[pull] main from hoppscotch:main

packages/hoppscotch-backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hoppscotch-backend",
-  "version": "2026.2.0",
+  "version": "2026.2.1",
   "description": "",
   "author": "",
   "private": true,
@@ -46,8 +46,8 @@
     "@nestjs/swagger": "11.2.6",
     "@nestjs/terminus": "11.0.0",
     "@nestjs/throttler": "6.5.0",
-    "@prisma/adapter-pg": "7.4.0",
-    "@prisma/client": "7.4.0",
+    "@prisma/adapter-pg": "7.4.2",
+    "@prisma/client": "7.4.2",
     "argon2": "0.44.0",
     "bcrypt": "6.0.0",
     "class-transformer": "0.5.1",
@@ -74,7 +74,7 @@
     "passport-microsoft": "2.1.0",
     "pg": "8.18.0",
     "posthog-node": "5.24.15",
-    "prisma": "7.4.0",
+    "prisma": "7.4.2",
     "reflect-metadata": "0.2.2",
     "rimraf": "6.1.3",
     "rxjs": "7.8.2"

packages/hoppscotch-backend/src/access-token/access-token.controller.ts

@@ -51,8 +51,14 @@ export class AccessTokenController {
 
   @Delete('revoke')
   @UseGuards(JwtAuthGuard)
-  async deletePAT(@Query('id') id: string) {
-    const result = await this.accessTokenService.deletePAT(id);
+  async deletePAT(@GqlUser() user: AuthUser, @Query('id') id: string) {
+    if (!id) {
+      throw new BadRequestException(
+        createCLIErrorResponse(ACCESS_TOKENS_INVALID_DATA_ID),
+      );
+    }
+
+    const result = await this.accessTokenService.deletePAT(id, user.uid);
 
     if (E.isLeft(result)) throwHTTPErr(result.left);
     return result.right;

packages/hoppscotch-backend/src/access-token/access-token.service.spec.ts

@@ -112,25 +112,55 @@ describe('AccessTokenService', () => {
 
   describe('deletePAT', () => {
     test('should throw ACCESS_TOKEN_NOT_FOUND if Access Token is not found', async () => {
-      mockPrisma.personalAccessToken.delete.mockRejectedValueOnce(
-        'RecordNotFound',
-      );
+      mockPrisma.personalAccessToken.deleteMany.mockResolvedValueOnce({
+        count: 0,
+      });
 
-      const result = await accessTokenService.deletePAT(userAccessToken.id);
+      const result = await accessTokenService.deletePAT(
+        userAccessToken.id,
+        user.uid,
+      );
+      expect(mockPrisma.personalAccessToken.deleteMany).toHaveBeenCalledWith({
+        where: { id: userAccessToken.id, userUid: user.uid },
+      });
       expect(result).toEqualLeft({
         message: ACCESS_TOKEN_NOT_FOUND,
         statusCode: HttpStatus.NOT_FOUND,
       });
     });
 
     test('should successfully delete a new Access Token', async () => {
-      mockPrisma.personalAccessToken.delete.mockResolvedValueOnce(
-        userAccessToken,
-      );
+      mockPrisma.personalAccessToken.deleteMany.mockResolvedValueOnce({
+        count: 1,
+      });
 
-      const result = await accessTokenService.deletePAT(userAccessToken.id);
+      const result = await accessTokenService.deletePAT(
+        userAccessToken.id,
+        user.uid,
+      );
+      expect(mockPrisma.personalAccessToken.deleteMany).toHaveBeenCalledWith({
+        where: { id: userAccessToken.id, userUid: user.uid },
+      });
       expect(result).toEqualRight(true);
     });
+
+    test('should throw ACCESS_TOKEN_NOT_FOUND when token belongs to a different user', async () => {
+      mockPrisma.personalAccessToken.deleteMany.mockResolvedValueOnce({
+        count: 0,
+      });
+
+      const result = await accessTokenService.deletePAT(
+        userAccessToken.id,
+        'different-user-uid',
+      );
+      expect(mockPrisma.personalAccessToken.deleteMany).toHaveBeenCalledWith({
+        where: { id: userAccessToken.id, userUid: 'different-user-uid' },
+      });
+      expect(result).toEqualLeft({
+        message: ACCESS_TOKEN_NOT_FOUND,
+        statusCode: HttpStatus.NOT_FOUND,
+      });
+    });
   });
 
