐛(frontend) fix tables deletion #1739
 - 🐛(frontend) fix children not display when first resize #1753
-
+- 🐛(frontend) fix clickable main content regression #1773
 
 ## [4.2.0] - 2025-12-17
 
@@ -50,7 +73,6 @@ and this project adheres to
 - 🐛(frontend) Select text + Go back one page crash the app #1733
 - 🐛(frontend) fix versioning conflict #1742
 
-
 ## [4.1.0] - 2025-12-09
 
 ### Added

docs/env.md

@@ -64,6 +64,9 @@ These are the environment variables you can set for the `impress-backend` contai
 | FRONTEND_HOMEPAGE_FEATURE_ENABLED               | Frontend feature flag to display the homepage                                                                                                                              | false                                                                   |
 | FRONTEND_THEME                                  | Frontend theme to use                                                                                                                                                      |                                                                         |
 | LANGUAGE_CODE                                   | Default language                                                                                                                                                           | en-us                                                                   |
+| LANGFUSE_SECRET_KEY                             | The Langfuse secret key used by the sdk                                                                                                                                    | None                                                                    |
+| LANGFUSE_PUBLIC_KEY                             | The Langfuse public key used by the sdk                                                                                                                                    | None                                                                    |
+| LANGFUSE_BASE_URL                               | The Langfuse base url used by the sdk                                                                                                                                      | None                                                                    |
 | LASUITE_MARKETING_BACKEND                       | Backend used when SIGNUP_NEW_USER_TO_MARKETING_EMAIL is True. See https://github.com/suitenumerique/django-lasuite/blob/main/documentation/how-to-use-marketing-backend.md | lasuite.marketing.backends.dummy.DummyBackend                           |   
 | LASUITE_MARKETING_PARAMETERS                    | The parameters to configure LASUITE_MARKETING_BACKEND. See https://github.com/suitenumerique/django-lasuite/blob/main/documentation/how-to-use-marketing-backend.md        | {}                                                                      |
 | LOGGING_LEVEL_LOGGERS_APP                       | Application logging level. options are "DEBUG", "INFO", "WARN", "ERROR", "CRITICAL"                                                                                        | INFO                                                                    |

docs/languages-configuration.md

@@ -0,0 +1,180 @@
+# Language Configuration (2025-12)
+
+This document explains how to configure and override the available languages in the Docs application.
+
+## Default Languages
+
+By default, the application supports the following languages (in priority order):
+
+- English (en-us)
+- French (fr-fr)
+- German (de-de)
+- Dutch (nl-nl)
+- Spanish (es-es)
+
+The default configuration is defined in `src/backend/impress/settings.py`:
+
+```python
+LANGUAGES = values.SingleNestedTupleValue(
+    (
+        ("en-us", "English"),
+        ("fr-fr", "Français"),
+        ("de-de", "Deutsch"),
+        ("nl-nl", "Nederlands"),
+        ("es-es", "Español"),
+    )
+)
+```
+
+## Overriding Languages
+
+### Using Environment Variables
+
+You can override the available languages by setting the `DJANGO_LANGUAGES` environment variable. This is the recommended approach for customizing language support without modifying the source code.
+
+#### Format
+
+The `DJANGO_LANGUAGES` variable expects a semicolon-separated list of language configurations, where each language is defined as `code,Display Name`:
+
+```
+DJANGO_LANGUAGES=code1,Name1;code2,Name2;code3,Name3
+```
+
+#### Example Configurations
+
+**Example 1: English and French only**
+
+```bash
+DJANGO_LANGUAGES=en-us,English;fr-fr,Français
+```
+
+**Example 2: Add Italian and Chinese**
+
+```bash
+DJANGO_LANGUAGES=en-us,English;fr-fr,Français;de-de,Deutsch;it-it,Italiano;zh-cn,中文
+```
+
+**Example 3: Custom subset of languages**
+
+```bash
+DJANGO_LANGUAGES=fr-fr,Français;de-de,Deutsch;es-es,Español
+```
+
+### Configuration Files
+
+#### Development Environment
+
+For local development, you can set the `DJANGO_LANGUAGES` variable in your environment configuration file:
+
+**File:** `env.d/development/common.local`
+
+```bash
+DJANGO_LANGUAGES=en-us,English;fr-fr,Français;de-de,Deutsch;it-it,Italiano;zh-cn,中文;
+```
+
+#### Production Environment
+
+For production deployments, add the variable to your production environment configuration:
+
+**File:** `env.d/production.dist/common`
+
+```bash
+DJANGO_LANGUAGES=en-us,English;fr-fr,Français
+```
+
+#### Docker Compose
+
+When using Docker Compose, you can set the environment variable in your `compose.yml` or `compose.override.yml` file:
+
+```yaml
+services:
+  app:
+    environment:
+      - DJANGO_LANGUAGES=en-us,English;fr-fr,Français;de-de,Deutsch
+```
+
+## Important Considerations
+
+### Language Codes
+
+- Use standard language codes (ISO 639-1 with optional region codes)
+- Format: `language-region` (e.g., `en-us`, `fr-fr`, `de-de`)
+- Use lowercase for language codes and region identifiers
+
+### Priority Order
+
+Languages are listed in priority order. The first language in the list is used as the fallback language throughout the application when a specific translation is not available.
+
+### Translation Availability
+
+Before adding a new language, ensure that:
+
+1. Translation files exist for that language in the `src/backend/locale/` directory
+2. The frontend application has corresponding translation files
+3. All required messages have been translated
+
+#### Available Languages
+
+The following languages have translation files available in `src/backend/locale/`:
+
+- `br_FR` - Breton (France)
+- `cn_CN` - Chinese (China) - *Note: Use `zh-cn` in DJANGO_LANGUAGES*
+- `de_DE` - German (Germany) - Use `de-de`
+- `en_US` - English (United States) - Use `en-us`
+- `es_ES` - Spanish (Spain) - Use `es-es`
+- `fr_FR` - French (France) - Use `fr-fr`
+- `it_IT` - Italian (Italy) - Use `it-it`
+- `nl_NL` - Dutch (Netherlands) - Use `nl-nl`
+- `pt_PT` - Portuguese (Portugal) - Use `pt-pt`
+- `ru_RU` - Russian (Russia) - Use `ru-ru`
+- `sl_SI` - Slovenian (Slovenia) - Use `sl-si`
+- `sv_SE` - Swedish (Sweden) - Use `sv-se`
+- `tr_TR` - Turkish (Turkey) - Use `tr-tr`
+- `uk_UA` - Ukrainian (Ukraine) - Use `uk-ua`
+- `zh_CN` - Chinese (China) - Use `zh-cn`
+
+**Note:** When configuring `DJANGO_LANGUAGES`, use lowercase with hyphens (e.g., `pt-pt`, `ru-ru`) rather than the directory name format.
+
+### Translation Management
+
+We use [Crowdin](https://crowdin.com/) to manage translations for the Docs application. Crowdin allows our community to contribute translations and helps maintain consistency across all supported languages.
+
+**Want to add a new language or improve existing translations?**
+
+If you would like us to support a new language or want to contribute to translations, please get in touch with the project maintainers. We can add new languages to our Crowdin project and coordinate translation efforts with the community.
+
+### Cookie and Session
+
+The application stores the user's language preference in a cookie named `docs_language`. The cookie path is set to `/` by default.
+
+## Testing Language Configuration
+
+After changing the language configuration:
+
+1. Restart the application services
+2. Verify the language selector displays the correct languages
+3. Test switching between different languages
+4. Confirm that content is displayed in the selected language
+
+## Troubleshooting
+
+### Languages not appearing
+
+- Verify the environment variable is correctly formatted (semicolon-separated, comma between code and name)
+- Check that there are no trailing spaces in language codes or names
+- Ensure the application was restarted after changing the configuration
+
+### Missing translations
+
+If you add a new language but see untranslated text:
+
+1. Check if translation files exist in `src/backend/locale/<language_code>/LC_MESSAGES/`
+2. Run Django's `makemessages` and `compilemessages` commands to generate/update translations
+3. Verify frontend translation files are available
+
+## Related Configuration
+
+- `LANGUAGE_CODE`: Default language code (default: `en-us`)
+- `LANGUAGE_COOKIE_NAME`: Cookie name for storing user language preference (default: `docs_language`)
+- `LANGUAGE_COOKIE_PATH`: Cookie path (default: `/`)
+

renovate.json

@@ -25,6 +25,12 @@
       "matchPackageNames": ["pylint"],
       "allowedVersions": "<4.0.0"
     },
+    {
+      "groupName": "allowed django versions",
+      "matchManagers": ["pep621"],
+      "matchPackageNames": ["django"],
+      "allowedVersions": "<6.0.0"
+    },
     {
       "enabled": false,
       "groupName": "ignored js dependencies",

src/backend/core/api/viewsets.py

@@ -3,8 +3,10 @@
 # pylint: disable=too-many-lines
 
 import base64
+import ipaddress
 import json
 import logging
+import socket
 import uuid
 from collections import defaultdict
 from urllib.parse import unquote, urlencode, urlparse
@@ -388,6 +390,7 @@ class DocumentViewSet(
     queryset = models.Document.objects.select_related("creator").all()
     serializer_class = serializers.DocumentSerializer
     ai_translate_serializer_class = serializers.AITranslateSerializer
+    all_serializer_class = serializers.ListDocumentSerializer
     children_serializer_class = serializers.ListDocumentSerializer
     descendants_serializer_class = serializers.ListDocumentSerializer
     list_serializer_class = serializers.ListDocumentSerializer
@@ -858,6 +861,60 @@ class DocumentViewSet(
             },
         )
 
+    @drf.decorators.action(
+        detail=False,
+        methods=["get"],
+    )
+    def all(self, request, *args, **kwargs):
+        """
+        Returns all documents (including descendants) that the user has access to.
+
+        Unlike the list endpoint which only returns top-level documents, this endpoint
+        returns all documents including children, grandchildren, etc.
+        """
+        user = self.request.user
+
+        accessible_documents = self.get_queryset()
+        accessible_paths = list(accessible_documents.values_list("path", flat=True))
+
+        if not accessible_paths:
+            return self.get_response_for_queryset(self.queryset.none())
+
+        # Build query to include all descendants using path prefix matching
+        descendants_clause = db.Q()
+        for path in accessible_paths:
+            descendants_clause |= db.Q(path__startswith=path)
+
+        queryset = self.queryset.filter(
+            descendants_clause, ancestors_deleted_at__isnull=True
+        )
+
+        # Apply existing filters
+        filterset = ListDocumentFilter(
+            self.request.GET, queryset=queryset, request=self.request
+        )
+        if not filterset.is_valid():
+            raise drf.exceptions.ValidationError(filterset.errors)
+        filter_data = filterset.form.cleaned_data
+
+        # Filter as early as possible on fields that are available on the model
+        for field in ["is_creator_me", "title"]:
+            queryset = filterset.filters[field].filter(queryset, filter_data[field])
+
+        queryset = queryset.annotate_user_roles(user)
+
+        # Annotate favorite status and filter if applicable as late as possible
+        queryset = queryset.annotate_is_favorite(user)
+        for field in ["is_favorite", "is_masked"]:
+            queryset = filterset.filters[field].filter(queryset, filter_data[field])
+
+        # Apply ordering only now that everything is filtered and annotated
+        queryset = filters.OrderingFilter().filter_queryset(
+            self.request, queryset, self
+        )
+
+        return self.get_response_for_queryset(queryset)
+
     @drf.decorators.action(
         detail=True,
         methods=["get"],
@@ -1600,6 +1657,101 @@ class DocumentViewSet(
 
         return drf.response.Response(response, status=drf.status.HTTP_200_OK)
 
+    def _reject_invalid_ips(self, ips):
+        """
+        Check if an IP address is safe from SSRF attacks.
+
+        Raises:
+            drf.exceptions.ValidationError: If the IP is unsafe
+        """
+        for ip in ips:
+            # Block loopback addresses (check before private,
+            # as 127.0.0.1 might be considered private)
+            if ip.is_loopback:
+                raise drf.exceptions.ValidationError(
+                    "Access to loopback addresses is not allowed"
+                )
+
+            # Block link-local addresses (169.254.0.0/16) - check before private
+            if ip.is_link_local:
+                raise drf.exceptions.ValidationError(
+                    "Access to link-local addresses is not allowed"
+                )
+
+            # Block private IP ranges
+            if ip.is_private:
+                raise drf.exceptions.ValidationError(
+                    "Access to private IP addresses is not allowed"
+                )
+
+            # Block multicast addresses
+            if ip.is_multicast:
+                raise drf.exceptions.ValidationError(
+                    "Access to multicast addresses is not allowed"
+                )
+
+            # Block reserved addresses (including 0.0.0.0)
+            if ip.is_reserved:
+                raise drf.exceptions.ValidationError(
+                    "Access to reserved IP addresses is not allowed"
+                )
+
+    def _validate_url_against_ssrf(self, url):
+        """
+        Validate that a URL is safe from SSRF (Server-Side Request Forgery) attacks.
+
+        Blocks:
+        - localhost and its variations
+        - Private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+        - Link-local addresses (169.254.0.0/16)
+        - Loopback addresses
+
+        Raises:
+            drf.exceptions.ValidationError: If the URL is unsafe
+        """
+        parsed = urlparse(url)
+        hostname = parsed.hostname
+
+        if not hostname:
+            raise drf.exceptions.ValidationError("Invalid hostname")
+
+        # Resolve hostname to IP address(es)
+        # Check all resolved IPs to prevent DNS rebinding attacks
+        try:
+            # Try to parse as IP address first (if hostname is already an IP)
+            try:
+                ip = ipaddress.ip_address(hostname)
+                resolved_ips = [ip]
+            except ValueError:
+                # Resolve hostname to IP addresses (supports both IPv4 and IPv6)
+                resolved_ips = []
+                try:
+                    # Get all address info (IPv4 and IPv6)
+                    addr_info = socket.getaddrinfo(hostname, None, socket.AF_UNSPEC)
+                    for family, _, _, _, sockaddr in addr_info:
+                        if family == socket.AF_INET:
+                            # IPv4
+                            ip = ipaddress.ip_address(sockaddr[0])
+                            resolved_ips.append(ip)
+                        elif family == socket.AF_INET6:
+                            # IPv6
+                            ip = ipaddress.ip_address(sockaddr[0])
+                            resolved_ips.append(ip)
+                except (socket.gaierror, OSError) as e:
+                    raise drf.exceptions.ValidationError(
+                        f"Failed to resolve hostname: {str(e)}"
+                    ) from e
+
+                if not resolved_ips:
+                    raise drf.exceptions.ValidationError(
+                        "No IP addresses found for hostname"
+                    ) from None
+        except ValueError as e:
+            raise drf.exceptions.ValidationError(f"Invalid IP address: {str(e)}") from e
+
+        # Check all resolved IPs to ensure none are private/internal
+        self._reject_invalid_ips(resolved_ips)
+
     @drf.decorators.action(
         detail=True,
         methods=["get"],
@@ -1633,6 +1785,16 @@ class DocumentViewSet(
                 status=drf.status.HTTP_400_BAD_REQUEST,
             )
 
