v1.11.67

Signed-off-by: Misty De Meo <mistydemeo@gmail.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,12 +2,7 @@
 
 ## Checklist
 
--   [ ] Ensure your code works with manual testing
--   [ ] Linter and other CI checks pass
--   [ ] Sign-off given on the changes (see [CONTRIBUTING.md](https://github.com/vector-im/element-desktop/blob/develop/CONTRIBUTING.md))
-
-<!--
-If you would like to specify text for the changelog entry other than your PR title, add the following:
-
-Notes: Add super cool feature
--->
+-   [ ] Ensure your code works with manual testing.
+-   [ ] New or updated `public`/`exported` symbols have accurate [TSDoc](https://tsdoc.org/) documentation.
+-   [ ] Linter and other CI checks pass.
+-   [ ] Sign-off given on the changes (see [CONTRIBUTING.md](https://github.com/vector-im/element-web/blob/develop/CONTRIBUTING.md)).

.github/workflows/build_and_deploy.yaml

@@ -86,9 +86,6 @@ jobs:
             matrix:
                 arch: [amd64, arm64]
                 sqlcipher: [system, static]
-                exclude:
-                    - arch: arm64
-                      sqlcipher: static
         uses: ./.github/workflows/build_linux.yaml
         with:
             arch: ${{ matrix.arch }}
@@ -103,9 +100,9 @@ jobs:
             - linux
             - windows
         runs-on: ubuntu-latest
-        name: ${{ needs.prepare.outputs.deploy && 'Deploy' || 'Deploy (dry-run)' }}
-        if: always() && !failure() && !cancelled()
-        environment: ${{ needs.prepare.outputs.deploy && 'packages.element.io' || '' }}
+        name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
+        if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
+        environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
         steps:
             - name: Download artifacts
               uses: actions/download-artifact@v4
@@ -136,6 +133,10 @@ jobs:
                       mkdir -p packages.element.io/install/linux/glibc-x86-64
                       mv linux-amd64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-x86-64
                   fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-aarch64
+                      mv linux-arm64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-aarch64
+                  fi
 
             # We don't wish to store the installer for every nightly ever, so we only keep the latest
             - name: "[Nightly] Strip version from installer file"
@@ -152,6 +153,7 @@ jobs:
 
                   # Linux
                   [ -d linux-amd64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz
+                  [ -d linux-arm64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz
 
             - name: "[Release] Prepare release latest symlink"
               if: needs.prepare.outputs.nightly-version == ''
@@ -179,16 +181,21 @@ jobs:
                       ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
                       popd
                   fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-aarch64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
 
             - name: Stash packages.element.io
-              if: ${{ !needs.prepare.outputs.deploy }}
+              if: needs.prepare.outputs.deploy == 'false'
               uses: actions/upload-artifact@v4
               with:
                   name: packages.element.io
                   path: packages.element.io
 
             - name: Deploy artifacts
-              if: needs.prepare.outputs.deploy
+              if: needs.prepare.outputs.deploy == 'true'
               run: |
                   aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto
               env:
@@ -198,8 +205,8 @@ jobs:
                   DEPLOYMENT_DIR: ${{ needs.prepare.outputs.packages-dir }}
 
             - name: Notify packages.element.io of new files
-              if: needs.prepare.outputs.deploy
-              uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
+              if: needs.prepare.outputs.deploy == 'true'
+              uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
               with:
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                   repository: element-hq/packages.element.io
@@ -215,7 +222,7 @@ jobs:
                   done
 
             - name: Stash debs
-              if: ${{ !needs.prepare.outputs.deploy && needs.linux.result == 'success' }}
+              if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
               uses: actions/upload-artifact@v4
               with:
                   name: debs
@@ -225,7 +232,7 @@ jobs:
 
             - name: Publish amd64 deb to packages.element.io
               uses: element-hq/packages.element.io@master
-              if: needs.prepare.outputs.deploy && needs.linux.result == 'success'
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
               with:
                   file: ${{ steps.deb.outputs.amd64 }}
                   github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -235,10 +242,43 @@ jobs:
 
