Update pull request template and add contributing guide for CLA

Update LICENCE files, package.json and readme.
Update file headers copyright and change licence to AGPL-3.0-only OR GPL-3.0-only
2026-02-06 05:42:08 -05:00 · 2024-09-05 20:07:21 +01:00 · 2024-09-05 19:14:04 +01:00 · 2024-09-05 18:51:53 +01:00
168 changed files with 8813 additions and 15186 deletions
--- a/.eslintrc-hak.js
+++ b/.eslintrc-hak.js
@@ -0,0 +1,22 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: [".eslintrc.js"],
+    parserOptions: {
+        project: ["hak/tsconfig.json"],
+    },
+    overrides: [
+        {
+            files: ["hak/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};
--- a/.eslintrc-scripts.js
+++ b/.eslintrc-scripts.js
@@ -0,0 +1,22 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: [".eslintrc.js"],
+    parserOptions: {
+        project: ["scripts/tsconfig.json"],
+    },
+    overrides: [
+        {
+            files: ["scripts/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};
--- a/.eslintrc-test.js
+++ b/.eslintrc-test.js
@@ -0,0 +1,22 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: [".eslintrc.js"],
+    parserOptions: {
+        project: ["playwright/tsconfig.json"],
+    },
+    overrides: [
+        {
+            files: ["playwright/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};
--- a/.eslintrc.cjs
+++ b/.eslintrc.cjs
@@ -1,88 +0,0 @@
-module.exports = {
-    plugins: ["matrix-org", "n"],
-    extends: ["plugin:matrix-org/javascript"],
-    parserOptions: {
-        ecmaVersion: 2021,
-        project: ["tsconfig.json"],
-    },
-    env: {
-        es6: true,
-        node: true,
-        // we also have some browser code (ie. the preload script)
-        browser: true,
-    },
-    // NOTE: These rules are frozen and new rules should not be added here.
-    // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
-    rules: {
-        "quotes": "off",
-        "indent": "off",
-        "prefer-promise-reject-errors": "off",
-        "no-async-promise-executor": "off",
-
-        "n/file-extension-in-import": ["error", "always"],
-        "unicorn/prefer-node-protocol": ["error"],
-    },
-    overrides: [
-        {
-            files: ["src/**/*.ts"],
-            extends: ["plugin:matrix-org/typescript"],
-            rules: {
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "quotes": "off",
-
-                "@typescript-eslint/no-explicit-any": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-            },
-        },
-        {
-            files: ["hak/**/*.ts"],
-            extends: ["plugin:matrix-org/typescript"],
-            parserOptions: {
-                project: ["hak/tsconfig.json"],
-            },
-            rules: {
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "quotes": "off",
-
-                "@typescript-eslint/no-explicit-any": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-            },
-        },
-        {
-            files: ["scripts/**/*.ts"],
-            extends: ["plugin:matrix-org/typescript"],
-            parserOptions: {
-                project: ["scripts/tsconfig.json"],
-            },
-            rules: {
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "quotes": "off",
-
-                "@typescript-eslint/no-explicit-any": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-            },
-        },
-        {
-            files: ["playwright/**/*.ts"],
-            extends: ["plugin:matrix-org/typescript"],
-            parserOptions: {
-                project: ["playwright/tsconfig.json"],
-            },
-            rules: {
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "quotes": "off",
-
-                "@typescript-eslint/no-explicit-any": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-            },
-        },
-    ],
-};
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -0,0 +1,37 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: ["plugin:matrix-org/javascript"],
+    parserOptions: {
+        ecmaVersion: 2021,
+        project: ["tsconfig.json"],
+    },
+    env: {
+        es6: true,
+        node: true,
+        // we also have some browser code (ie. the preload script)
+        browser: true,
+    },
+    // NOTE: These rules are frozen and new rules should not be added here.
+    // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
+    rules: {
+        "quotes": "off",
+        "indent": "off",
+        "prefer-promise-reject-errors": "off",
+        "no-async-promise-executor": "off",
+    },
+    overrides: [
+        {
+            files: ["src/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,5 +1,5 @@
 *                         @element-hq/element-web-reviewers
 /.github/workflows/**     @element-hq/element-web-team
 /package.json             @element-hq/element-web-team
-/pnpm-lock.yaml           @element-hq/element-web-team
+/yarn.lock                @element-hq/element-web-team
 /src/i18n/strings
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1 @@
 blank_issues_enabled: false
-contact_links:
-    - name: Bug report for the Element flatpak app
-      url: https://github.com/flathub/im.riot.Riot/issues
-      about: Please file bugs with the Flatpak application on the respective repository.
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -2,7 +2,7 @@

 ## Checklist

- [ ] Ensure your code works with manual testing.
- [ ] New or updated `public`/`exported` symbols have accurate [TSDoc](https://tsdoc.org/) documentation.
- [ ] Linter and other CI checks pass.
- [ ] I have licensed the changes to Element by completing the [Contributor License Agreement (CLA)](https://cla-assistant.io/element-hq/element-desktop)
+-   [ ] Ensure your code works with manual testing.
+-   [ ] New or updated `public`/`exported` symbols have accurate [TSDoc](https://tsdoc.org/) documentation.
+-   [ ] Linter and other CI checks pass.
+-   [ ] Changes are licensed to Element under a Contributor License Agreement (CLA) (see [CONTRIBUTING.md](https://github.com/vector-im/element-web/blob/develop/CONTRIBUTING.md)).
--- a/.github/SSLcom-sandbox.crt
+++ b/.github/SSLcom-sandbox.crt
@@ -1,35 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIGBzCCA++gAwIBAgIIaI6ivggL++4wDQYJKoZIhvcNAQELBQAwgZAxCzAJBgNV
-BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
-CgwPU1NMIENvcnBvcmF0aW9uMUUwQwYDVQQDDDxTU0wuY29tIEVWIFJvb3QgQ2Vy
-dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyIC0gRGV2ZWxvcG1lbnQwHhcNMTgw
-MTE2MTIxNjM2WhcNNDMwMTE1MTIxNjM2WjCBkDELMAkGA1UEBhMCVVMxDjAMBgNV
-BAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9y
-YXRpb24xRTBDBgNVBAMMPFNTTC5jb20gRVYgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1
-dGhvcml0eSBSU0EgUjIgLSBEZXZlbG9wbWVudDCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAK/qcD65JCkueKp0+KXG2kAw8euDHuraLR3lJoUFz4ilGK1M
-t+RjSuY6dHQw8ku7TnW9ejWoSFjCBSDx7tP/fzOwOxmBW6+F1NDuV/IaUtn3G2lk
-CZglVk9z3n1HuWDN10xNiLoo5nzeIlvNAoDbXDGhI4Y6Z0qouAIS607JpJMWHOqZ
-OUiiOuM11gI5Kz9GtVttXCjRmwlkU8WiJVIUuVedQAQt2FChrzNQewGFFi0uIau/
-wFRclx6hd4JRIImC6VMJd9lcitWsqMcM94pD3fX2ozNgWX+MVlmcDYFSN9Sv8tG4
-yCj4ONS8HZGzbxeyQXJhEJSi2FnBi0j6MD/d4DNFj0hCg9wz3fgVLDGCO0pNMO0Y
-oXdrzfoj1/zEv0Ibgh7zKG2JHkPfapn3ExFI5d6xi66u5tPVI8cvLxqrgybRPs7Z
-y1dQA7ew3LyTPAHoGtbTMvewtx1TkTtRxxhRRm0l58owqSVbSYrixFtosNobCERo
-uiknaQqoY1ZDsdKsaqFoZDbntNRYhN3Ea4OPWVqDUU5ZPz9MTIRAi3MIq854yyQo
-BjX9nv+kYa+Esr19pxUW0z7BWFhbXsMVpt0QMVyhwgzXvEreaZHFwHHaGb9d5x5P
-VBDhsigMmtzBk9NlbCsy+uGXWHgZA/DVefueEq0sv38VoU30uYa5Tj0FLm09AgMB
-AAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUI9PCucv3G9fRoTDu
-ZQ4Hw6g4PkIwHQYDVR0OBBYEFCPTwrnL9xvX0aEw7mUOB8OoOD5CMA4GA1UdDwEB
-/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAk43CCrC0Zbvi7YUsSePKi+KzvyQ9
-mjKa5NBU/A5/sLeZS3R+wqCX7l5euYVDsUuNgNVD/QL9jNIonuHBrvKaxkmqxE1r
-IcDEaUdjy2lQ0uqD7UDoS3ctrjGkPpUahrTdr3gaKcQBtUhn9v4Y2OBm6J1hDVwI
-CIKcxIzRv6AUpApOtk+++m5tzDU48t8+GzrVl1hkspSYcumA+zuHllbPDL1ADdo5
-kK/bBQtZrGqzPqKzeqaB1A5Wm0Igwf++7nyzdKNdjxtv907D9vg8EB4Swavuv/Ne
-5/jbpI32pz0NIzzSl5ARAHuFhILsO/cEAlloDoTHzibHqFDIeU9/59HMUsJYMOtD
-Ii0/LmQ6dBE4TeukCCLJwtkFYZ2eBgDjF/LHBB+z/UBs4milRgwx+Pe5UDUEjtGe
-G/XMVnTSKZTy9jMaXJD5EmfP+Cfh8EEgFgjg4AmLUbEo9gXzPxyXSLgd8JGSsjg8
-EV/Ri4Mmmt4XUwlSVvEOezxxDGd17gwbottCIC+rqPHonHkGmKpLMH80Bk0uOOCs
-ui1oVwSifMyIcudgCcOfRLUf/f2j2NW7N7E7Vw/Zqfn+pqp/EG0KCqOM2vfJAc0s
-u3rSrOJZGtB6txgtmTjoadxApWf4U/FCi3uArt6gS5MJqZjuiRNXs/K3SlSAqLGl
-5UiG52ew+VdBHzE=
-----END CERTIFICATE-----
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -7,12 +7,10 @@ on:
        branches:
            - develop

-permissions: {} # We use ELEMENT_BOT_TOKEN instead
-
 jobs:
    backport:
        name: Backport
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        # Only react to merged PRs for security reasons.
        # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
        if: >
--- a/.github/workflows/build_and_deploy.yaml
+++ b/.github/workflows/build_and_deploy.yaml
@@ -41,12 +41,9 @@ run-name: Element ${{ inputs.mode != 'release' && github.event_name != 'release'
 concurrency: ${{ github.workflow }}
 env:
    R2_BUCKET: ${{ vars.R2_BUCKET }}
-permissions: {} # Uses ELEMENT_BOT_TOKEN
 jobs:
    prepare:
        uses: ./.github/workflows/build_prepare.yaml
-        permissions:
-            contents: read
        with:
            config: element.io/${{ inputs.mode || (github.event_name == 'release' && 'release') || 'nightly' }}
            version: ${{ (inputs.mode != 'release' && github.event_name != 'release') && 'develop' || '' }}
@@ -56,28 +53,13 @@ jobs:
            CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
            CF_R2_TOKEN: ${{ secrets.CF_R2_TOKEN }}

-    trigger-pro-pipeline:
-        name: Trigger Pro pipeline
-        needs: prepare
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
-              with:
-                  repository: element-hq/element-web-pro
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  event-type: trigger-pipeline
-                  client-payload: |-
-                      {
-                          "base-ref": "${{ github.ref_name }}"
-                      }
-
    windows:
        if: github.event_name != 'workflow_dispatch' || inputs.windows
        needs: prepare
        name: Windows ${{ matrix.arch }}
        strategy:
            matrix:
-                arch: [x64, arm64]
+                arch: [ia32, x64]
        uses: ./.github/workflows/build_windows.yaml
        secrets: inherit
        with:
@@ -107,6 +89,7 @@ jobs:
        uses: ./.github/workflows/build_linux.yaml
        with:
            arch: ${{ matrix.arch }}
+            config: ${{ needs.prepare.outputs.config }}
            sqlcipher: ${{ matrix.sqlcipher }}
            version: ${{ needs.prepare.outputs.nightly-version }}

@@ -116,20 +99,18 @@ jobs:
            - macos
            - linux
            - windows
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
        if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
        environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
        steps:
            - name: Download artifacts
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@v4

            - name: Prepare artifacts for deployment
              run: |
-                  set -ex
-
                  # Windows
-                  for arch in x64 arm64
+                  for arch in x64 ia32 arm64
                  do
                      if [ -d "win-$arch" ]; then
                          mkdir -p packages.element.io/{install,update}/win32/$arch
@@ -161,28 +142,24 @@ jobs:
            - name: "[Nightly] Strip version from installer file"
              if: needs.prepare.outputs.nightly-version != ''
              run: |
-                  set -ex
-
                  # Windows
-                  for arch in x64 arm64
+                  for arch in x64 ia32 arm64
                  do
-                      if [ -d "win-$arch" ]; then mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe; fi
+                      [ -d "win-$arch" ] && mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe
                  done

                  # macOS
-                  if [ -d macos ]; then mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg; fi
+                  [ -d macos ] && mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg

                  # Linux
-                  if [ -d linux-amd64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz; fi
-                  if [ -d linux-arm64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz; fi
+                  [ -d linux-amd64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz
+                  [ -d linux-arm64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz

            - name: "[Release] Prepare release latest symlink"
              if: needs.prepare.outputs.nightly-version == ''
              run: |
-                  set -ex
-
                  # Windows
-                  for arch in x64 arm64
+                  for arch in x64 ia32 arm64
                  do
                      if [ -d "win-$arch" ]; then
                          pushd packages.element.io/install/win32/$arch
@@ -212,17 +189,15 @@ jobs:

            - name: Stash packages.element.io
              if: needs.prepare.outputs.deploy == 'false'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@v4
              with:
                  name: packages.element.io
                  path: packages.element.io

-            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
            - name: Deploy artifacts
              if: needs.prepare.outputs.deploy == 'true'
              run: |
-                  set -x
-                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto --checksum-algorithm CRC32
+                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto
              env:
                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
@@ -231,7 +206,7 @@ jobs:

            - name: Notify packages.element.io of new files
              if: needs.prepare.outputs.deploy == 'true'
-              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
+              uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  repository: element-hq/packages.element.io
@@ -241,8 +216,6 @@ jobs:
              id: deb
              if: needs.linux.result == 'success'
              run: |
-                  set -x
-
                  for arch in amd64 arm64
                  do
                      echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
@@ -250,7 +223,7 @@ jobs:

            - name: Stash debs
              if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@v4
              with:
                  name: debs
                  path: |
@@ -279,7 +252,7 @@ jobs:

    deploy-ess:
        needs: deploy
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        name: Deploy builds to ESS
        if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
        env:
@@ -289,21 +262,19 @@ jobs:
            id-token: write # This is required for requesting the JWT
        steps:
            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
+              uses: aws-actions/configure-aws-credentials@v4
              with:
                  role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
                  role-session-name: githubaction-run-${{ github.run_id }}
                  aws-region: ${{ env.AWS_REGION }}

            - name: Download artifacts
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@v4
              with:
                  pattern: win-*

            - name: Copy files to S3
              run: |
-                  set -x
-
                  PREFIX="${VERSION%.*}"
                  for file in win-*/*.msi; do
                      filename=$(basename "$file")
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -6,16 +6,12 @@ on:
 concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true
-permissions: {} # No permissions required
 jobs:
    fetch:
        uses: ./.github/workflows/build_prepare.yaml
-        permissions:
-            contents: read
        with:
-            config: ${{ (github.event.pull_request.base.ref || github.ref_name) == 'develop' && 'element.io/nightly' || 'element.io/release' }}
-            version: ${{ (github.event.pull_request.base.ref || github.ref_name) == 'develop' && 'develop' || '' }}
-            branch-matching: true
+            config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
+            version: ${{ github.event.pull_request.base.ref == 'develop' && 'develop' || '' }}

    windows:
        needs: fetch
@@ -23,10 +19,9 @@ jobs:
        uses: ./.github/workflows/build_windows.yaml
        strategy:
            matrix:
-                arch: [x64, ia32, arm64]
+                arch: [x64, ia32]
        with:
            arch: ${{ matrix.arch }}
-            blob_report: true

    linux:
        needs: fetch
@@ -37,50 +32,123 @@ jobs:
                sqlcipher: [system, static]
                arch: [amd64, arm64]
        with:
+            config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
            sqlcipher: ${{ matrix.sqlcipher }}
            arch: ${{ matrix.arch }}
-            blob_report: true

    macos:
        needs: fetch
        name: macOS
        uses: ./.github/workflows/build_macos.yaml
-        with:
-            blob_report: true

-    tests-done:
-        needs: [windows, linux, macos]
-        runs-on: ubuntu-24.04
-        if: ${{ !cancelled() }}
+    test:
+        needs:
+            - macos
+            - linux
+            - windows
+        strategy:
+            matrix:
+                include:
+                    - name: macOS Universal
+                      os: macos-latest
+                      artifact: macos
+                      executable: "/Users/runner/Applications/Element.app/Contents/MacOS/Element"
+                      # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
+                      # read-only and thus would not allow us to override the fuses as is required for Playwright.
+                      prepare_cmd: |
+                          hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
+                          rsync -a /Volumes/Element/Element.app ~/Applications/ &&
+                          hdiutil detach /Volumes/Element
+                    - name: "Linux (amd64) (sqlcipher: system)"
+                      os: ubuntu-latest
+                      artifact: linux-amd64-sqlcipher-system
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
+                    - name: "Linux (amd64) (sqlcipher: static)"
+                      os: ubuntu-latest
+                      artifact: linux-amd64-sqlcipher-static
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
+                    - name: "Linux (arm64) (sqlcipher: system)"
+                      os: dind-l-arm64
+                      artifact: linux-arm64-sqlcipher-system
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
+                    - name: "Linux (arm64) (sqlcipher: static)"
+                      os: dind-l-arm64
+                      artifact: linux-arm64-sqlcipher-static
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
+                    - name: Windows (x86)
+                      os: windows-latest
+                      artifact: win-ia32
+                      executable: "./dist/win-ia32-unpacked/Element.exe"
+                    - name: Windows (x64)
+                      os: windows-latest
+                      artifact: win-x64
+                      executable: "./dist/win-unpacked/Element.exe"
+        name: Test ${{ matrix.name }}
+        runs-on: ${{ matrix.os }}
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            # Workaround for self-hosted runners lacking yarn
+            - name: Install Yarn
+              if: runner.environment == 'self-hosted'
+              run: |
+                  # Sanity check that the arch is arm64 as we expect
+                  [[ $(uname -p) == "aarch64" ]] || exit 1

