Merge branch 'develop' into chore/improve-quiz-submit

Author: krusche

.github/workflows/test.yml

@@ -238,7 +238,7 @@ jobs:
 
   client-tests:
     runs-on: aet-large-ubuntu
-    timeout-minutes: 30
+    timeout-minutes: 45
     steps:
         - uses: actions/checkout@v6
         # It seems like there is some memory issue with these tests with the project-wide default node option

CLAUDE.md

@@ -169,6 +169,7 @@ Organized by feature module:
   - All new UI elements must be implemented using PrimeNG components
   - We are migrating from Bootstrap to PrimeNG; do not introduce new Bootstrap components
   - Existing Bootstrap usage will be migrated incrementally
+  - **`@ng-bootstrap/ng-bootstrap` is deprecated** — do not use `NgbModal`, `NgbActiveModal`, `NgbModalRef`, `NgbTooltip`, `NgbDropdown`, etc. in new code. Use PrimeNG's `DialogService` (`primeng/dynamicdialog`) for modals, `p-tooltip` for tooltips, etc. ng-bootstrap is incompatible with Angular signal inputs (assigning to `modalRef.componentInstance.X` silently fails when `X` is `input()`/`input.required()`). Existing usages are being migrated.
 
 ### General
 - LF line endings

README.md

@@ -199,7 +199,7 @@ Refer to [Using JHipster in production](http://www.jhipster.tech/production) for
 The following command can automate the deployment to a server. The example shows the deployment to the main Artemis test server (which runs a virtual machine):
 
 ```shell
-./artemis-server-cli deploy username@artemis-test0.artemis.in.tum.de -w build/libs/Artemis-9.1.2.war
+./artemis-server-cli deploy username@artemis-test0.artemis.in.tum.de -w build/libs/Artemis-9.1.3.war
 ```
 
 ## Architecture

build.gradle

@@ -40,7 +40,7 @@ envProperties.each { key, value ->
 }
 
 group = "de.tum.cit.aet.artemis"
-version = "9.1.2"
+version = "9.1.3"
 description = "Interactive Learning with Individual Feedback"
 
 java {
@@ -102,9 +102,9 @@ gitProperties {
 }
 
 // Override Spring Boot BOM versions to patched releases addressing known CVEs
-// thymeleaf 3.1.4.RELEASE: GHSA-7rgv-g3jm-rvv4, GHSA-vjp2-6m4m-cv5q
+// thymeleaf 3.1.5.RELEASE: GHSA-7rgv-g3jm-rvv4, GHSA-vjp2-6m4m-cv5q, GHSA-c9ph-gxww-7744
 // tomcat 11.0.21: GHSA-h9fx-5mv3-gmh6, GHSA-6q54-28g2-vpgm, GHSA-55j7-cm8x-wvmh
-ext["thymeleaf.version"] = "3.1.4.RELEASE"
+ext["thymeleaf.version"] = "3.1.5.RELEASE"
 ext["tomcat.version"] = "11.0.21"
 
 configurations {
@@ -198,11 +198,15 @@ dependencies {
 
     // Required by Sharing Platform
     implementation "org.codeability:SharingPluginPlatformAPI:1.2.1"
-    // Required by Spring cloud
-    implementation "org.apache.httpcomponents.client5:httpclient5:5.6.1"
-    // Pin the cache module to 5.6.1 so its transitive httpclient5 declaration is also patched (CVE-2026-40542 / GHSA-v468-qcjx-r72w);
-    // otherwise Spring Boot's BOM and Shibboleth pull in httpclient5-cache:5.5.2, which declares httpclient5:5.5.2 transitively.
-    implementation "org.apache.httpcomponents.client5:httpclient5-cache:5.6.1"
+    // Required by Spring cloud.
+    // Pinned to 5.5.1: not vulnerable to CVE-2026-40542 / GHSA-v468-qcjx-r72w (vulnerable range >= 5.6-alpha1, < 5.6.1).
+    // The CVE affects the SCRAM-SHA-256 authentication scheme that was first introduced in 5.6; that code path does not
+    // exist in 5.5.x, and Artemis does not use SCRAM-SHA-256 anywhere. A transitive request for httpclient5:5.6 from
+    // io.weaviate:client6 (and httpclient5:5.5.2 from httpclient5-cache via the Spring BOM / Shibboleth) is resolved
+    // down to 5.5.1 by this explicit pin.
+    // We cannot upgrade to 5.6.1 (the patched release) because it breaks Hazelcast cluster formation; the bump was
+    // reverted in PR #12652.
+    implementation "org.apache.httpcomponents.client5:httpclient5:5.5.1"
     implementation "org.apache.httpcomponents.core5:httpcore5:5.3.6"
     implementation "org.apache.httpcomponents:httpmime:4.5.14"
 