             - name: Publish arm64 deb to packages.element.io
               uses: element-hq/packages.element.io@master
-              if: needs.prepare.outputs.deploy && needs.linux.result == 'success'
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
               with:
                   file: ${{ steps.deb.outputs.arm64 }}
                   github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                   bucket-api: ${{ vars.CF_R2_S3_API }}
                   bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
                   bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+    deploy-ess:
+        needs: deploy
+        runs-on: ubuntu-latest
+        name: Deploy builds to ESS
+        if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
+        env:
+            BUCKET_NAME: "element-desktop-msi.onprem.element.io"
+            AWS_REGION: "eu-central-1"
+        permissions:
+            id-token: write # This is required for requesting the JWT
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v4
+              with:
+                  role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
+                  role-session-name: githubaction-run-${{ github.run_id }}
+                  aws-region: ${{ env.AWS_REGION }}
+
+            - name: Download artifacts
+              uses: actions/download-artifact@v4
+              with:
+                  pattern: win-*
+
+            - name: Copy files to S3
+              run: |
+                  PREFIX="${VERSION%.*}"
+                  for file in win-*/*.msi; do
+                      filename=$(basename "$file")
+                      aws s3 cp "$file" "s3://${{ env.BUCKET_NAME }}/$PREFIX/$filename"
+                  done
+              env:
+                  VERSION: ${{ github.event.release.tag_name }}

.github/workflows/build_and_test.yaml

@@ -23,71 +23,17 @@ jobs:
         with:
             arch: ${{ matrix.arch }}
 
-    # This allows core contributors to test changes to the dockerbuild image within a pull request
-    linux_docker:
-        name: Linux docker
-        runs-on: ubuntu-latest
-        if: github.event_name == 'pull_request'
-        outputs:
-            docker-image: ${{ steps.docker.outputs.image }}
-        permissions:
-            contents: read
-            packages: write
-        env:
-            REGISTRY: ghcr.io
-            IMAGE_NAME: ${{ github.repository }}-dockerbuild-pr
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: "Get modified files"
-              id: changed_files
-              uses: tj-actions/changed-files@716b1e13042866565e00e85fd4ec490e186c4a2f # v41
-              with:
-                  files: |
-                      dockerbuild/**
-            - name: Log in to the Container registry
-              if: steps.changed_files.outputs.any_modified == 'true'
-              uses: docker/login-action@3d58c274f17dffee475a5520cbe67f0a882c4dbb
-              with:
-                  registry: ${{ env.REGISTRY }}
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
-            - id: docker
-              if: steps.changed_files.outputs.any_modified == 'true'
-              run: |
-                  echo "image=$IMAGE:$PR" >> $GITHUB_OUTPUT
-              env:
-                  IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-                  PR: ${{ github.event.pull_request.number }}
-
-            - name: Build and push Docker image
-              if: steps.changed_files.outputs.any_modified == 'true'
-              uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
-              with:
-                  context: dockerbuild
-                  push: true
-                  tags: ${{ steps.docker.outputs.image }}
-
     linux:
-        needs:
-            - fetch
-            - linux_docker
+        needs: fetch
         name: "Linux (${{ matrix.arch }}) (sqlcipher: ${{ matrix.sqlcipher }})"
         uses: ./.github/workflows/build_linux.yaml
         strategy:
             matrix:
                 sqlcipher: [system, static]
                 arch: [amd64, arm64]
-                exclude:
-                    # FIXME: This combination yields a broken Seshat at this time
-                    # Errors at launch with `undefined symbol: PKCS5_PBKDF2_HMAC
-                    - arch: arm64
-                      sqlcipher: static
         with:
             config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
             sqlcipher: ${{ matrix.sqlcipher }}
-            docker-image: ${{ needs.linux_docker.outputs.docker-image }}
             arch: ${{ matrix.arch }}
 
