Merge branch 'develop' into backend-esm-vitest

Brings 150 commits of develop work into the backend ESM + vitest migration
branch (v2.7.3 → v3.0.0 release prep). 41 conflicts resolved, preserving
this branch's ESM structure while layering in develop's new functionality.

Conflict resolution highlights:
- CHANGELOG.md: ESM/vitest plugin-author breaking changes folded into the
  v3.0.0 entry as a new "Breaking changes for plugin authors" section.
- src/package.json: kept vitest-only test scripts, dropped mocha/mocha-froth
  devDeps, took newer @types/node and etherpad-cli-client versions.
- src/node/db/{API,AuthorManager,DB,GroupManager,Pad}.ts: ESM exports
  preserved, develop's new GDPR anonymize/search APIs, deletion-token flow,
  ueberdb2 v6, and SYSTEM_AUTHOR_ID added as ESM exports.
- src/node/handler/{APIHandler,PadMessageHandler,RestAPI,SocketIORouter}.ts:
  v1.3.1 API surface with compactPad/anonymizeAuthor, prometheus instrument
  hooks, anonymizeIp + isAcceptingConnections imports, socketioServer rename
  preserved.
- src/node/hooks/express/*: ESM imports, anonymizeIp/ensureAuthorTokenCookie/
  socialMeta wired in for v3 features.
- src/node/utils/{Settings,UpdateCheck,ImportEtherpad}.ts: createHash for
  randomVersionString determinism, axios dropped in favour of native fetch /
  undici, dynamic ueberdb2 import removed (static import works under ESM).
- src/node/server.ts: undici ProxyAgent (axios removal from develop), pkg.json
  import with `with { type: 'json' }` ESM attributes.
- src/static/js/{ace,pad,pad_editor,pad_userlist,timeslider}.ts +
  pluginfw/installer.ts: full require()→import conversion preserved,
  develop's pad_mode/showPrivacyBannerIfEnabled/pad_version_badge/
  pluginCatalogGuard/pluginEngineCheck/installerTasks imports added,
  pad_editor's focusOnLine settle-loop refactor kept.
- Backend test specs: ESM imports + .js extensions preserved, vitest harness
  in src/tests/backend/common.ts kept (with develop's diagnostic loggers
  layered in), Settings CJS-compat tests dropped (no longer applicable
  under ESM), randomVersionString + padOptions tests converted to ESM.
- Frontend specs: import unions resolved with .js extensions.
- fuzzImportTest.ts: kept deleted (removed earlier in this branch with
  mocha-froth).
- .github/workflows/backend-tests.yml: unified single `pnpm test` (vitest)
  with develop's Node diagnostic-report capture.
- pnpm-lock.yaml: taken from develop; will need `pnpm install` to reconcile
  against the merged package.json (drops mocha/mocha-froth lockfile entries).

Author: SamTV12345

.github/workflows/backend-tests.yml

@@ -27,8 +27,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # PRs: test on latest Node only. Push to develop: full matrix.
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[20, 22, 24]') }}
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
     steps:
       -
         name: Checkout repository
@@ -43,7 +43,6 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10.33.2
           run_install: false
       - name: Use Node.js
         uses: actions/setup-node@v6
@@ -67,7 +66,24 @@ jobs:
         run: pnpm build
       -
         name: Run the backend tests
-        run: pnpm test
+        env:
+          # --report-on-fatalerror and friends write a Node diagnostic report
+          # (V8 stack, libuv handles, OS info) on fatal errors that bypass JS
+          # handlers — the failure mode we've been chasing on Windows + Node
+          # 24 since PR #7663. Reports land in node-report/ and are uploaded
+          # as an artifact if the step fails.
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          pnpm test
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
 
   withpluginsLinux:
     env:
@@ -82,7 +98,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[20, 22, 24]') }}
+        node: ${{ fromJSON('[24]') }}
     steps:
       -
         name: Checkout repository
@@ -97,7 +113,6 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10.33.2
           run_install: false
       - name: Use Node.js
         uses: actions/setup-node@v6
@@ -123,7 +138,9 @@ jobs:
           ep_align
           ep_author_hover
           ep_cursortrace
+          ep_font_color
           ep_font_size
+          ep_hash_auth
           ep_headings2
           ep_markdown
           ep_readonly_guest
@@ -133,7 +150,19 @@ jobs:
           ep_table_of_contents
       -
         name: Run the backend tests
-        run: pnpm test
+        env:
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          pnpm test
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
 