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+                  sudo apt-get -qq update
+                  sudo apt-get install -y curl
+                  curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
+                  chmod +x $HOME/bin/yarn
+                  echo "$HOME/bin" >> $GITHUB_PATH
+
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
              with:
-                  cache: "pnpm"
-                  node-version: "lts/*"
+                  node-version-file: package.json
+                  cache: "yarn"

-            - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"

-            - name: Download blob reports from GitHub Actions Artifacts
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@v4
              with:
-                  pattern: blob-report-*
-                  path: all-blob-reports
-                  merge-multiple: true
+                  name: ${{ matrix.artifact }}
+                  path: dist

-            - name: Merge into HTML Report
-              run: pnpm playwright merge-reports -c ./playwright.config.ts --reporter=html ./all-blob-reports
+            - name: Prepare for tests
+              run: ${{ matrix.prepare_cmd }}
+              if: matrix.prepare_cmd
+
+            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
+            # it to be enabled to test Electron apps, so turn it back on.
+            - name: Set EnableNodeCliInspectArguments fuse enabled
+              run: $RUN_AS npx @electron/fuses write --app ${{ matrix.executable }} EnableNodeCliInspectArguments=on
+              shell: bash
+              env:
+                  # We need sudo on Linux as it is installed in /opt/
+                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
+
+            - name: Workaround macOS GHA permission issues
+              if: matrix.os == 'macos-latest'
+              run: |
+                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
+                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/opt/off/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
+
+            - name: Run tests
+              uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
+              timeout-minutes: 5
+              with:
+                  run: "yarn test ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }}"
+              env:
+                  ELEMENT_DESKTOP_EXECUTABLE: ${{ matrix.executable }}

            - name: Upload HTML report
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@v4
              with:
-                  name: html-report
-                  path: playwright-report
+                  name: ${{ matrix.artifact }}-test
+                  path: playwright/html-report
                  retention-days: 14
-
-            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
-              run: exit 1
--- a/.github/workflows/build_linux.yaml
+++ b/.github/workflows/build_linux.yaml
@@ -4,14 +4,14 @@
 on:
    workflow_call:
        inputs:
-            ref:
-                type: string
-                required: false
-                description: "The git ref to checkout, defaults to the default branch"
            arch:
                type: string
                required: true
                description: "The architecture to build for, one of 'amd64' | 'arm64'"
+            config:
+                type: string
+                required: true
+                description: "The config directory to use"
            version:
                type: string
                required: false
@@ -20,66 +20,37 @@ on:
                type: string
                required: true
                description: "How to link sqlcipher, one of 'system' | 'static'"
-            blob_report:
-                type: boolean
-                required: false
-                description: "Whether to run the blob report"
-            prepare-artifact-name:
-                type: string
-                required: false
-                description: |
-                    The name of the prepare artifact to use, defaults to 'webapp'.
-                    The artifact must contain the following:
-                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
-                    + electronVersion - the version of electron to use for cache keying
-                    + hakHash - the hash of the .hak directory to use for cache keying
-                    + changelog.Debian - the changelog file to embed in the Debian package  
-                    + variant.json - the variant configuration to use for the build
-
-                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
-                    for example icons in the `build/` directory to override the app icons.
-                default: "webapp"
-            test:
-                type: boolean
-                required: false
-                default: true
-                description: "Whether to run the test stage after building"
-            test-args:
-                type: string
-                required: false
-                description: "Additional arguments to pass to playwright"
-            runs-on:
-                type: string
-                required: false
-                description: "The runner image to use, normally set for you, may be needed for running in private repos."
-            artifact-prefix:
-                type: string
-                required: false
-                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
-                default: ""
-            targets:
-                type: string
-                required: false
-                description: "List of targets to build"
-                default: "tar.gz deb"
 env:
    SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
-    MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
-permissions: {} # No permissions required
 jobs:
-    build:
-        name: Build Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
-        # We build on native infrastructure as matrix-seshat fails to cross-compile properly
-        # https://github.com/matrix-org/seshat/issues/135
-        runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+    # We build the hak files on native infrastructure as matrix-seshat fails to cross-compile properly
+    # https://github.com/matrix-org/seshat/issues/135
+    hak:
+        runs-on: ${{ inputs.arch == 'arm64' && 'dind-l-arm64' || 'ubuntu-latest' }}
        env:
            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
+        outputs:
+            cache-key: ${{ steps.cache-key.outputs.key }}
+            arch: ${{ steps.config.outputs.arch }}
+            build-args: ${{ steps.config.outputs.build-args }}
        steps:
+            # Workaround for self-hosted runners lacking tools
+            - name: Install missing tools
+              if: runner.environment == 'self-hosted'
+              run: |
+                  # Sanity check that the arch is arm64 as we expect
+                  [[ $(uname -p) == "aarch64" ]] || exit 1
+
+                  sudo apt-get -qq update
+                  # curl for yarn download, git for tj-actions/changed-files, zstd for actions/cache
+                  sudo apt-get install -y curl git zstd
+                  curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
+                  chmod +x $HOME/bin/yarn
+                  echo "$HOME/bin" >> $GITHUB_PATH
+
            - name: Resolve docker image tag for push
              if: github.event_name == 'push'
-              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:$REF" >> $GITHUB_ENV
-              env:
-                  REF: ${{ inputs.ref || github.ref_name }}
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:$GITHUB_REF_NAME" >> $GITHUB_ENV
            - name: Resolve docker image tag for release
              if: github.event_name == 'release'
              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:staging" >> $GITHUB_ENV
@@ -105,49 +76,53 @@ jobs:
                        }
                      }

-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-              with:
-                  repository: element-hq/element-desktop
-                  ref: ${{ inputs.ref }}
+            - uses: actions/checkout@v4

-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@v4
              with:
-                  name: ${{ inputs.prepare-artifact-name }}
+                  name: webapp
+
+            - name: Calculate cache key
+              id: cache-key
+              run: |
+                  echo "key=$CACHE_KEY" >> $GITHUB_OUTPUT
+              env:
+                  CACHE_KEY: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}

            - name: Cache .hak
              id: cache
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@v4
              with:
-                  key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
+                  key: ${{ steps.cache-key.outputs.key }}
                  path: |
                      ./.hak

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
-                  node-version-file: .node-version
-                  cache: "pnpm"
+                  node-version-file: package.json
+                  cache: "yarn"
              env:
                  # Workaround for https://github.com/actions/setup-node/issues/317
                  FORCE_COLOR: 0

+            # Does not need branch matching as only analyses this layer
            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

            - name: "Get modified files"
              id: changed_files
-              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-desktop'
-              uses: tj-actions/changed-files@823fcebdb31bb35fdf2229d9f769b400309430d0 # v46
+              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request'
+              uses: tj-actions/changed-files@e9772d140489982e0e3704fea5ee93d536f1e275 # v45
              with:
                  files: |
                      dockerbuild/**

            # This allows contributors to test changes to the dockerbuild image within a pull request
            - name: Build docker image
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
              if: steps.changed_files.outputs.any_modified == 'true'
              with:
-                  file: dockerbuild/Dockerfile
+                  context: dockerbuild
                  load: true
                  platforms: linux/${{ inputs.arch }}
                  tags: ${{ env.HAK_DOCKER_IMAGE }}
@@ -159,18 +134,53 @@ jobs:
                    -v ${{ github.workspace }}:/work -w /work \
                    -e SQLCIPHER_BUNDLED \
                    $HAK_DOCKER_IMAGE \
-                    pnpm build:native
+                    yarn build:native

-            - name: Fix permissions on .hak
-              run: sudo chown -R $USER:$USER .hak
-
-            - name: Check native libraries in hak dependencies
+            - name: Check native libraries
              run: |
                  shopt -s globstar

                  for filename in ./.hak/hakModules/**/*.node; do
                      ./scripts/glibc-check.sh $filename
                  done
+              env:
+                  MAX_VER: 2.28 # buster-era glibc
+
+    build:
+        needs: hak
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: webapp
+
+            - name: Load .hak
+              id: cache
+              uses: actions/cache/restore@v4
+              with:
+                  key: ${{ needs.hak.outputs.cache-key }}
+                  fail-on-cache-miss: true
+                  path: |
+                      ./.hak
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+              env:
+                  # Workaround for https://github.com/actions/setup-node/issues/317
+                  FORCE_COLOR: 0
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: "[Nightly] Resolve version"
+              if: inputs.version != ''
+              run: |
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV

            - name: Generate debian files and arguments
              run: |
@@ -179,13 +189,7 @@ jobs:
                  fi

            - name: Build App
-              run: pnpm build --publish never ${{ steps.config.outputs.build-args }} -l ${{ inputs.targets }}
-              env:
-                  VARIANT_PATH: variant.json
-                  # Only set for Nightly builds
-                  VERSION: ${{ inputs.version }}
-                  # Workaround for https://github.com/electron-userland/electron-builder/issues/5721
-                  USE_HARD_LINKS: false
+              run: yarn build --publish never -l ${{ needs.hak.outputs.build-args }}

            - name: Check native libraries
              run: |
@@ -193,9 +197,11 @@ jobs:
                  shopt -s globstar

                  FILES=$(file dist/**/*.node)
-                  echo $FILES
+                  echo "$FILES"

-                  ! echo "$FILES" | grep -v "$ARCH"
+                  if [ grep -v "$ARCH" ]; then
+                      exit 1
+                  fi

                  LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
                  echo "$LIBS"
@@ -211,52 +217,14 @@ jobs:

                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
              env:
-                  ARCH: ${{ steps.config.outputs.arch }}
+                  ARCH: ${{ needs.hak.outputs.arch }}

            # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
            - name: Upload Artifacts
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@v4
              with:
-                  name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+                  name: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
                  path: |
                      dist
                      !dist/*-unpacked/**
                  retention-days: 1
-
-            - name: Assert deb is present and valid
-              if: contains(inputs.targets, 'deb')
-              run: |
-                  test -f ./dist/element-desktop*$ARCH.deb
-
-                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
-                  echo "deb listing: "
-                  echo "$DEB_LISTING"
-                  ! echo "$DEB_LISTING" | grep '^h'
-              env:
-                  ARCH: ${{ inputs.arch }}
-
-            - name: Assert tar.gz is present
-              if: contains(inputs.targets, 'tar.gz')
-              run: |
-                  test -f ./dist/element-desktop*.tar.gz
-
-                  TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
-                  echo "tar.gz listing: "
-                  echo "$TAR_GZ_LISTING"
-                  ! echo "$TAR_GZ_LISTING" | grep '^h'
-
-    test:
-        name: Test Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
-        needs: build
-        if: inputs.test && contains(inputs.targets, 'deb')
-        uses: ./.github/workflows/build_test.yaml
-        with:
-            project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
-            artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
-            runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
-            executable: /opt/Element*/element-desktop*
-            prepare_cmd: |
-                sudo apt-get -qq update
-                sudo apt install ./dist/*.deb
-            blob_report: ${{ inputs.blob_report }}
-            args: ${{ inputs.test-args }}
--- a/.github/workflows/build_macos.yaml
+++ b/.github/workflows/build_macos.yaml
@@ -15,10 +15,6 @@ on:
            APPLE_CSC_LINK:
                required: false
        inputs:
-            ref:
-                type: string
-                required: false
-                description: "The git ref to checkout, defaults to the default branch"
            version:
                type: string
                required: false
@@ -31,66 +27,20 @@ on:
                type: string
                required: false
                description: "The URL to which the output will be deployed."
-            blob_report:
-                type: boolean
-                required: false
-                description: "Whether to run the blob report"
-            prepare-artifact-name:
-                type: string
-                required: false
-                description: |
-                    The name of the prepare artifact to use, defaults to 'webapp'.
-                    The artifact must contain the following:
-                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
-                    + electronVersion - the version of electron to use for cache keying
-                    + hakHash - the hash of the .hak directory to use for cache keying
-                    + variant.json - the variant configuration to use for the build
-
-                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
-                    for example icons in the `build/` directory to override the app icons.
-                default: "webapp"
-            test:
-                type: boolean
-                required: false
-                default: true
-                description: "Whether to run the test stage after building"
-            test-args:
-                type: string
-                required: false
-                description: "Additional arguments to pass to playwright"
-            artifact-prefix:
-                type: string
-                required: false
-                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
-                default: ""
-            targets:
-                type: string
-                required: false
-                description: "List of targets to build"
-                default: "dmg zip"
-permissions: {} # No permissions required
 jobs:
    build:
-        name: Build macOS Universal
-        runs-on: macos-15 # M1
+        runs-on: macos-14 # M1
        environment: ${{ inputs.sign && 'packages.element.io' || '' }}
        steps:
-            - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1
-              with:
-                  xcode-version: latest-stable
+            - uses: actions/checkout@v4

-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/download-artifact@v4
              with:
-                  repository: element-hq/element-desktop
-                  ref: ${{ inputs.ref }}
-
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
-              with:
-                  name: ${{ inputs.prepare-artifact-name }}
+                  name: webapp

            - name: Cache .hak
              id: cache
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@v4
              with:
                  key: ${{ runner.os }}-${{ hashFiles('hakHash', 'electronVersion') }}
                  path: |
@@ -105,41 +55,42 @@ jobs:
                  rustup target add x86_64-apple-darwin

            # M1 macos-14 comes without Python preinstalled
-            - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+            - uses: actions/setup-python@v5
              with:
-                  python-version: "3.13"
+                  python-version: "3.12"

-            # Install Quartz for DMG badges
-            # https://github.com/electron-userland/electron-builder/issues/9511#issuecomment-3774092888
-            - run: sudo pip3 install pyobjc-framework-Quartz
-
-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
-                  node-version-file: .node-version
-                  cache: "pnpm"
+                  node-version-file: package.json
+                  cache: "yarn"

+            # Does not need branch matching as only analyses this layer
            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

            - name: Build Natives
              if: steps.cache.outputs.cache-hit != 'true'
-              run: pnpm build:native:universal
+              run: |
+                  # Python 3.12 drops distutils which keytar relies on
+                  pip3 install setuptools
+                  yarn build:native:universal
+
+            - name: "[Nightly] Resolve version"
+              if: inputs.version != ''
+              run: |
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV

            # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
            - name: "[Signed] Build App"
              if: inputs.sign != ''
              run: |
-                  pnpm build:universal --publish never -m ${{ inputs.targets }}
+                  yarn build:universal --publish never
              env:
-                  APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+                  ED_NOTARYTOOL_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
                  APPLE_ID: ${{ secrets.APPLE_ID }}
                  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
                  CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
-                  VARIANT_PATH: variant.json
-                  # Only set for Nightly builds
-                  VERSION: ${{ inputs.version }}

            - name: Check app was signed & notarised successfully
              if: inputs.sign != ''
@@ -152,10 +103,9 @@ jobs:
            - name: "[Unsigned] Build App"
              if: inputs.sign == ''
              run: |
-                  pnpm build:universal --publish never -m ${{ inputs.targets }}
+                  yarn build:universal --publish never
              env:
                  CSC_IDENTITY_AUTO_DISCOVERY: false
-                  VARIANT_PATH: variant.json

            - name: Generate releases.json
              if: inputs.base-url
@@ -185,39 +135,10 @@ jobs:

            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
            - name: Upload Artifacts
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@v4
              with:
-                  name: ${{ inputs.artifact-prefix }}macos
+                  name: macos
                  path: |
                      dist
                      !dist/mac-universal/**
                  retention-days: 1
-
-            - name: Assert zip is present
-              if: contains(inputs.targets, 'zip')
-              run: |
-                  test -f ./dist/Element*-mac.zip
-
-            - name: Assert dmg is present
-              if: contains(inputs.targets, 'dmg')
-              run: |
-                  test -f ./dist/Element*.dmg
-
-    test:
-        name: Test macOS Universal
-        needs: build
-        if: inputs.test && contains(inputs.targets, 'dmg')
-        uses: ./.github/workflows/build_test.yaml
-        with:
-            project: macos
-            artifact: ${{ inputs.artifact-prefix }}macos
-            runs-on: macos-14
-            executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
-            # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
-            # read-only and thus would not allow us to override the fuses as is required for Playwright.
-            prepare_cmd: |
-                hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
-                rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
-                hdiutil detach /Volumes/Element
-            blob_report: ${{ inputs.blob_report }}
-            args: ${{ inputs.test-args }}
--- a/.github/workflows/build_prepare.yaml
+++ b/.github/workflows/build_prepare.yaml
@@ -20,11 +20,6 @@ on:
                required: false
                default: false
                description: "Whether the build should be deployed to production"
-            branch-matching:
-                type: boolean
-                required: false
-                default: false
-                description: "Whether the branch name should be matched to find the element-web commit"
        secrets:
            # Required if `nightly` is set
            CF_R2_ACCESS_KEY_ID:
@@ -39,64 +34,38 @@ on:
            packages-dir:
                description: "The directory non-deb packages for this run should live in within packages.element.io"
                value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
-            # This is just a simple pass-through of the input to simplify reuse of complex inline conditions
+            # These are just simple pass-throughs of the input to simplify reuse of complex inline conditions
+            config:
+                description: "The relative path to the config file for this run"
+                value: ${{ inputs.config }}
            deploy:
-                description: "Whether the build should be deployed to production"
+                description: "The relative path to the config file for this run"
                value: ${{ inputs.deploy }}
-permissions: {}
 jobs:
    prepare:
        name: Prepare
        environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
-        runs-on: ubuntu-24.04
-        permissions:
-            contents: read
+        runs-on: ubuntu-latest
        outputs:
            nightly-version: ${{ steps.versions.outputs.nightly }}
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
-                  node-version-file: .node-version
-                  cache: "pnpm"
+                  node-version-file: package.json
+                  cache: "yarn"