documentation/docs/developer/guidelines/client-development.mdx

@@ -69,11 +69,16 @@ Use Angular's signal-based APIs instead. An ESLint rule (`enforce-signal-apis-in
 
 **UI Component Library: PrimeNG**
 
+<Callout variant={CalloutVariant.danger}>
+**`@ng-bootstrap/ng-bootstrap` is deprecated.** Do not use `NgbModal`, `NgbActiveModal`, `NgbModalRef`, `NgbTooltip`, `NgbDropdown`, or any other ng-bootstrap component in new code. ng-bootstrap is incompatible with Angular signal inputs (`input()`/`input.required()`) — assigning to a signal input via `modalRef.componentInstance.X = Y` silently fails. We are removing the dependency entirely; existing usages are being migrated to PrimeNG incrementally.
+</Callout>
+
 <Callout variant={CalloutVariant.info}>
 **We are migrating from Bootstrap to PrimeNG.** All new UI elements must be implemented using [PrimeNG](https://primeng.org/) components. Do not introduce new Bootstrap components. Existing Bootstrap usage will be migrated incrementally.
 </Callout>
 
 * Use PrimeNG components (buttons, tables, dialogs, inputs, etc.) for all new UI development.
+* For modals/dialogs, use PrimeNG's `DialogService` (`primeng/dynamicdialog`) — see `src/main/webapp/app/exam/manage/exam-management/exam-management.component.ts` for a reference implementation.
 * Refer to the PrimeNG documentation for available components and usage: https://primeng.org/
 * Bootstrap CSS utility classes (e.g. `d-flex`, `ms-2`) may still be used for layout until the migration is complete, but prefer PrimeNG's built-in layout capabilities where available.
 