   describe('listAllUserPAT', () => {

packages/hoppscotch-backend/src/access-token/access-token.service.ts

@@ -103,20 +103,22 @@ export class AccessTokenService {
    * Delete a Personal Access Token
    *
    * @param accessTokenID ID of the Personal Access Token
+   * @param userUid UID of the user requesting the deletion
    * @returns Either of true or error message
    */
-  async deletePAT(accessTokenID: string) {
-    try {
-      await this.prisma.personalAccessToken.delete({
-        where: { id: accessTokenID },
-      });
-      return E.right(true);
-    } catch {
+  async deletePAT(accessTokenID: string, userUid: string) {
+    const { count } = await this.prisma.personalAccessToken.deleteMany({
+      where: { id: accessTokenID, userUid },
+    });
+
+    if (count === 0) {
       return E.left({
         message: ACCESS_TOKEN_NOT_FOUND,
         statusCode: HttpStatus.NOT_FOUND,
       });
     }
+
+    return E.right(true);
   }
 
   /**

packages/hoppscotch-backend/src/user-collection/user-collection.service.spec.ts

@@ -2314,3 +2314,69 @@ describe('updateUserCollection', () => {
     );
   });
 });
+
+describe('exportUserCollectionToJSONObject', () => {
+  test('should use DB row id and title over conflicting values in stored request payload', async () => {
+    const dbRowId = 'db-row-cuid-001';
+    const dbRowTitle = 'My Request';
+    const payloadId = 'stale-payload-id-from-original';
+    const payloadName = 'stale-payload-name-from-original';
+
+    mockPrisma.userCollection.findUniqueOrThrow.mockResolvedValueOnce({
+      ...rootRESTUserCollection,
+    });
+    mockPrisma.userCollection.findMany.mockResolvedValueOnce([]);
+    mockPrisma.userRequest.findMany.mockResolvedValueOnce([
+      {
+        id: dbRowId,
+        title: dbRowTitle,
+        collectionID: rootRESTUserCollection.id,
+        userUid: user.uid,
+        type: ReqType.REST,
+        orderIndex: 1,
+        createdOn: currentTime,
+        updatedOn: currentTime,
+        mockExamples: null,
+        request: {
+          id: payloadId,
+          name: payloadName,
+          v: '12',
+          endpoint: 'https://example.com',
+          method: 'GET',
+          params: [],
+          headers: [],
+          preRequestScript: '',
+          testScript: '',
+          auth: { authType: 'none', authActive: false },
+          body: { contentType: null, body: null },
+          requestVariables: [],
+          responses: {},
+        },
+      },
+    ]);
+
+    const result = await userCollectionService.exportUserCollectionToJSONObject(
+      user.uid,
+      rootRESTUserCollection.id,
+    );
+
+    expect(result).toEqualRight(
+      expect.objectContaining({
+        requests: [expect.objectContaining({ id: dbRowId, name: dbRowTitle })],
+      }),
+    );
+  });
+
+  test('should throw USER_COLL_NOT_FOUND when collectionID is invalid', async () => {
+    mockPrisma.userCollection.findUniqueOrThrow.mockRejectedValueOnce(
+      new Error('NotFoundError'),
+    );
+
+    const result = await userCollectionService.exportUserCollectionToJSONObject(
+      user.uid,
+      'non-existent-id',
+    );
+
+    expect(result).toEqualLeft(USER_COLL_NOT_FOUND);
+  });
+});

packages/hoppscotch-backend/src/user-collection/user-collection.service.ts

@@ -920,9 +920,9 @@ export class UserCollectionService {
       folders: childrenCollectionObjects,
       requests: requests.map((x) => {
         return {
+          ...(x.request as Record<string, unknown>), // type casting x.request of type Prisma.JSONValue to an object to enable spread
           id: x.id,
           name: x.title,
-          ...(x.request as Record<string, unknown>), // type casting x.request of type Prisma.JSONValue to an object to enable spread
         };
       }),
       data,
@@ -996,9 +996,9 @@ export class UserCollectionService {
           folders: collectionListObjects,
           requests: requests.map((x) => {
             return {
+              ...(x.request as Record<string, unknown>), // type casting x.request of type Prisma.JSONValue to an object to enable spread
               id: x.id,
               name: x.title,
-              ...(x.request as Record<string, unknown>), // type casting x.request of type Prisma.JSONValue to an object to enable spread
             };
           }),
           data: JSON.stringify(parentCollection.right.data),