     macos:
@@ -104,7 +50,7 @@ jobs:
             matrix:
                 include:
                     - name: macOS Universal
-                      os: macos
+                      os: macos-latest
                       artifact: macos
                       executable: "/Users/runner/Applications/Element.app/Contents/MacOS/Element"
                       # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
@@ -114,26 +60,46 @@ jobs:
                           rsync -a /Volumes/Element/Element.app ~/Applications/ &&
                           hdiutil detach /Volumes/Element
                     - name: "Linux (amd64) (sqlcipher: system)"
-                      os: ubuntu
+                      os: ubuntu-latest
                       artifact: linux-amd64-sqlcipher-system
                       executable: "/opt/Element/element-desktop"
                       prepare_cmd: "sudo apt install ./dist/*.deb"
                     - name: "Linux (amd64) (sqlcipher: static)"
-                      os: ubuntu
+                      os: ubuntu-latest
                       artifact: linux-amd64-sqlcipher-static
                       executable: "/opt/Element/element-desktop"
                       prepare_cmd: "sudo apt install ./dist/*.deb"
+                    - name: "Linux (arm64) (sqlcipher: system)"
+                      os: dind-l-arm64
+                      artifact: linux-arm64-sqlcipher-system
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt install -y ./dist/*.deb"
+                    - name: "Linux (arm64) (sqlcipher: static)"
+                      os: dind-l-arm64
+                      artifact: linux-arm64-sqlcipher-static
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt install -y ./dist/*.deb"
                     - name: Windows (x86)
-                      os: windows
+                      os: windows-latest
                       artifact: win-ia32
                       executable: "./dist/win-ia32-unpacked/Element.exe"
                     - name: Windows (x64)
-                      os: windows
+                      os: windows-latest
                       artifact: win-x64
                       executable: "./dist/win-unpacked/Element.exe"
         name: Test ${{ matrix.name }}
-        runs-on: ${{ matrix.os }}-latest
+        runs-on: ${{ matrix.os }}
         steps:
+            # Workaround for self-hosted runners lacking yarn
+            - name: Install Yarn
+              if: runner.environment == 'self-hosted'
+              run: |
+                  sudo apt-get -qq update
+                  sudo apt-get install -y curl
+                  curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
+                  chmod +x $HOME/bin/yarn
+                  echo "$HOME/bin" >> $GITHUB_PATH
+
             - uses: actions/checkout@v4
 
             - uses: actions/setup-node@v4
@@ -163,7 +129,7 @@ jobs:
                   RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
 
             - name: Run tests
-              uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
+              uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
               timeout-minutes: 5
               with:
                   run: "yarn test ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }}"
@@ -171,8 +137,9 @@ jobs:
                   ELEMENT_DESKTOP_EXECUTABLE: ${{ matrix.executable }}
 
             - name: Upload HTML report
+              if: always()
               uses: actions/upload-artifact@v4
               with:
                   name: ${{ matrix.artifact }}-test
-                  path: playwright-report
+                  path: playwright/html-report
                   retention-days: 14

.github/workflows/build_linux.yaml

@@ -20,20 +20,42 @@ on:
                 type: string
                 required: true
                 description: "How to link sqlcipher, one of 'system' | 'static'"
-            docker-image:
-                type: string
-                required: false
-                description: "The docker image to use for the build, defaults to ghcr.io/element-hq/element-desktop-dockerbuild"
+env:
+    SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
 jobs:
-    build:
-        runs-on: ubuntu-latest
-        container:
-            image: ${{ inputs.docker-image || format('ghcr.io/element-hq/element-desktop-dockerbuild:{0}', github.ref_name == 'master' && 'master' || 'develop') }}
-        defaults:
-            run:
-                shell: bash
+    # We build the hak files on native infrastructure as matrix-seshat fails to cross-compile properly
+    # https://github.com/matrix-org/seshat/issues/135
+    hak:
+        runs-on: ${{ inputs.arch == 'arm64' && 'dind-l-arm64' || 'ubuntu-latest' }}
+        env:
+            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
+        outputs:
+            cache-key: ${{ steps.cache-key.outputs.key }}
+            arch: ${{ steps.config.outputs.arch }}
+            build-args: ${{ steps.config.outputs.build-args }}
         steps:
-            - uses: kanga333/variable-mapper@master
+            # Workaround for self-hosted runners lacking tools
+            - name: Install missing tools
+              if: runner.environment == 'self-hosted'
+              run: |
+                  sudo apt-get -qq update
+                  # curl for yarn download, git for tj-actions/changed-files, zstd for actions/cache
+                  sudo apt-get install -y curl git zstd
+                  curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
+                  chmod +x $HOME/bin/yarn
+                  echo "$HOME/bin" >> $GITHUB_PATH
+
+            - name: Resolve docker image tag for push
+              if: github.event_name == 'push'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:$GITHUB_REF_NAME" >> $GITHUB_ENV
+            - name: Resolve docker image tag for release
+              if: github.event_name == 'release'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:staging" >> $GITHUB_ENV
+            - name: Resolve docker image tag for other triggers
+              if: github.event_name != 'push' && github.event_name != 'release'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:develop" >> $GITHUB_ENV
+
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
               id: config
               with:
                   key: "${{ inputs.arch }}"
@@ -57,11 +79,18 @@ jobs:
               with:
                   name: webapp
 