+        # Validate URL against SSRF attacks
+        try:
+            self._validate_url_against_ssrf(url)
+        except drf.exceptions.ValidationError as e:
+            logger.error("Potential SSRF attack detected: %s", e)
+            return drf.response.Response(
+                {"detail": "Invalid URL used."},
+                status=drf.status.HTTP_400_BAD_REQUEST,
+            )
+
         try:
             response = requests.get(
                 url,
@@ -1641,13 +1803,15 @@ class DocumentViewSet(
                     "User-Agent": request.headers.get("User-Agent", ""),
                     "Accept": request.headers.get("Accept", ""),
                 },
+                allow_redirects=False,
                 timeout=10,
             )
+            response.raise_for_status()
             content_type = response.headers.get("Content-Type", "")
 
             if not content_type.startswith("image/"):
                 return drf.response.Response(
-                    status=status.HTTP_415_UNSUPPORTED_MEDIA_TYPE
+                    {"detail": "Invalid URL used."}, status=status.HTTP_400_BAD_REQUEST
                 )
 
             # Use StreamingHttpResponse with the response's iter_content to properly stream the data
@@ -1665,7 +1829,7 @@ class DocumentViewSet(
         except requests.RequestException as e:
             logger.exception(e)
             return drf.response.Response(
-                {"error": f"Failed to fetch resource from {url}"},
+                {"detail": "Invalid URL used."},
                 status=status.HTTP_400_BAD_REQUEST,
             )
 

src/backend/core/services/ai_services.py

@@ -3,10 +3,14 @@
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 
-from openai import OpenAI
-
 from core import enums
 
+if settings.LANGFUSE_PUBLIC_KEY:
+    from langfuse.openai import OpenAI
+else:
+    from openai import OpenAI
+
+
 AI_ACTIONS = {
     "prompt": (
         "Answer the prompt using markdown formatting for structure and emphasis. "

src/backend/core/tests/authentication/test_backends.py

@@ -5,7 +5,6 @@ import re
 from unittest import mock
 
 from django.core.exceptions import SuspiciousOperation
-from django.test.utils import override_settings
 
 import pytest
 import responses
@@ -323,85 +322,6 @@ def test_authentication_getter_new_user_with_email(monkeypatch):
     assert models.User.objects.count() == 1
 
 
-@override_settings(OIDC_OP_USER_ENDPOINT="http://oidc.endpoint.test/userinfo")
-@responses.activate
-def test_authentication_get_userinfo_json_response():
-    """Test get_userinfo method with a JSON response."""
-
-    responses.add(
-        responses.GET,
-        re.compile(r".*/userinfo"),
-        json={
-            "first_name": "John",
-            "last_name": "Doe",
-            "email": "john.doe@example.com",
-        },
-        status=200,
-    )
-
-    oidc_backend = OIDCAuthenticationBackend()
-    result = oidc_backend.get_userinfo("fake_access_token", None, None)
-
-    assert result["first_name"] == "John"
-    assert result["last_name"] == "Doe"
-    assert result["email"] == "john.doe@example.com"
-
-
-@override_settings(OIDC_OP_USER_ENDPOINT="http://oidc.endpoint.test/userinfo")
-@responses.activate
-def test_authentication_get_userinfo_token_response(monkeypatch, settings):
-    """Test get_userinfo method with a token response."""
-    settings.OIDC_RP_SIGN_ALGO = "HS256"  # disable JWKS URL call
-    responses.add(
-        responses.GET,
-        re.compile(r".*/userinfo"),
-        body="fake.jwt.token",
-        status=200,
-        content_type="application/jwt",
-    )
-
-    def mock_verify_token(self, token):  # pylint: disable=unused-argument
-        return {
-            "first_name": "Jane",
-            "last_name": "Doe",
-            "email": "jane.doe@example.com",
-        }
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "verify_token", mock_verify_token)
-
-    oidc_backend = OIDCAuthenticationBackend()
-    result = oidc_backend.get_userinfo("fake_access_token", None, None)
-
-    assert result["first_name"] == "Jane"
-    assert result["last_name"] == "Doe"
-    assert result["email"] == "jane.doe@example.com"
-
-
-@override_settings(OIDC_OP_USER_ENDPOINT="http://oidc.endpoint.test/userinfo")
-@responses.activate
-def test_authentication_get_userinfo_invalid_response(settings):
-    """
-    Test get_userinfo method with an invalid JWT response that
-    causes verify_token to raise an error.
-    """
-    settings.OIDC_RP_SIGN_ALGO = "HS256"  # disable JWKS URL call
-    responses.add(
-        responses.GET,
-        re.compile(r".*/userinfo"),
-        body="fake.jwt.token",
-        status=200,
-        content_type="application/jwt",
-    )
-
-    oidc_backend = OIDCAuthenticationBackend()
-
-    with pytest.raises(
-        SuspiciousOperation,
-        match="User info response was not valid JWT",
-    ):
-        oidc_backend.get_userinfo("fake_access_token", None, None)
-
-
 def test_authentication_getter_existing_disabled_user_via_sub(
     django_assert_num_queries, monkeypatch
 ):

src/backend/core/tests/documents/test_api_documents_all.py

@@ -0,0 +1,427 @@
+"""
+Tests for Documents API endpoint in impress's core app: all
+
+The 'all' endpoint returns ALL documents (including descendants) that the user has access to.
+This is different from the 'list' endpoint which only returns top-level documents.
+"""
+
+from datetime import timedelta
+from unittest import mock
+
+from django.utils import timezone
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_all_anonymous(reach, role):
+    """
+    Anonymous users should not be able to list any documents via the all endpoint
+    whatever the link reach and link role.
+    """
+    parent = factories.DocumentFactory(link_reach=reach, link_role=role)
+    factories.DocumentFactory(parent=parent, link_reach=reach, link_role=role)
+
+    response = APIClient().get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 0
+
+
+def test_api_documents_all_authenticated_with_children():
+    """
+    Authenticated users should see all documents including children,
+    even though children don't have DocumentAccess records.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Create a document tree: parent -> child -> grandchild
+    parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=parent, user=user, role="owner")
+
+    child = factories.DocumentFactory(parent=parent)
+    grandchild = factories.DocumentFactory(parent=child)
+
+    # Verify setup
+    assert models.DocumentAccess.objects.filter(document=parent).count() == 1
+    assert models.DocumentAccess.objects.filter(document=child).count() == 0
+    assert models.DocumentAccess.objects.filter(document=grandchild).count() == 0
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # All three documents should be returned (parent + child + grandchild)
+    assert len(results) == 3
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(parent.id), str(child.id), str(grandchild.id)}
+
+    depths = {result["depth"] for result in results}
+    assert depths == {1, 2, 3}
+
+
+def test_api_documents_all_authenticated_multiple_trees():
+    """
+    Users should see all accessible documents from multiple document trees.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Tree 1: User has access
+    tree1_parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=tree1_parent, user=user)
+    tree1_child = factories.DocumentFactory(parent=tree1_parent)
+
+    # Tree 2: User has access
+    tree2_parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=tree2_parent, user=user)
+    tree2_child1 = factories.DocumentFactory(parent=tree2_parent)
+    tree2_child2 = factories.DocumentFactory(parent=tree2_parent)
+
+    # Tree 3: User does NOT have access
+    tree3_parent = factories.DocumentFactory()
+    factories.DocumentFactory(parent=tree3_parent)
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Should return 5 documents (tree1: 2, tree2: 3, tree3: 0)
+    assert len(results) == 5
+    results_ids = {result["id"] for result in results}
+    expected_ids = {
+        str(tree1_parent.id),
+        str(tree1_child.id),
+        str(tree2_parent.id),
+        str(tree2_child1.id),
+        str(tree2_child2.id),
+    }
+    assert results_ids == expected_ids
+
+
+def test_api_documents_all_authenticated_explicit_access_to_parent_and_child():
+    """
+    When a user has explicit DocumentAccess to both parent AND child,
+    both should appear in the 'all' endpoint results (unlike 'list' which deduplicates).
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Parent with explicit access
+    parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=parent, user=user)
+
+    # Child also has explicit access (e.g., shared separately)
+    child = factories.DocumentFactory(parent=parent)
+    factories.UserDocumentAccessFactory(document=child, user=user)
+
+    # Grandchild has no explicit access
+    grandchild = factories.DocumentFactory(parent=child)
+
+    # Verify setup
+    assert models.DocumentAccess.objects.filter(document=parent).count() == 1
+    assert models.DocumentAccess.objects.filter(document=child).count() == 1
+    assert models.DocumentAccess.objects.filter(document=grandchild).count() == 0
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # All three should appear
+    assert len(results) == 3
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(parent.id), str(child.id), str(grandchild.id)}
+
+    # Each document should appear exactly once (no duplicates)
+    results_ids_list = [result["id"] for result in results]
+    assert len(results_ids_list) == len(set(results_ids_list))  # No duplicates
+
+
+def test_api_documents_all_authenticated_via_team(mock_user_teams):
+    """
+    Users should see all documents (including descendants) for documents accessed via teams.
+    """
+    mock_user_teams.return_value = ["team1", "team2"]
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Document tree via team1
+    parent1 = factories.DocumentFactory()
+    factories.TeamDocumentAccessFactory(document=parent1, team="team1")
+    child1 = factories.DocumentFactory(parent=parent1)
+
+    # Document tree via team2
+    parent2 = factories.DocumentFactory()
+    factories.TeamDocumentAccessFactory(document=parent2, team="team2")
+    child2 = factories.DocumentFactory(parent=parent2)
+
+    # Document tree via unknown team
+    parent3 = factories.DocumentFactory()
+    factories.TeamDocumentAccessFactory(document=parent3, team="team3")
+    factories.DocumentFactory(parent=parent3)
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Should return 4 documents (team1: 2, team2: 2, team3: 0)
+    assert len(results) == 4
+    results_ids = {result["id"] for result in results}
+    expected_ids = {
+        str(parent1.id),
+        str(child1.id),
+        str(parent2.id),
+        str(child2.id),
+    }
+    assert results_ids == expected_ids
+
+
+def test_api_documents_all_authenticated_soft_deleted():
+    """
+    Soft-deleted documents and their descendants should not be included.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Active tree
+    active_parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=active_parent, user=user)
+    active_child = factories.DocumentFactory(parent=active_parent)
+
+    # Soft-deleted tree
+    deleted_parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=deleted_parent, user=user)
+    _deleted_child = factories.DocumentFactory(parent=deleted_parent)
+    deleted_parent.soft_delete()
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Should only return active documents
+    assert len(results) == 2
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(active_parent.id), str(active_child.id)}
+
+
+def test_api_documents_all_authenticated_permanently_deleted():
+    """
+    Permanently deleted documents should not be included.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Active tree
+    active_parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=active_parent, user=user)
+    active_child = factories.DocumentFactory(parent=active_parent)
+
+    # Permanently deleted tree (deleted > 30 days ago)
+    deleted_parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=deleted_parent, user=user)
+    _deleted_child = factories.DocumentFactory(parent=deleted_parent)
+
+    fourty_days_ago = timezone.now() - timedelta(days=40)
+    with mock.patch("django.utils.timezone.now", return_value=fourty_days_ago):
+        deleted_parent.soft_delete()
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Should only return active documents
+    assert len(results) == 2
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(active_parent.id), str(active_child.id)}
+
+
+def test_api_documents_all_authenticated_link_reach_restricted():
+    """
+    Documents with link_reach=restricted accessed via LinkTrace should not appear
+    in the all endpoint results.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Document with direct access (should appear)
+    parent_with_access = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=parent_with_access, user=user)
+    child_with_access = factories.DocumentFactory(parent=parent_with_access)
+
+    # Document with only LinkTrace and restricted reach (should NOT appear)
+    parent_restricted = factories.DocumentFactory(
+        link_reach="restricted", link_traces=[user]
+    )
+    factories.DocumentFactory(parent=parent_restricted)
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Only documents with direct access should appear
+    assert len(results) == 2
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(parent_with_access.id), str(child_with_access.id)}
+
+
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_all_authenticated_link_reach_public_or_authenticated(reach):
+    """
+    Documents with link_reach=public or authenticated accessed via LinkTrace
+    should appear with all their descendants.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Document accessed via LinkTrace with non-restricted reach
+    parent = factories.DocumentFactory(link_reach=reach, link_traces=[user])
+    child = factories.DocumentFactory(parent=parent)
+    grandchild = factories.DocumentFactory(parent=child)
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # All descendants should be included
+    assert len(results) == 3
+    results_ids = {result["id"] for result in results}
+    assert results_ids == {str(parent.id), str(child.id), str(grandchild.id)}
+
+
+def test_api_documents_all_format():
+    """Validate the format of documents as returned by the all endpoint."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    access = factories.UserDocumentAccessFactory(document=document, user=user)
+    child = factories.DocumentFactory(parent=document)
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    content = response.json()
+    results = content.pop("results")
+
+    # Check pagination structure
+    assert content == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+    }
+
+    # Verify parent document format
+    parent_result = [r for r in results if r["id"] == str(document.id)][0]
+    assert parent_result == {
+        "id": str(document.id),
+        "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "creator": str(document.creator.id),
+        "deleted_at": None,
+        "depth": 1,
+        "excerpt": document.excerpt,
+        "is_favorite": False,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
+        "nb_accesses_ancestors": 1,
+        "nb_accesses_direct": 1,
+        "numchild": 1,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_role": access.role,
+    }
+
+    # Verify child document format
+    child_result = [r for r in results if r["id"] == str(child.id)][0]
+    assert child_result["depth"] == 2
+    assert child_result["user_role"] == access.role  # Inherited from parent
+    assert child_result["nb_accesses_direct"] == 0  # No direct access on child
+
+
+def test_api_documents_all_distinct():
+    """
+    A document should only appear once even if the user has multiple access paths to it.
+    """
+    user = factories.UserFactory()
+    other_user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Document with multiple accesses for the same user
+    document = factories.DocumentFactory(users=[user, other_user])
+    child = factories.DocumentFactory(parent=document)
+
+    response = client.get("/api/v1.0/documents/all/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Should return 2 documents (parent + child), each appearing once
+    assert len(results) == 2
+    results_ids = [result["id"] for result in results]
+    assert results_ids.count(str(document.id)) == 1
+    assert results_ids.count(str(child.id)) == 1
+
+
+def test_api_documents_all_comparison_with_list():
+    """
+    The 'all' endpoint should return more documents than 'list' when there are children.
+    'list' returns only top-level documents, 'all' returns all descendants.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Create a document tree
+    parent = factories.DocumentFactory()
+    factories.UserDocumentAccessFactory(document=parent, user=user)
+    child = factories.DocumentFactory(parent=parent)
+    grandchild = factories.DocumentFactory(parent=child)
+
+    # Call list endpoint
+    list_response = client.get("/api/v1.0/documents/")
+    list_results = list_response.json()["results"]
+
+    # Call all endpoint
+    all_response = client.get("/api/v1.0/documents/all/")
+    all_results = all_response.json()["results"]
+
+    # list should return only parent
+    assert len(list_results) == 1
+    assert list_results[0]["id"] == str(parent.id)
+
+    # all should return parent + child + grandchild
+    assert len(all_results) == 3
+    all_ids = {result["id"] for result in all_results}
+    assert all_ids == {str(parent.id), str(child.id), str(grandchild.id)}