            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

-            - name: Fetch Element Web (matching branch)
-              id: branch-matching
-              if: inputs.branch-matching
-              continue-on-error: true
-              run: |
-                  scripts/branch-match.sh
-                  cp "$CONFIG_DIR/config.json" element-web/
-                  pnpm --cwd element-web install --frozen-lockfile
-                  pnpm --cwd element-web run build
-                  mv element-web/webapp .
-                  pnpm asar-webapp
-              env:
-                  # These must be set for branch-match.sh to get the right branch
-                  REPOSITORY: ${{ github.repository }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
-                  CONFIG_DIR: ${{ inputs.config }}
-
-            - name: Fetch Element Web (${{ inputs.version }})
-              if: steps.branch-matching.outcome == 'failure' || steps.branch-matching.outcome == 'skipped'
-              run: pnpm run fetch --noverify -d ${{ inputs.config }} ${{ inputs.version }}
-
-            - name: Copy variant config
-              run: cp "$CONFIG_DIR/build.json" variant.json
-              env:
-                  CONFIG_DIR: ${{ inputs.config }}
+            - name: Fetch Element Web
+              run: yarn run fetch --noverify -d ${{ inputs.config }} ${{ inputs.version }}

            # We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
            - name: Generate cache hash files
              run: |
-                  set -ex
-                  # Add --no-sandbox as otherwise it fails because the helper isn't setuid root. It's only getting the version.
-                  pnpm run --silent electron --no-sandbox --version > electronVersion
+                  yarn run --silent electron --version > electronVersion
                  cat package.json | jq -c .hakDependencies | sha1sum > hakHash
                  find hak -type f -print0 | xargs -0 sha1sum >> hakHash
                  find scripts/hak -type f -print0 | xargs -0 sha1sum >> hakHash
@@ -110,7 +79,7 @@ jobs:
                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-amd64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-arm64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/x64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
-                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/arm64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/ia32/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS

                  # Pick the greatest one
                  VERSION=$(cat VERSIONS | sort -uf | tail -n1)
@@ -157,7 +126,8 @@ jobs:
                  BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
                  WEBAPP_VERSION=$(./scripts/get-version.ts)
                  WEB_VERSION=${WEBAPP_VERSION:0:12}
-                  JS_VERSION=${WEBAPP_VERSION:16:12}
+                  REACT_VERSION=${WEBAPP_VERSION:19:12}
+                  JS_VERSION=${WEBAPP_VERSION:35:12}

                  echo "### Nightly build ${{ steps.versions.outputs.nightly }}" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
@@ -165,15 +135,16 @@ jobs:
                  echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
                  echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
                  echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
+                  echo "| React SDK   | [$REACT_VERSION](https://github.com/matrix-org/matrix-react-sdk/commit/$REACT_VERSION) |" >> $GITHUB_STEP_SUMMARY
                  echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@v4
              with:
                  name: webapp
                  retention-days: 1
                  path: |
                      webapp.asar
+                      package.json
                      electronVersion
                      hakHash
                      changelog.Debian
-                      variant.json
--- a/.github/workflows/build_test.yaml
+++ b/.github/workflows/build_test.yaml
@@ -1,102 +0,0 @@
-# This action helps run Playwright tests within one of the build_* stages.
-on:
-    workflow_call:
-        inputs:
-            runs-on:
-                type: string
-                required: true
-                description: "The runner image to use"
-            artifact:
-                type: string
-                required: true
-                description: "The name of the artifact to download"
-            project:
-                type: string
-                required: true
-                description: "The Playwright project to use for testing"
-            executable:
-                type: string
-                required: true
-                description: "Path to the executable to test"
-            prepare_cmd:
-                type: string
-                required: false
-                description: "Command to run to prepare the executable or environment for testing"
-            blob_report:
-                type: boolean
-                default: false
-                description: "Whether to upload a blob report instead of the HTML report"
-            args:
-                type: string
-                required: false
-                description: "Additional arguments to pass to playwright, for e.g. skipping specific tests"
-permissions: {}
-jobs:
-    test:
-        name: Test ${{ inputs.project }}
-        runs-on: ${{ inputs.runs-on }}
-        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-              with:
-                  repository: ${{ github.repository == 'element-hq/element-web-pro' && 'element-hq/element-desktop' || github.repository }}
-
-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
-              with:
-                  node-version-file: .node-version
-                  cache: "pnpm"
-
-            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
-
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
-              with:
-                  name: ${{ inputs.artifact }}
-                  path: dist
-
-            - name: Prepare for tests
-              run: ${{ inputs.prepare_cmd }}
-              if: inputs.prepare_cmd
-
-            - name: Expand executable path
-              id: executable
-              shell: bash
-              env:
-                  EXECUTABLE: ${{ inputs.executable }}
-              run: |
-                  FILES=($EXECUTABLE)
-                  echo "path=${FILES[0]}" >> $GITHUB_OUTPUT
-
-            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
-            # it to be enabled to test Electron apps, so turn it back on.
-            - name: Set EnableNodeCliInspectArguments fuse enabled
-              run: $RUN_AS npx @electron/fuses write --app "$EXECUTABLE" EnableNodeCliInspectArguments=on
-              shell: bash
-              env:
-                  # We need sudo on Linux as it is installed in /opt/
-                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
-                  EXECUTABLE: ${{ steps.executable.outputs.path }}
-
-            - name: Run tests
-              uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
-              timeout-minutes: 20
-              with:
-                  run: pnpm test --project=${{ inputs.project }} ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} ${{ inputs.blob_report == false && '--reporter=html' || '' }} ${{ inputs.args }}
-              env:
-                  ELEMENT_DESKTOP_EXECUTABLE: ${{ steps.executable.outputs.path }}
-
-            - name: Upload blob report
-              if: always() && inputs.blob_report
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-              with:
-                  name: blob-report-${{ inputs.artifact }}
-                  path: blob-report
-                  retention-days: 1
-
-            - name: Upload HTML report
-              if: always() && inputs.blob_report == false
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-              with:
-                  name: ${{ inputs.artifact }}-test
-                  path: playwright-report
-                  retention-days: 14
--- a/.github/workflows/build_windows.yaml
+++ b/.github/workflows/build_windows.yaml
@@ -2,9 +2,7 @@
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.

-# Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
-# We always sign using eSignerCKA to ensure it keeps working, but aside from release & nightlies we use demo credentials
-# which do not yield trusted signatures.
+# window-latest by default uses the pwsh shell which breaks codeSigningCert in the workflow
 defaults:
    run:
        shell: powershell
@@ -18,10 +16,6 @@ on:
            ESIGNER_USER_TOTP:
                required: false
        inputs:
-            ref:
-                type: string
-                required: false
-                description: "The git ref to checkout, defaults to the default branch"
            arch:
                type: string
                required: true
@@ -34,56 +28,12 @@ on:
                type: string
                required: false
                description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
-            blob_report:
-                type: boolean
-                required: false
-                description: "Whether to run the blob report"
-            prepare-artifact-name:
-                type: string
-                required: false
-                description: |
-                    The name of the prepare artifact to use, defaults to 'webapp'.
-                    The artifact must contain the following:
-                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
-                    + electronVersion - the version of electron to use for cache keying
-                    + hakHash - the hash of the .hak directory to use for cache keying
-                    + variant.json - the variant configuration to use for the build
-
-
-                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
-                    for example icons in the `build/` directory to override the app icons.
-                default: "webapp"
-            test:
-                type: boolean
-                required: false
-                default: true
-                description: "Whether to run the test stage after building"
-            test-runs-on:
-                type: string
-                required: false
-                description: "The runner image to use for testing, normally set for you, may be needed for running in private repos."
-            test-args:
-                type: string
-                required: false
-                description: "Additional arguments to pass to playwright"
-            artifact-prefix:
-                type: string
-                required: false
-                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
-                default: ""
-            targets:
-                type: string
-                required: false
-                description: "List of targets to build"
-                default: "squirrel msi"
-permissions: {} # No permissions required
 jobs:
    build:
-        name: Build Windows ${{ inputs.arch }}
-        runs-on: windows-2025
+        runs-on: windows-latest
        environment: ${{ inputs.sign && 'packages.element.io' || '' }}
        env:
-            SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
+            SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe"
        steps:
            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
              id: config
@@ -103,28 +53,29 @@ jobs:
                        "ia32": {
                          "target": "i686-pc-windows-msvc",
                          "build-args": "--ia32",
-                          "arch": "x86",
-                          "extra_config": "{\"user_notice\": {\"title\": \"Your desktop environment is unsupported.\",\"description\": \"Support for 32-bit Windows installations has ended. Transition to the web or mobile app for continued access.\"}}"
+                          "arch": "x86"
                        }
                      }

-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-              with:
-                  repository: element-hq/element-desktop
-                  ref: ${{ inputs.ref }}
+            - uses: actions/checkout@v4

-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@v4
              with:
-                  name: ${{ inputs.prepare-artifact-name }}
+                  name: webapp

            - name: Cache .hak
              id: cache
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@v4
              with:
                  key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
                  path: |
                      ./.hak

+            - name: Set up build tools
+              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+              with:
+                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
+
            # ActiveTCL package on choco is from 2015,
            # this one is newer but includes more than we need
            - name: Choco install tclsh
@@ -148,48 +99,23 @@ jobs:
                  rustup default stable
                  rustup target add ${{ steps.config.outputs.target }}

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
-                  node-version-file: .node-version
-                  cache: "pnpm"
+                  node-version-file: package.json
+                  cache: "yarn"

+            # Does not need branch matching as only analyses this layer
            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
-
-            - name: Insert config snippet
-              if: steps.config.outputs.extra_config != ''
-              shell: bash
-              run: |
-                  mkdir config-edit
-                  pnpm asar extract webapp.asar config-edit
-                  cd config-edit
-                  mv config.json old-config.json
-                  echo '${{ steps.config.outputs.extra_config }}' | jq -s '.[0] * .[1]' old-config.json - > config.json
-                  rm old-config.json
-                  cd ..
-                  rm webapp.asar
-                  pnpm asar pack config-edit/ webapp.asar
-
-            - name: Set up sqlcipher macros
-              if: steps.cache.outputs.cache-hit != 'true' && contains(inputs.arch, 'arm')
-              shell: pwsh
-              run: |
-                  echo "NCC=${{ github.workspace }}\scripts\cl.bat" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-
-            - name: Set up build tools
-              if: steps.cache.outputs.cache-hit != 'true'
-              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
-              with:
-                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
+              run: "yarn install --frozen-lockfile"

            - name: Build Natives
              if: steps.cache.outputs.cache-hit != 'true'
              run: |
                  refreshenv
-                  pnpm build:native --target ${{ steps.config.outputs.target }}
+                  yarn build:native --target ${{ steps.config.outputs.target }}

            - name: Install and configure eSigner CKA
+              if: inputs.sign
              run: |
                  Set-StrictMode -Version 'Latest'

@@ -207,13 +133,8 @@ jobs:
                  $LogConfig[0] = '<log4net threshold="OFF">'
                  $LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config

-                  # Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
-                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
-                      -mode ${{ vars.ESIGNER_MODE || 'sandbox' }} `
-                      -user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
-                      -pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
-                      -totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
-                      -key "${{ env.MASTER_KEY_FILE }}" -r
+                  # Configure
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config -mode product -user "${{ secrets.ESIGNER_USER_NAME }}" -pass "${{ secrets.ESIGNER_USER_PASSWORD }}" -totp "${{ secrets.ESIGNER_USER_TOTP }}" -key "${{ env.MASTER_KEY_FILE }}" -r
                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe load

@@ -232,65 +153,29 @@ jobs:
                  INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
                  MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key

-            - name: Build App
-              run: pnpm build --publish never ${{ steps.config.outputs.build-args }} -w ${{ inputs.targets }}
-              env:
-                  VARIANT_PATH: variant.json
-                  # Only set for Nightly builds
-                  # The windows packager relies on parsing this as semver, so we have to make it look like one.
-                  # This will give our update packages really stupid names, but we probably can't change that either
-                  # because squirrel windows parses them for the version too. We don't really care: nobody sees them.
-                  # We just give the installer a static name, so you'll just see this in the 'about' dialog.
-                  # Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
-                  VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
-
-            - name: Trust eSigner sandbox cert
-              if: inputs.sign == ''
+            - name: "[Nightly] Resolve version"
+              if: inputs.version != ''
+              shell: bash
              run: |
-                  Set-StrictMode -Version 'Latest'
-                  Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root -FilePath .github/SSLcom-sandbox.crt
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
+
+            # XXX: For whatever reason if we use `yarn build ...` it freezes, but splitting it into parts it is fine
+            - run: yarn run build:ts
+            - run: yarn run build:res
+
+            - name: Build App
+              run: |
+                  yarn electron-builder --publish never -w ${{ steps.config.outputs.build-args }}

            - name: Check app was signed successfully
+              if: inputs.sign != ''
              run: |
-                  Set-StrictMode -Version 'Latest'
-                  Get-ChildItem `
-                      -Recurse dist `
-                      -Include *.exe, *.msi `
-                  | ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
+                  . "$env:SIGNTOOL_PATH" verify /pa (get-item ./dist/squirrel-windows*/*.exe)

            - name: Upload Artifacts
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@v4
              with:
-                  name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
+                  name: win-${{ inputs.arch }}
                  path: |
                      dist
                  retention-days: 1
-
-            - name: Assert executable is present
-              run: |
-                  Test-Path './dist/win-*unpacked/Element*.exe'
-
-            - name: Assert all Squirrel files are present
-              if: contains(inputs.targets, 'squirrel')
-              run: |
-                  Test-Path './dist/squirrel-windows*/Element Setup*.exe'
-                  Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
-                  Test-Path './dist/squirrel-windows*/RELEASES'
-
-            - name: Assert MSI is present
-              if: contains(inputs.targets, 'msi')
-              run: |
-                  Test-Path './dist/Element*.msi'
-
-    test:
-        name: Test Windows ${{ inputs.arch }}
-        needs: build
-        if: inputs.test
-        uses: ./.github/workflows/build_test.yaml
-        with:
-            project: win-${{ inputs.arch }}
-            artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
-            runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
-            executable: ./dist/win*-unpacked/Element*.exe
-            blob_report: ${{ inputs.blob_report }}
-            args: ${{ inputs.test-args }}
--- a/.github/workflows/dockerbuild.yaml
+++ b/.github/workflows/dockerbuild.yaml
@@ -5,45 +5,30 @@ on:
        branches: [master, staging, develop]
        paths:
            - "dockerbuild/**"
-    pull_request:
 concurrency: ${{ github.workflow }}-${{ github.ref_name }}
 env:
    REGISTRY: ghcr.io
    IMAGE_NAME: ${{ github.repository }}-dockerbuild
-permissions: {}
 jobs:
    build:
        name: Docker Build
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@v4

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+              uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3

            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+              uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
              with:
                  install: true

-            - name: Build test image
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
-              with:
-                  file: dockerbuild/Dockerfile
-                  push: false
-                  load: true
-                  tags: element-desktop-dockerbuild
-                  platforms: linux/amd64
-
-            - name: Test image
-              run: docker run -v $PWD:/project element-desktop-dockerbuild pnpm install
-
            - name: Log in to the Container registry
-              uses: docker/login-action@3227f5311cb93ffd14d13e65d8cc400d30f4dd8a
-              if: github.event_name != 'pull_request'
+              uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
              with:
                  registry: ${{ env.REGISTRY }}
                  username: ${{ github.actor }}
@@ -51,19 +36,16 @@ jobs:

            - name: Extract metadata for Docker
              id: meta
-              if: github.event_name != 'pull_request'
-              uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+              uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
              with:
                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
                  tags: |
                      type=ref,event=branch
-                      type=ref,event=pr

            - name: Build and push Docker image
-              if: github.event_name != 'pull_request'
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
              with:
-                  file: dockerbuild/Dockerfile
+                  context: dockerbuild
                  push: true
                  tags: ${{ steps.meta.outputs.tags }}
                  labels: ${{ steps.meta.outputs.labels }}
--- a/.github/workflows/localazy_download.yaml
+++ b/.github/workflows/localazy_download.yaml
@@ -3,8 +3,6 @@ on:
    workflow_dispatch: {}
    schedule:
        - cron: "0 6 * * 1,3,5" # Every Monday, Wednesday and Friday at 6am UTC
-permissions:
-    pull-requests: write # needed to auto-approve PRs
 jobs:
    download:
        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
--- a/.github/workflows/localazy_upload.yaml
+++ b/.github/workflows/localazy_upload.yaml
@@ -4,7 +4,6 @@ on:
        branches: [develop]
        paths:
            - "src/i18n/strings/en_EN.json"
-permissions: {} # No permissions needed
 jobs:
    upload:
        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
--- a/.github/workflows/pull_request.yaml
+++ b/.github/workflows/pull_request.yaml
@@ -2,11 +2,8 @@ name: Pull Request
 on:
    pull_request_target:
        types: [opened, edited, labeled, unlabeled, synchronize]
-permissions: {}
 jobs:
    action:
        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
-        permissions:
-            pull-requests: write
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -4,11 +4,8 @@ on:
        branches: [staging]
    workflow_dispatch: {}
 concurrency: ${{ github.workflow }}
-permissions: {}
 jobs:
    draft:
        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
-        permissions:
-            contents: write
        with:
            include-changes: element-hq/element-web~$VERSION
--- a/.github/workflows/release-gitflow.yml
+++ b/.github/workflows/release-gitflow.yml
@@ -4,7 +4,6 @@ on:
    push:
        branches: [master]
 concurrency: ${{ github.repository }}-${{ github.workflow }}
-permissions: {} # Uses ELEMENT_BOT_TOKEN
 jobs:
    merge:
        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,15 +11,9 @@ on:
                    - rc
                    - final
 concurrency: ${{ github.workflow }}
-permissions: {}
 jobs:
    release:
        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
-        permissions:
-            contents: write
-            issues: write
-            pull-requests: read
-            id-token: write
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
            GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
@@ -32,9 +26,7 @@ jobs:
    check:
        name: Post release checks
        needs: release
-        runs-on: ubuntu-24.04
-        permissions:
-            checks: read
+        runs-on: ubuntu-latest
        steps:
            - name: Wait for desktop packaging
              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
@@ -42,5 +34,5 @@ jobs:
                  ref: master
                  repo-token: ${{ secrets.GITHUB_TOKEN }}
                  wait-interval: 10
-                  check-regexp: Prepare|Linux|macOS|Windows|Deploy|deploy
+                  check-name: Deploy
                  allowed-conclusions: success
--- a/.github/workflows/static_analysis.yaml
+++ b/.github/workflows/static_analysis.yaml
@@ -3,87 +3,80 @@ on:
    pull_request: {}
    push:
        branches: [develop, master]
-permissions: {} # No permissions needed
 jobs:
    ts_lint:
        name: "Typescript Syntax Check"
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
                  node-version-file: package.json
-                  cache: "pnpm"
+                  cache: "yarn"

