v1.11.82

while we work out why 24 fails

.github/workflows/backport.yml

@@ -10,7 +10,7 @@ on:
 jobs:
     backport:
         name: Backport
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         # Only react to merged PRs for security reasons.
         # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
         if: >

.github/workflows/build_and_deploy.yaml

@@ -99,7 +99,7 @@ jobs:
             - macos
             - linux
             - windows
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
         if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
         environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
@@ -252,7 +252,7 @@ jobs:
 
     deploy-ess:
         needs: deploy
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         name: Deploy builds to ESS
         if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
         env:

.github/workflows/build_and_test.yaml

@@ -60,12 +60,12 @@ jobs:
                           rsync -a /Volumes/Element/Element.app ~/Applications/ &&
                           hdiutil detach /Volumes/Element
                     - name: "Linux (amd64) (sqlcipher: system)"
-                      os: ubuntu-latest
+                      os: ubuntu-22.04
                       artifact: linux-amd64-sqlcipher-system
                       executable: "/opt/Element/element-desktop"
                       prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
                     - name: "Linux (amd64) (sqlcipher: static)"
-                      os: ubuntu-latest
+                      os: ubuntu-22.04
                       artifact: linux-amd64-sqlcipher-static
                       executable: "/opt/Element/element-desktop"
                       prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"

.github/workflows/build_linux.yaml

@@ -26,7 +26,7 @@ jobs:
     # We build the hak files on native infrastructure as matrix-seshat fails to cross-compile properly
     # https://github.com/matrix-org/seshat/issues/135
     hak:
-        runs-on: ${{ inputs.arch == 'arm64' && 'dind-l-arm64' || 'ubuntu-latest' }}
+        runs-on: ${{ inputs.arch == 'arm64' && 'dind-l-arm64' || 'ubuntu-22.04' }}
         env:
             HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
         outputs:
@@ -148,7 +148,7 @@ jobs:
 
     build:
         needs: hak
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@v4
 

.github/workflows/build_prepare.yaml

@@ -45,7 +45,7 @@ jobs:
     prepare:
         name: Prepare
         environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         outputs:
             nightly-version: ${{ steps.versions.outputs.nightly }}
         steps:

.github/workflows/dockerbuild.yaml

@@ -12,7 +12,7 @@ env:
 jobs:
     build:
         name: Docker Build
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         permissions:
             contents: read
             packages: write

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
     check:
         name: Post release checks
         needs: release
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - name: Wait for desktop packaging
               uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork

.github/workflows/static_analysis.yaml

@@ -6,7 +6,7 @@ on:
 jobs:
     ts_lint:
         name: "Typescript Syntax Check"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@v4
 
@@ -30,7 +30,7 @@ jobs:
 
     js_lint:
         name: "ESLint"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@v4
 
@@ -48,7 +48,7 @@ jobs:
 
     workflow_lint:
         name: "Workflow Lint"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@v4
 
@@ -66,7 +66,7 @@ jobs:
 
     analyse_dead_code:
         name: "Analyse Dead Code"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@v4
 

.github/workflows/triage-incoming.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
     automate-project-columns-next:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-22.04
         steps:
             - uses: actions/add-to-project@main
               with:

CHANGELOG.md

@@ -1,3 +1,70 @@
+Changes in [1.11.82](https://github.com/element-hq/element-desktop/releases/tag/v1.11.82) (2024-10-22)
+======================================================================================================
+## ✨ Features
+
+* Add monochrome tray icon ([#1804](https://github.com/element-hq/element-desktop/pull/1804)). Contributed by @SakiiCode.
+* Deduplicate more icons using Compound Design Tokens ([#132](https://github.com/element-hq/matrix-react-sdk/pull/132)). Contributed by @t3chguy.
+* Always show link new device flow even if unsupported ([#147](https://github.com/element-hq/matrix-react-sdk/pull/147)). Contributed by @t3chguy.
+* Update design of files list in right panel ([#144](https://github.com/element-hq/matrix-react-sdk/pull/144)). Contributed by @t3chguy.
+* Remove feature\_dehydration ([#138](https://github.com/element-hq/matrix-react-sdk/pull/138)). Contributed by @florianduros.
+* Upgrade emojibase-bindings and remove local handling of emoticon variations ([#127](https://github.com/element-hq/matrix-react-sdk/pull/127)). Contributed by @langleyd.
+* Add support for rendering media captions ([#43](https://github.com/element-hq/matrix-react-sdk/pull/43)). Contributed by @tulir.
+* Replace composer icons with Compound variants ([#123](https://github.com/element-hq/matrix-react-sdk/pull/123)). Contributed by @t3chguy.
+* Tweak default right panel size to be 320px except for maximised widgets at 420px ([#110](https://github.com/element-hq/matrix-react-sdk/pull/110)). Contributed by @t3chguy.
+* Add a pinned message badge under a pinned message ([#118](https://github.com/element-hq/matrix-react-sdk/pull/118)). Contributed by @florianduros.
+* Ditch right panel tabs and re-add close button ([#99](https://github.com/element-hq/matrix-react-sdk/pull/99)). Contributed by @t3chguy.
+* Force verification even for refreshed clients ([#44](https://github.com/element-hq/matrix-react-sdk/pull/44)). Contributed by @dbkr.
+* Update emoji text, border and background colour in timeline ([#119](https://github.com/element-hq/matrix-react-sdk/pull/119)). Contributed by @florianduros.
+* Disable ICE fallback based on well-known configuration ([#111](https://github.com/element-hq/matrix-react-sdk/pull/111)). Contributed by @t3chguy.
+* Remove legacy room header and promote beta room header ([#105](https://github.com/element-hq/matrix-react-sdk/pull/105)). Contributed by @t3chguy.
+* Respect `io.element.jitsi` `useFor1To1Calls` in well-known ([#112](https://github.com/element-hq/matrix-react-sdk/pull/112)). Contributed by @t3chguy.
+* Use Compound close icon in favour of mishmash of x/close icons ([#108](https://github.com/element-hq/matrix-react-sdk/pull/108)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Correct typo in option documentation ([#28148](https://github.com/element-hq/element-web/pull/28148)). Contributed by @AndrewKvalheim.
+* Revert #124 and #135 ([#139](https://github.com/element-hq/matrix-react-sdk/pull/139)). Contributed by @dbkr.
+* Add aria-label to e2e icon ([#136](https://github.com/element-hq/matrix-react-sdk/pull/136)). Contributed by @florianduros.
+* Fix bell icons on room list hover being black squares ([#135](https://github.com/element-hq/matrix-react-sdk/pull/135)). Contributed by @dbkr.
+* Fix vertical overflow on the mobile register screen ([#137](https://github.com/element-hq/matrix-react-sdk/pull/137)). Contributed by @langleyd.
+* Allow to unpin redacted event ([#98](https://github.com/element-hq/matrix-react-sdk/pull/98)). Contributed by @florianduros.
+
+
+