jest.config.js

@@ -109,6 +109,17 @@ module.exports = {
         '!<rootDir>/src/main/webapp/app/shared/table-view/**',          // table view module uses Vitest (see vitest.config.ts)
         '!<rootDir>/src/main/webapp/app/shared/components/buttons/**',  // buttons module uses Vitest (see vitest.config.ts)
         '!<rootDir>/src/main/webapp/app/exam/manage/students/**', // exam manage students module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/student-exams/**', // exam manage student-exams module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/test-runs/**', // exam manage test-runs module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/exercise-groups/**', // exam manage exercise groups module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/suspicious-behavior/**', // exam manage suspicious behavior module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/services/**', // exam manage services module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/exam-management/**', // exam management module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/exam-scores/**', // exam scores module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/exam-status/**', // exam status module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/manage/exams/**', // exam manage exams (detail/import/update/checklist/mode-picker) uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/shared/**', // exam shared module uses Vitest (see vitest.config.ts)
+        '!<rootDir>/src/main/webapp/app/exam/overview/**', // exam overview module uses Vitest (see vitest.config.ts)
         '!<rootDir>/src/main/webapp/app/shared/feature-toggle/**', // feature-toggle service uses Vitest (see vitest.config.ts)
         '!<rootDir>/src/main/webapp/app/shared/sort/**', // sort directives use vitest (see vitest.config.ts)
         '!<rootDir>/src/main/webapp/app/shared/user-import/util/**', // user import utils use Vitest (see vitest.config.ts)
@@ -142,6 +153,17 @@ module.exports = {
         '<rootDir>/src/main/webapp/app/atlas/',             // atlas module uses Vitest
         '<rootDir>/src/main/webapp/app/shared/components/buttons/', // buttons module uses Vitest
         '<rootDir>/src/main/webapp/app/exam/manage/students/', // exam manage students module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/student-exams/', // exam manage student-exams module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/test-runs/', // exam manage test-runs module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/exercise-groups/', // exam manage exercise groups module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/suspicious-behavior/', // exam manage suspicious behavior module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/services/', // exam manage services module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/exam-management/', // exam management module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/exam-scores/', // exam scores module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/exam-status/', // exam status module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/manage/exams/', // exam manage exams uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/shared/', // exam shared module uses Vitest
+        '<rootDir>/src/main/webapp/app/exam/overview/', // exam overview module uses Vitest
         '<rootDir>/src/main/webapp/app/shared/sort/', // sort directives use Vitest
         '<rootDir>/src/main/webapp/app/shared/user-import/util/', // user import utils use Vitest
         '<rootDir>/src/main/webapp/app/shared/table-view/', // table view module uses Vitest
@@ -159,12 +181,15 @@ module.exports = {
     ],
     // Global coverage thresholds for Jest. Modules using Vitest (e.g., fileupload) have their own
     // coverage thresholds in vitest.config.ts. Per-module thresholds are enforced by check-client-module-coverage.mjs
+    // Lowered with the exam-module Vitest migration: when ~100 spec files moved from Jest to Vitest,
+    // a few peripheral helpers stopped being touched by the Jest run, dropping each global metric by 1-2pp.
+    // Per-file coverage is unchanged — the exam-module tests still cover the same files, just under Vitest.
     coverageThreshold: {
         global: {
-            statements: 85.5,
-            branches: 74.1,
-            functions: 75.4,
-            lines: 86.5,
+            statements: 83.5,
+            branches: 73,
+            functions: 73,
+            lines: 84.5,
         },
     },
     // 'json-summary' reporter is used by supporting_scripts/code-coverage/module-coverage-client/check-client-module-coverage.mjs
@@ -201,6 +226,17 @@ module.exports = {
         '<rootDir>/src/main/webapp/app/tutorialgroup/', // tutorialgroup module
         '<rootDir>/src/main/webapp/app/atlas/',         // atlas module
         '<rootDir>/src/main/webapp/app/exam/manage/students/', // exam manage students module
+        '<rootDir>/src/main/webapp/app/exam/manage/student-exams/', // exam manage student-exams module
+        '<rootDir>/src/main/webapp/app/exam/manage/test-runs/', // exam manage test-runs module
+        '<rootDir>/src/main/webapp/app/exam/manage/exercise-groups/', // exam manage exercise groups module
+        '<rootDir>/src/main/webapp/app/exam/manage/suspicious-behavior/', // exam manage suspicious behavior module
+        '<rootDir>/src/main/webapp/app/exam/manage/services/', // exam manage services module
+        '<rootDir>/src/main/webapp/app/exam/manage/exam-management/', // exam management module (vitest)
+        '<rootDir>/src/main/webapp/app/exam/manage/exam-scores/', // exam scores module (vitest)
+        '<rootDir>/src/main/webapp/app/exam/manage/exam-status/', // exam status module (vitest)
+        '<rootDir>/src/main/webapp/app/exam/manage/exams/', // exam manage exams (detail/import/update/checklist/mode-picker) (vitest)
+        '<rootDir>/src/main/webapp/app/exam/shared/', // exam shared module (vitest)
+        '<rootDir>/src/main/webapp/app/exam/overview/', // exam overview module (vitest)
         '<rootDir>/src/main/webapp/app/shared/components/buttons/', // shared/buttons components
         '<rootDir>/src/main/webapp/app/shared/table-view/', // shared/table-view component
         '<rootDir>/src/main/webapp/app/shared/feature-toggle/', // feature-toggle service (vitest)