src/backend/core/tests/documents/test_api_documents_cors_proxy.py

@@ -1,5 +1,8 @@
 """Test on the CORS proxy API for documents."""
 
+import socket
+import unittest.mock
+
 import pytest
 import responses
 from requests.exceptions import RequestException
@@ -10,11 +13,17 @@ from core import factories
 pytestmark = pytest.mark.django_db
 
 
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
 @responses.activate
-def test_api_docs_cors_proxy_valid_url():
+def test_api_docs_cors_proxy_valid_url(mock_getaddrinfo):
     """Test the CORS proxy API for documents with a valid URL."""
     document = factories.DocumentFactory(link_reach="public")
 
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
     client = APIClient()
     url_to_fetch = "https://external-url.com/assets/logo-gouv.png"
     responses.get(url_to_fetch, body=b"", status=200, content_type="image/png")
@@ -56,11 +65,17 @@ def test_api_docs_cors_proxy_without_url_query_string():
     assert response.json() == {"detail": "Missing 'url' query parameter"}
 
 
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
 @responses.activate
-def test_api_docs_cors_proxy_anonymous_document_not_public():
+def test_api_docs_cors_proxy_anonymous_document_not_public(mock_getaddrinfo):
     """Test the CORS proxy API for documents with an anonymous user and a non-public document."""
     document = factories.DocumentFactory(link_reach="authenticated")
 
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
     client = APIClient()
     url_to_fetch = "https://external-url.com/assets/logo-gouv.png"
     responses.get(url_to_fetch, body=b"", status=200, content_type="image/png")
@@ -73,14 +88,22 @@ def test_api_docs_cors_proxy_anonymous_document_not_public():
     }
 
 
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
 @responses.activate
-def test_api_docs_cors_proxy_authenticated_user_accessing_protected_doc():
+def test_api_docs_cors_proxy_authenticated_user_accessing_protected_doc(
+    mock_getaddrinfo,
+):
     """
     Test the CORS proxy API for documents with an authenticated user accessing a protected
     document.
     """
     document = factories.DocumentFactory(link_reach="authenticated")
 
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
     user = factories.UserFactory()
 
     client = APIClient()
@@ -115,14 +138,22 @@ def test_api_docs_cors_proxy_authenticated_user_accessing_protected_doc():
     assert response.streaming_content
 
 
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
 @responses.activate
-def test_api_docs_cors_proxy_authenticated_not_accessing_restricted_doc():
+def test_api_docs_cors_proxy_authenticated_not_accessing_restricted_doc(
+    mock_getaddrinfo,
+):
     """
     Test the CORS proxy API for documents with an authenticated user not accessing a restricted
     document.
     """
     document = factories.DocumentFactory(link_reach="restricted")
 
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
     user = factories.UserFactory()
 
     client = APIClient()
@@ -138,18 +169,72 @@ def test_api_docs_cors_proxy_authenticated_not_accessing_restricted_doc():
     }
 
 
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
 @responses.activate
-def test_api_docs_cors_proxy_unsupported_media_type():
+def test_api_docs_cors_proxy_unsupported_media_type(mock_getaddrinfo):
     """Test the CORS proxy API for documents with an unsupported media type."""
     document = factories.DocumentFactory(link_reach="public")
 
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
     client = APIClient()
     url_to_fetch = "https://external-url.com/assets/index.html"
     responses.get(url_to_fetch, body=b"", status=200, content_type="text/html")
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
     )
-    assert response.status_code == 415
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Invalid URL used."}
+
+
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+@responses.activate
+def test_api_docs_cors_proxy_redirect(mock_getaddrinfo):
+    """Test the CORS proxy API for documents with a redirect."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
+    client = APIClient()
+    url_to_fetch = "https://external-url.com/assets/index.html"
+    responses.get(
+        url_to_fetch,
+        body=b"",
+        status=302,
+        headers={"Location": "https://external-url.com/other/assets/index.html"},
+    )
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Invalid URL used."}
+
+
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+@responses.activate
+def test_api_docs_cors_proxy_url_not_returning_200(mock_getaddrinfo):
+    """Test the CORS proxy API for documents with a URL that does not return 200."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
+    client = APIClient()
+    url_to_fetch = "https://external-url.com/assets/index.html"
+    responses.get(url_to_fetch, body=b"", status=404)
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json() == {"detail": "Invalid URL used."}
 
 
 @pytest.mark.parametrize(
@@ -173,11 +258,17 @@ def test_api_docs_cors_proxy_invalid_url(url_to_fetch):
     assert response.json() == ["Enter a valid URL."]
 
 
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
 @responses.activate
-def test_api_docs_cors_proxy_request_failed():
+def test_api_docs_cors_proxy_request_failed(mock_getaddrinfo):
     """Test the CORS proxy API for documents with a request failed."""
     document = factories.DocumentFactory(link_reach="public")
 
+    # Mock DNS resolution to return a public IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0))
+    ]
+
     client = APIClient()
     url_to_fetch = "https://external-url.com/assets/index.html"
     responses.get(url_to_fetch, body=RequestException("Connection refused"))
@@ -185,6 +276,164 @@ def test_api_docs_cors_proxy_request_failed():
         f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
     )
     assert response.status_code == 400
-    assert response.json() == {
-        "error": "Failed to fetch resource from https://external-url.com/assets/index.html"
-    }
+    assert response.json() == {"detail": "Invalid URL used."}
+
+
+@pytest.mark.parametrize(
+    "url_to_fetch",
+    [
+        "http://localhost/image.png",
+        "https://localhost/image.png",
+        "http://127.0.0.1/image.png",
+        "https://127.0.0.1/image.png",
+        "http://0.0.0.0/image.png",
+        "https://0.0.0.0/image.png",
+        "http://[::1]/image.png",
+        "https://[::1]/image.png",
+        "http://[0:0:0:0:0:0:0:1]/image.png",
+        "https://[0:0:0:0:0:0:0:1]/image.png",
+    ],
+)
+def test_api_docs_cors_proxy_blocks_localhost(url_to_fetch):
+    """Test that the CORS proxy API blocks localhost variations."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    client = APIClient()
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+
+
+@pytest.mark.parametrize(
+    "url_to_fetch",
+    [
+        "http://10.0.0.1/image.png",
+        "https://10.0.0.1/image.png",
+        "http://172.16.0.1/image.png",
+        "https://172.16.0.1/image.png",
+        "http://192.168.1.1/image.png",
+        "https://192.168.1.1/image.png",
+        "http://10.255.255.255/image.png",
+        "https://10.255.255.255/image.png",
+        "http://172.31.255.255/image.png",
+        "https://172.31.255.255/image.png",
+        "http://192.168.255.255/image.png",
+        "https://192.168.255.255/image.png",
+    ],
+)
+def test_api_docs_cors_proxy_blocks_private_ips(url_to_fetch):
+    """Test that the CORS proxy API blocks private IP addresses."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    client = APIClient()
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+
+
+@pytest.mark.parametrize(
+    "url_to_fetch",
+    [
+        "http://169.254.1.1/image.png",
+        "https://169.254.1.1/image.png",
+        "http://169.254.255.255/image.png",
+        "https://169.254.255.255/image.png",
+    ],
+)
+def test_api_docs_cors_proxy_blocks_link_local(url_to_fetch):
+    """Test that the CORS proxy API blocks link-local addresses."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    client = APIClient()
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+
+
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+@responses.activate
+def test_api_docs_cors_proxy_blocks_dns_rebinding_to_private_ip(mock_getaddrinfo):
+    """Test that the CORS proxy API blocks DNS rebinding attacks to private IPs."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to return a private IP address
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("192.168.1.1", 0))
+    ]
+
+    client = APIClient()
+    url_to_fetch = "https://malicious-domain.com/image.png"
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+    mock_getaddrinfo.assert_called_once()
+
+
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+@responses.activate
+def test_api_docs_cors_proxy_blocks_dns_rebinding_to_localhost(mock_getaddrinfo):
+    """Test that the CORS proxy API blocks DNS rebinding attacks to localhost."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to return localhost
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("127.0.0.1", 0))
+    ]
+
+    client = APIClient()
+    url_to_fetch = "https://malicious-domain.com/image.png"
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+    mock_getaddrinfo.assert_called_once()
+
+
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+def test_api_docs_cors_proxy_handles_dns_resolution_failure(mock_getaddrinfo):
+    """Test that the CORS proxy API handles DNS resolution failures gracefully."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to fail
+    mock_getaddrinfo.side_effect = socket.gaierror("Name or service not known")
+
+    client = APIClient()
+    url_to_fetch = "https://nonexistent-domain-12345.com/image.png"
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+    mock_getaddrinfo.assert_called_once()
+
+
+@unittest.mock.patch("core.api.viewsets.socket.getaddrinfo")
+def test_api_docs_cors_proxy_blocks_multiple_resolved_ips_if_any_private(
+    mock_getaddrinfo,
+):
+    """Test that the CORS proxy API blocks if any resolved IP is private."""
+    document = factories.DocumentFactory(link_reach="public")
+
+    # Mock DNS resolution to return both public and private IPs
+    mock_getaddrinfo.return_value = [
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("8.8.8.8", 0)),
+        (socket.AF_INET, socket.SOCK_STREAM, 0, "", ("192.168.1.1", 0)),
+    ]
+
+    client = APIClient()
+    url_to_fetch = "https://example.com/image.png"
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/cors-proxy/?url={url_to_fetch}"
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Invalid URL used."
+    mock_getaddrinfo.assert_called_once()

src/backend/core/tests/test_api_users.py

@@ -311,7 +311,7 @@ def test_api_users_list_query_short_queries():
     """
     Queries shorter than 5 characters should return an empty result set.
     """
-    user = factories.UserFactory(email="paul@example.com")
+    user = factories.UserFactory(email="paul@example.com", full_name="Paul")
     client = APIClient()
     client.force_login(user)
 

src/backend/core/tests/test_models_documents.py

@@ -1393,7 +1393,7 @@ def test_models_documents_restore_complex(django_assert_num_queries):
     assert child2.ancestors_deleted_at == document.deleted_at
 
     # Restore the item
-    with django_assert_num_queries(13):
+    with django_assert_num_queries(14):
         document.restore()
     document.refresh_from_db()
     child1.refresh_from_db()

src/backend/impress/settings.py

@@ -453,7 +453,7 @@ class Base(Configuration):
         "REDOC_DIST": "SIDECAR",
     }
 
-    TRASHBIN_CUTOFF_DAYS = values.Value(
+    TRASHBIN_CUTOFF_DAYS = values.IntegerValue(
         30, environ_name="TRASHBIN_CUTOFF_DAYS", environ_prefix=None
     )
 