            # Does not need branch matching as only analyses this layer
            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

            - name: Typecheck
-              run: "pnpm run lint:types"
+              run: "yarn run lint:types"

    i18n_lint:
        name: "i18n Check"
        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
-        permissions:
-            pull-requests: read
        with:
            hardcoded-words: "Element"

    js_lint:
        name: "ESLint"
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
                  node-version-file: package.json
-                  cache: "pnpm"
+                  cache: "yarn"

            # Does not need branch matching as only analyses this layer
            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

            - name: Run Linter
-              run: "pnpm run lint:js"
+              run: "yarn run lint:js"

    workflow_lint:
        name: "Workflow Lint"
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
                  node-version-file: package.json
-                  cache: "pnpm"
+                  cache: "yarn"

            # Does not need branch matching as only analyses this layer
            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

            - name: Run Linter
-              run: "pnpm lint:workflows"
+              run: "yarn lint:workflows"

    analyse_dead_code:
        name: "Analyse Dead Code"
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/setup-node@v4
              with:
                  node-version-file: package.json
-                  cache: "pnpm"
+                  cache: "yarn"

            - name: Install Deps
-              run: "pnpm install --frozen-lockfile"
+              run: "yarn install --frozen-lockfile"

            - name: Run linter
-              run: "pnpm run lint:knip"
+              run: "yarn run lint:knip"
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -8,7 +8,6 @@ on:
            - develop
        paths:
            - .github/labels.yml
-permissions: {} # Uses ELEMENT_BOT_TOKEN
 jobs:
    sync-labels:
        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
--- a/.github/workflows/triage-incoming.yml
+++ b/.github/workflows/triage-incoming.yml
@@ -4,11 +4,9 @@ on:
    issues:
        types: [opened]

-permissions: {} # Uses ELEMENT_BOT_TOKEN
-
 jobs:
    automate-project-columns-next:
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
        steps:
            - uses: actions/add-to-project@main
              with:
--- a/.github/workflows/triage-labelled.yml
+++ b/.github/workflows/triage-labelled.yml
@@ -4,8 +4,6 @@ on:
    issues:
        types: [labeled]

-permissions: {} # Uses ELEMENT_BOT_TOKEN
-
 jobs:
    call-triage-labelled:
        uses: element-hq/element-web/.github/workflows/triage-labelled.yml@develop
--- a/.github/workflows/triage-stale.yml
+++ b/.github/workflows/triage-stale.yml
@@ -1,22 +0,0 @@
-name: Close stale PRs
-on:
-    workflow_dispatch: {}
-    schedule:
-        - cron: "30 1 * * *"
-permissions: {}
-jobs:
-    close:
-        runs-on: ubuntu-24.04
-        permissions:
-            actions: write
-            issues: write
-            pull-requests: write
-        steps:
-            - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10
-              with:
-                  operations-per-run: 250
-                  days-before-issue-stale: -1
-                  days-before-issue-close: -1
-                  days-before-pr-stale: 180
-                  days-before-pr-close: 0
-                  close-pr-message: "This PR has been automatically closed because it has been stale for 180 days. If you wish to continue working on this PR, please ping a maintainer to reopen it."
--- a/.gitignore
+++ b/.gitignore
@@ -17,5 +17,3 @@ node_modules/
 yarn-error.log
 /hak/**/*.js
 /scripts/hak/**/*.js
-.DS_Store
-/playwright-report
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname "$0")/_/husky.sh"
-
-npx lint-staged --concurrent false
--- a/.lintstagedrc
+++ b/.lintstagedrc
@@ -1,4 +0,0 @@
-{
-    "*": "prettier --write",
-    "*.(ts|tsx)": ["eslint --fix"]
-}
--- a/.node-version
+++ b/.node-version
@@ -1 +0,0 @@
-24.13.0
--- a/.prettierignore
+++ b/.prettierignore
@@ -7,7 +7,7 @@
 /src/i18n/strings
 /CHANGELOG.md
 /package-lock.json
-/pnpm-lock.yaml
+/yarn.lock
 /playwright/html-report
 /playwright/test-results

--- a/.prettierrc.cjs
+++ b/.prettierrc.cjs
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,5 +1 @@
-# Contributing code to element-desktop
-
-Everyone is welcome to contribute code to element-desktop, provided that they are willing to license their contributions to Element under a [Contributor License Agreement](https://cla-assistant.io/element-hq/element-desktop) (CLA). This ensures that their contribution will be made available under an approved licence(as described in the [README](/README.md#copyright--license)).
-
-element-desktop follows the same pattern as element-web, please find more contributing guidelines at https://github.com/vector-im/element-web/blob/develop/CONTRIBUTING.md
+Please read the element-web [contributing guide](https://github.com/element-hq/element-web/blob/develop/CONTRIBUTING.md).
--- a/6
+++ b/6
@@ -1,6 +0,0 @@
-Licensees holding a valid commercial license with Element may use this
-software in accordance with the terms contained in a written agreement
-between you and Element.
-
-To purchase a commercial license please contact our sales team at
-licensing@element.io
--- a/README.md
+++ b/README.md
@@ -7,14 +7,14 @@

 # Element Desktop

-Element Desktop is a Matrix client for desktop platforms with Element Web at its core.
+Element Desktop is a Matrix client for desktop platforms with Element Web at its core. You can directly run and manage the source code in this repository, available dual-licensed under an AGPL or GPL.

 # First Steps

 Before you do anything else, fetch the dependencies:

 ```
-pnpm install
+yarn install
 ```

 # Fetching Element
@@ -26,7 +26,7 @@ so the first step is to get a working copy of Element Web. There are a few ways
 # Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
 # fetched will be the same as the local element-desktop package.
 # We're explicitly asking for no config, so the packaged Element will have no config.json.
-pnpm run fetch --noverify --cfgdir ""
+yarn run fetch --noverify --cfgdir ""
 ```

 ...or if you'd like to use GPG to verify the downloaded package:
@@ -35,9 +35,9 @@ pnpm run fetch --noverify --cfgdir ""
 # Fetch the Element public key from the element.io web server over a secure connection and import
 # it into your local GPG keychain (you'll need GPG installed). You only need to to do this
 # once.
-pnpm run fetch --importkey
+yarn run fetch --importkey
 # Fetch the package and verify the signature
-pnpm run fetch --cfgdir ""
+yarn run fetch --cfgdir ""
 ```

 ...or either of the above, but fetching a specific version of Element:
@@ -45,16 +45,14 @@ pnpm run fetch --cfgdir ""
 ```
 # Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
 # fetched will be the same as the local element-desktop package.
-pnpm run fetch --noverify --cfgdir "" v1.5.6
+yarn run fetch --noverify --cfgdir "" v1.5.6
 ```

 If you only want to run the app locally and don't need to build packages, you can
 provide the `webapp` directory directly:

 ```
-# Assuming you've checked out and built a copy of element-web in ../element-web.
-# Note that you will not be able to `pnpm build` after this, but `pnpm start`
-# will work fine.
+# Assuming you've checked out and built a copy of element-web in ../element-web
 ln -s ../element-web/webapp ./
 ```

@@ -72,15 +70,15 @@ which include support for searching in encrypted rooms and secure storage. Skipp
 Then, run

 ```
-pnpm run build
+yarn run build
 ```

 This will do a couple of things:

- Run the `setversion` script to set the local package version to match whatever
-  version of Element you installed above.
- Run electron-builder to build a package. The package built will match the operating system
-  you're running the build process on.
+-   Run the `setversion` script to set the local package version to match whatever
+    version of Element you installed above.
+-   Run electron-builder to build a package. The package built will match the operating system
+    you're running the build process on.

 ## Docker

@@ -88,12 +86,12 @@ Alternatively, you can also build using docker, which will always produce the li

 ```
 # Run this once to make the docker image
-pnpm run docker:setup
+yarn run docker:setup

-pnpm run docker:install
+yarn run docker:install
 # if you want to build the native modules (this will take a while)
-pnpm run docker:build:native
-pnpm run docker:build
+yarn run docker:build:native
+yarn run docker:build
 ```

 After running, the packages should be in `dist/`.
@@ -103,19 +101,22 @@ After running, the packages should be in `dist/`.
 If you'd just like to run the electron app locally for development:

 ```
-pnpm start
+# Install electron - we don't normally need electron itself as it's provided
+# by electron-builder when building packages
+yarn add electron
+yarn start
 ```

 # Config

 If you'd like the packaged Element to have a configuration file, you can create a
 config directory and place `config.json` in there, then specify this directory
-with the `--cfgdir` option to `pnpm run fetch`, eg:
+with the `--cfgdir` option to `yarn run fetch`, eg:

 ```
 mkdir myconfig
 cp /path/to/my/config.json myconfig/
-pnpm run fetch --cfgdir myconfig
+yarn run fetch --cfgdir myconfig
 ```

 The config dir for the official Element app is in `element.io`. If you use this,
@@ -133,19 +134,15 @@ Alternatively, a custom location for the profile data can be specified using the

 # User-specified config.json

- `%APPDATA%\$NAME\config.json` on Windows
- `$XDG_CONFIG_HOME/$NAME/config.json` or `~/.config/$NAME/config.json` on Linux
- `~/Library/Application Support/$NAME/config.json` on macOS
+-   `%APPDATA%\$NAME\config.json` on Windows
+-   `$XDG_CONFIG_HOME/$NAME/config.json` or `~/.config/$NAME/config.json` on Linux
+-   `~/Library/Application Support/$NAME/config.json` on macOS

 In the paths above, `$NAME` is typically `Element`, unless you use `--profile
 $PROFILE` in which case it becomes `Element-$PROFILE`, or it is using one of
 the above created by a pre-1.7 install, in which case it will be `Riot` or
 `Riot-$PROFILE`.

-You may also specify a different path entirely for the `config.json` file by
-providing the `--config $YOUR_CONFIG_JSON_FILE` to the process, or via the
-`ELEMENT_DESKTOP_CONFIG_JSON` environment variable.
-
 # Translations

 To add a new translation, head to the [translating doc](https://github.com/vector-im/element-web/blob/develop/docs/translating.md).
@@ -157,20 +154,3 @@ For a developer guide, see the [translating dev doc](https://github.com/vector-i
 If you run into any bugs or have feedback you'd like to share, please let us know on GitHub.

 To help avoid duplicate issues, please [view existing issues](https://github.com/vector-im/element-web/issues?q=is%3Aopen+is%3Aissue+sort%3Areactions-%2B1-desc) first (and add a +1) or [create a new issue](https://github.com/vector-im/element-web/issues/new/choose) if you can't find it. Please note that this issue tracker is associated with the [element-web](https://github.com/vector-im/element-web) repo, but is also applied to the code in this repo as well.
-
-## Copyright & License
-
-Copyright (c) 2016-2017 OpenMarket Ltd
-
-Copyright (c) 2017 Vector Creations Ltd
-
-Copyright (c) 2017-2025 New Vector Ltd
-
-This software is multi licensed by New Vector Ltd (Element). It can be used either:
-
-(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
-
-(2) for free under the terms of the GNU General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
-
-(3) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
-Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
--- a/babel.config.cjs
+++ b/babel.config.cjs
--- a/build/icon.icns
+++ b/build/icon.icns
--- a/build/icon.ico
+++ b/build/icon.ico
--- a/build/icon.icon/Assets/element.png
+++ b/build/icon.icon/Assets/element.png
--- a/build/icon.icon/icon.json
+++ b/build/icon.icon/icon.json
@@ -1,29 +0,0 @@
-{
-  "fill" : "automatic",
-  "groups" : [
-    {
-      "layers" : [
-        {
-          "glass" : false,
-          "image-name" : "element.png",
-          "name" : "element"
-        }
-      ],
-      "name" : "Figma",
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 0.5
-      },
-      "specular" : false,
-      "translucency" : {
-        "enabled" : false,
-        "value" : 0.5
-      }
-    }
-  ],
-  "supported-platforms" : {
-    "squares" : [
-      "macOS"
-    ]
-  }
-}
--- a/build/icon.png
+++ b/build/icon.png
--- a/build/icons/128x128.png
+++ b/build/icons/128x128.png
--- a/build/icons/16x16.png
+++ b/build/icons/16x16.png
--- a/build/icons/24x24.png
+++ b/build/icons/24x24.png
--- a/build/icons/256x256.png
+++ b/build/icons/256x256.png
--- a/build/icons/48x48.png
+++ b/build/icons/48x48.png
--- a/build/icons/512x512.png
+++ b/build/icons/512x512.png
--- a/build/icons/64x64.png
+++ b/build/icons/64x64.png
--- a/build/icons/96x96.png
+++ b/build/icons/96x96.png
--- a/dockerbuild/Dockerfile
+++ b/dockerbuild/Dockerfile
@@ -1,24 +1,27 @@
-# Docker image to facilitate building Element Desktop's native bits using a glibc version (2.31)
-# with broader compatibility, down to Debian bullseye & Ubuntu focal.
-FROM rust:bullseye@sha256:3ebcc2d6d71fb93a2967e35723902c51dd87dbb36f66f795a58d7921553fbcd4
+# Docker image to facilitate building Element Desktop's native bits using a glibc version with broader compatibility
+FROM rust:buster

-ENV DEBIAN_FRONTEND=noninteractive
+ENV DEBIAN_FRONTEND noninteractive

+RUN curl --proto "=https" -L https://yarnpkg.com/latest.tar.gz | tar xvz && mv yarn-* /yarn && ln -s /yarn/bin/yarn /usr/bin/yarn
 RUN apt-get -qq update && apt-get -y -qq dist-upgrade && \
  apt-get -y -qq install --no-install-recommends \
  # tclsh is required for building SQLite as part of SQLCipher
  tcl \
+  # libsecret-1-dev is required even for prebuild keytar
+  libsecret-1-dev \
  # Used by seshat (when not SQLCIPHER_STATIC) \
  libsqlcipher-dev && \
  apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
 RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip

-ENV DEBUG_COLORS=true
-ENV FORCE_COLOR=true
+ENV DEBUG_COLORS true
+ENV FORCE_COLOR true

 WORKDIR /project

+ENV NODE_VERSION 20.15.1
 ARG TARGETOS
 ARG TARGETARCH
-COPY .node-version dockerbuild/setup.sh /
+COPY setup.sh /setup.sh
 RUN /setup.sh
--- a/dockerbuild/setup.sh
+++ b/dockerbuild/setup.sh
@@ -3,10 +3,5 @@
 set -x
 declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
 ARCH="${archMap["$TARGETARCH"]}"
-# The .node-version file generally doesn't have the 'v' (renovate does not put the 'v' and will
-# strip it on upgrade if it's there) but the 'v' is also widely supported so we probably ought
-# to just work either way.
-NODE_VERSION=$(cat /.node-version | sed -e 's/^v//')
 curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md
-corepack enable
--- a/docs/SUMMARY.md
+++ b/docs/SUMMARY.md
@@ -1,19 +1,17 @@
 # Summary

- [Introduction](../README.md)
+-   [Introduction](../README.md)

-# Build/Debug
+# Build

- [Native Node modules](native-node-modules.md)
- [Windows requirements](windows-requirements.md)
- [Debugging](debugging.md)
- [Using gdb](gdb.md)
+-   [Native Node modules](native-node-modules.md)
+-   [Windows requirements](windows-requirements.md)

 # Distribution

- [Updates](updates.md)
- [Packaging](packaging.md)
+-   [Updates](updates.md)
+-   [Packaging](packaging.md)

 # Setup

- [Config](config.md)
+-   [Config](config.md)
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -1,28 +0,0 @@
-# Debugging Element-Desktop
-
-There are two parts of the desktop app that you might want to debug.
-
-## The renderer process
-
-This is the regular element-web codeand can be debugged by just selecting 'toggle developer tools'
-from the menu, even on ppackaged builds. This then works the same as chrome dev tools for element web.
-
-## The main process
-
-This is debugged as a node app, so:
-
-1.  Open any chrome dev tools window
-1.  Start element with the `--inspect-brk` flag
-1.  Notice that you now have a little green icon in the top left of your chrome devtools window, click it.
-
-You are now debugging the code of the desktop app itself.
-
-## The main process of a package app
-
-When the app is shipped, electron's "fuses" are flipped, editing the electron binary itself to prevent certain features from being usable, one of which is debugging using `--inspect-brk` as above. You can flip the fuse back on Linux as follows:
-
-```
-sudo npx @electron/fuses write --app /opt/Element/element-desktop EnableNodeCliInspectArguments=on
-```
-
-A similar command will work, in theory, on mac and windows, except that this will break code signing (which is the point of fuses) so you would have to re-sign the app or somesuch.
--- a/docs/gdb.md
+++ b/docs/gdb.md
@@ -1,45 +0,0 @@
-# Using gdb against Element-Desktop
-
-Occasionally it is useful to be able to connect to a running Element-Desktop
-with [`gdb`](https://sourceware.org/gdb/), or to analayze a coredump. For this,
-you will need debug symbols.
-
-1. If you don't already have the right version of Element-Desktop (eg because
-   you are analyzing someone else's coredump), download and unpack the tarball
-   from https://packages.element.io/desktop/install/linux/. If it was a
-   nightly, your best bet may be to download the deb from
-   https://packages.element.io/debian/pool/main/e/element-nightly/ and unpack
-   it.
-2. Figure out which version of Electron your Element-Desktop is based on. The
-   best way to do this is to figure out the version of Element-Desktop, then
-   look at
-   [`package.json`](https://github.com/element-hq/element-desktop/blob/develop/package.json)
-   for the corresponding version. There will be an entry within `dependencies` of
-   `electron`: the value will tell you the version of Electron that was used for that version of Element-Desktop.
-
-3. Go to [Electron's releases page](https://github.com/electron/electron/releases/)
-   and find the version you just identified. Under "Assets", download
-   `electron-v<version>-linux-x64-debug.zip` (or, the -debug zip corresponding to your
-   architecture).
-
-4. The debug zip has a structure like:
-
-    ```
-    .
-    ├── debug
-    │   ├── chrome_crashpad_handler.debug
-    │   ├── electron.debug
-    │   ├── libEGL.so.debug
-    │   ├── libffmpeg.so.debug
-    │   ├── libGLESv2.so.debug
-    │   └── libvk_swiftshader.so.debug
-    ├── LICENSE
-    ├── LICENSES.chromium.html
-    └── version
-    ```
-
-    Take all the contents of `debug`, and copy them into the Element-Desktop directory,
-    so that `electron.debug` is alongside the `element-desktop-nightly` executable.
-
-5. You now have a thing you can gdb as normal, either as `gdb --args element-desktop-nightly`, or
-   `gdb element-desktop-nightly core`.
--- a/docs/native-node-modules.md
+++ b/docs/native-node-modules.md
@@ -13,42 +13,20 @@ custom build of Element without installing the various build tools required.
 The process is automated by [vector-im/element-builder](https://github.com/vector-im/element-builder)
 when releasing.