+Changes in [1.11.81](https://github.com/element-hq/element-desktop/releases/tag/v1.11.81) (2024-10-15)
+======================================================================================================
+This release fixes High severity vulnerability CVE-2024-47771 / GHSA-963w-49j9-gxj6.
+
+Changes in [1.11.80](https://github.com/element-hq/element-desktop/releases/tag/v1.11.80) (2024-10-08)
+======================================================================================================
+## ✨ Features
+
+* enable Element Call on desktop nightly ([#1873](https://github.com/element-hq/element-desktop/pull/1873)). Contributed by @fkwp.
+* Add doc for 'force\_verification config option ([#28035](https://github.com/element-hq/element-web/pull/28035)). Contributed by @dbkr.
+* Roll back change to device isolation mode ([#104](https://github.com/element-hq/matrix-react-sdk/pull/104)). Contributed by @richvdh.
+* Remove right panel toggling behaviour on room header buttons ([#100](https://github.com/element-hq/matrix-react-sdk/pull/100)). Contributed by @t3chguy.
+* Improve error display for messages sent from insecure devices ([#93](https://github.com/element-hq/matrix-react-sdk/pull/93)). Contributed by @richvdh.
+* Add labs option to exclude unverified devices ([#92](https://github.com/element-hq/matrix-react-sdk/pull/92)). Contributed by @richvdh.
+* Improve contrast for timestamps, date separators \& spotlight trigger ([#91](https://github.com/element-hq/matrix-react-sdk/pull/91)). Contributed by @t3chguy.
+* Open room settings on room header avatar click ([#88](https://github.com/element-hq/matrix-react-sdk/pull/88)). Contributed by @t3chguy.
+* Use `strong` over `b` for improved a11y semantics ([#41](https://github.com/element-hq/matrix-react-sdk/pull/41)). Contributed by @t3chguy.
+* Grant Element Call widget capabilities for "raise hand" feature ([#82](https://github.com/element-hq/matrix-react-sdk/pull/82)). Contributed by @AndrewFerr.
+* Mobile registration optimizations and tests ([#62](https://github.com/element-hq/matrix-react-sdk/pull/62)). Contributed by @langleyd.
+* Ignore chat effect when older than 48h ([#48](https://github.com/element-hq/matrix-react-sdk/pull/48)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* Update native OIDC callback url to be RFC8252 compliant ([#28096](https://github.com/element-hq/element-web/pull/28096)). Contributed by @t3chguy.
+* Update icons to include transparency ([#28040](https://github.com/element-hq/element-web/pull/28040)). Contributed by @t3chguy.
+* Fix default\_widget\_container\_height in sample config ([#28034](https://github.com/element-hq/element-web/pull/28034)). Contributed by @dbkr.
+* Fix untranslated keys being rendered in `/help` dialog ([#90](https://github.com/element-hq/matrix-react-sdk/pull/90)). Contributed by @t3chguy.
+* Ensure timeline search results are visible even in video rooms ([#96](https://github.com/element-hq/matrix-react-sdk/pull/96)). Contributed by @t3chguy.
+* Pop right panel timeline when unmaximising widget to avoid double timeline ([#94](https://github.com/element-hq/matrix-react-sdk/pull/94)). Contributed by @t3chguy.
+* Fix accessible label on left panel spotlight trigger ([#87](https://github.com/element-hq/matrix-react-sdk/pull/87)). Contributed by @t3chguy.
+* Crypto: fix display of device key ([#86](https://github.com/element-hq/matrix-react-sdk/pull/86)). Contributed by @richvdh.
+
+
+
 Changes in [1.11.79](https://github.com/element-hq/element-desktop/releases/tag/v1.11.79) (2024-10-01)
 ======================================================================================================
 * No changes