@@ -699,6 +699,16 @@ class Base(Configuration):
         "day": 200,
     }
 
+    LANGFUSE_SECRET_KEY = SecretFileValue(
+        None, environ_name="LANGFUSE_SECRET_KEY", environ_prefix=None
+    )
+    LANGFUSE_PUBLIC_KEY = values.Value(
+        None, environ_name="LANGFUSE_PUBLIC_KEY", environ_prefix=None
+    )
+    LANGFUSE_BASE_URL = values.Value(
+        None, environ_name="LANGFUSE_BASE_URL", environ_prefix=None
+    )
+
     # Y provider microservice
     Y_PROVIDER_API_KEY = SecretFileValue(
         environ_name="Y_PROVIDER_API_KEY",

src/backend/pyproject.toml

@@ -25,13 +25,13 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
-    "beautifulsoup4==4.14.2",
-    "boto3==1.40.74",
+    "beautifulsoup4==4.14.3",
+    "boto3==1.42.17",
     "Brotli==1.2.0",
-    "celery[redis]==5.5.3",
+    "celery[redis]==5.6.0",
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
-    "django-countries==8.1.0",
+    "django-countries==8.2.0",
     "django-csp==4.0",
     "django-filter==25.2",
     "django-lasuite[all]==0.0.22",
@@ -39,8 +39,8 @@ dependencies = [
     "django-redis==6.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
-    "django==5.2.9",
-    "django-treebeard==4.7.1",
+    "django<6.0.0",
+    "django-treebeard==4.8.0",
     "djangorestframework==3.16.1",
     "drf_spectacular==0.29.0",
     "dockerflow==2024.4.2",
@@ -48,18 +48,19 @@ dependencies = [
     "factory_boy==3.3.3",
     "gunicorn==23.0.0",
     "jsonschema==4.25.1",
+    "langfuse==3.11.2",
     "lxml==6.0.2",
     "markdown==3.10",
-    "mozilla-django-oidc==4.0.1",
+    "mozilla-django-oidc==5.0.2",
     "nested-multipart-parser==1.6.0",
-    "openai==2.8.0",
-    "psycopg[binary]==3.2.12",
-    "pycrdt==0.12.43", 
+    "openai==2.14.0",
+    "psycopg[binary]==3.3.2",
+    "pycrdt==0.12.44", 
     "PyJWT==2.10.1",
     "python-magic==0.4.27",
     "redis<6.0.0",
     "requests==2.32.5",
-    "sentry-sdk==2.44.0",
+    "sentry-sdk==2.48.0",
     "whitenoise==6.11.0",
 ]
 
@@ -73,20 +74,20 @@ dependencies = [
 dev = [
     "django-extensions==4.1",
     "django-test-migrations==1.5.0",
-    "drf-spectacular-sidecar==2025.10.1",
+    "drf-spectacular-sidecar==2025.12.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.7.0",
-    "pyfakefs==5.10.2",
+    "ipython==9.8.0",
+    "pyfakefs==6.0.0",
     "pylint-django==2.6.1",
     "pylint<4.0.0",
     "pytest-cov==7.0.0",
     "pytest-django==4.11.1",
-    "pytest==9.0.1",
+    "pytest==9.0.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.25.8",
-    "ruff==0.14.5",
+    "ruff==0.14.10",
     "types-requests==2.32.4.20250913",
 ]
 

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -604,7 +604,7 @@ test.describe('Doc Editor', () => {
 
     await verifyDocName(page, randomDoc);
 
-    const editor = await openSuggestionMenu({ page });
+    const { editor } = await openSuggestionMenu({ page });
     await page.getByText('Embedded file').click();
     await page.getByText('Upload file').click();
 

src/frontend/apps/e2e/__tests__/app-impress/doc-export.spec.ts

@@ -1,18 +1,19 @@
+import fs from 'fs';
 import path from 'path';
 
-import { expect, test } from '@playwright/test';
+import { Download, Page, expect, test } from '@playwright/test';
 import cs from 'convert-stream';
 import JSZip from 'jszip';
 import { PDFParse } from 'pdf-parse';
 
 import {
+  BrowserName,
   TestLanguage,
   createDoc,
   verifyDocName,
   waitForLanguageSwitch,
 } from './utils-common';
 import { openSuggestionMenu, writeInEditor } from './utils-editor';
-import { createRootSubPage } from './utils-sub-pages';
 
 test.beforeEach(async ({ page }) => {
   await page.goto('/');
@@ -46,81 +47,14 @@ test.describe('Doc Export', () => {
     await expect(page.getByTestId('doc-export-download-button')).toBeVisible();
   });
 
-  test('it exports the doc with pdf line break', async ({
-    page,
-    browserName,
-  }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'doc-editor-line-break',
-      browserName,
-      1,
-    );
-
-    await verifyDocName(page, randomDoc);
-
-    const editor = await writeInEditor({ page, text: 'Hello' });
-    await page.keyboard.press('Enter');
-    await openSuggestionMenu({ page });
-    await page.getByText('Page Break').click();
-
-    await expect(
-      editor.locator('div[data-content-type="pageBreak"]'),
-    ).toBeVisible();
-
-    await writeInEditor({ page, text: 'World' });
-
-    await page
-      .getByRole('button', {
-        name: 'Export the document',
-      })
-      .click();
-
-    const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${randomDoc}.pdf`);
-    });
-
-    void page.getByTestId('doc-export-download-button').click();
-
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${randomDoc}.pdf`);
-
-    const pdfBuffer = await cs.toBuffer(await download.createReadStream());
-    const pdfParse = new PDFParse({ data: pdfBuffer });
-    const pdfInfo = await pdfParse.getInfo();
-    const pdfText = await pdfParse.getText();
-
-    expect(pdfInfo.total).toBe(2);
-    expect(pdfText.pages).toStrictEqual([
-      { text: 'Hello', num: 1 },
-      { text: 'World', num: 2 },
-    ]);
-    expect(pdfInfo?.info.Title).toBe(randomDoc);
-  });
-
+  /**
+   * We override the document content to ensure that the exported DOCX
+   * contains various elements for testing.
+   * We don't check the content of the DOCX here, just that the export works
+   * and the file is correctly named.
+   */
   test('it exports the doc to docx', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(page, 'doc-editor', browserName, 1);
-
-    await verifyDocName(page, randomDoc);
-
-    await page.locator('.ProseMirror.bn-editor').click();
-    await page.locator('.ProseMirror.bn-editor').fill('Hello World');
-
-    await page.keyboard.press('Enter');
-    await page.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Resizable image with caption').click();
-
-    const fileChooserPromise = page.waitForEvent('filechooser');
-    await page.getByText('Upload image').click();
-
-    const fileChooser = await fileChooserPromise;
-    await fileChooser.setFiles(path.join(__dirname, 'assets/test.svg'));
-
-    const image = page
-      .locator('.--docs--editor-container img.bn-visual-media')
-      .first();
-
-    await expect(image).toBeVisible();
+    const randomDoc = await overrideDocContent({ page, browserName });
 
     await page
       .getByRole('button', {
@@ -143,29 +77,14 @@ test.describe('Doc Export', () => {
     expect(download.suggestedFilename()).toBe(`${randomDoc}.docx`);
   });
 
+  /**
+   * We override the document content to ensure that the exported ODT
+   * contains various elements for testing.
+   * We don't check the content of the ODT here, just that the export works
+   * and the file is correctly named.
+   */
   test('it exports the doc to odt', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(page, 'doc-editor-odt', browserName, 1);
-
-    await verifyDocName(page, randomDoc);
-
-    await page.locator('.ProseMirror.bn-editor').click();
-    await page.locator('.ProseMirror.bn-editor').fill('Hello World ODT');
-
-    await page.keyboard.press('Enter');
-    await page.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Resizable image with caption').click();
-
-    const fileChooserPromise = page.waitForEvent('filechooser');
-    await page.getByText('Upload image').click();
-
-    const fileChooser = await fileChooserPromise;
-    await fileChooser.setFiles(path.join(__dirname, 'assets/test.svg'));
-
-    const image = page
-      .locator('.--docs--editor-container img.bn-visual-media')
-      .first();
-
-    await expect(image).toBeVisible();
+    const randomDoc = await overrideDocContent({ page, browserName });
 
     await page
       .getByRole('button', {
@@ -358,108 +277,6 @@ test.describe('Doc Export', () => {
     expect(pdfText.text).toContain('Hello World');
   });
 
-  test('it exports the doc with quotes', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(page, 'export-quotes', browserName, 1);
-
-    const editor = page.locator('.ProseMirror.bn-editor');
-    // Trigger slash menu to show menu
-    await editor.click();
-    await editor.fill('/');
-    await page.getByText('Quote or excerpt').click();
-
-    await expect(
-      editor.locator('.bn-block-content[data-content-type="quote"]'),
-    ).toBeVisible();
-
-    await editor
-      .locator('.bn-block-content[data-content-type="quote"]')
-      .fill('Hello World');
-
-    await expect(editor.getByText('Hello World')).toHaveCSS(
-      'font-style',
-      'italic',
-    );
-
-    await page
-      .getByRole('button', {
-        name: 'Export the document',
-      })
-      .click();
-
-    await expect(page.getByTestId('doc-export-download-button')).toBeVisible();
-
-    const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${randomDoc}.pdf`);
-    });
-
-    void page.getByTestId('doc-export-download-button').click();
-
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${randomDoc}.pdf`);
-
-    const pdfBuffer = await cs.toBuffer(await download.createReadStream());
-    const pdfParse = new PDFParse({ data: pdfBuffer });
-    const pdfText = await pdfParse.getText();
-    expect(pdfText.text).toContain('Hello World');
-  });
-
-  test('it exports the doc with multi columns', async ({
-    page,
-    browserName,
-  }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'doc-multi-columns',
-      browserName,
-      1,
-    );
-
-    await page.locator('.bn-block-outer').last().fill('/');
-
-    await page.getByText('Three Columns', { exact: true }).click();
-
-    await page.locator('.bn-block-column').first().fill('Column 1');
-    await page.locator('.bn-block-column').nth(1).fill('Column 2');
-    await page.locator('.bn-block-column').last().fill('Column 3');
-
-    expect(await page.locator('.bn-block-column').count()).toBe(3);
-    await expect(
-      page.locator('.bn-block-column[data-node-type="column"]').first(),
-    ).toHaveText('Column 1');
-    await expect(
-      page.locator('.bn-block-column[data-node-type="column"]').nth(1),
-    ).toHaveText('Column 2');
-    await expect(
-      page.locator('.bn-block-column[data-node-type="column"]').last(),
-    ).toHaveText('Column 3');
-
-    await page
-      .getByRole('button', {
-        name: 'Export the document',
-      })
-      .click();
-
-    await expect(
-      page.getByTestId('doc-open-modal-download-button'),
-    ).toBeVisible();
-
-    const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${randomDoc}.pdf`);
-    });
-
-    void page.getByTestId('doc-export-download-button').click();
-
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${randomDoc}.pdf`);
-
-    const pdfBuffer = await cs.toBuffer(await download.createReadStream());
-    const pdfParse = new PDFParse({ data: pdfBuffer });
-    const pdfText = await pdfParse.getText();
-    expect(pdfText.text).toContain('Column 1');
-    expect(pdfText.text).toContain('Column 2');
-    expect(pdfText.text).toContain('Column 3');
-  });
-
   test('it injects the correct language attribute into PDF export', async ({
     page,
     browserName,
@@ -506,53 +323,18 @@ test.describe('Doc Export', () => {
     expect(pdfString).toContain('/Lang (fr)');
   });
 
-  test('it exports the doc with interlinking', async ({
+  test('it exports the doc to PDF and checks regressions', async ({
     page,
     browserName,
   }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'export-interlinking',
-      browserName,
-      1,
-    );
+    // PDF Binary comparison is different depending on the browser used
+    // We only run this test on Chromium to avoid having to maintain
+    // multiple sets of PDF fixtures
+    if (browserName !== 'chromium') {
+      test.skip();
+    }
 
-    await verifyDocName(page, randomDoc);
-
-    const { name: docChild } = await createRootSubPage(
-      page,
-      browserName,
-      'export-interlink-child',
-    );
-
-    await verifyDocName(page, docChild);
-
-    const editor = await openSuggestionMenu({ page });
-    await page.getByText('Link a doc').first().click();
-
-    const input = page.locator(
-      "span[data-inline-content-type='interlinkingSearchInline'] input",
-    );
-    const searchContainer = page.locator('.quick-search-container');
-
-    await input.fill('export-interlink');
-
-    await expect(searchContainer).toBeVisible();
-    await expect(searchContainer.getByText(randomDoc)).toBeVisible();
-
-    // We are in docChild, we want to create a link to randomDoc (parent)
-    await searchContainer.getByText(randomDoc).click();
-
-    // Search the interlinking link in the editor (not in the document tree)
-    const interlink = editor
-      .locator('.--docs--interlinking-link-inline-content')
-      .first();
-
-    await expect(interlink).toContainText(randomDoc);
-
-    const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${docChild}.pdf`);
-    });
+    const randomDoc = await overrideDocContent({ page, browserName });
 
     await page
       .getByRole('button', {
@@ -560,77 +342,159 @@ test.describe('Doc Export', () => {
       })
       .click();
 
-    void page.getByTestId('doc-export-download-button').click();
-
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${docChild}.pdf`);
-
-    const pdfBuffer = await cs.toBuffer(await download.createReadStream());
-    const pdfParse = new PDFParse({ data: pdfBuffer });
-    const pdfText = await pdfParse.getText();
-    expect(pdfText.text).toContain(randomDoc);
-  });
-
-  test('it exports the doc with interlinking to odt', async ({
-    page,
-    browserName,
-  }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'export-interlinking-odt',
-      browserName,
-      1,
-    );
-
-    await verifyDocName(page, randomDoc);
-
-    const { name: docChild } = await createRootSubPage(
-      page,
-      browserName,
-      'export-interlink-child-odt',
-    );
-
-    await verifyDocName(page, docChild);
-
-    const editor = await openSuggestionMenu({ page });
-    await page.getByText('Link a doc').first().click();
-
-    const input = page.locator(
-      "span[data-inline-content-type='interlinkingSearchInline'] input",
-    );
-    const searchContainer = page.locator('.quick-search-container');
-
-    await input.fill('export-interlink');
-
-    await expect(searchContainer).toBeVisible();
-    await expect(searchContainer.getByText(randomDoc)).toBeVisible();
-
-    // We are in docChild, we want to create a link to randomDoc (parent)
-    await searchContainer.getByText(randomDoc).click();
-
-    // Search the interlinking link in the editor (not in the document tree)
-    const interlink = editor
-      .locator('.--docs--interlinking-link-inline-content')
-      .first();
-
-    await expect(interlink).toContainText(randomDoc);
-
-    await page
-      .getByRole('button', {
-        name: 'Export the document',
-      })
-      .click();
-
-    await page.getByRole('combobox', { name: 'Format' }).click();
-    await page.getByRole('option', { name: 'Odt' }).click();
+    await expect(
+      page.getByTestId('doc-open-modal-download-button'),
+    ).toBeVisible();
 
     const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${docChild}.odt`);
+      return download.suggestedFilename().includes(`${randomDoc}.pdf`);
     });
 