-## Use docker
-
-If you are building for Linux, you can build the native modules with:
-
-```
-pnpm docker:setup
-pnpm docker:install
-INDOCKER_SQLCIPHER_BUNDLED=1 pnpm docker:build:native
-```
-
-The above will build `matrix-seshat` in
-`docker/node_modules/matrix-seshat`. You can then either run `pnpm docker:build`
-to build the app inside docker, or:
-
-```
-pnpm link docker/node_modules/matrix-seshat
-```
-
-... and build the app with `pnpm build` or run it with `pnpm start`.
-
-(See also https://github.com/element-hq/element-desktop#docker.)
-
 ## Building

 Install the pre-requisites for your system:

- [Windows pre-requisites](https://github.com/vector-im/element-desktop/blob/develop/docs/windows-requirements.md)
- Linux: TODO. Using the docker environment as above is recommended.
- OS X: TODO
+-   [Windows pre-requisites](https://github.com/vector-im/element-desktop/blob/develop/docs/windows-requirements.md)
+-   Linux: TODO
+-   OS X: TODO

 Then optionally, [add seshat and dependencies to support search in E2E rooms](#adding-seshat-for-search-in-e2e-encrypted-rooms).

 Then, to build for an architecture selected automatically based on your system (recommended), run:

 ```
-pnpm run build:native
+yarn run build:native
 ```

 If you need to build for a specific architecture, see [here](#compiling-for-specific-architectures).
@@ -66,20 +44,19 @@ Seshat also depends on the SQLCipher library to store its data in encrypted form
 on disk. You'll need to install it via your OS package manager.

 After installing the Rust compiler and SQLCipher, Seshat support can be added
-using pnpm at the root of this project:
+using yarn at the root of this project:

-    pnpm add matrix-seshat
+    yarn add matrix-seshat

 You will have to rebuild the native libraries against electron's version
 of node rather than your system node, using the `electron-build-env` tool.
-This is also needed to when pulling in changes to Seshat using `pnpm link`.
+This is also needed to when pulling in changes to Seshat using `yarn link`.

-    pnpm add electron-build-env
+    yarn add electron-build-env

 Recompiling Seshat itself can be done like so:

-    ELECTRON_VERSION=$(electron --version)
-    pnpm run electron-build-env -- --electron ${ELECTRON_VERSION#v} -- neon build matrix-seshat --release
+    yarn run electron-build-env -- --electron 6.1.1 -- neon build matrix-seshat --release

 Please make sure to include all the `--` as well as the `--release` command line
 switch at the end. Modify your electron version accordingly depending on the
@@ -88,7 +65,7 @@ version that is installed on your system.
 After this is done the Electron version of Element can be run from the main folder
 as usual using:

-    pnpm start
+    yarn start

 ### Statically linking libsqlcipher

@@ -108,26 +85,26 @@ and https://github.com/vector-im/element-web/issues/20926.
 On macOS, you can build universal native modules too:

 ```
-pnpm run build:native:universal
+yarn run build:native:universal
 ```

 ...or you can build for a specific architecture:

 ```
-pnpm run build:native --target x86_64-apple-darwin
+yarn run build:native --target x86_64-apple-darwin
 ```

 or

 ```
-pnpm run build:native --target aarch64-apple-darwin
+yarn run build:native --target aarch64-apple-darwin
 ```

 You'll then need to create a built bundle with the same architecture.
 To bundle a universal build for macOS, run:

 ```
-pnpm run build:universal
+yarn run build:universal
 ```

 ### Windows
@@ -135,13 +112,13 @@ pnpm run build:universal
 If you're on Windows, you can choose to build specifically for 32 or 64 bit:

 ```
-pnpm run build:32
+yarn run build:32
 ```

 or

 ```
-pnpm run build:64
+yarn run build:64
 ```

 ### Cross compiling
@@ -155,19 +132,19 @@ at this time.

 The native module build system keeps the different architectures
 separate, so you can keep native modules for several architectures at the same
-time and switch which are active using a `pnpm run hak copy` command, passing
+time and switch which are active using a `yarn run hak copy` command, passing
 the appropriate architectures. This will error if you haven't yet built those
 architectures. eg:

 ```
-pnpm run build:native --target x86_64-apple-darwin
+yarn run build:native --target x86_64-apple-darwin
 # We've now built & linked into place native modules for Intel
-pnpm run build:native --target aarch64-apple-darwin
+yarn run build:native --target aarch64-apple-darwin
 # We've now built Apple Silicon modules too, and linked them into place as the active ones

-pnpm run hak copy --target x86_64-apple-darwin
+yarn run hak copy --target x86_64-apple-darwin
 # We've now switched back to our Intel modules
-pnpm run hak copy --target x86_64-apple-darwin --target aarch64-apple-darwin
+yarn run hak copy --target x86_64-apple-darwin --target aarch64-apple-darwin
 # Now our native modules are universal x86_64+aarch64 binaries
 ```

--- a/docs/packaging.md
+++ b/docs/packaging.md
@@ -17,8 +17,8 @@ Simply go to https://github.com/vector-im/element-desktop/actions/workflows/buil

 For releasing Element Desktop, we assume the following prerequisites:

- a tag of `element-desktop` repo with the Element Desktop version to be released set in `package.json`.
- an Element Web tarball published to GitHub with a matching version number.
+-   a tag of `element-desktop` repo with the Element Desktop version to be released set in `package.json`.
+-   an Element Web tarball published to GitHub with a matching version number.

 **Both of these are done automatically when you run the release automation.**

--- a/docs/windows-requirements.md
+++ b/docs/windows-requirements.md
@@ -2,30 +2,23 @@

 ## Requirements to build native modules

-We rely on Github Actions `windows-2022` plus a few extra utilities as per [the workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml).
+We rely on Github Actions `windows-latest` plus a few extra utilities as per [the workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml).

 If you want to build native modules, make sure that the following tools are installed on your system.

- [Git for Windows](https://git-scm.com/download/win)
- [Node 16](https://nodejs.org)
- [Python 3](https://www.python.org/downloads/) (if you type 'python' into command prompt it will offer to install it from the windows store)
- [Strawberry Perl](https://strawberryperl.com/)
- [Rustup](https://rustup.rs/)
- [NASM](https://www.nasm.us/)
-
-You can install the above tools using [Chocolatey](https://chocolatey.org/install):
-
-```cmd
-choco install --no-progress -y git nodejs-lts pnpm python StrawberryPerl rustup.install nasm magicsplat-tcl-tk
-```
-
- [Build Tools for Visual Studio 2019](https://visualstudio.microsoft.com/downloads/#build-tools-for-visual-studio-2019) with the following configuration:
-    - On the Workloads tab:
-        - Desktop & Mobile -> C++ build tools
-    - On the Individual components tab:
-        - MSVC VS 2019 C++ build tools
-        - Windows 10 SDK (latest version available)
-        - C++ CMake tools for Windows
+-   [Git for Windows](https://git-scm.com/download/win)
+-   [Node 16](https://nodejs.org)
+-   [Python 3](https://www.python.org/downloads/) (if you type 'python' into command prompt it will offer to install it from the windows store)
+-   [Strawberry Perl](https://strawberryperl.com/)
+-   [Rustup](https://rustup.rs/)
+-   [NASM](https://www.nasm.us/)
+-   [Build Tools for Visual Studio 2019](https://visualstudio.microsoft.com/downloads/#build-tools-for-visual-studio-2019) with the following configuration:
+    -   On the Workloads tab:
+        -   Desktop & Mobile -> C++ build tools
+    -   On the Individual components tab:
+        -   MSVC VS 2019 C++ build tools
+        -   Windows 10 SDK (latest version available)
+        -   C++ CMake tools for Windows

 Once installed make sure all those utilities are accessible in your `PATH`.

--- a/electron-builder.ts
+++ b/electron-builder.ts
@@ -1,14 +1,19 @@
-import * as os from "node:os";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { type Configuration as BaseConfiguration, type Protocol } from "electron-builder";
+import * as os from "os";
+import * as fs from "fs";
+import * as path from "path";
+import { Arch, Configuration as BaseConfiguration, AfterPackContext } from "electron-builder";
+import { flipFuses, FuseVersion, FuseV1Options } from "@electron/fuses";

 /**
 * This script has different outputs depending on your os platform.
 *
 * On Windows:
+ *  Prefixes the nightly version with `0.0.1-nightly.` as it breaks if it is not semver
 *  Passes $ED_SIGNTOOL_THUMBPRINT and $ED_SIGNTOOL_SUBJECT_NAME to
- *      build.win.signtoolOptions.signingHashAlgorithms and build.win.signtoolOptions.certificateSubjectName respectively if specified.
+ *      build.win.signingHashAlgorithms and build.win.certificateSubjectName respectively if specified.
+ *
+ * On macOS:
+ *   Passes $ED_NOTARYTOOL_TEAM_ID to build.mac.notarize.notarize if specified
 *
 * On Linux:
 *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
@@ -16,68 +21,24 @@ import { type Configuration as BaseConfiguration, type Protocol } from "electron
 *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
 */

-/**
- * Interface describing relevant fields of the package.json file.
- */
-interface Pkg {
-    version: string;
-}
+const NIGHTLY_APP_ID = "im.riot.nightly";
+const NIGHTLY_DEB_NAME = "element-nightly";

-/**
- * Base metadata fields, used in both package.json and the variant configuration.
- */
-interface Metadata {
+interface Pkg {
    name: string;
    productName: string;
    description: string;
-}
-
-/**
- * Extra metadata fields that are injected into the build to pass to the app at runtime.
- */
-interface ExtraMetadata extends Metadata {
-    electron_appId: string;
-    electron_protocol: string;
-}
-
-/**
- * Interface describing the variant configuration format.
- */
-interface Variant extends Metadata {
-    "appId": string;
-    "linux.executableName"?: string;
-    "linux.deb.name"?: string;
-    "protocols": string[];
+    version: string;
 }

 type Writable<T> = NonNullable<
    T extends Function ? T : T extends object ? { -readonly [K in keyof T]: Writable<T[K]> } : T
 >;

-// Load the default variant as a base configuration
-const DEFAULT_VARIANT = path.join("element.io", "release", "build.json");
-let variant: Variant = JSON.parse(fs.readFileSync(DEFAULT_VARIANT, "utf8"));
-
-/**
- * If a variant is specified, we will use it to override the build-specific values.
- * This allows us to have different builds for different purposes (e.g. stable, nightly).
- */
-if (process.env.VARIANT_PATH) {
-    console.log(`Using variant configuration from '${process.env.VARIANT_PATH}':`);
-    variant = {
-        ...variant,
-        ...JSON.parse(fs.readFileSync(`${process.env.VARIANT_PATH}`, "utf8")),
-    };
-} else {
-    console.warn(`No VARIANT_PATH specified, using default variant configuration '${DEFAULT_VARIANT}':`);
-}
-
-for (const key in variant) {
-    console.log(`${key}: ${variant[key]}`);
-}
+const pkg: Pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));

 interface Configuration extends BaseConfiguration {
-    extraMetadata: Partial<Pick<Pkg, "version">> & ExtraMetadata;
+    extraMetadata: Partial<Pick<Pkg, "version">> & Omit<Pkg, "version">;
    linux: BaseConfiguration["linux"];
    win: BaseConfiguration["win"];
    mac: BaseConfiguration["mac"];
@@ -90,25 +51,45 @@ interface Configuration extends BaseConfiguration {
 * @type {import('electron-builder').Configuration}
 * @see https://www.electron.build/configuration/configuration
 */
-const config: Omit<Writable<Configuration>, "electronFuses"> & {
-    // Make all fuses required to ensure they are all explicitly specified
-    electronFuses: Required<Configuration["electronFuses"]>;
-} = {
-    appId: variant.appId,
+const config: Writable<Configuration> = {
+    appId: "im.riot.app",
    asarUnpack: "**/*.node",
-    electronFuses: {
-        enableCookieEncryption: true,
-        onlyLoadAppFromAsar: true,
-        grantFileProtocolExtraPrivileges: false,
+    afterPack: async (context: AfterPackContext) => {
+        if (context.electronPlatformName !== "darwin" || context.arch === Arch.universal) {
+            // Burn in electron fuses for proactive security hardening.
+            // On macOS, we only do this for the universal package, as the constituent arm64 and amd64 packages are embedded within.
+            const ext = (<Record<string, string>>{
+                darwin: ".app",
+                win32: ".exe",
+                linux: "",
+            })[context.electronPlatformName];

-        runAsNode: false,
-        enableNodeOptionsEnvironmentVariable: false,
-        enableNodeCliInspectArguments: false,
-        // We need to reset the signature if we are not signing on darwin otherwise it won't launch
-        resetAdHocDarwinSignature: !process.env.APPLE_TEAM_ID,
+            let executableName = context.packager.appInfo.productFilename;
+            if (context.electronPlatformName === "linux") {
+                // Linux uses the package name as the executable name
+                executableName = context.packager.appInfo.name;
+            }

-        loadBrowserProcessSpecificV8Snapshot: false,
-        enableEmbeddedAsarIntegrityValidation: true,
+            const electronBinaryPath = path.join(context.appOutDir, `${executableName}${ext}`);
+            console.log(`Flipping fuses for: ${electronBinaryPath}`);
+
+            await flipFuses(electronBinaryPath, {
+                version: FuseVersion.V1,
+                resetAdHocDarwinSignature: context.electronPlatformName === "darwin" && context.arch === Arch.universal,
+
+                [FuseV1Options.EnableCookieEncryption]: true,
+                [FuseV1Options.OnlyLoadAppFromAsar]: true,
+
+                [FuseV1Options.RunAsNode]: false,
+                [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+                [FuseV1Options.EnableNodeCliInspectArguments]: false,
+
+                // Mac app crashes on arm for us when `LoadBrowserProcessSpecificV8Snapshot` is enabled
+                [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
+                // https://github.com/electron/fuses/issues/7
+                [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,
+            });
+        }
    },
    files: [
        "package.json",
@@ -118,19 +99,23 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
        },
        "lib/**",
    ],
-    extraResources: ["build/icon.*", "webapp.asar"],
+    extraResources: [
+        {
+            from: "res/img",
+            to: "img",
+        },
+        "webapp.asar",
+    ],
    extraMetadata: {
-        name: variant.name,
-        productName: variant.productName,
-        description: variant.description,
-        electron_appId: variant.appId,
-        electron_protocol: variant.protocols[0],
+        name: pkg.name,
+        productName: pkg.productName,
+        description: pkg.description,
    },
    linux: {
        target: ["tar.gz", "deb"],
        category: "Network;InstantMessaging;Chat",
-        icon: "icon.png",
-        executableName: variant.name, // element-desktop or element-desktop-nightly
+        maintainer: "support@element.io",
+        icon: "build/icons",
    },
    deb: {
        packageCategory: "net",
@@ -148,29 +133,25 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
            "libgbm1",
        ],
        recommends: ["libsqlcipher0", "element-io-archive-keyring"],
-        fpm: ["--deb-pre-depends", "libc6 (>= 2.31)"],
+        fpm: [
+            "--deb-field",
+            "Replaces: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
+            "--deb-field",
+            "Breaks: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
+        ],
    },
    mac: {
-        target: ["dmg", "zip"],
        category: "public.app-category.social-networking",
        darkModeSupport: true,
        hardenedRuntime: true,
        gatekeeperAssess: true,
-        strictVerify: true,
        entitlements: "./build/entitlements.mac.plist",
-        icon: "build/icon.icon",
-        mergeASARs: true,
-        x64ArchFiles: "**/matrix-seshat/*.node", // hak already runs lipo
-    },
-    dmg: {
-        badgeIcon: "build/icon.icon",
+        icon: "build/icons/icon.icns",
    },
    win: {
        target: ["squirrel", "msi"],
-        signtoolOptions: {
-            signingHashAlgorithms: ["sha256"],
-        },
-        icon: "build/icon.ico",
+        signingHashAlgorithms: ["sha256"],
+        icon: "build/icons/icon.ico",
    },
    msi: {
        perMachine: true,
@@ -178,36 +159,57 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
    directories: {
        output: "dist",
    },
-    protocols: {
-        name: variant.productName,
-        schemes: variant.protocols,
-    },
-    nativeRebuilder: "sequential",
-    nodeGypRebuild: false,
-    npmRebuild: true,
+    protocols: [
+        {
+            name: "element",
+            schemes: ["io.element.desktop", "element"],
+        },
+    ],
 };