   # Windows tests only run on push to develop/master, not on PRs
   withoutpluginsWindows:
@@ -144,7 +173,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [20, 22, 24]
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
     name: Windows without plugins
     runs-on: windows-latest
     steps:
@@ -161,7 +191,6 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10.33.2
           run_install: false
       - name: Use Node.js
         uses: actions/setup-node@v6
@@ -181,8 +210,21 @@ jobs:
           powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
       -
         name: Run the backend tests
+        shell: bash
         working-directory: src
-        run: pnpm test
+        env:
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          pnpm test
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7
 
   withpluginsWindows:
     env:
@@ -192,7 +234,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [20, 22, 24]
+        # Etherpad requires Node >= 24 (see package.json engines.node).
+        node: ${{ fromJSON('[24]') }}
     name: Windows with Plugins
     runs-on: windows-latest
 
@@ -210,7 +253,6 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10.33.2
           run_install: false
       - name: Use Node.js
         uses: actions/setup-node@v6
@@ -229,7 +271,9 @@ jobs:
           ep_align
           ep_author_hover
           ep_cursortrace
+          ep_font_color
           ep_font_size
+          ep_hash_auth
           ep_headings2
           ep_markdown
           ep_readonly_guest
@@ -256,5 +300,18 @@ jobs:
           powershell -Command "(gc settings.json.holder) -replace '\"points\": 10', '\"points\": 1000' | Out-File -encoding ASCII settings.json"
       -
         name: Run the backend tests
+        shell: bash
         working-directory: src
-        run: pnpm test
+        env:
+          NODE_OPTIONS: "--report-on-fatalerror --report-uncaught-exception --report-on-signal --report-compact --report-directory=${{ github.workspace }}/node-report"
+        run: |
+          mkdir -p "${{ github.workspace }}/node-report"
+          pnpm test
+      - name: Upload Node diagnostic reports on failure
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: node-diagnostic-report-${{ runner.os }}-node${{ matrix.node }}-${{ github.job }}
+          path: node-report/
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/build-and-deploy-docs.yml

@@ -1,34 +1,38 @@
-# Workflow for deploying static content to GitHub Pages
+# Workflow for building and deploying the VitePress site to GitHub Pages.
+# Build runs on every push to develop and on every PR that touches docs (so
+# a build regression is caught at review time instead of breaking develop
+# after merge — see #7640). Deploy runs only on push: the github-pages
+# environment has protection rules that reject PR refs, and a PR build
+# never produced an artifact to deploy anyway.
 name: Deploy Docs to GitHub Pages
 
 on:
-  # Runs on pushes targeting the default branch
   push:
     branches: ["develop"]
     paths:
-      - doc/** # Only run workflow when changes are made to the doc directory
-  # Allows you to run this workflow manually from the Actions tab
+      - doc/**
+      - .github/workflows/build-and-deploy-docs.yml
+  pull_request:
+    paths:
+      - doc/**
+      - .github/workflows/build-and-deploy-docs.yml
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
   contents: read
   pages: write
   id-token: write
   packages: read
 
-# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
-# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+# Allow only one concurrent deployment, skipping runs queued between the run
+# in-progress and latest queued. Do NOT cancel in-progress runs — production
+# deployments are allowed to complete.
 concurrency:
   group: "pages"
   cancel-in-progress: false
 
 jobs:
-  # Single deploy job since we're just deploying
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
+  build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -50,22 +54,43 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10.33.2
           run_install: false
+      # Pin Node so the build does not silently fall back to whatever the
+      # runner image ships with. The repo declares engines.node >=24.0.0.
+      - name: Use Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
       - name: Setup Pages
+        if: github.event_name == 'push'
         uses: actions/configure-pages@v6
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Build app
         working-directory: doc
         run: pnpm run docs:build
         env:
+          GITHUB_PAGES: ${{ github.event_name == 'push' && 'true' || '' }}
           COMMIT_REF: ${{ github.sha }}
       - name: Upload artifact
+        if: github.event_name == 'push'
         uses: actions/upload-pages-artifact@v5
         with:
-          # Upload entire repository
           path: './doc/.vitepress/dist'
+
+  # Deploy to GitHub Pages on push to develop only. Kept as a separate job
+  # because the github-pages environment's protection rules reject any
+  # non-develop ref (including PR merge refs), which used to fail the entire
+  # workflow at job-creation time before any build step could run.
+  deploy:
+    needs: build
+    if: github.event_name == 'push'
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v5