-    void page.getByTestId('doc-export-download-button').click();
+    await page.getByTestId('doc-export-download-button').click();
 
     const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${docChild}.odt`);
+    expect(download.suggestedFilename()).toBe(`${randomDoc}.pdf`);
+
+    // If we need to update the PDF regression fixture, uncomment the line below
+    //await savePDFToAssetFolder(download);
+
+    // Assert the generated PDF matches "assets/doc-export-regressions.pdf"
+    await comparePDFWithAssetFolder(download);
   });
 });
+
+export const savePDFToAssetFolder = async (download: Download) => {
+  const pdfBuffer = await cs.toBuffer(await download.createReadStream());
+  const pdfPath = path.join(__dirname, 'assets', `doc-export-regressions.pdf`);
+  fs.writeFileSync(pdfPath, pdfBuffer);
+};
+
+export const comparePDFWithAssetFolder = async (download: Download) => {
+  const pdfBuffer = await cs.toBuffer(await download.createReadStream());
+
+  // Load reference PDF for comparison
+  const referencePdfPath = path.join(
+    __dirname,
+    'assets',
+    'doc-export-regressions.pdf',
+  );
+
+  const referencePdfBuffer = fs.readFileSync(referencePdfPath);
+
+  // Parse both PDFs
+  const generatedPdf = new PDFParse({ data: pdfBuffer });
+  const referencePdf = new PDFParse({ data: referencePdfBuffer });
+
+  const [generatedInfo, referenceInfo] = await Promise.all([
+    generatedPdf.getInfo(),
+    referencePdf.getInfo(),
+  ]);
+
+  const [generatedScreenshot, referenceScreenshot] = await Promise.all([
+    generatedPdf.getScreenshot(),
+    referencePdf.getScreenshot(),
+  ]);
+  generatedScreenshot.pages[0].data;
+
+  const [generatedText, referenceText] = await Promise.all([
+    generatedPdf.getText(),
+    referencePdf.getText(),
+  ]);
+
+  // Compare page count
+  expect(generatedInfo.total).toBe(referenceInfo.total);
+
+  // Compare text content
+  expect(generatedText.text).toBe(referenceText.text);
+
+  // Compare screenshots page by page
+  for (let i = 0; i < generatedScreenshot.pages.length; i++) {
+    const genPage = generatedScreenshot.pages[i];
+    const refPage = referenceScreenshot.pages[i];
+
+    expect(genPage.width).toBe(refPage.width);
+    expect(genPage.height).toBe(refPage.height);
+    expect(genPage.data).toStrictEqual(refPage.data);
+  }
+};
+
+/**
+ * Override the document content API response to use a test content
+ * This test content contains many blocks to facilitate testing
+ * @param page
+ */
+export const overrideDocContent = async ({
+  page,
+  browserName,
+}: {
+  page: Page;
+  browserName: BrowserName;
+}) => {
+  // Override content prop with assets/base-content-test-pdf.txt
+  await page.route(/\**\/documents\/\**/, async (route) => {
+    const request = route.request();
+    if (
+      request.method().includes('GET') &&
+      !request.url().includes('page=') &&
+      !request.url().includes('versions') &&
+      !request.url().includes('accesses') &&
+      !request.url().includes('invitations')
+    ) {
+      const response = await route.fetch();
+      const json = await response.json();
+      json.content = fs.readFileSync(
+        path.join(__dirname, 'assets/base-content-test-pdf.txt'),
+        'utf-8',
+      );
+      void route.fulfill({
+        response,
+        body: JSON.stringify(json),
+      });
+    } else {
+      await route.continue();
+    }
+  });
+
+  const [randomDoc] = await createDoc(
+    page,
+    'doc-export-override-content',
+    browserName,
+    1,
+  );
+
+  await verifyDocName(page, randomDoc);
+
+  // Add Image SVG
+  await page.keyboard.press('Enter');
+  const { suggestionMenu } = await openSuggestionMenu({ page });
+  await suggestionMenu.getByText('Resizable image with caption').click();
+  const fileChooserPromise = page.waitForEvent('filechooser');
+  await page.getByText('Upload image').click();
+  const fileChooser = await fileChooserPromise;
+  await fileChooser.setFiles(path.join(__dirname, 'assets/test.svg'));
+  const image = page
+    .locator('.--docs--editor-container img.bn-visual-media[src$=".svg"]')
+    .first();
+  await expect(image).toBeVisible();
+  await page.keyboard.press('Enter');
+
+  await page.waitForTimeout(1000);
+
+  // Add Image PNG
+  await openSuggestionMenu({ page });
+  await suggestionMenu.getByText('Resizable image with caption').click();
+  const fileChooserPNGPromise = page.waitForEvent('filechooser');
+  await page.getByText('Upload image').click();
+  const fileChooserPNG = await fileChooserPNGPromise;
+  await fileChooserPNG.setFiles(
+    path.join(__dirname, 'assets/logo-suite-numerique.png'),
+  );
+  const imagePng = page
+    .locator('.--docs--editor-container img.bn-visual-media[src$=".png"]')
+    .first();
+  await expect(imagePng).toBeVisible();
+
+  await page.waitForTimeout(1000);
+
+  return randomDoc;
+};

src/frontend/apps/e2e/__tests__/app-impress/doc-version.spec.ts

@@ -42,8 +42,8 @@ test.describe('Doc Version', () => {
     // Write more
     await writeInEditor({ page, text: 'It will create a version' });
 
-    await openSuggestionMenu({ page });
-    await page.getByText('Add a callout block').click();
+    const { suggestionMenu } = await openSuggestionMenu({ page });
+    await suggestionMenu.getByText('Add a callout block').click();
 
     const calloutBlock = page
       .locator('div[data-content-type="callout"]')

src/frontend/apps/e2e/__tests__/app-impress/language.spec.ts

@@ -109,8 +109,10 @@ test.describe('Language', () => {
   }) => {
     await createDoc(page, 'doc-toolbar', browserName, 1);
 
-    const editor = await openSuggestionMenu({ page });
-    await expect(page.getByText('Headings', { exact: true })).toBeVisible();
+    const { editor, suggestionMenu } = await openSuggestionMenu({ page });
+    await expect(
+      suggestionMenu.getByText('Headings', { exact: true }),
+    ).toBeVisible();
 
     await editor.click(); // close the menu
 
@@ -121,6 +123,8 @@ test.describe('Language', () => {
 
     // Trigger slash menu to show french menu
     await openSuggestionMenu({ page });
-    await expect(page.getByText('Titres', { exact: true })).toBeVisible();
+    await expect(
+      suggestionMenu.getByText('Titres', { exact: true }),
+    ).toBeVisible();
   });
 });

src/frontend/apps/e2e/__tests__/app-impress/utils-editor.ts

@@ -7,11 +7,11 @@ export const getEditor = async ({ page }: { page: Page }) => {
 };
 
 export const openSuggestionMenu = async ({ page }: { page: Page }) => {
-  const editor = await getEditor({ page });
-  await editor.click();
-  await writeInEditor({ page, text: '/' });
+  const editor = await writeInEditor({ page, text: '/' });
 
-  return editor;
+  const suggestionMenu = page.locator('.bn-suggestion-menu');
+
+  return { editor, suggestionMenu };
 };
 
 export const writeInEditor = async ({
@@ -22,6 +22,11 @@ export const writeInEditor = async ({
   text: string;
 }) => {
   const editor = await getEditor({ page });
-  await editor.locator('.bn-block-outer .bn-inline-content').last().fill(text);
+  await editor
+    .locator('.bn-block-outer:last-child')
+    .last()
+    .locator('.bn-inline-content:last-child')
+    .last()
+    .fill(text);
   return editor;
 };

src/frontend/apps/impress/cunningham.ts

@@ -1,5 +1,5 @@
+import { defaultTokens } from '@gouvfr-lasuite/cunningham-react';
 import { cunninghamConfig as tokens } from '@gouvfr-lasuite/ui-kit';
-import { defaultTokens } from '@openfun/cunningham-react';
 import merge from 'lodash/merge';
 
 // Uikit does not provide the full list of tokens.

src/frontend/apps/impress/package.json

@@ -34,15 +34,15 @@
     "@fontsource-variable/inter": "5.2.8",
     "@fontsource-variable/material-symbols-outlined": "5.2.30",
     "@fontsource/material-icons": "5.2.7",
+    "@gouvfr-lasuite/cunningham-react": "4.1.0",
     "@gouvfr-lasuite/integration": "1.0.3",
-    "@gouvfr-lasuite/ui-kit": "0.18.4",
+    "@gouvfr-lasuite/ui-kit": "0.18.6",
     "@hocuspocus/provider": "3.4.3",
     "@mantine/core": "8.3.10",
     "@mantine/hooks": "8.3.10",
-    "@openfun/cunningham-react": "4.0.0",
     "@react-pdf/renderer": "4.3.1",
-    "@sentry/nextjs": "10.30.0",
-    "@tanstack/react-query": "5.90.12",
+    "@sentry/nextjs": "10.32.1",
+    "@tanstack/react-query": "5.90.16",
     "@tiptap/extensions": "*",
     "canvg": "4.0.3",
     "clsx": "2.1.1",
@@ -52,32 +52,32 @@
     "emoji-datasource-apple": "16.0.0",
     "emoji-mart": "5.6.0",
     "emoji-regex": "10.6.0",
-    "i18next": "25.7.2",
+    "i18next": "25.7.3",
     "i18next-browser-languagedetector": "8.2.0",
     "idb": "8.0.3",
     "lodash": "4.17.21",
     "luxon": "3.7.2",
     "next": "15.5.9",
-    "posthog-js": "1.306.1",
+    "posthog-js": "1.312.0",
     "react": "*",
-    "react-aria-components": "1.13.0",
+    "react-aria-components": "1.14.0",
     "react-dom": "*",
-    "react-i18next": "16.5.0",
+    "react-i18next": "16.5.1",
     "react-intersection-observer": "10.0.0",
     "react-resizable-panels": "3.0.6",
     "react-select": "5.10.2",
     "styled-components": "6.1.19",
     "use-debounce": "10.0.6",
-    "y-protocols": "1.0.6",
+    "y-protocols": "1.0.7",
     "yjs": "*",
     "zustand": "5.0.9"
   },
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
-    "@tanstack/react-query-devtools": "5.91.1",
+    "@tanstack/react-query-devtools": "5.91.2",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
-    "@testing-library/react": "16.3.0",
+    "@testing-library/react": "16.3.1",
     "@testing-library/user-event": "14.6.1",
     "@types/lodash": "4.17.21",
     "@types/luxon": "3.7.1",
@@ -90,16 +90,16 @@
     "dotenv": "17.2.3",
     "eslint-plugin-docs": "*",
     "fetch-mock": "9.11.0",
-    "jsdom": "27.3.0",
+    "jsdom": "27.4.0",
     "node-fetch": "2.7.0",
     "prettier": "3.7.4",
     "stylelint": "16.26.1",
     "stylelint-config-standard": "39.0.1",
     "stylelint-prettier": "5.0.3",
     "typescript": "*",
-    "vite-tsconfig-paths": "6.0.1",
-    "vitest": "4.0.15",
-    "webpack": "5.103.0",
+    "vite-tsconfig-paths": "6.0.3",
+    "vitest": "4.0.16",
+    "webpack": "5.104.1",
     "workbox-webpack-plugin": "7.1.0"
   },
   "packageManager": "yarn@1.22.22"

src/frontend/apps/impress/src/components/InfiniteScroll.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { PropsWithChildren } from 'react';
 import { useTranslation } from 'react-i18next';
 import { InView } from 'react-intersection-observer';

src/frontend/apps/impress/src/components/Loading.tsx

@@ -1,4 +1,4 @@
-import { Loader } from '@openfun/cunningham-react';
+import { Loader } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, BoxProps } from './Box';

src/frontend/apps/impress/src/components/SkipToContent.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useRouter } from 'next/router';
 import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/components/TextErrors.tsx

@@ -1,4 +1,4 @@
-import { Alert, VariantType } from '@openfun/cunningham-react';
+import { Alert, VariantType } from '@gouvfr-lasuite/cunningham-react';
 import { ReactNode } from 'react';
 import { useTranslation } from 'react-i18next';
 import styled from 'styled-components';

src/frontend/apps/impress/src/components/modal/AlertModal.tsx

@@ -1,4 +1,4 @@
-import { Button, Modal, ModalSize } from '@openfun/cunningham-react';
+import { Button, Modal, ModalSize } from '@gouvfr-lasuite/cunningham-react';
 import { ReactNode } from 'react';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/components/modal/ButtonCloseModal.tsx

@@ -1,4 +1,4 @@
-import { Button, type ButtonProps } from '@openfun/cunningham-react';
+import { Button, type ButtonProps } from '@gouvfr-lasuite/cunningham-react';
 import React from 'react';
 
 import { Icon } from '@/components';

src/frontend/apps/impress/src/components/modal/SideModal.tsx

@@ -1,4 +1,4 @@
-import { Modal, ModalSize } from '@openfun/cunningham-react';
+import { Modal, ModalSize } from '@gouvfr-lasuite/cunningham-react';
 import { ComponentPropsWithRef, PropsWithChildren } from 'react';
 import { createGlobalStyle } from 'styled-components';
 

src/frontend/apps/impress/src/components/quick-search/QuickSearchInput.tsx

@@ -1,4 +1,4 @@
-import { Loader } from '@openfun/cunningham-react';
+import { Loader } from '@gouvfr-lasuite/cunningham-react';
 import { Command } from 'cmdk';
 import { ReactNode } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/core/AppProvider.tsx

@@ -1,4 +1,4 @@
-import { CunninghamProvider } from '@openfun/cunningham-react';
+import { CunninghamProvider } from '@gouvfr-lasuite/cunningham-react';
 import {
   MutationCache,
   QueryClient,

src/frontend/apps/impress/src/core/config/ConfigProvider.tsx

@@ -1,4 +1,4 @@
-import { Loader } from '@openfun/cunningham-react';
+import { Loader } from '@gouvfr-lasuite/cunningham-react';
 import Head from 'next/head';
 import Script from 'next/script';
 import { PropsWithChildren, useEffect, useRef } from 'react';

src/frontend/apps/impress/src/features/auth/components/ButtonLogin.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteToolBar/AIButton.tsx