-/**
- * Allow specifying the version via env var.
- * If unspecified, it will default to the version in package.json.
- * @param {string} process.env.VERSION
- */
-if (process.env.VERSION) {
-    config.extraMetadata.version = process.env.VERSION;
-}
-
-if (variant["linux.deb.name"]) {
-    config.deb.fpm.push("--name", variant["linux.deb.name"]);
-}
-
 /**
 * Allow specifying windows signing cert via env vars
 * @param {string} process.env.ED_SIGNTOOL_SUBJECT_NAME
 * @param {string} process.env.ED_SIGNTOOL_THUMBPRINT
 */
 if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT) {
-    config.win.signtoolOptions!.certificateSubjectName = process.env.ED_SIGNTOOL_SUBJECT_NAME;
-    config.win.signtoolOptions!.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
+    config.win.certificateSubjectName = process.env.ED_SIGNTOOL_SUBJECT_NAME;
+    config.win.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
+}
+
+/**
+ * Allow specifying macOS notary team id via env var
+ * @param {string} process.env.ED_NOTARYTOOL_TEAM_ID
+ */
+if (process.env.ED_NOTARYTOOL_TEAM_ID) {
+    config.mac.notarize = {
+        teamId: process.env.ED_NOTARYTOOL_TEAM_ID,
+    };
+}
+
+/**
+ * Allow specifying nightly version via env var
+ * @param {string} process.env.ED_NIGHTLY
+ */
+if (process.env.ED_NIGHTLY) {
+    config.deb.fpm = []; // Clear the fpm as the breaks deb fields don't apply to nightly
+
+    config.appId = NIGHTLY_APP_ID;
+    config.extraMetadata.productName += " Nightly";
+    config.extraMetadata.name += "-nightly";
+    config.extraMetadata.description += " (nightly unstable build)";
+    config.deb.fpm.push("--name", NIGHTLY_DEB_NAME);
+
+    let version = process.env.ED_NIGHTLY;
+    if (os.platform() === "win32") {
+        // The windows packager relies on parsing this as semver, so we have to make it look like one.
+        // This will give our update packages really stupid names, but we probably can't change that either
+        // because squirrel windows parses them for the version too. We don't really care: nobody sees them.
+        // We just give the installer a static name, so you'll just see this in the 'about' dialog.
+        // Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
+        version = "0.0.1-nightly." + version;
+    }
+    config.extraMetadata.version = version;
 }

 if (os.platform() === "linux") {
--- a/element.io/nightly/build.json
+++ b/element.io/nightly/build.json
@@ -1,9 +0,0 @@
-{
-    "appId": "im.riot.nightly",
-    "name": "element-desktop-nightly",
-    "productName": "Element Nightly",
-    "description": "Element: the future of secure communication (nightly unstable build)",
-    "protocols": ["io.element.nightly", "element"],
-    "linux.executableName": "element-desktop-nightly",
-    "linux.deb.name": "element-nightly"
-}
--- a/element.io/nightly/config.json
+++ b/element.io/nightly/config.json
@@ -19,7 +19,7 @@
        "https://scalar-staging.vector.im/api",
        "https://scalar-staging.riot.im/scalar/api"
    ],
-    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "bug_report_endpoint_url": "https://element.io/bugreports/submit",
    "uisi_autorageshake_app": "element-auto-uisi",
    "show_labs_settings": true,
    "room_directory": {
@@ -51,9 +51,9 @@
    "features": {
        "threadsActivityCentre": true,
        "feature_spotlight": true,
-        "feature_group_calls": true,
        "feature_video_rooms": true,
-        "feature_element_call_video_rooms": true
+        "feature_element_call_video_rooms": true,
+        "feature_new_room_decoration_ui": true
    },
    "setting_defaults": {
        "RustCrypto.staged_rollout_percent": 100
--- a/element.io/release/build.json
+++ b/element.io/release/build.json
@@ -1,7 +0,0 @@
-{
-    "appId": "im.riot.app",
-    "name": "element-desktop",
-    "productName": "Element",
-    "description": "Element: the future of secure communication",
-    "protocols": ["io.element.desktop", "element"]
-}
--- a/element.io/release/config.json
+++ b/element.io/release/config.json
@@ -19,7 +19,7 @@
        "https://scalar-staging.vector.im/api",
        "https://scalar-staging.riot.im/scalar/api"
    ],
-    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "bug_report_endpoint_url": "https://element.io/bugreports/submit",
    "uisi_autorageshake_app": "element-auto-uisi",
    "room_directory": {
        "servers": ["matrix.org", "gitter.im"]
@@ -47,13 +47,5 @@
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
    "setting_defaults": {
        "RustCrypto.staged_rollout_percent": 60
-    },
-    "features": {
-        "feature_video_rooms": true,
-        "feature_group_calls": true,
-        "feature_element_call_video_rooms": true
-    },
-    "element_call": {
-        "url": "https://call.element.io"
    }
 }
--- a/hak/keytar/build.ts
+++ b/hak/keytar/build.ts
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020-2024 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
+*/
+
+import path from "path";
+import childProcess from "child_process";
+
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";
+
+export default async function buildKeytar(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const env = hakEnv.makeGypEnv();
+
+    console.log("Running yarn with env", env);
+    await new Promise<void>((resolve, reject) => {
+        const proc = childProcess.spawn(
+            path.join(moduleInfo.nodeModuleBinDir, "node-gyp" + (hakEnv.isWin() ? ".cmd" : "")),
+            ["rebuild", "--arch", hakEnv.getTargetArch()],
+            {
+                cwd: moduleInfo.moduleBuildDir,
+                env,
+                stdio: "inherit",
+                // We need shell mode on Windows to be able to launch `.cmd` executables
+                // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+                shell: hakEnv.isWin(),
+            },
+        );
+        proc.on("exit", (code) => {
+            code ? reject(code) : resolve();
+        });
+    });
+}
--- a/hak/keytar/check.ts
+++ b/hak/keytar/check.ts
@@ -0,0 +1,31 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020-2024 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
+*/
+
+import childProcess from "child_process";
+
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const tools = [["python", "--version"]]; // node-gyp uses python for reasons beyond comprehension
+
+    for (const tool of tools) {
+        await new Promise<void>((resolve, reject) => {
+            const proc = childProcess.spawn(tool[0], tool.slice(1), {
+                stdio: ["ignore"],
+            });
+            proc.on("exit", (code) => {
+                if (code !== 0) {
+                    reject("Can't find " + tool);
+                } else {
+                    resolve();
+                }
+            });
+        });
+    }
+}
--- a/hak/keytar/hak.json
+++ b/hak/keytar/hak.json
@@ -0,0 +1,10 @@
+{
+    "scripts": {
+        "check": "check.ts",
+        "build": "build.ts"
+    },
+    "copy": "build/Release/keytar.node",
+    "dependencies": {
+        "libsecret": "0.20.3"
+    }
+}
--- a/hak/matrix-seshat/build.ts
+++ b/hak/matrix-seshat/build.ts
@@ -1,13 +1,15 @@
 /*
 Copyright 2024 New Vector Ltd.
-Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+Copyright 2020-2024 The Matrix.org Foundation C.I.C.

-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
 */

-import type HakEnv from "../../scripts/hak/hakEnv.js";
-import type { DependencyInfo } from "../../scripts/hak/dep.js";
+import childProcess from "child_process";
+
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";

 export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
    const env = hakEnv.makeGypEnv();
@@ -16,19 +18,31 @@ export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Prom
        env.CARGO_BUILD_TARGET = hakEnv.getTargetId();
    }

-    console.log("Running pnpm install");
-    await hakEnv.spawn("pnpm", ["install"], {
-        cwd: moduleInfo.moduleBuildDir,
-        env,
-        shell: true,
+    console.log("Running yarn install");
+    await new Promise<void>((resolve, reject) => {
+        const proc = childProcess.spawn("yarn" + (hakEnv.isWin() ? ".cmd" : ""), ["install"], {
+            cwd: moduleInfo.moduleBuildDir,
+            env,
+            shell: true,
+            stdio: "inherit",
+        });
+        proc.on("exit", (code) => {
+            code ? reject(code) : resolve();
+        });
    });

    const buildTarget = hakEnv.wantsStaticSqlCipher() ? "build-bundled" : "build";

-    console.log("Running pnpm build");
-    await hakEnv.spawn("pnpm", ["run", buildTarget], {
-        cwd: moduleInfo.moduleBuildDir,
-        env,
-        shell: true,
+    console.log("Running yarn build");
+    await new Promise<void>((resolve, reject) => {
+        const proc = childProcess.spawn("yarn" + (hakEnv.isWin() ? ".cmd" : ""), ["run", buildTarget], {
+            cwd: moduleInfo.moduleBuildDir,
+            env,
+            shell: true,
+            stdio: "inherit",
+        });
+        proc.on("exit", (code) => {
+            code ? reject(code) : resolve();
+        });
    });
 }
--- a/hak/matrix-seshat/check.ts
+++ b/hak/matrix-seshat/check.ts
@@ -1,20 +1,19 @@
 /*
 Copyright 2024 New Vector Ltd.
-Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+Copyright 2020-2024 The Matrix.org Foundation C.I.C.

-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
 */

-import childProcess from "node:child_process";
-import fsProm from "node:fs/promises";
+import childProcess from "child_process";
+import fsProm from "fs/promises";

-import type HakEnv from "../../scripts/hak/hakEnv.js";
-import type { Tool } from "../../scripts/hak/hakEnv.js";
-import type { DependencyInfo } from "../../scripts/hak/dep.js";
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";

 export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    const tools: Tool[] = [
+    const tools = [
        ["rustc", "--version"],
        ["python", "--version"], // node-gyp uses python for reasons beyond comprehension
    ];
@@ -26,7 +25,21 @@ export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Prom
    } else {
        tools.push(["make", "--version"]);
    }
-    await hakEnv.checkTools(tools);
+
+    for (const tool of tools) {
+        await new Promise<void>((resolve, reject) => {
+            const proc = childProcess.spawn(tool[0], tool.slice(1), {
+                stdio: ["ignore"],
+            });
+            proc.on("exit", (code) => {
+                if (code !== 0) {
+                    reject("Can't find " + tool);
+                } else {
+                    resolve();
+                }
+            });
+        });
+    }

    // Ensure Rust target exists (nb. we avoid depending on rustup)
    await new Promise((resolve, reject) => {
--- a/hak/tsconfig.json
+++ b/hak/tsconfig.json
@@ -7,5 +7,8 @@
        "strict": true,
        "lib": ["es2022"]
    },
-    "include": ["../scripts/@types/*.d.ts", "./**/*.ts"]
+    "include": ["../scripts/@types/*.d.ts", "./**/*.ts"],
+    "ts-node": {
+        "transpileOnly": true
+    }
 }
--- a/knip.ts
+++ b/knip.ts
@@ -1,17 +1,17 @@
 import { KnipConfig } from "knip";

 export default {
-    entry: ["src/preload.cts", "electron-builder.ts", "scripts/**", "hak/**"],
+    entry: ["src/electron-main.ts", "src/preload.ts", "electron-builder.ts", ".eslintrc-*.js", "scripts/**", "hak/**"],
    project: ["**/*.{js,ts}"],
    ignoreDependencies: [
        // Brought in via hak scripts
+        "keytar",
        "matrix-seshat",
+        // Needed by `electron-builder`
+        "electron-builder-squirrel-windows",
+        "@types/yargs",
        // Required for `action-validator`
        "@action-validator/*",
-        // Used for git pre-commit hooks
-        "husky",
-        // Required for `patch-package`
-        "postinstall-postinstall",
    ],
    ignoreBinaries: ["jq", "scripts/in-docker.sh"],
 } satisfies KnipConfig;
--- a/package.json
+++ b/package.json
@@ -2,72 +2,76 @@
    "name": "element-desktop",
    "productName": "Element",
    "main": "lib/electron-main.js",
-    "exports": "./lib/electron-main.js",
-    "version": "1.12.9",
-    "description": "Element: the future of secure communication",
-    "author": {
-        "name": "Element",
-        "email": "support@element.io"
-    },
+    "version": "1.11.76",
+    "description": "A feature-rich client for Matrix.org",
+    "author": "Element",
    "homepage": "https://element.io",
    "repository": {
        "type": "git",
        "url": "https://github.com/vector-im/element-desktop"
    },
-    "license": "SEE LICENSE IN README.md",
-    "type": "module",
+    "license": "AGPL-3.0-only OR GPL-3.0-only",
    "files": [],
    "engines": {
        "node": ">=18.0.0"
    },
    "scripts": {
-        "i18n": "matrix-gen-i18n && pnpm i18n:sort && pnpm i18n:lint",
-        "i18n:sort": "matrix-sort-i18n src/i18n/strings/en_EN.json",
+        "i18n": "matrix-gen-i18n && yarn i18n:sort && yarn i18n:lint",
+        "i18n:sort": "jq --sort-keys '.' src/i18n/strings/en_EN.json > src/i18n/strings/en_EN.json.tmp && mv src/i18n/strings/en_EN.json.tmp src/i18n/strings/en_EN.json",
        "i18n:lint": "prettier --log-level=silent  --write src/i18n/strings/ --ignore-path /dev/null",
-        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && pnpm i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && yarn i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
        "mkdirs": "mkdirp packages deploys",
-        "fetch": "pnpm run mkdirs && tsx scripts/fetch-package.ts",
+        "fetch": "yarn run mkdirs && ts-node scripts/fetch-package.ts",
        "asar-webapp": "asar p webapp webapp.asar",
-        "start": "pnpm run build:ts && pnpm run build:res && electron .",
-        "lint": "pnpm lint:types && pnpm lint:js && pnpm lint:workflows",
-        "lint:js": "eslint --max-warnings 0 src hak playwright scripts && prettier --check .",
-        "lint:js-fix": "eslint --fix --max-warnings 0 src hak playwright scripts && prettier --log-level=warn --write .",
-        "lint:types": "pnpm lint:types:src && pnpm lint:types:test && pnpm lint:types:scripts && pnpm lint:types:hak",
+        "start": "yarn run build:ts && yarn run build:res && electron .",
+        "lint": "yarn lint:types && yarn lint:js && yarn lint:workflows",
+        "lint:js": "yarn lint:js:src && yarn lint:js:test && yarn lint:js:scripts && yarn lint:js:hak && prettier --check .",
+        "lint:js:src": "eslint --max-warnings 0 src",
+        "lint:js:test": "eslint --max-warnings 0 --config .eslintrc-test.js playwright",
+        "lint:js:scripts": "eslint --max-warnings 0 --config .eslintrc-scripts.js scripts",
+        "lint:js:hak": "eslint --max-warnings 0 --config .eslintrc-hak.js hak",
+        "lint:js-fix": "yarn lint:js-fix:src &&yarn lint:js-fix:test && yarn lint:js-fix:scripts && yarn lint:js-fix:hak && prettier --log-level=warn --write .",
+        "lint:js-fix:src": "eslint --fix --max-warnings 0 src",
+        "lint:js-fix:test": "eslint --fix --max-warnings 0 --config .eslintrc-test.js playwright",
+        "lint:js-fix:scripts": "eslint --fix --max-warnings 0 --config .eslintrc-scripts.js scripts",
+        "lint:js-fix:hak": "eslint --fix --max-warnings 0 --config .eslintrc-hak.js hak",
+        "lint:types": "yarn lint:types:src && yarn lint:types:test && yarn lint:types:scripts && yarn lint:types:hak",
        "lint:types:src": "tsc --noEmit",
        "lint:types:test": "tsc --noEmit -p playwright/tsconfig.json",
        "lint:types:scripts": "tsc --noEmit -p scripts/tsconfig.json",
        "lint:types:hak": "tsc --noEmit -p hak/tsconfig.json",
        "lint:workflows": "find .github/workflows -type f \\( -iname '*.yaml' -o -iname '*.yml' \\) | xargs -I {} sh -c 'echo \"Linting {}\"; action-validator \"{}\"'",
        "lint:knip": "knip",
-        "build:native": "pnpm run hak",
-        "build:native:universal": "pnpm run hak --target x86_64-apple-darwin fetchandbuild && pnpm run hak --target aarch64-apple-darwin fetchandbuild && pnpm run hak --target x86_64-apple-darwin --target aarch64-apple-darwin copyandlink",
-        "build:32": "pnpm run build:ts && pnpm run build:res && electron-builder --ia32",
-        "build:64": "pnpm run build:ts && pnpm run build:res && electron-builder --x64",
-        "build:universal": "pnpm run build:ts && pnpm run build:res && electron-builder --universal",
-        "build": "pnpm run build:ts && pnpm run build:res && electron-builder",
+        "build:native": "yarn run hak",
+        "build:native:universal": "yarn run hak --target x86_64-apple-darwin fetchandbuild && yarn run hak --target aarch64-apple-darwin fetchandbuild && yarn run hak --target x86_64-apple-darwin --target aarch64-apple-darwin copyandlink",
+        "build:32": "yarn run build:ts && yarn run build:res && electron-builder --ia32",
+        "build:64": "yarn run build:ts && yarn run build:res && electron-builder --x64",
+        "build:universal": "yarn run build:ts && yarn run build:res && electron-builder --universal",
+        "build": "yarn run build:ts && yarn run build:res && electron-builder",
        "build:ts": "tsc",
-        "build:res": "tsx scripts/copy-res.ts",
-        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild -f dockerbuild/Dockerfile .",
-        "docker:build:native": "scripts/in-docker.sh pnpm run hak",
-        "docker:build": "scripts/in-docker.sh pnpm run build",
-        "docker:install": "scripts/in-docker.sh pnpm install",
+        "build:res": "ts-node scripts/copy-res.ts",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild dockerbuild",
+        "docker:build:native": "scripts/in-docker.sh yarn run hak",
+        "docker:build": "scripts/in-docker.sh yarn run build",
+        "docker:install": "scripts/in-docker.sh yarn install",
        "clean": "rimraf webapp.asar dist packages deploys lib",
-        "hak": "tsx scripts/hak/index.ts",
+        "hak": "ts-node scripts/hak/index.ts",
        "test": "playwright test",
-        "test:open": "pnpm test --ui",
+        "test:open": "yarn test --ui",
        "test:screenshots:build": "docker build playwright -t element-desktop-playwright --platform linux/amd64",
-        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v element-desktop-playwright:/work/element-desktop/node_modules -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright",
-        "postinstall": "electron-builder install-app-deps"
+        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright"
    },
    "dependencies": {
-        "@sentry/electron": "^7.0.0",
+        "@sentry/electron": "^5.0.0",
        "auto-launch": "^5.0.5",
        "counterpart": "^0.18.6",
-        "electron-store": "^11.0.0",
+        "electron-clear-data": "^1.0.5",
+        "electron-store": "^8.0.2",
        "electron-window-state": "^5.0.3",
        "minimist": "^1.2.6",
-        "png-to-ico": "^3.0.0",
-        "uuid": "^13.0.0"
+        "node-fetch": "^2",
+        "png-to-ico": "^2.1.1",
+        "uuid": "^10.0.0"
    },
    "devDependencies": {
        "@action-validator/cli": "^0.6.0",
@@ -75,69 +79,50 @@
        "@babel/core": "^7.18.10",
        "@babel/preset-env": "^7.18.10",
        "@babel/preset-typescript": "^7.18.6",
-        "@electron/asar": "4.0.1",
-        "@playwright/test": "1.58.1",
-        "@stylistic/eslint-plugin": "^5.0.0",
+        "@electron/asar": "^3.2.3",
+        "@electron/fuses": "^1.7.0",
+        "@mapbox/node-pre-gyp": "^1.0.11",
+        "@playwright/test": "1.46.1",
        "@types/auto-launch": "^5.0.1",
        "@types/counterpart": "^0.18.1",
        "@types/minimist": "^1.2.1",
-        "@types/node": "18.19.130",
+        "@types/node": "18.19.47",
        "@types/pacote": "^11.1.1",
-        "@typescript-eslint/eslint-plugin": "^8.0.0",
-        "@typescript-eslint/parser": "^8.0.0",
-        "app-builder-lib": "26.6.0",
-        "chokidar": "^5.0.0",
+        "@types/tar": "^6.1.3",
+        "@types/uuid": "^10.0.0",
+        "@types/yargs": "^17.0.32",
+        "@typescript-eslint/eslint-plugin": "^7.0.0",
+        "@typescript-eslint/parser": "^7.0.0",
+        "app-builder-lib": "24.13.3",
+        "chokidar": "^3.5.2",
        "detect-libc": "^2.0.0",
-        "electron": "40.1.0",
-        "electron-builder": "26.6.0",
-        "electron-builder-squirrel-windows": "26.6.0",
-        "electron-devtools-installer": "^4.0.0",
-        "electron-playwright-helpers": "^2.1.0",
+        "electron": "^32.0.0",
+        "electron-builder": "24.13.3",
+        "electron-builder-squirrel-windows": "24.13.3",
+        "electron-devtools-installer": "^3.2.0",
        "eslint": "^8.26.0",
        "eslint-config-google": "^0.14.0",
-        "eslint-config-prettier": "^10.0.0",
+        "eslint-config-prettier": "^9.0.0",
        "eslint-plugin-import": "^2.25.4",
-        "eslint-plugin-matrix-org": "^3.0.0",
-        "eslint-plugin-n": "^17.12.0",
-        "eslint-plugin-unicorn": "^56.0.0",
-        "glob": "^13.0.0",
-        "husky": "^9.1.6",
+        "eslint-plugin-matrix-org": "^1.0.0",
+        "eslint-plugin-unicorn": "^55.0.0",
+        "glob": "^11.0.0",
        "knip": "^5.0.0",
-        "lint-staged": "^16.0.0",
-        "matrix-web-i18n": "3.6.0",
+        "matrix-web-i18n": "^3.2.1",
        "mkdirp": "^3.0.0",
-        "pacote": "^21.0.0",
+        "pacote": "^18.0.0",
        "prettier": "^3.0.0",
        "rimraf": "^6.0.0",
-        "tar": "^7.0.0",
-        "tsx": "^4.19.2",
-        "typescript": "5.9.3"
+        "tar": "^6.2.1",
+        "ts-node": "^10.9.1",
+        "typescript": "5.5.4"
    },
    "hakDependencies": {
-        "matrix-seshat": "^4.0.1"
+        "matrix-seshat": "^4.0.0",
+        "keytar": "^7.9.0"
    },
    "resolutions": {
-        "atomically": "2.1.0",
-        "@types/node": "18.19.130",
-        "config-file-ts": "0.2.8-rc1",
-        "node-abi": "4.26.0",
-        "@types/pg-pool": "2.0.7"
-    },
-    "pnpm": {
-        "onlyBuiltDependencies": [
-            "matrix-js-sdk"
-        ],
-        "patchedDependencies": {
-            "@types/auto-launch": "patches/@types__auto-launch.patch"
-        },
-        "peerDependencyRules": {
-            "allowedVersions": {
-                "eslint": "8"
-            }
-        },
-        "allowedDeprecatedVersions": {
-            "eslint": "8"
-        }
-    },
-    "packageManager": "pnpm@10.28.2+sha512.41872f037ad22f7348e3b1debbaf7e867cfd448f2726d9cf74c08f19507c31d2c8e7a11525b983febc2df640b5438dee6023ebb1f84ed43cc2d654d2bc326264"
+        "@types/node": "18.19.47",
+        "config-file-ts": "0.2.8-rc1"
+    }
 }
--- a/patches/@types__auto-launch.patch
+++ b/patches/@types__auto-launch.patch
@@ -1,18 +0,0 @@
-diff --git a/index.d.ts b/index.d.ts
-index a30a77c..e512ce1 100644
--- a/index.d.ts
-+++ b/index.d.ts
-@@ -25,6 +25,13 @@ interface AutoLaunchOptions {
- declare class AutoLaunch {
-     constructor(options: AutoLaunchOptions);
- 
-+    /**
-+     * This type describes the internal options of the `auto-launch` package which allows us to update options after initialization.
-+     */
-+    readonly opts: {
-+        isHiddenOnLaunch: boolean;
-+    };
-+
-     /**
-      * Enables auto-launch at start up.
-      */
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -1,32 +1,14 @@
 /*
 Copyright 2024 New Vector Ltd.
-Copyright 2023 The Matrix.org Foundation C.I.C.
+Copyright 2023, 2024 The Matrix.org Foundation C.I.C.