packages/hoppscotch-common/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hoppscotch/common",
   "private": true,
-  "version": "2026.2.0",
+  "version": "2026.2.1",
   "scripts": {
     "dev": "pnpm exec npm-run-all -p -l dev:*",
     "test": "vitest --run",

packages/hoppscotch-common/src/components/mockServer/MockServerDashboard.vue

@@ -22,7 +22,7 @@
       <span class="flex">
         <HoppButtonSecondary
           v-tippy="{ theme: 'tooltip' }"
-          to="https://docs.hoppscotch.io/documentation/features/mock-servers"
+          to="https://docs.hoppscotch.io/documentation/features/mock"
           blank
           :title="t('app.wiki')"
           :icon="IconHelpCircle"

packages/hoppscotch-common/src/components/smart/EnvInput.vue

@@ -749,6 +749,11 @@ watch(
   @apply flex-shrink-0;
   @apply whitespace-nowrap py-4;
 
+  // Hide horizontal scrollbar for CodeMirror in Firefox (Chrome is handled by global ::-webkit-scrollbar { h-0 })
+  :deep(.cm-scroller) {
+    scrollbar-width: none;
+  }
+
   .suggestions {
     @apply absolute;
     @apply bg-popover;

packages/hoppscotch-common/src/platform/instance.ts

@@ -18,7 +18,7 @@ export const VENDORED_INSTANCE_CONFIG: Instance = {
   kind: "vendored" as const,
   serverUrl: "app://hoppscotch",
   displayName: "Hoppscotch Desktop",
-  version: "26.2.0",
+  version: "26.2.1",
   lastUsed: new Date().toISOString(),
   bundleName: "Hoppscotch",
 }

packages/hoppscotch-desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hoppscotch-desktop",
   "private": true,
-  "version": "26.2.0",
+  "version": "26.2.1",
   "type": "module",
   "scripts": {
     "dev": "vite",

packages/hoppscotch-desktop/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hoppscotch-desktop"
-version = "26.2.0"
+version = "26.2.1"
 description = "Desktop App for hoppscotch.io"
 authors = ["CuriousCorrelation"]
 edition = "2021"

packages/hoppscotch-desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Hoppscotch",
-  "version": "26.2.0",
+  "version": "26.2.1",
   "identifier": "io.hoppscotch.desktop",
   "build": {
     "beforeDevCommand": "pnpm dev",

packages/hoppscotch-desktop/src-tauri/tauri.portable.macos.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Hoppscotch",
-  "version": "26.2.0",
+  "version": "26.2.1",
   "identifier": "io.hoppscotch.desktop",
   "build": {
     "beforeDevCommand": "pnpm dev",

packages/hoppscotch-desktop/src-tauri/tauri.portable.windows.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Hoppscotch",
-  "version": "26.2.0",
+  "version": "26.2.1",
   "identifier": "io.hoppscotch.desktop",
   "build": {
     "beforeDevCommand": "pnpm dev",

packages/hoppscotch-desktop/src/views/Home.vue

@@ -299,7 +299,7 @@ const loadVendored = async () => {
     const vendoredInstance: VendoredInstance = {
       type: "vendored",
       displayName: "Hoppscotch",
-      version: "26.2.0",
+      version: "26.2.1",
     }
 
     const connectionState: ConnectionState = {

packages/hoppscotch-selfhost-web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hoppscotch/selfhost-web",
   "private": true,
-  "version": "2026.2.0",
+  "version": "2026.2.1",
   "type": "module",
   "scripts": {
     "dev:vite": "vite",

packages/hoppscotch-selfhost-web/webapp-server/internal/bundle/types.go

@@ -3,7 +3,7 @@ package bundle
 import "time"
 
 const (
-	Version = "2026.2.0"
+	Version = "2026.2.1"
 
 	DefaultMaxSize = 50 * 1024 * 1024
 

packages/hoppscotch-sh-admin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hoppscotch-sh-admin",
   "private": true,
-  "version": "2026.2.0",
+  "version": "2026.2.1",
   "type": "module",
   "scripts": {
     "dev": "pnpm exec npm-run-all -p -l dev:*",

packages/hoppscotch-sh-admin/src/components/setup/DataSharingAndNewsletter.vue

@@ -58,7 +58,7 @@
         />
         <HoppSmartAnchor
           blank
-          to="http://docs.hoppscotch.io"
+          to="https://docs.hoppscotch.io"
           :icon="IconBookOpenText"
           :label="t('app.read_documentation')"
         />