@@ -9,7 +9,7 @@ import {
   Loader,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { PropsWithChildren, ReactNode, useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteToolBar/ModalConfirmDownloadUnsafe.tsx

@@ -1,4 +1,4 @@
-import { Button, Modal, ModalSize } from '@openfun/cunningham-react';
+import { Button, Modal, ModalSize } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Icon, Text } from '@/components';

src/frontend/apps/impress/src/features/docs/doc-editor/hook/useSaveDoc.tsx

@@ -4,7 +4,6 @@ import * as Y from 'yjs';
 
 import { useUpdateDoc } from '@/docs/doc-management/';
 import { KEY_LIST_DOC_VERSIONS } from '@/docs/doc-versioning';
-import { isFirefox } from '@/utils/userAgent';
 
 import { toBase64 } from '../utils';
 
@@ -62,24 +61,8 @@ export const useSaveDoc = (
   const router = useRouter();
 
   useEffect(() => {
-    const onSave = (e?: Event) => {
-      const isSaving = saveDoc();
-
-      /**
-       * Firefox does not trigger the request every time the user leaves the page.
-       * Plus the request is not intercepted by the service worker.
-       * So we prevent the default behavior to have the popup asking the user
-       * if he wants to leave the page, by adding the popup, we let the time to the
-       * request to be sent, and intercepted by the service worker (for the offline part).
-       */
-      if (
-        isSaving &&
-        typeof e !== 'undefined' &&
-        e.preventDefault &&
-        isFirefox()
-      ) {
-        e.preventDefault();
-      }
+    const onSave = () => {
+      saveDoc();
     };
 
     // Save every minute

src/frontend/apps/impress/src/features/docs/doc-export/__tests__/utilsMediaFilename.test.ts

@@ -1,4 +1,4 @@
-import { deriveMediaFilename } from '../utils';
+import { deriveMediaFilename } from '../utils_html';
 
 describe('deriveMediaFilename', () => {
   test('uses last URL segment when src is a valid URL', () => {

src/frontend/apps/impress/src/features/docs/doc-export/assets/export-html-styles.txt

@@ -184,6 +184,75 @@ s {
   margin: 0;
 }
 
+/* Remove bullet points from checkbox lists */
+ul.checklist,
+ul:has(li input[type='checkbox']) {
+  list-style: none;
+  padding-left: 0;
+  margin-left: 0;
+}
+
+ul.checklist li,
+ul:has(li input[type='checkbox']) li {
+  list-style: none;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+ul.checklist li input[type='checkbox'],
+ul:has(li input[type='checkbox']) li input[type='checkbox'] {
+  margin: 0;
+  width: 16px;
+  height: 16px;
+  cursor: pointer;
+  flex-shrink: 0;
+}
+
+ul.checklist li p,
+ul:has(li input[type='checkbox']) li p {
+  margin: 0;
+  flex: 1;
+}
+
+/* Native HTML Lists - remove default margins */
+ol,
+ul {
+  margin: 0;
+  padding-left: 24px;
+}
+
+ol {
+  list-style-type: decimal;
+}
+
+ul {
+  list-style-type: disc;
+}
+
+/* Nested lists */
+ul ul {
+  list-style-type: circle;
+}
+
+/* Keep decimal numbering for nested ol (remove this if you want letters) */
+ol ol {
+  list-style-type: decimal;
+}
+
+li {
+  margin: 0;
+  padding: 0;
+  line-height: 24px;
+}
+
+li p {
+  margin: 0;
+  display: inline;
+}
+
+
+
 /* Quotes */
 blockquote,
 .bn-block-content[data-content-type='quote'] blockquote {

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/headingPDF.tsx

@@ -1,3 +1,7 @@
+/**
+ * Derivated from Blockquote PDF mapping
+ * @see: https://github.com/TypeCellOS/BlockNote/blob/main/packages/xl-pdf-exporter/src/pdf/defaultSchema/blocks.tsx
+ */
 import { Text } from '@react-pdf/renderer';
 
 import { DocsExporterPDF } from '../types';
@@ -30,6 +34,15 @@ export const blockMappingHeadingPDF: DocsExporterPDF['mappings']['blockMapping']
     const fontSizeEM =
       block.props.level === 1 ? 2 : block.props.level === 2 ? 1.5 : 1.17;
 
+    const levelFontSizeEM = {
+      1: 2,
+      2: 1.5,
+      3: 1.17,
+      4: 1,
+      5: 0.83,
+      6: 0.67,
+    }[block.props.level as 1 | 2 | 3 | 4 | 5 | 6];
+
     // Extract plain text for bookmark title
     const bookmarkTitle =
       extractTextFromBlockContent(block.content) || 'Untitled';
@@ -42,7 +55,7 @@ export const blockMappingHeadingPDF: DocsExporterPDF['mappings']['blockMapping']
           title: bookmarkTitle,
         }}
         style={{
-          fontSize: fontSizeEM * FONT_SIZE * PIXELS_PER_POINT,
+          fontSize: levelFontSizeEM * FONT_SIZE * PIXELS_PER_POINT,
           fontWeight: 700,
           marginTop: `${fontSizeEM * MERGE_RATIO}px`,
           marginBottom: `${fontSizeEM * MERGE_RATIO}px`,

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/imagePDF.tsx

@@ -21,9 +21,6 @@ export const blockMappingImagePDF: DocsExporterPDF['mappings']['blockMapping']['
 
     if (blob.type.includes('svg')) {
       const svgText = await blob.text();
-      const FALLBACK_SIZE = 536;
-      previewWidth = previewWidth || FALLBACK_SIZE;
-
       const result = await convertSvgToPng(svgText, previewWidth);
       pngConverted = result.png;
       dimensions = { width: result.width, height: result.height };

src/frontend/apps/impress/src/features/docs/doc-export/components/ModalExport.tsx

@@ -9,7 +9,7 @@ import {
   Select,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { DocumentProps, pdf } from '@react-pdf/renderer';
 import jsonemoji from 'emoji-datasource-apple' assert { type: 'json' };
 import i18next from 'i18next';
@@ -29,11 +29,12 @@ import { TemplatesOrdering, useTemplates } from '../api/useTemplates';
 import { docxDocsSchemaMappings } from '../mappingDocx';
 import { odtDocsSchemaMappings } from '../mappingODT';
 import { pdfDocsSchemaMappings } from '../mappingPDF';
+import { downloadFile } from '../utils';
 import {
   addMediaFilesToZip,
-  downloadFile,
   generateHtmlDocument,
-} from '../utils';
+  improveHtmlAccessibility,
+} from '../utils_html';
 
 enum DocDownloadFormat {
   HTML = 'html',
@@ -161,10 +162,12 @@ export const ModalExport = ({ onClose, doc }: ModalExportProps) => {
 
       const zip = new JSZip();
 
+      improveHtmlAccessibility(parsedDocument, documentTitle);
       await addMediaFilesToZip(parsedDocument, zip, mediaUrl);
 
       const lang = i18next.language || fallbackLng;
-      const editorHtmlWithLocalMedia = parsedDocument.body.innerHTML;
+      const body = parsedDocument.body;
+      const editorHtmlWithLocalMedia = body ? body.innerHTML : '';
 
       const htmlContent = generateHtmlDocument(
         documentTitle,

src/frontend/apps/impress/src/features/docs/doc-export/index.ts

@@ -5,6 +5,7 @@
  */
 export * from './api';
 export * from './utils';
+export * from './utils_html';
 
 import * as ModalExport from './components/ModalExport';
 

src/frontend/apps/impress/src/features/docs/doc-export/utils.ts

@@ -5,11 +5,8 @@ import {
 } from '@blocknote/core';
 import { Canvg } from 'canvg';
 import { IParagraphOptions, ShadingType } from 'docx';
-import JSZip from 'jszip';
 import React from 'react';
 
-import { exportResolveFileUrl } from './api';
-
 export function downloadFile(blob: Blob, filename: string) {
   const url = window.URL.createObjectURL(blob);
   const a = document.createElement('a');
@@ -36,7 +33,7 @@ export function downloadFile(blob: Blob, filename: string) {
  */
 export async function convertSvgToPng(
   svgText: string,
-  width: number,
+  width?: number,
 ): Promise<{ png: string; width: number; height: number }> {
   // Create a canvas and render the SVG onto it
   const canvas = document.createElement('canvas');
@@ -54,26 +51,36 @@ export async function convertSvgToPng(
   const svgElement = svgDoc.documentElement;
 
   // Get viewBox or fallback to width/height attributes
-  let height;
+  let calculatedHeight: number | undefined;
   const svgWidth = svgElement.getAttribute?.('width');
   const svgHeight = svgElement.getAttribute?.('height');
   const viewBox = svgElement.getAttribute('viewBox')?.split(' ').map(Number);
 
   const originalWidth = svgWidth ? parseInt(svgWidth) : viewBox?.[2];
   const originalHeight = svgHeight ? parseInt(svgHeight) : viewBox?.[3];
-  if (originalWidth && originalHeight) {
-    const aspectRatio = originalHeight / originalWidth;
-    height = Math.round(width * aspectRatio);
-  }
 
   const svg = Canvg.fromString(ctx, svgText);
-  svg.resize(width, height, true);
+
+  const FALLBACK_WIDTH = 536;
+
+  // Resize if width provided, preserving aspect ratio
+  if (originalWidth && originalHeight && width) {
+    const aspectRatio = originalHeight / originalWidth;
+    calculatedHeight = Math.round(width * aspectRatio);
+    svg.resize(width, calculatedHeight, true);
+  } else if (!width && !originalWidth) {
+    svg.resize(FALLBACK_WIDTH, undefined, true);
+  }
+
   await svg.render();
 
+  const returnWidth = width || originalWidth || FALLBACK_WIDTH;
+  const returnHeight = calculatedHeight || returnWidth;
+
   return {
     png: canvas.toDataURL('image/png'),
-    width,
-    height: height || width,
+    width: returnWidth,
+    height: returnHeight,
   };
 }
 
@@ -182,172 +189,3 @@ export function odtRegisterParagraphStyleForBlock(
 
   return styleName;
 }
-
-// Escape user-provided text  before injecting it into the exported HTML document.
-export const escapeHtml = (value: string): string =>
-  value
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-
-interface MediaFilenameParams {
-  src: string;
-  index: number;
-  blob: Blob;
-}
-
-/**
- * Derives a stable, readable filename for media exported in the HTML ZIP.
- *
- * Rules:
- * - Default base name is "media-{index+1}".
- * - For non data: URLs, we reuse the last path segment when possible (e.g. 1-photo.png).
- * - If the base name has no extension, we try to infer one from the blob MIME type.
- */
-export const deriveMediaFilename = ({
-  src,
-  index,
-  blob,
-}: MediaFilenameParams): string => {
-  // Default base name
-  let baseName = `media-${index + 1}`;
-
-  // Try to reuse the last path segment for non data URLs.
-  if (!src.startsWith('data:')) {
-    try {
-      const url = new URL(src, window.location.origin);
-      const lastSegment = url.pathname.split('/').pop();
-      if (lastSegment) {
-        baseName = `${index + 1}-${lastSegment}`;
-      }
-    } catch {
-      // Ignore invalid URLs, keep default baseName.
-    }
-  }
-
-  let filename = baseName;
-
-  // Ensure the filename has an extension consistent with the blob MIME type.
-  const mimeType = blob.type;
-  if (mimeType && !baseName.includes('.')) {
-    const slashIndex = mimeType.indexOf('/');
-    const rawSubtype =
-      slashIndex !== -1 && slashIndex < mimeType.length - 1
-        ? mimeType.slice(slashIndex + 1)
-        : '';
-
-    let extension = '';
-    const subtype = rawSubtype.toLowerCase();
-
-    if (subtype.includes('svg')) {
-      extension = 'svg';
-    } else if (subtype.includes('jpeg') || subtype.includes('pjpeg')) {
-      extension = 'jpg';
-    } else if (subtype.includes('png')) {
-      extension = 'png';
-    } else if (subtype.includes('gif')) {
-      extension = 'gif';
-    } else if (subtype.includes('webp')) {
-      extension = 'webp';
-    } else if (subtype.includes('pdf')) {
-      extension = 'pdf';
-    } else if (subtype) {
-      extension = subtype.split('+')[0];
-    }
-
-    if (extension) {
-      filename = `${baseName}.${extension}`;
-    }
-  }
-
-  return filename;
-};
-
-/**
- * Generates a complete HTML document structure for export.
- *
- * @param documentTitle - The title of the document (will be escaped)
- * @param editorHtmlWithLocalMedia - The HTML content from the editor
- * @param lang - The language code for the document (e.g., 'fr', 'en')
- * @returns A complete HTML5 document string
- */
-export const generateHtmlDocument = (
-  documentTitle: string,
-  editorHtmlWithLocalMedia: string,
-  lang: string,
-): string => {
-  return `<!DOCTYPE html>
-<html lang="${lang}">
-  <head>
-    <meta charset="utf-8" />
-    <title>${escapeHtml(documentTitle)}</title>
-    <link rel="stylesheet" href="styles.css">
-  </head>
-  <body>
-    <main role="main">
-${editorHtmlWithLocalMedia}
-    </main>
-  </body>
-</html>`;
-};
-
-export const addMediaFilesToZip = async (
-  parsedDocument: Document,
-  zip: JSZip,
-  mediaUrl: string,
-) => {
-  const mediaFiles: { filename: string; blob: Blob }[] = [];
-  const mediaElements = Array.from(
-    parsedDocument.querySelectorAll<
-      HTMLImageElement | HTMLVideoElement | HTMLAudioElement | HTMLSourceElement
-    >('img, video, audio, source'),
-  );
-
-  await Promise.all(
-    mediaElements.map(async (element, index) => {
-      const src = element.getAttribute('src');
-
-      if (!src) {
-        return;
-      }
-
-      // data: URLs are already embedded and work offline; no need to create separate files.
-      if (src.startsWith('data:')) {
-        return;
-      }
-
-      // Only download same-origin resources (internal media like /media/...).
-      // External URLs keep their original src and are not included in the ZIP
-      let url: URL | null = null;
-      try {
-        url = new URL(src, mediaUrl);
-      } catch {
-        url = null;
-      }
-
-      if (!url || url.origin !== mediaUrl) {
-        return;
-      }
-
-      const fetched = await exportResolveFileUrl(url.href);
-
-      if (!(fetched instanceof Blob)) {
-        return;
-      }
-
-      const filename = deriveMediaFilename({
-        src: url.href,
-        index,
-        blob: fetched,
-      });
-      element.setAttribute('src', filename);
-      mediaFiles.push({ filename, blob: fetched });
-    }),
-  );
-
-  mediaFiles.forEach(({ filename, blob }) => {
-    zip.file(filename, blob);
-  });
-};