-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
 */

 import { defineConfig } from "@playwright/test";

-const projects = [
-    "macos",
-    "win-x64",
-    "win-ia32",
-    "win-arm64",
-    "linux-amd64-sqlcipher-system",
-    "linux-amd64-sqlcipher-static",
-    "linux-arm64-sqlcipher-system",
-    "linux-arm64-sqlcipher-static",
-];
-
 export default defineConfig({
-    // Allows the GitHub action to specify a project name (OS + arch) for the combined report to make sense
-    // workaround for https://github.com/microsoft/playwright/issues/33521
-    projects: process.env.CI
-        ? projects.map((name) => ({
-              name,
-          }))
-        : undefined,
    use: {
        viewport: { width: 1280, height: 720 },
        video: "retain-on-failure",
@@ -36,7 +18,7 @@ export default defineConfig({
    outputDir: "playwright/test-results",
    workers: 1,
    retries: process.env.CI ? 2 : 0,
-    reporter: process.env.CI ? [["blob"], ["github"]] : [["html", { outputFolder: "playwright/html-report" }]],
+    reporter: [["html", { outputFolder: "playwright/html-report" }]],
    snapshotDir: "playwright/snapshots",
    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
    timeout: 30 * 1000,
--- a/playwright/Dockerfile
+++ b/playwright/Dockerfile
@@ -1,11 +1,8 @@
-FROM mcr.microsoft.com/playwright:v1.58.1-jammy@sha256:1b52a0833ae13c3bb16f728eec5f9216db29f3cd5eec21a9cbd33e7623723c0e
+FROM mcr.microsoft.com/playwright:v1.46.1-jammy

 WORKDIR /work/element-desktop

-RUN apt-get update && apt-get -y install xvfb dbus-x11 && apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
-
-# Create node_modules & dist dirs so that the volumes have the correct permissions
-RUN mkdir node_modules dist && chown 1000:1000 node_modules dist
+RUN apt-get update && apt-get -y install xvfb && apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*

 USER 1000:1000

--- a/playwright/docker-entrypoint.sh
+++ b/playwright/docker-entrypoint.sh
@@ -8,11 +8,4 @@ sleep 2

 export DISPLAY=:99

-pnpm install --frozen-lockfile
-pnpm build -l --dir
-
-PLAYWRIGHT_HTML_OPEN=never ELEMENT_DESKTOP_EXECUTABLE="./dist/linux-unpacked/element-desktop" \
-  npx playwright test --update-snapshots --reporter line,html "$1"
-
-# Clean up
-rm -R core qemu_* || exit 0
+npx playwright test --update-snapshots --reporter line $1
--- a/playwright/e2e/launch/config-options.spec.ts
+++ b/playwright/e2e/launch/config-options.spec.ts
@@ -1,44 +0,0 @@
-/*
-Copyright 2024 New Vector Ltd.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-import { resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { test, expect } from "../../element-desktop-test.js";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-test.describe("App config options", () => {
-    test.describe("Should load custom config via env", () => {
-        test.slow();
-        test.use({
-            extraEnv: {
-                ELEMENT_DESKTOP_CONFIG_JSON: resolve(__dirname, "../..", "fixtures/custom-config.json"),
-            },
-        });
-        test("should launch and use configured homeserver", async ({ page }) => {
-            await page.locator("#matrixchat").waitFor();
-            await page.locator(".mx_Welcome").waitFor();
-            await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
-            await page.getByText("Sign in").click();
-            await page.getByText("matrix.example.org", { exact: true }).waitFor();
-        });
-    });
-    test.describe("Should load custom config via argument", () => {
-        test.slow();
-        test.use({
-            extraArgs: ["--config", resolve(__dirname, "../..", "fixtures/custom-config.json")],
-        });
-        test("should launch and use configured homeserver", async ({ page }) => {
-            await page.locator("#matrixchat").waitFor();
-            await page.locator(".mx_Welcome").waitFor();
-            await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
-            await page.getByText("Sign in").click();
-            await page.getByText("matrix.example.org", { exact: true }).waitFor();
-        });
-    });
-});
--- a/playwright/e2e/launch/launch.spec.ts
+++ b/playwright/e2e/launch/launch.spec.ts
@@ -1,75 +1,40 @@
 /*
 Copyright 2024 New Vector Ltd.
-Copyright 2022, 2023 The Matrix.org Foundation C.I.C.
+Copyright 2022-2024 The Matrix.org Foundation C.I.C.

-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
 */

-import { test, expect } from "../../element-desktop-test.js";
+import { test, expect } from "../../element-desktop-test";

 declare global {
-    interface ElectronPlatform {
-        getEventIndexingManager():
-            | {
-                  supportsEventIndexing(): Promise<boolean>;
-              }
-            | undefined;
-        getPickleKey(userId: string, deviceId: string): Promise<string | null>;
-        createPickleKey(userId: string, deviceId: string): Promise<string | null>;
-    }
-
    interface Window {
        mxPlatformPeg: {
-            get(): ElectronPlatform;
+            get(): {
+                getEventIndexingManager():
+                    | {
+                          supportsEventIndexing(): Promise<boolean>;
+                      }
+                    | undefined;
+            };
        };
    }
 }

 test.describe("App launch", () => {
    test.slow();
-
-    test.beforeEach(async ({ page }) => {
+    test("should launch and render the welcome view successfully and support seshat", async ({ page }) => {
        await page.locator("#matrixchat").waitFor();
        await page.locator(".mx_Welcome").waitFor();
-    });
-
-    test("should launch and render the welcome view successfully", async ({ page }) => {
        await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
        await expect(page).toHaveScreenshot();
-    });

-    test("should launch and render the welcome view successfully and support seshat", async ({ page }) => {
-        await expect(
-            page.evaluate<boolean>(async () => {
-                return window.mxPlatformPeg.get().getEventIndexingManager()?.supportsEventIndexing();
-            }),
-        ).resolves.toBeTruthy();
-    });
-
-    test.describe("safeStorage", () => {
-        const userId = "@user:server";
-        const deviceId = "ABCDEF";
-
-        test("should be supported", async ({ page }) => {
-            await expect(
-                page.evaluate(
-                    ([userId, deviceId]) => window.mxPlatformPeg.get().createPickleKey(userId, deviceId),
-                    [userId, deviceId],
-                ),
-            ).resolves.not.toBeNull();
-        });
-    });
-
-    test.describe("--no-update", () => {
-        test.use({
-            extraArgs: ["--no-update"],
+        const supported = await page.evaluate<boolean>(async () => {
+            const indexManager = window.mxPlatformPeg.get()?.getEventIndexingManager();
+            return await indexManager?.supportsEventIndexing();
        });

-        // XXX: this test works fine locally but in CI the app start races with the test plumbing up the stdout/stderr pipes
-        // which means the logs are missed, disabling for now.
-        test.skip("should respect option", async ({ page, stdout }) => {
-            expect(stdout.data.toString()).toContain("Auto update disabled via command line flag");
-        });
+        expect(supported).toBe(true);
    });
 });
--- a/playwright/e2e/launch/oidc.spec.ts
+++ b/playwright/e2e/launch/oidc.spec.ts
@@ -1,36 +0,0 @@
-/*
-Copyright 2025 New Vector Ltd.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-import { test, expect } from "../../element-desktop-test.js";
-
-declare global {
-    interface ElectronPlatform {
-        getOidcCallbackUrl(): URL;
-    }
-
-    interface Window {
-        mxPlatformPeg: {
-            get(): ElectronPlatform;
-        };
-    }
-}
-
-test.describe("OIDC Native", () => {
-    test.slow();
-
-    test.beforeEach(async ({ page }) => {
-        await page.locator(".mx_Welcome").waitFor();
-    });
-
-    test("should use OIDC callback URL without authority component", async ({ page }) => {
-        await expect(
-            page.evaluate<string>(() => {
-                return window.mxPlatformPeg.get().getOidcCallbackUrl().toString();
-            }),
-        ).resolves.toMatch(/io\.element\.(desktop|nightly):\/vector\/webapp\//);
-    });
-});
--- a/playwright/element-desktop-test.ts
+++ b/playwright/element-desktop-test.ts
@@ -1,83 +1,26 @@
 /*
 Copyright 2024 New Vector Ltd.
-Copyright 2023 The Matrix.org Foundation C.I.C.
+Copyright 2023, 2024 The Matrix.org Foundation C.I.C.

-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
 */

 import { _electron as electron, test as base, expect as baseExpect, type ElectronApplication } from "@playwright/test";
 import fs from "node:fs/promises";
-import path, { dirname } from "node:path";
+import path from "node:path";
 import os from "node:os";
-import { fileURLToPath } from "node:url";
-import { PassThrough } from "node:stream";
-import { stubDialog } from "electron-playwright-helpers";
-
-/**
- * A PassThrough stream that captures all data written to it.
- */
-class CapturedPassThrough extends PassThrough {
-    private _chunks = [];
-
-    public constructor() {
-        super();
-        super.on("data", this.onData);
-    }
-
-    private onData = (chunk): void => {
-        this._chunks.push(chunk);
-    };
-
-    public get data(): Buffer {
-        return Buffer.concat(this._chunks);
-    }
-}
-
-interface Fixtures {
-    app: ElectronApplication;
-    tmpDir: string;
-    extraEnv: Record<string, string>;
-    extraArgs: string[];
-
-    // Utilities to capture stdout and stderr for tests to make assertions against
-    stdout: CapturedPassThrough;
-    stderr: CapturedPassThrough;
-}
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-export const test = base.extend<Fixtures>({
-    extraEnv: {},
-    extraArgs: [],
-
-    // eslint-disable-next-line no-empty-pattern
-    stdout: async ({}, use) => {
-        await use(new CapturedPassThrough());
-    },
-    // eslint-disable-next-line no-empty-pattern
-    stderr: async ({}, use) => {
-        await use(new CapturedPassThrough());
-    },

+export const test = base.extend<{ app: ElectronApplication; tmpDir: string }>({
    // eslint-disable-next-line no-empty-pattern
    tmpDir: async ({}, use) => {
        const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "element-desktop-tests-"));
+        console.log("Using temp profile directory: ", tmpDir);
        await use(tmpDir);
        await fs.rm(tmpDir, { recursive: true });
    },
-    app: async ({ tmpDir, extraEnv, extraArgs, stdout, stderr }, use) => {
-        const args = ["--profile-dir", tmpDir, ...extraArgs];
-
-        if (process.env.GITHUB_ACTIONS) {
-            if (process.platform === "linux") {
-                // GitHub Actions hosted runner lacks dbus and a compatible keyring, so we need to force plaintext storage
-                args.push("--storage-mode", "force-plaintext");
-            } else if (process.platform === "darwin") {
-                // GitHub Actions hosted runner has no working default keychain, so allow plaintext storage
-                args.push("--storage-mode", "allow-plaintext");
-            }
-        }
+    app: async ({ tmpDir }, use) => {
+        const args = ["--profile-dir", tmpDir];

        const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
        if (!executablePath) {
@@ -85,35 +28,21 @@ export const test = base.extend<Fixtures>({
            args.unshift(path.join(__dirname, "..", "lib", "electron-main.js"));
        }

-        console.log(`Launching '${executablePath || "electron"}' with args ${args.join(" ")}`);
-
        const app = await electron.launch({
-            env: {
-                ...process.env,
-                ...extraEnv,
-            },
+            env: process.env,
            executablePath,
            args,
        });