package.json

@@ -2,7 +2,7 @@
     "name": "element-desktop",
     "productName": "Element",
     "main": "lib/electron-main.js",
-    "version": "1.11.79",
+    "version": "1.11.82",
     "description": "A feature-rich client for Matrix.org",
     "author": "Element",
     "homepage": "https://element.io",

src/@types/global.d.ts

@@ -20,8 +20,8 @@ declare global {
     var launcher: AutoLaunch;
     var vectorConfig: Record<string, any>;
     var trayConfig: {
-        // eslint-disable-next-line camelcase
-        icon_path: string;
+        color_icon_path: string; // eslint-disable-line camelcase
+        monochrome_icon_path: string; // eslint-disable-line camelcase
         brand: string;
     };
     var store: Store<{
@@ -31,6 +31,7 @@ declare global {
         autoHideMenuBar?: boolean;
         locale?: string | string[];
         disableHardwareAcceleration?: boolean;
+        monochromeIcon?: boolean;
     }>;
 }
 /* eslint-enable no-var */

src/electron-main.ts

@@ -212,9 +212,11 @@ async function setupGlobals(): Promise<void> {
 
     // The tray icon
     // It's important to call `path.join` so we don't end up with the packaged asar in the final path.
-    const iconFile = `element.${process.platform === "win32" ? "ico" : "png"}`;
+    const colorIconFile = `element.${process.platform === "win32" ? "ico" : "png"}`;
+    const monochromeIconFile = `monochrome.${process.platform === "win32" ? "ico" : "png"}`;
     global.trayConfig = {
-        icon_path: path.join(resPath, "img", iconFile),
+        monochrome_icon_path: path.join(resPath, "img", monochromeIconFile),
+        color_icon_path: path.join(resPath, "img", colorIconFile),
         brand: global.vectorConfig.brand || "Element",
     };
 
@@ -453,7 +455,7 @@ app.on("ready", async () => {
         titleBarStyle: process.platform === "darwin" ? "hidden" : "default",
         trafficLightPosition: { x: 9, y: 8 },
 
-        icon: global.trayConfig.icon_path,
+        icon: global.trayConfig.color_icon_path,
         show: false,
         autoHideMenuBar: global.store.get("autoHideMenuBar", true),
 

src/media-auth.ts

@@ -33,39 +33,74 @@ async function getAccessToken(window: BrowserWindow): Promise<string | undefined
     });
 }
 
+/**
+ * Get the homeserver url
+ * This requires asking the renderer process for the homeserver url.
+ */
+async function getHomeserverUrl(window: BrowserWindow): Promise<string> {
+    return new Promise((resolve) => {
+        ipcMain.once("homeserverUrl", (_, homeserver) => {
+            resolve(homeserver);
+        });
+        window.webContents.send("homeserverUrl"); // ping now that the listener exists
+    });
+}
+
 export function setupMediaAuth(window: BrowserWindow): void {
     session.defaultSession.webRequest.onBeforeRequest(async (req, callback) => {
         // This handler emulates the element-web service worker, where URLs are rewritten late in the request
         // for backwards compatibility. As authenticated media becomes more prevalent, this should be replaced
         // by the app using authenticated URLs from the outset.
-        let url = req.url;
-        if (!url.includes("/_matrix/media/v3/download") && !url.includes("/_matrix/media/v3/thumbnail")) {
-            return callback({}); // not a URL we care about
-        }
+        try {
+            const url = new URL(req.url);
+            if (
+                !url.pathname.startsWith("/_matrix/media/v3/download") &&
+                !url.pathname.startsWith("/_matrix/media/v3/thumbnail")
+            ) {
+                return callback({}); // not a URL we care about
+            }
 
-        const supportedVersions = await getSupportedVersions(window);
-        // We have to check that the access token is truthy otherwise we'd be intercepting pre-login media request too,
-        // e.g. those required for SSO button icons.
-        const accessToken = await getAccessToken(window);
-        if (supportedVersions.includes("v1.11") && accessToken) {
-            url = url.replace(/\/media\/v3\/(.*)\//, "/client/v1/media/$1/");
-            return callback({ redirectURL: url });
-        } else {
-            return callback({}); // no support == no modification
+            const supportedVersions = await getSupportedVersions(window);
+            // We have to check that the access token is truthy otherwise we'd be intercepting pre-login media request too,
+            // e.g. those required for SSO button icons.
+            const accessToken = await getAccessToken(window);
+            if (supportedVersions.includes("v1.11") && accessToken) {
+                url.href = url.href.replace(/\/media\/v3\/(.*)\//, "/client/v1/media/$1/");
+                return callback({ redirectURL: url.toString() });
+            } else {
+                return callback({}); // no support == no modification
+            }
+        } catch (e) {
+            console.error(e);
         }
     });
 
     session.defaultSession.webRequest.onBeforeSendHeaders(async (req, callback) => {
-        if (!req.url.includes("/_matrix/client/v1/media")) {
-            return callback({}); // invoke unmodified
-        }
+        try {
+            const url = new URL(req.url);
+            if (!url.pathname.startsWith("/_matrix/client/v1/media")) {
+                return callback({}); // invoke unmodified
+            }
 