src/frontend/apps/impress/src/features/docs/doc-export/utils_html.ts

@@ -0,0 +1,434 @@
+import JSZip from 'jszip';
+
+import { exportResolveFileUrl } from './api';
+
+// Escape user-provided text  before injecting it into the exported HTML document.
+export const escapeHtml = (value: string): string =>
+  value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+
+/**
+ * Derives a stable, readable filename for media exported in the HTML ZIP.
+ *
+ * Rules:
+ * - Default base name is "media-{index+1}".
+ * - For non data: URLs, we reuse the last path segment when possible (e.g. 1-photo.png).
+ * - If the base name has no extension, we try to infer one from the blob MIME type.
+ */
+
+interface MediaFilenameParams {
+  src: string;
+  index: number;
+  blob: Blob;
+}
+
+export const deriveMediaFilename = ({
+  src,
+  index,
+  blob,
+}: MediaFilenameParams): string => {
+  // Default base name
+  let baseName = `media-${index + 1}`;
+
+  // Try to reuse the last path segment for non data URLs.
+  if (!src.startsWith('data:')) {
+    try {
+      const url = new URL(src, window.location.origin);
+      const lastSegment = url.pathname.split('/').pop();
+      if (lastSegment) {
+        baseName = `${index + 1}-${lastSegment}`;
+      }
+    } catch {
+      // Ignore invalid URLs, keep default baseName.
+    }
+  }
+
+  let filename = baseName;
+
+  // Ensure the filename has an extension consistent with the blob MIME type.
+  const mimeType = blob.type;
+  if (mimeType && !baseName.includes('.')) {
+    const slashIndex = mimeType.indexOf('/');
+    const rawSubtype =
+      slashIndex !== -1 && slashIndex < mimeType.length - 1
+        ? mimeType.slice(slashIndex + 1)
+        : '';
+
+    let extension = '';
+    const subtype = rawSubtype.toLowerCase();
+
+    if (subtype.includes('svg')) {
+      extension = 'svg';
+    } else if (subtype.includes('jpeg') || subtype.includes('pjpeg')) {
+      extension = 'jpg';
+    } else if (subtype.includes('png')) {
+      extension = 'png';
+    } else if (subtype.includes('gif')) {
+      extension = 'gif';
+    } else if (subtype.includes('webp')) {
+      extension = 'webp';
+    } else if (subtype.includes('pdf')) {
+      extension = 'pdf';
+    } else if (subtype) {
+      extension = subtype.split('+')[0];
+    }
+
+    if (extension) {
+      filename = `${baseName}.${extension}`;
+    }
+  }
+
+  return filename;
+};
+
+/**
+ * Generates a complete HTML document structure for export.
+ *
+ * @param documentTitle - The title of the document (will be escaped)
+ * @param editorHtmlWithLocalMedia - The HTML content from the editor
+ * @param lang - The language code for the document (e.g., 'fr', 'en')
+ * @returns A complete HTML5 document string
+ */
+export const generateHtmlDocument = (
+  documentTitle: string,
+  editorHtmlWithLocalMedia: string,
+  lang: string,
+): string => {
+  return `<!DOCTYPE html>
+  <html lang="${lang}">
+    <head>
+      <meta charset="utf-8" />
+      <title>${escapeHtml(documentTitle)}</title>
+      <link rel="stylesheet" href="styles.css">
+    </head>
+    <body>
+      <main role="main">
+  ${editorHtmlWithLocalMedia}
+      </main>
+    </body>
+  </html>`;
+};
+
+/**
+ * Enrich the HTML produced by the editor with semantic tags and basic a11y defaults.
+ *
+ * Notes:
+ * - We work directly on the parsed Document so modifications are reflected before we zip files.
+ * - We keep the editor inner structure but upgrade the key block types to native elements.
+ */
+export const improveHtmlAccessibility = (
+  parsedDocument: Document,
+  documentTitle: string,
+) => {
+  const body = parsedDocument.body;
+  if (!body) {
+    return;
+  }
+
+  // 1) Headings: convert heading blocks to h1-h6 based on data-level
+  const headingBlocks = Array.from(
+    body.querySelectorAll<HTMLElement>("[data-content-type='heading']"),
+  );
+
+  headingBlocks.forEach((block) => {
+    const rawLevel = Number(block.getAttribute('data-level')) || 1;
+    const level = Math.min(Math.max(rawLevel, 1), 6);
+    const heading = parsedDocument.createElement(`h${level}`);
+    heading.innerHTML = block.innerHTML;
+    block.replaceWith(heading);
+  });
+
+  // 2) Lists: convert to semantic OL/UL/LI elements for accessibility
+  const listItemSelector =
+    "[data-content-type='bulletListItem'], [data-content-type='numberedListItem']";
+
+  // Helper function to get nesting level by counting block-group ancestors
+  const getNestingLevel = (blockOuter: HTMLElement): number => {
+    let level = 0;
+    let parent = blockOuter.parentElement;
+    while (parent) {
+      if (parent.classList.contains('bn-block-group')) {
+        level++;
+      }
+      parent = parent.parentElement;
+    }
+    return level;
+  };
+
+  // Find all block-outer elements in document order
+  const allBlockOuters = Array.from(
+    body.querySelectorAll<HTMLElement>('.bn-block-outer'),
+  );
+
+  // Collect list items with their info before modifying DOM
+  interface ListItemInfo {
+    blockOuter: HTMLElement;
+    listItem: HTMLElement;
+    contentType: string;
+    level: number;
+  }
+
+  const listItemsInfo: ListItemInfo[] = [];
+  allBlockOuters.forEach((blockOuter) => {
+    const listItem = blockOuter.querySelector<HTMLElement>(listItemSelector);
+    if (listItem) {
+      const contentType = listItem.getAttribute('data-content-type');
+      if (contentType) {
+        const level = getNestingLevel(blockOuter);
+        listItemsInfo.push({
+          blockOuter,
+          listItem,
+          contentType,
+          level,
+        });
+      }
+    }
+  });
+
+  // Stack to track lists at each nesting level
+  const listStack: Array<{ list: HTMLElement; type: string; level: number }> =
+    [];
+
+  listItemsInfo.forEach((info, idx) => {
+    const { blockOuter, listItem, contentType, level } = info;
+    const isBullet = contentType === 'bulletListItem';
+    const listTag = isBullet ? 'ul' : 'ol';
+
+    // Check if previous item continues the same list (same type and level)
+    const previousInfo = idx > 0 ? listItemsInfo[idx - 1] : null;
+    const continuesPreviousList =
+      previousInfo &&
+      previousInfo.contentType === contentType &&
+      previousInfo.level === level;
+
+    // Find or create the appropriate list
+    let targetList: HTMLElement | null = null;
+
+    if (continuesPreviousList) {
+      // Continue with the list at this level from stack
+      const listAtLevel = listStack.find((item) => item.level === level);
+      targetList = listAtLevel?.list || null;
+    }
+
+    // If no list found, create a new one
+    if (!targetList) {
+      targetList = parsedDocument.createElement(listTag);
+
+      // Remove lists from stack that are at same or deeper level
+      while (
+        listStack.length > 0 &&
+        listStack[listStack.length - 1].level >= level
+      ) {
+        listStack.pop();
+      }
+
+      // If we have a parent list, nest this list inside its last li
+      if (
+        listStack.length > 0 &&
+        listStack[listStack.length - 1].level < level
+      ) {
+        const parentList = listStack[listStack.length - 1].list;
+        const lastLi = parentList.querySelector('li:last-child');
+        if (lastLi) {
+          lastLi.appendChild(targetList);
+        } else {
+          // No li yet, create one and add the nested list
+          const li = parsedDocument.createElement('li');
+          parentList.appendChild(li);
+          li.appendChild(targetList);
+        }
+      } else {
+        // Top-level list
+        blockOuter.parentElement?.insertBefore(targetList, blockOuter);
+      }
+
+      // Add to stack
+      listStack.push({ list: targetList, type: contentType, level });
+    }
+
+    // Create list item and add content
+    const li = parsedDocument.createElement('li');
+    li.innerHTML = listItem.innerHTML;
+    targetList.appendChild(li);
+
+    // Remove original block-outer
+    blockOuter.remove();
+  });
+
+  // 3) Quotes -> <blockquote>
+  const quoteBlocks = Array.from(
+    body.querySelectorAll<HTMLElement>("[data-content-type='quote']"),
+  );
+  quoteBlocks.forEach((block) => {
+    const quote = parsedDocument.createElement('blockquote');
+    quote.innerHTML = block.innerHTML;
+    block.replaceWith(quote);
+  });
+
+  // 4) Callouts -> <aside role="note">
+  const calloutBlocks = Array.from(
+    body.querySelectorAll<HTMLElement>("[data-content-type='callout']"),
+  );
+  calloutBlocks.forEach((block) => {
+    const aside = parsedDocument.createElement('aside');
+    aside.setAttribute('role', 'note');
+    aside.innerHTML = block.innerHTML;
+    block.replaceWith(aside);
+  });
+
+  // 5) Checklists -> list + checkbox semantics
+  const checkListItems = Array.from(
+    body.querySelectorAll<HTMLElement>("[data-content-type='checkListItem']"),
+  );
+  checkListItems.forEach((item) => {
+    const parent = item.parentElement;
+    if (!parent) {
+      return;
+    }
+
+    let previousSibling = item.previousElementSibling;
+    let listContainer: HTMLElement | null = null;
+
+    if (previousSibling?.tagName.toLowerCase() === 'ul') {
+      listContainer = previousSibling as HTMLElement;
+    } else {
+      listContainer = parsedDocument.createElement('ul');
+      listContainer.setAttribute('role', 'list');
+      listContainer.classList.add('checklist');
+      parent.insertBefore(listContainer, item);
+    }
+
+    const li = parsedDocument.createElement('li');
+    li.innerHTML = item.innerHTML;
+
+    // Ensure checkbox has an accessible state; fall back to aria-checked if missing.
+    const checkbox = li.querySelector<HTMLInputElement>(
+      "input[type='checkbox']",
+    );
+    if (checkbox && !checkbox.hasAttribute('aria-checked')) {
+      checkbox.setAttribute(
+        'aria-checked',
+        checkbox.checked ? 'true' : 'false',
+      );
+    }
+
+    listContainer.appendChild(li);
+    parent.removeChild(item);
+  });
+
+  // 6) Code blocks -> <pre><code>
+  const codeBlocks = Array.from(
+    body.querySelectorAll<HTMLElement>("[data-content-type='codeBlock']"),
+  );
+  codeBlocks.forEach((block) => {
+    const pre = parsedDocument.createElement('pre');
+    const code = parsedDocument.createElement('code');
+
+    // Preserve existing classes/attributes so the exported CSS (dark theme) still applies.
+    pre.className = block.className || '';
+    pre.setAttribute('data-content-type', 'codeBlock');
+
+    // Copy other data attributes from the original block to the new <pre>.
+    Array.from(block.attributes).forEach((attr) => {
+      if (attr.name.startsWith('data-') && attr.name !== 'data-content-type') {
+        pre.setAttribute(attr.name, attr.value);
+      }
+    });
+
+    // Move content inside <code>.
+    code.innerHTML = block.innerHTML;
+    pre.appendChild(code);
+    block.replaceWith(pre);
+  });
+
+  // 7) Ensure images have alt text (empty when not provided)
+  body.querySelectorAll<HTMLImageElement>('img').forEach((img) => {
+    if (!img.hasAttribute('alt')) {
+      img.setAttribute('alt', '');
+    }
+  });
+
+  // 8) Wrap content in an article with a title landmark if none exists
+  const existingH1 = body.querySelector('h1');
+  if (!existingH1) {
+    const titleHeading = parsedDocument.createElement('h1');
+    titleHeading.id = 'doc-title';
+    titleHeading.textContent = documentTitle;
+    body.insertBefore(titleHeading, body.firstChild);
+  }
+
+  // If there is no article, group the body content inside one for better semantics.
+  const hasArticle = body.querySelector('article');
+  if (!hasArticle) {
+    const article = parsedDocument.createElement('article');
+    article.setAttribute('role', 'document');
+    article.setAttribute('aria-labelledby', 'doc-title');
+    while (body.firstChild) {
+      article.appendChild(body.firstChild);
+    }
+    body.appendChild(article);
+  }
+};
+
+export const addMediaFilesToZip = async (
+  parsedDocument: Document,
+  zip: JSZip,
+  mediaUrl: string,
+) => {
+  const mediaFiles: { filename: string; blob: Blob }[] = [];
+  const mediaElements = Array.from(
+    parsedDocument.querySelectorAll<
+      HTMLImageElement | HTMLVideoElement | HTMLAudioElement | HTMLSourceElement
+    >('img, video, audio, source'),
+  );
+
+  await Promise.all(
+    mediaElements.map(async (element, index) => {
+      const src = element.getAttribute('src');
+
+      if (!src) {
+        return;
+      }
+
+      // data: URLs are already embedded and work offline; no need to create separate files.
+      if (src.startsWith('data:')) {
+        return;
+      }
+
+      // Only download same-origin resources (internal media like /media/...).
+      // External URLs keep their original src and are not included in the ZIP
+      let url: URL | null = null;
+      try {
+        url = new URL(src, mediaUrl);
+      } catch {
+        url = null;
+      }
+
+      if (!url || url.origin !== mediaUrl) {
+        return;
+      }
+
+      const fetched = await exportResolveFileUrl(url.href);
+
+      if (!(fetched instanceof Blob)) {
+        return;
+      }
+
+      const filename = deriveMediaFilename({
+        src: url.href,
+        index,
+        blob: fetched,
+      });
+      element.setAttribute('src', filename);
+      mediaFiles.push({ filename, blob: fetched });
+    }),
+  );
+
+  mediaFiles.forEach(({ filename, blob }) => {
+    zip.file(filename, blob);
+  });
+};

src/frontend/apps/impress/src/features/docs/doc-header/components/AlertNetwork.tsx