-        app.process().stdout.pipe(stdout).pipe(process.stdout);
-        app.process().stderr.pipe(stderr).pipe(process.stderr);
+        app.process().stdout.pipe(process.stdout);
+        app.process().stderr.pipe(process.stderr);

        await app.firstWindow();
-
-        // Block matrix.org access to ensure consistent tests
-        const context = app.context();
-        await context.route("https://matrix.org/**", async (route) => {
-            await route.abort();
-        });
-
        await use(app);
    },
    page: async ({ app }, use) => {
        const window = await app.firstWindow();
        await use(window);
-        // EW may be configured to ask for confirmation before the app exits.
-        await stubDialog(app, "showMessageBoxSync", 1);
        await app.close().catch((e) => {
            console.error(e);
        });
--- a/playwright/fixtures/custom-config.json
+++ b/playwright/fixtures/custom-config.json
@@ -1,10 +0,0 @@
-{
-    "default_server_config": {
-        "m.homeserver": {
-            "base_url": "https://matrix.example.org"
-        },
-        "m.identity_server": {
-            "base_url": "https://identity.example.org"
-        }
-    }
-}
--- a/playwright/snapshots/launch/launch.spec.ts/App-launch-should-launch-and-render-the-welcome-view-successfully-1-linux.png
+++ b/playwright/snapshots/launch/launch.spec.ts/App-launch-should-launch-and-render-the-welcome-view-successfully-1-linux.png
--- a/playwright/snapshots/launch/launch.spec.ts/App-launch-should-launch-and-render-the-welcome-view-successfully-and-support-seshat-1-linux.png
+++ b/playwright/snapshots/launch/launch.spec.ts/App-launch-should-launch-and-render-the-welcome-view-successfully-and-support-seshat-1-linux.png
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1 +0,0 @@
-nodeLinker: hoisted
--- a/release_config.yaml
+++ b/release_config.yaml
@@ -0,0 +1,7 @@
+signing_id: releases@riot.im
+subprojects:
+    element-web:
+        includeByDefault: true
+        # Because element-web is not in our dependencies, but the versions
+        # follow those of this project (well, vice-versa really)
+        mirrorVersion: true
--- a/res/img/element.ico
+++ b/res/img/element.ico
--- a/res/img/element.png
+++ b/res/img/element.png
--- a/scripts/@types/node-pre-gyp.d.ts
+++ b/scripts/@types/node-pre-gyp.d.ts
@@ -0,0 +1,11 @@
+/*
+Copyright 2022-2024 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE in the repository root for full details.
+*/
+
+declare module "@mapbox/node-pre-gyp/lib/util/versioning" {
+    // eslint-disable-next-line @typescript-eslint/naming-convention
+    export function get_runtime_abi(runtime: string, version: string): string;
+}
--- a/scripts/branch-match.sh
+++ b/scripts/branch-match.sh
@@ -1,48 +0,0 @@
-#!/bin/bash
-
-# Script for downloading a branch of element-web matching the branch a PR is contributed from
-
-set -x
-
-deforg="element-hq"
-defrepo="element-web"
-
-# The PR_NUMBER variable must be set explicitly.
-default_org_repo=${GITHUB_REPOSITORY:-"$deforg/$defrepo"}
-PR_ORG=${PR_ORG:-${default_org_repo%%/*}}
-PR_REPO=${PR_REPO:-${default_org_repo##*/}}
-
-# A function that clones a branch of a repo based on the org, repo and branch
-clone() {
-    org=$1
-    repo=$2
-    branch=$3
-    if [ -n "$branch" ]
-    then
-        echo "Trying to use $org/$repo#$branch"
-        # Disable auth prompts: https://serverfault.com/a/665959
-        GIT_TERMINAL_PROMPT=0 git clone https://github.com/$org/$repo.git $repo --branch "$branch" --depth 1 && exit 0
-    fi
-}
-
-echo "Getting info about a PR with number $PR_NUMBER"
-apiEndpoint="https://api.github.com/repos/$PR_ORG/$PR_REPO/pulls/$PR_NUMBER"
-head=$(curl "$apiEndpoint" | jq -r '.head.label')
-
-# for forks, $head will be in the format "fork:branch", so we split it by ":"
-# into an array. On non-forks, this has the effect of splitting into a single
-# element array given ":" shouldn't appear in the head - it'll just be the
-# branch name. Based on the results, we clone.
-BRANCH_ARRAY=(${head//:/ })
-TRY_ORG=$deforg
-TRY_BRANCH=${BRANCH_ARRAY[0]}
-if [[ "$head" == *":"* ]]; then
-    # ... but only match that fork if it's a real fork
-    if [ "${BRANCH_ARRAY[0]}" != "$PR_ORG" ]; then
-        TRY_ORG=${BRANCH_ARRAY[0]}
-    fi
-    TRY_BRANCH=${BRANCH_ARRAY[1]}
-fi
-clone "$TRY_ORG" "$defrepo" "$TRY_BRANCH"
-
-exit 1
--- a/scripts/cl.bat
+++ b/scripts/cl.bat
@@ -1,7 +0,0 @@
-REM Batch file to aid in cross-compiling sqlcipher for Windows ARM64
-REM Full path should be passed to Makefile.msc as NCC env var
-
-setlocal
-call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" %VSCMD_ARG_HOST_ARCH%
-cl.exe %*
-endlocal
--- a/scripts/copy-res.ts
+++ b/scripts/copy-res.ts
@@ -1,20 +1,20 @@
-#!/usr/bin/env -S npx tsx
+#!/usr/bin/env -S npx ts-node

 // copies resources into the lib directory.

 import parseArgs from "minimist";
 import * as chokidar from "chokidar";
-import * as path from "node:path";
-import * as fs from "node:fs";
+import * as path from "path";
+import * as fs from "fs";

 const argv = parseArgs(process.argv.slice(2), {});

 const watch = argv.w;
 const verbose = argv.v;

-function errCheck(err: unknown): void {
+function errCheck(err?: Error): void {
    if (err) {
-        console.error(err instanceof Error ? err.message : err);
+        console.error(err.message);
        process.exit(1);
    }
 }
--- a/scripts/fetch-package.ts
+++ b/scripts/fetch-package.ts
@@ -1,14 +1,15 @@
-#!/usr/bin/env -S npx tsx --resolveJsonModule
+#!/usr/bin/env -S npx ts-node --resolveJsonModule

-import * as path from "node:path";
-import { createWriteStream, promises as fs } from "node:fs";
-import * as childProcess from "node:child_process";
-import * as tar from "tar";
+import * as path from "path";
+import { createWriteStream, promises as fs } from "fs";
+import * as childProcess from "child_process";
+import tar from "tar";
 import * as asar from "@electron/asar";
-import { promises as stream } from "node:stream";
+import fetch from "node-fetch";
+import { promises as stream } from "stream";

 import riotDesktopPackageJson from "../package.json";
-import { setPackageVersion } from "./set-version.js";
+import { setPackageVersion } from "./set-version";

 const PUB_KEY_URL = "https://packages.riot.im/element-release-key.asc";
 const PACKAGE_URL_PREFIX = "https://github.com/element-hq/element-web/releases/download/";
@@ -27,7 +28,7 @@ async function downloadToFile(url: string, filename: string): Promise<void> {
        console.error(e);
        try {
            await fs.unlink(filename);
-        } catch {}
+        } catch (_) {}
        throw e;
    }
 }
@@ -124,8 +125,6 @@ async function main(): Promise<number | undefined> {
            });
            fetch(PUB_KEY_URL)
                .then((resp) => {
-                    if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
-                    if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
                    stream.pipeline(resp.body, gpgProc.stdin!).catch(reject);
                })
                .catch(reject);
@@ -151,14 +150,14 @@ async function main(): Promise<number | undefined> {
        await fs.opendir(expectedDeployDir);
        console.log(expectedDeployDir + "already exists");
        haveDeploy = true;
-    } catch {}
+    } catch (e) {}

    if (!haveDeploy) {
        const outPath = path.join(pkgDir, filename);
        try {
            await fs.stat(outPath);
            console.log("Already have " + filename + ": not redownloading");
-        } catch {
+        } catch (e) {
            try {
                await downloadToFile(url, outPath);
            } catch (e) {
@@ -171,7 +170,7 @@ async function main(): Promise<number | undefined> {
            try {
                await fs.stat(outPath + ".asc");
                console.log("Already have " + filename + ".asc: not redownloading");
-            } catch {
+            } catch (e) {
                try {
                    await downloadToFile(url + ".asc", outPath + ".asc");
                } catch (e) {
@@ -207,7 +206,7 @@ async function main(): Promise<number | undefined> {
        await fs.stat(ASAR_PATH);
        console.log(ASAR_PATH + " already present: removing");
        await fs.unlink(ASAR_PATH);
-    } catch {}
+    } catch (e) {}

    if (cfgDir.length) {
        const configJsonSource = path.join(cfgDir, "config.json");
--- a/scripts/fetchdep.sh
+++ b/scripts/fetchdep.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+set -x
+
+deforg="$1"
+defrepo="$2"
+defbranch="$3"
+
+[ -z "$defbranch" ] && defbranch="develop"
+
+rm -r "$defrepo" || true
+
+clone() {
+    org=$1
+    repo=$2
+    branch=$3
+    if [ -n "$branch" ]
+    then
+        echo "Trying to use $org/$repo#$branch"
+        # Disable auth prompts: https://serverfault.com/a/665959
+        GIT_TERMINAL_PROMPT=0 git clone https://github.com/$org/$repo.git $repo --branch "$branch" --depth 1 && exit 0
+    fi
+}
+
+# Try the PR author's branch in case it exists on the deps as well.
+# If BUILDKITE_BRANCH is set, it will contain either:
+#   * "branch" when the author's branch and target branch are in the same repo
+#   * "author:branch" when the author's branch is in their fork
+# We can split on `:` into an array to check.
+BUILDKITE_BRANCH_ARRAY=(${BUILDKITE_BRANCH//:/ })
+if [[ "${#BUILDKITE_BRANCH_ARRAY[@]}" == "1" ]]; then
+    clone $deforg $defrepo $BUILDKITE_BRANCH
+elif [[ "${#BUILDKITE_BRANCH_ARRAY[@]}" == "2" ]]; then
+    clone ${BUILDKITE_BRANCH_ARRAY[0]} $defrepo ${BUILDKITE_BRANCH_ARRAY[1]}
+fi
+# Try the target branch of the push or PR.
+clone $deforg $defrepo $BUILDKITE_PULL_REQUEST_BASE_BRANCH
+# Try the current branch from Jenkins.
+clone $deforg $defrepo `"echo $GIT_BRANCH" | sed -e 's/^origin\///'`
+# Use the default branch as the last resort.
+clone $deforg $defrepo $defbranch
--- a/scripts/generate-nightly-version.ts
+++ b/scripts/generate-nightly-version.ts
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S npx tsx
+#!/usr/bin/env -S npx ts-node

 /**
 * Script to generate incremental Nightly build versions, based on the latest Nightly build version of that kind.
--- a/scripts/get-version.ts
+++ b/scripts/get-version.ts
@@ -1,12 +1,10 @@
-#!/usr/bin/env -S npx tsx
+#!/usr/bin/env -S npx ts-node

 /*
 * Checks for the presence of a webapp, inspects its version and prints it
 */

-import url from "node:url";
-
-import { versionFromAsar } from "./set-version.js";
+import { versionFromAsar } from "./set-version";

 async function main(): Promise<number> {
    const version = await versionFromAsar();
@@ -15,16 +13,13 @@ async function main(): Promise<number> {
    return 0;
 }

-if (import.meta.url.startsWith("file:")) {
-    const modulePath = url.fileURLToPath(import.meta.url);
-    if (process.argv[1] === modulePath) {
-        main()
-            .then((ret) => {
-                process.exit(ret);
-            })
-            .catch((e) => {
-                console.error(e);
-                process.exit(1);
-            });
-    }
+if (require.main === module) {
+    main()
+        .then((ret) => {
+            process.exit(ret);
+        })
+        .catch((e) => {
+            console.error(e);
+            process.exit(1);
+        });
 }
--- a/scripts/glibc-check.sh
+++ b/scripts/glibc-check.sh
@@ -3,7 +3,7 @@
 # Source https://gist.github.com/vladimyr/9a03481154cd3048a486bdf71e5e1535/57e57a6ace6fb2c8bba948bce726df7a96c3f99f
 # This scripts lets you check which minimum GLIBC version an executable requires.
 # Simply run './glibc-check.sh path/to/your/binary'
-MAX_GLIBC="${MAX_GLIBC:-2.28}"
+MAX_VER="${MAX_VER:-2.28}"

 BINARY="$1"

@@ -39,10 +39,10 @@ IFS="
 VERS=$(objdump -T "$BINARY" | grep GLIBC_ | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -u)

 for VER in $VERS; do
-  vercomp "$VER" "$MAX_GLIBC"
+  vercomp "$VER" "$MAX_VER"
  COMP=$?
  if [[ $COMP -eq 1 ]]; then
-    echo "Error! ${BINARY} requests GLIBC ${VER}, which is higher than target ${MAX_GLIBC}"
+    echo "Error! ${BINARY} requests GLIBC ${VER}, which is higher than target ${MAX_VER}"
    echo "Affected symbols:"
    objdump -T "$BINARY" | grep -F "GLIBC_${VER}"
    echo "Looking for symbols in libraries..."
--- a/scripts/hak/README.md
+++ b/scripts/hak/README.md
@@ -5,12 +5,12 @@ documentation for it.

 Goals:

- Must build compiled native node modules in a shippable state
-  (ie. only dynamically linked against libraries that will be on the
-  target system, all unnecessary files removed).
- Must be able to build any native module, no matter what build system
-  it uses (electron-rebuild is supposed to do this job but only works
-  for modules that use gyp).
+-   Must build compiled native node modules in a shippable state
+    (ie. only dynamically linked against libraries that will be on the
+    target system, all unnecessary files removed).
+-   Must be able to build any native module, no matter what build system
+    it uses (electron-rebuild is supposed to do this job but only works
+    for modules that use gyp).

 It's also loosely designed to be a general tool and agnostic to what it's
 actually building. It's used here to build modules for the electron app
@@ -18,34 +18,34 @@ but should work equally well for building modules for normal node.

 # Running

-Hak is invoked with a command and a dependency, eg. `pnpm run hak fetch matrix-seshat`.
+Hak is invoked with a command and a dependency, eg. `yarn run hak fetch matrix-seshat`.
 If no dependencies are given, hak runs the command on all dependencies.

 # Files

 There are a lot of files involved:

- scripts/hak/... - The tool itself
- hak/[dependency] - Files provided by the app that tell hak how to build each of its native dependencies.
-  Contains a hak.json file and also some script files, each of which must be referenced in hak.json.
- .hak/ - Files generated by hak in the course of doing its job. Includes the dependency module itself and
-  any of the native dependency's native dependencies.
- .hak/[dependency]/build - An extracted copy of the dependency's node module used to build it.
- .hak/[dependency]/out - Another extracted copy of the dependency, this one contains only what will be shipped.
+-   scripts/hak/... - The tool itself
+-   hak/[dependency] - Files provided by the app that tell hak how to build each of its native dependencies.
+    Contains a hak.json file and also some script files, each of which must be referenced in hak.json.
+-   .hak/ - Files generated by hak in the course of doing its job. Includes the dependency module itself and
+    any of the native dependency's native dependencies.
+-   .hak/[dependency]/build - An extracted copy of the dependency's node module used to build it.
+-   .hak/[dependency]/out - Another extracted copy of the dependency, this one contains only what will be shipped.

 # Workings

 Hak works around native node modules that try to fetch or build their native component in
 the npm 'install' phase - modules that do this will typically end up with native components
-targeted to the build platform and the node that npm/pnpm is using, which is no good for an
+targeted to the build platform and the node that npm/yarn is using, which is no good for an
 electron app.

-It does this by installing it with `--ignore-scripts` and then using `pnpm link` to keep the
-dependency module separate so pnpm doesn't try to run its install / postinstall script
-at other points (eg. whenever you `pnpm add` a random other dependency).
+It does this by installing it with `--ignore-scripts` and then using `yarn link` to keep the
+dependency module separate so yarn doesn't try to run its install / postinstall script
+at other points (eg. whenever you `yarn add` a random other dependency).

 This also means that the dependencies cannot be listed in `dependencies` or
-`devDependencies` in the project, since this would cause pnpm to install them and
+`devDependencies` in the project, since this would cause npm / yarn to install them and
 try to fetch their native parts. Instead, they are listed in `hakDependencies` which
 hak reads to install them for you.

@@ -53,25 +53,28 @@ Hak will _not_ install dependencies for the copy of the module it links into you
 project, so if your native module has javascript dependencies that are actually needed at
 runtime (and not just to fetch / build the native parts), it won't work.

+Hak will generate a `.yarnrc` in the project directory to set the link directory to its
+own in the .hak directory (unless one already exists, in which case this is your problem).
+
 # Lifecycle

 Hak is divided into lifecycle stages, in order:

- fetch - Download and extract the source of the dependency
- link - Link the copy of the dependency into your node_modules directory
- build - The Good Stuff. Configure and build any native dependencies, then the module itself.
- copy - Copy the built artifact from the module build directory to the module output directory.
+-   fetch - Download and extract the source of the dependency
+-   link - Link the copy of the dependency into your node_modules directory
+-   build - The Good Stuff. Configure and build any native dependencies, then the module itself.
+-   copy - Copy the built artifact from the module build directory to the module output directory.

 # hak.json

-The scripts section contains scripts used for lifecycle stages that need them (fetch, build).
+The scripts section contains scripts used for lifecycle stages that need them (fetch, fetchDeps, build).
 It also contains 'prune' and 'copy' which are globs of files to delete from the output module directory
 and copy over from the module build directory to the output module directory, respectively.

 # Shortcomings

 Hak doesn't know about dependencies between lifecycle stages, ie. it doesn't know that you need to
-'fetch' before you can 'build', etc. You get to run each individually, and remember
+'fetch' and 'fetchDeps' before you can 'build', etc. You get to run each individually, and remember
 the right order.

 There is also a _lot_ of duplication in the command execution: we should abstract away
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
David Langley	cdc6d60e48	Update pull request template and add contributing guide for CLA	2024-09-05 20:07:21 +01:00
David Langley	cceb34315d	Update LICENCE files, package.json and readme.	2024-09-05 19:14:04 +01:00
David Langley	11054ccbc4	Update file headers copyright and change licence to AGPL-3.0-only OR GPL-3.0-only	2024-09-05 18:51:53 +01:00