-        // Only add authorization header to authenticated media URLs. This emulates the service worker
-        // behaviour in element-web.
-        const accessToken = await getAccessToken(window);
-        // `accessToken` can be falsy, but if we're trying to download media without authentication
-        // then we should expect failure anyway.
-        const headers = { ...req.requestHeaders, Authorization: `Bearer ${accessToken}` };
-        return callback({ requestHeaders: headers });
+            // Is this request actually going to the homeserver?
+            // We don't combine this check with the one above on purpose.
+            // We're fetching the homeserver url through IPC and should do so
+            // as sparingly as possible.
+            const homeserver = await getHomeserverUrl(window);
+            const isRequestToHomeServer = homeserver && url.origin === new URL(homeserver).origin;
+            if (!isRequestToHomeServer) {
+                return callback({}); // invoke unmodified
+            }
+
+            // Only add authorization header to authenticated media URLs. This emulates the service worker
+            // behaviour in element-web.
+            const accessToken = await getAccessToken(window);
+            // `accessToken` can be falsy, but if we're trying to download media without authentication
+            // then we should expect failure anyway.
+            const headers = { ...req.requestHeaders, Authorization: `Bearer ${accessToken}` };
+            return callback({ requestHeaders: headers });
+        } catch (e) {
+            console.error(e);
+        }
     });
 }

src/preload.ts

@@ -28,6 +28,7 @@ const CHANNELS = [
     "userDownloadAction",
     "openDesktopCapturerSourcePicker",
     "userAccessToken",
+    "homeserverUrl",
     "serverSupportedVersions",
 ];
 

src/settings.ts

@@ -67,4 +67,13 @@ export const Settings: Record<string, Setting> = {
             global.store.set("disableHardwareAcceleration", !value);
         },
     },
+    "Electron.monochromeIcon": {
+        async read(): Promise<any> {
+            return tray.isMonochrome();
+        },
+        async write(value: any): Promise<void> {
+            global.store.set("monochromeIcon", value);
+            tray.refreshIcon();
+        },
+    },
 };

src/tray.ts

@@ -28,6 +28,19 @@ export function destroy(): void {
     }
 }
 
+export function isMonochrome(): boolean {
+    return global.store.get("monochromeIcon", process.platform === "linux");
+}
+
+export function refreshIcon(): void {
+    const monochrome = isMonochrome();
+    if (monochrome) {
+        trayIcon?.setImage(nativeImage.createFromPath(global.trayConfig.monochrome_icon_path));
+    } else {
+        trayIcon?.setImage(nativeImage.createFromPath(global.trayConfig.color_icon_path));
+    }
+}
+
 function toggleWin(): void {
     if (global.mainWindow?.isVisible() && !global.mainWindow.isMinimized() && global.mainWindow.isFocused()) {
         global.mainWindow.hide();
@@ -39,7 +52,8 @@ function toggleWin(): void {
 }
 
 interface IConfig {
-    icon_path: string; // eslint-disable-line camelcase
+    color_icon_path: string; // eslint-disable-line camelcase
+    monochrome_icon_path: string; // eslint-disable-line camelcase
     brand: string;
 }
 
@@ -52,7 +66,9 @@ function getUuid(): string {
 export function create(config: IConfig): void {
     // no trays on darwin
     if (process.platform === "darwin" || trayIcon) return;
-    const defaultIcon = nativeImage.createFromPath(config.icon_path);
+    const defaultIcon = nativeImage.createFromPath(
+        isMonochrome() ? config.monochrome_icon_path : config.color_icon_path,
+    );
 
     let guid: string | undefined;
     if (process.platform === "win32" && app.isPackaged) {