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "artemis",
-    "version": "9.1.2",
+    "version": "9.1.3",
     "description": "Interactive Learning with Individual Feedback",
     "private": true,
     "license": "MIT",

package.json

@@ -220,11 +220,16 @@ public ResponseEntity<SimpleLectureDTO> updateLecture(@RequestBody SimpleLecture
         if (updatedLectureDto.id() == null) {
             throw new BadRequestAlertException("Invalid id", ENTITY_NAME, "idNull");
         }
-        Course course = courseRepository.findByIdElseThrow(updatedLectureDto.course.id());
-        authCheckService.checkHasAtLeastRoleInCourseElseThrow(Role.EDITOR, course, null);
-
         // This explicitly does NOT change any relationships such as attachments or lecture units
         Lecture originalLecture = lectureRepository.findByIdElseThrow(updatedLectureDto.id());
+        Course course = originalLecture.getCourse();
+        if (course == null) {
+            throw new BadRequestAlertException("Lecture is not part of a course", ENTITY_NAME, "courseMissing");
+        }
+        authCheckService.checkHasAtLeastRoleInCourseElseThrow(Role.EDITOR, course, null);
+        if (updatedLectureDto.course == null || !course.getId().equals(updatedLectureDto.course.id())) {
+            throw new BadRequestAlertException("Lecture does not belong to the specified course", ENTITY_NAME, "courseMismatch");
+        }
         updateLectureAttributesFromDTO(originalLecture, updatedLectureDto);
 
         channelService.updateLectureChannel(originalLecture, updatedLectureDto.channelName());

src/main/java/de/tum/cit/aet/artemis/lecture/web/LectureResource.java

@@ -115,7 +115,11 @@ export class CourseOverviewComponent extends BaseCourseContainerComponent implem
 
     async ngOnInit() {
         this.toggleSidebarEventSubscription = this.courseSidebarService.toggleSidebar$.subscribe(() => {
-            this.isSidebarCollapsed.update((value) => this.activatedComponentReference()?.isCollapsed ?? !value);
+            this.isSidebarCollapsed.update((value) => {
+                const componentRef = this.activatedComponentReference();
+                const componentCollapsed = typeof componentRef?.isCollapsed === 'function' ? componentRef.isCollapsed() : (componentRef?.isCollapsed as boolean | undefined);
+                return componentCollapsed ?? !value;
+            });
         });
 
         this.subscription = this.route?.params.subscribe(async (params: { courseId: string }) => {
@@ -149,7 +153,9 @@ export class CourseOverviewComponent extends BaseCourseContainerComponent implem
         });
 
         this.courseActionItems.set(this.getCourseActionItems());
-        this.isSidebarCollapsed.set(this.activatedComponentReference()?.isCollapsed ?? false);
+        const componentRef = this.activatedComponentReference();
+        const componentCollapsed = typeof componentRef?.isCollapsed === 'function' ? componentRef.isCollapsed() : (componentRef?.isCollapsed as boolean | undefined);
+        this.isSidebarCollapsed.set(componentCollapsed ?? false);
         this.sidebarItems.set(this.getSidebarItems());
         await this.initAfterCourseLoad();
     }
@@ -293,7 +299,8 @@ export class CourseOverviewComponent extends BaseCourseContainerComponent implem
         }
         const childRouteComponent = this.activatedComponentReference();
         childRouteComponent?.toggleSidebar();
-        this.isSidebarCollapsed.set(childRouteComponent!.isCollapsed);
+        const componentCollapsed = typeof childRouteComponent!.isCollapsed === 'function' ? childRouteComponent!.isCollapsed() : (childRouteComponent!.isCollapsed as boolean);
+        this.isSidebarCollapsed.set(componentCollapsed);
     }
 
     getShowRefreshButton(): void {