+            - name: Calculate cache key
+              id: cache-key
+              run: |
+                  echo "key=$CACHE_KEY" >> $GITHUB_OUTPUT
+              env:
+                  CACHE_KEY: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
+
             - name: Cache .hak
               id: cache
-              uses: actions/cache@v3
+              uses: actions/cache@v4
               with:
-                  key: ${{ runner.os }}-${{ inputs.docker-image || github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  key: ${{ steps.cache-key.outputs.key }}
                   path: |
                       ./.hak
 
@@ -77,27 +106,73 @@ jobs:
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
-            - name: Prepare for static sqlcipher build
-              if: inputs.sqlcipher == 'static'
-              run: |
-                  echo "SQLCIPHER_BUNDLED=1" >> $GITHUB_ENV
+            - name: "Get modified files"
+              id: changed_files
+              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request'
+              uses: tj-actions/changed-files@635f118699dd888d737c15018cd30aff2e0274f8 # v44
+              with:
+                  files: |
+                      dockerbuild/**
 
-            # Ideally the docker image would be ready for cross-compilation but libsqlcipher-dev is not Multi-Arch compatible
-            # https://unix.stackexchange.com/a/349359
-            - name: Prepare for cross compilation
-              if: steps.cache.outputs.cache-hit != 'true' && inputs.arch == 'arm64'
-              run: |
-                  set -x
-                  dpkg --add-architecture arm64
-                  apt-get -qq update
-                  apt-get -qq install --no-install-recommends crossbuild-essential-arm64 libsqlcipher-dev:arm64 libssl-dev:arm64 libsecret-1-dev:arm64
-                  rustup target add aarch64-unknown-linux-gnu
-                  mv dockerbuild/aarch64/.cargo .
-                  cat dockerbuild/aarch64/.env >> $GITHUB_ENV
+            # This allows contributors to test changes to the dockerbuild image within a pull request
+            - name: Build docker image
+              uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5
+              if: steps.changed_files.outputs.any_modified == 'true'
+              with:
+                  context: dockerbuild
+                  load: true
+                  platforms: linux/${{ inputs.arch }}
+                  tags: ${{ env.HAK_DOCKER_IMAGE }}
 
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
-              run: "yarn build:native --target ${{ steps.config.outputs.target }}"
+              run: |
+                  docker run \
+                    -v ${{ github.workspace }}:/work -w /work \
+                    -e SQLCIPHER_BUNDLED \
+                    $HAK_DOCKER_IMAGE \
+                    yarn build:native
+
+            - name: Check native libraries
+              run: |
+                  shopt -s globstar
+
+                  for filename in ./.hak/hakModules/**/*.node; do
+                      ./scripts/glibc-check.sh $filename
+                  done
+              env:
+                  MAX_VER: 2.28 # buster-era glibc
+
+    build:
+        needs: hak
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: webapp
+
+            - name: Load .hak
+              id: cache
+              uses: actions/cache/restore@v4
+              with:
+                  key: ${{ needs.hak.outputs.cache-key }}
+                  fail-on-cache-miss: true
+                  path: |
+                      ./.hak
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+              env:
+                  # Workaround for https://github.com/actions/setup-node/issues/317
+                  FORCE_COLOR: 0
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
 
             - name: "[Nightly] Resolve version"
               if: inputs.version != ''
@@ -111,8 +186,7 @@ jobs:
                   fi
 
             - name: Build App
-              run: |
-                  yarn build --publish never -l ${{ steps.config.outputs.build-args }}
+              run: yarn build --publish never -l ${{ needs.hak.outputs.build-args }}
 