@@ -1,4 +1,4 @@
-import { Button, Modal, ModalSize } from '@openfun/cunningham-react';
+import { Button, Modal, ModalSize } from '@gouvfr-lasuite/cunningham-react';
 import { t } from 'i18next';
 import { useState } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/features/docs/doc-header/components/AlertRestore.tsx

@@ -1,9 +1,9 @@
-import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
 import {
   Button,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
+import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Card, Icon } from '@/components';

src/frontend/apps/impress/src/features/docs/doc-header/components/BoutonShare.tsx

@@ -1,5 +1,5 @@
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
-import { Button } from '@openfun/cunningham-react';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-header/components/DocTitle.tsx

@@ -1,4 +1,4 @@
-import { Tooltip } from '@openfun/cunningham-react';
+import { Tooltip } from '@gouvfr-lasuite/cunningham-react';
 import React, { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBox.tsx

@@ -1,5 +1,5 @@
+import { Button, useModal } from '@gouvfr-lasuite/cunningham-react';
 import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
-import { Button, useModal } from '@openfun/cunningham-react';
 import { useQueryClient } from '@tanstack/react-query';
 import { useRouter } from 'next/router';
 import { useEffect, useState } from 'react';

src/frontend/apps/impress/src/features/docs/doc-header/hooks/useCopyCurrentEditorToClipboard.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { useEditorStore } from '../../doc-editor';

src/frontend/apps/impress/src/features/docs/doc-management/api/useDuplicateDoc.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import {
   UseMutationOptions,
   useMutation,

src/frontend/apps/impress/src/features/docs/doc-management/api/useUpdateDoc.tsx

@@ -24,6 +24,7 @@ export const updateDoc = async ({
     body: JSON.stringify({
       ...params,
     }),
+    keepalive: true,
   });
 
   if (!response.ok) {

src/frontend/apps/impress/src/features/docs/doc-management/components/DocPage403.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import Head from 'next/head';
 import Image from 'next/image';
 import { useEffect } from 'react';

src/frontend/apps/impress/src/features/docs/doc-management/components/ModalRemoveDoc.tsx

@@ -5,7 +5,7 @@ import {
   ModalSize,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { useRouter } from 'next/router';
 import { useEffect, useRef } from 'react';
 import { Trans, useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchFilters.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { Box } from '@/components';

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchModal.tsx

@@ -1,4 +1,4 @@
-import { Modal, ModalSize } from '@openfun/cunningham-react';
+import { Modal, ModalSize } from '@gouvfr-lasuite/cunningham-react';
 import Image from 'next/image';
 import { useRouter } from 'next/router';
 import { useState } from 'react';

src/frontend/apps/impress/src/features/docs/doc-share/components/DocDesynchronized.tsx

@@ -2,7 +2,7 @@ import {
   Button,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Card, Text } from '@/components';

src/frontend/apps/impress/src/features/docs/doc-share/components/DocInheritedShareContent.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { Fragment } from 'react';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/features/docs/doc-share/components/DocRoleDropdown.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareAccessRequest.tsx

@@ -3,7 +3,7 @@ import {
   ButtonProps,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { useMemo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { createGlobalStyle } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareAddMemberList.tsx

@@ -2,7 +2,7 @@ import {
   Button,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareInvitation.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareMember.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareModal.tsx

@@ -1,4 +1,4 @@
-import { Modal, ModalSize } from '@openfun/cunningham-react';
+import { Modal, ModalSize } from '@gouvfr-lasuite/cunningham-react';
 import { useQueryClient } from '@tanstack/react-query';
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareModalFooter.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 

src/frontend/apps/impress/src/features/docs/doc-share/components/DocVisibility.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocTreeItemActions.tsx

@@ -1,10 +1,10 @@
+import { useModal } from '@gouvfr-lasuite/cunningham-react';
 import {
   DropdownMenu,
   DropdownMenuOption,
   useArrowRoving,
   useTreeContext,
 } from '@gouvfr-lasuite/ui-kit';
-import { useModal } from '@openfun/cunningham-react';
 import { useRouter } from 'next/router';
 import { useRef } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/features/docs/doc-versioning/components/DocVersionEditor.tsx

@@ -1,4 +1,4 @@
-import { Loader } from '@openfun/cunningham-react';
+import { Loader } from '@gouvfr-lasuite/cunningham-react';
 import { useRouter } from 'next/router';
 import { useEffect, useState } from 'react';
 import * as Y from 'yjs';

src/frontend/apps/impress/src/features/docs/doc-versioning/components/ModalConfirmationVersion.tsx

@@ -4,7 +4,7 @@ import {
   ModalSize,
   VariantType,
   useToastProvider,
-} from '@openfun/cunningham-react';
+} from '@gouvfr-lasuite/cunningham-react';
 import { useRouter } from 'next/router';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/features/docs/doc-versioning/components/ModalSelectVersion.tsx

@@ -1,4 +1,9 @@
-import { Button, Modal, ModalSize, useModal } from '@openfun/cunningham-react';
+import {
+  Button,
+  Modal,
+  ModalSize,
+  useModal,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { createGlobalStyle, css } from 'styled-components';

src/frontend/apps/impress/src/features/docs/doc-versioning/components/VersionList.tsx

@@ -1,4 +1,4 @@
-import { Loader } from '@openfun/cunningham-react';
+import { Loader } from '@gouvfr-lasuite/cunningham-react';
 import { DateTime } from 'luxon';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocGridContentList.tsx

@@ -1,7 +1,7 @@
 import { DndContext, DragOverlay, Modifier } from '@dnd-kit/core';
 import { getEventCoordinates } from '@dnd-kit/utilities';
+import { useModal } from '@gouvfr-lasuite/cunningham-react';
 import { TreeViewMoveModeEnum } from '@gouvfr-lasuite/ui-kit';
-import { useModal } from '@openfun/cunningham-react';
 import { useQueryClient } from '@tanstack/react-query';
 import { useMemo, useRef } from 'react';
 import { Trans, useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGrid.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { InView } from 'react-intersection-observer';

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGridActions.tsx

@@ -1,4 +1,4 @@
-import { useModal } from '@openfun/cunningham-react';
+import { useModal } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGridItem.tsx

@@ -1,4 +1,4 @@
-import { Tooltip, useModal } from '@openfun/cunningham-react';
+import { Tooltip, useModal } from '@gouvfr-lasuite/cunningham-react';
 import { useSearchParams } from 'next/navigation';
 import { KeyboardEvent } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGridItemSharedButton.tsx

@@ -1,4 +1,4 @@
-import { Button, Tooltip } from '@openfun/cunningham-react';
+import { Button, Tooltip } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Icon, Text } from '@/components';

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGridLoader.tsx

@@ -1,4 +1,4 @@
-import { Loader } from '@openfun/cunningham-react';
+import { Loader } from '@gouvfr-lasuite/cunningham-react';
 import { createGlobalStyle, css } from 'styled-components';
 
 import { Box } from '@/components';

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGridTrashbinActions.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 

src/frontend/apps/impress/src/features/header/components/ButtonTogglePanel.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useTranslation } from 'react-i18next';
 
 import { Icon } from '@/components/';

src/frontend/apps/impress/src/features/home/components/HomeBanner.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import Image from 'next/image';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/home/components/HomeContent.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { Trans, useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 

src/frontend/apps/impress/src/features/left-panel/components/LeftPanelFavoriteItem.tsx

@@ -1,4 +1,4 @@
-import { useModal } from '@openfun/cunningham-react';
+import { useModal } from '@gouvfr-lasuite/cunningham-react';
 import { t } from 'i18next';
 import { DateTime } from 'luxon';
 import { css } from 'styled-components';

src/frontend/apps/impress/src/features/left-panel/components/LeftPanelHeader.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { t } from 'i18next';
 import { useRouter } from 'next/router';
 import { PropsWithChildren, useCallback, useState } from 'react';

src/frontend/apps/impress/src/features/left-panel/components/LeftPanelHeaderButton.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { useRouter } from 'next/router';
 import { useState } from 'react';
 import { useTranslation } from 'react-i18next';

src/frontend/apps/impress/src/hook/useClipboard.tsx

@@ -1,4 +1,7 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import {
+  VariantType,
+  useToastProvider,
+} from '@gouvfr-lasuite/cunningham-react';
 import { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 

src/frontend/apps/impress/src/layouts/MainLayout.tsx

@@ -120,7 +120,7 @@ const MainContent = ({
       $css={css`
         overflow-y: auto;
         overflow-x: clip;
-        &:focus {
+        &:focus-visible {
           outline: 3px solid ${colorsTokens['brand-400']};
           outline-offset: -3px;
         }

src/frontend/apps/impress/src/pages/401.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import Head from 'next/head';
 import Image from 'next/image';
 import { useRouter } from 'next/router';

src/frontend/apps/impress/src/pages/404.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import Head from 'next/head';
 import Image from 'next/image';
 import { ReactElement } from 'react';

src/frontend/apps/impress/src/pages/_error.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import * as Sentry from '@sentry/nextjs';
 import { NextPageContext } from 'next';
 import NextError from 'next/error';

src/frontend/apps/impress/src/pages/offline/index.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@openfun/cunningham-react';
+import { Button } from '@gouvfr-lasuite/cunningham-react';
 import { ReactElement } from 'react';
 import { useTranslation } from 'react-i18next';
 import styled from 'styled-components';

src/frontend/apps/impress/src/tests/utils.tsx

@@ -1,5 +1,5 @@
+import { CunninghamProvider } from '@gouvfr-lasuite/cunningham-react';
 import { TreeProvider } from '@gouvfr-lasuite/ui-kit';
-import { CunninghamProvider } from '@openfun/cunningham-react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { PropsWithChildren } from 'react';
 

src/frontend/package.json

@@ -31,18 +31,18 @@
     "server:test": "yarn COLLABORATION_SERVER run test"
   },
   "resolutions": {
-    "@tiptap/extensions": "3.13.0",
+    "@tiptap/extensions": "3.14.0",
     "@types/node": "24.10.4",
     "@types/react": "19.2.7",
     "@types/react-dom": "19.2.3",
     "docx": "9.5.0",
     "eslint": "9.39.2",
-    "prosemirror-view": "1.41.3",
+    "prosemirror-view": "1.41.4",
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "typescript": "5.9.3",
     "wrap-ansi": "9.0.2",
-    "yjs": "13.6.27"
+    "yjs": "13.6.28"
   },
   "packageManager": "yarn@1.22.22"
 }

src/frontend/packages/eslint-plugin-docs/package.json

@@ -19,18 +19,18 @@
   "dependencies": {
     "@next/eslint-plugin-next": "15.5.9",
     "@tanstack/eslint-plugin-query": "5.91.2",
-    "@typescript-eslint/eslint-plugin": "8.49.0",
-    "@typescript-eslint/parser": "8.49.0",
-    "@vitest/eslint-plugin": "1.5.2",
+    "@typescript-eslint/eslint-plugin": "8.51.0",
+    "@typescript-eslint/parser": "8.51.0",
+    "@vitest/eslint-plugin": "1.6.4",
     "eslint-config-next": "15.5.9",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-import": "2.32.0",
-    "eslint-plugin-jest": "29.5.0",
+    "eslint-plugin-jest": "29.12.0",
     "eslint-plugin-jsx-a11y": "6.10.2",
     "eslint-plugin-playwright": "2.4.0",
     "eslint-plugin-prettier": "5.5.4",
     "eslint-plugin-react": "7.37.5",
-    "eslint-plugin-testing-library": "7.13.6",
+    "eslint-plugin-testing-library": "7.15.4",
     "prettier": "3.7.4"
   },
   "packageManager": "yarn@1.22.22"

src/frontend/servers/y-provider/package.json

@@ -18,15 +18,15 @@
   "dependencies": {
     "@blocknote/server-util": "0.45.0",
     "@hocuspocus/server": "3.4.3",
-    "@sentry/node": "10.30.0",
-    "@sentry/profiling-node": "10.30.0",
+    "@sentry/node": "10.32.1",
+    "@sentry/profiling-node": "10.32.1",
     "@tiptap/extensions": "*",
     "axios": "1.13.2",
     "cors": "2.8.5",
     "express": "5.2.1",
     "express-ws": "5.0.2",
     "uuid": "13.0.0",
-    "y-protocols": "1.0.6",
+    "y-protocols": "1.0.7",
     "yjs": "*"
   },
   "devDependencies": {
@@ -45,7 +45,7 @@
     "ts-node": "10.9.2",
     "tsc-alias": "1.8.16",
     "typescript": "*",
-    "vitest": "4.0.15",
+    "vitest": "4.0.16",
     "vitest-mock-extended": "3.1.0",
     "ws": "8.18.3"
   },

src/helm/impress/values.yaml

@@ -227,7 +227,14 @@ backend:
     backoffLimit: 2
 
   ## @param backend.securityContext Configure backend Pod security context
-  securityContext: null
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+      - "ALL"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
 
   ## @param backend.envVars Configure backend container environment variables
   ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly
@@ -431,7 +438,14 @@ frontend:
   sidecars: []
 
   ## @param frontend.securityContext Configure frontend Pod security context
-  securityContext: null
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+      - "ALL"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
 
   ## @param frontend.envVars Configure frontend container environment variables
   ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly
@@ -603,7 +617,14 @@ yProvider:
   sidecars: []
 
   ## @param yProvider.securityContext Configure yProvider Pod security context
-  securityContext: null
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+      - "ALL"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
 
   ## @param yProvider.envVars Configure yProvider container environment variables
   ## @extra yProvider.envVars.BY_VALUE Example environment variable by setting value directly