             - name: Check native libraries
               run: |
@@ -137,8 +211,10 @@ jobs:
                   else
                       assert_contains_string "$LIBS" "libsqlcipher.so.0"
                   fi
+
+                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
               env:
-                  ARCH: ${{ steps.config.outputs.arch }}
+                  ARCH: ${{ needs.hak.outputs.arch }}
 
             # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
             - name: Upload Artifacts

.github/workflows/build_macos.yaml

@@ -29,7 +29,7 @@ on:
                 description: "The URL to which the output will be deployed."
 jobs:
     build:
-        runs-on: macos-latest
+        runs-on: macos-14 # M1
         environment: ${{ inputs.sign && 'packages.element.io' || '' }}
         steps:
             - uses: actions/checkout@v4
@@ -40,7 +40,7 @@ jobs:
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@v3
+              uses: actions/cache@v4
               with:
                   key: ${{ runner.os }}-${{ hashFiles('hakHash', 'electronVersion') }}
                   path: |
@@ -52,6 +52,12 @@ jobs:
                   rustup toolchain install stable --profile minimal --no-self-update
                   rustup default stable
                   rustup target add aarch64-apple-darwin
+                  rustup target add x86_64-apple-darwin
+
+            # M1 macos-14 comes without Python preinstalled
+            - uses: actions/setup-python@v5
+              with:
+                  python-version: "3.12"
 
             - uses: actions/setup-node@v4
               with:

.github/workflows/build_windows.yaml

@@ -1,6 +1,11 @@
 # This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+
+# window-latest by default uses the pwsh shell which breaks codeSigningCert in the workflow
+defaults:
+    run:
+        shell: powershell
 on:
     workflow_call:
         secrets:
@@ -30,7 +35,7 @@ jobs:
         env:
             SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe"
         steps:
-            - uses: kanga333/variable-mapper@3681b75f5c6c00162721168fb91ab74925eaebcb
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
               id: config
               with:
                   key: "${{ inputs.arch }}"
@@ -60,7 +65,7 @@ jobs:
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@v3
+              uses: actions/cache@v4
               with:
                   key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
                   path: |
@@ -114,8 +119,10 @@ jobs:
               run: |
                   Set-StrictMode -Version 'Latest'
 
-                  # Download
-                  Invoke-WebRequest -OutFile eSigner_CKA.exe "https://packages.element.io/tools/SSL.COM%20eSigner%20CKA_1.0.4-build-20230221_signed.exe"
+                  # Download, extract, and rename
+                  Invoke-WebRequest -OutFile eSigner_CKA.zip "$env:ESIGNER_URL"
+                  Expand-Archive -Path eSigner_CKA.zip -DestinationPath .
+                  Get-ChildItem -Path * -Include "*_build_*.exe" | Rename-Item -NewName eSigner_CKA.exe
 
                   # Install
                   New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
@@ -142,6 +149,7 @@ jobs:
                   echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
                   echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
               env:
+                  ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
                   INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
                   MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
 

.github/workflows/dockerbuild.yaml

@@ -2,7 +2,7 @@ name: Dockerbuild
 on:
     workflow_dispatch: {}
     push:
-        branches: [master, develop]
+        branches: [master, staging, develop]
         paths:
             - "dockerbuild/**"
 concurrency: ${{ github.workflow }}-${{ github.ref_name }}
@@ -19,8 +19,16 @@ jobs:
         steps:
             - uses: actions/checkout@v4
 
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3
+              with:
+                  install: true
+
             - name: Log in to the Container registry
-              uses: docker/login-action@3d58c274f17dffee475a5520cbe67f0a882c4dbb
+              uses: docker/login-action@5f4866a30a54f16a52d2ecb4a3898e9e424939cf
               with:
                   registry: ${{ env.REGISTRY }}
                   username: ${{ github.actor }}
@@ -28,16 +36,17 @@ jobs:
 
             - name: Extract metadata for Docker
               id: meta
-              uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4
+              uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
               with:
                   images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
                   tags: |
                       type=ref,event=branch
 
             - name: Build and push Docker image
-              uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
+              uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5
               with:
                   context: dockerbuild
                   push: true
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}
+                  platforms: linux/amd64,linux/arm64

.github/workflows/release-drafter.yml

@@ -2,20 +2,12 @@ name: Release Drafter
 on:
     push:
         branches: [staging]
-    workflow_dispatch:
-        inputs:
-            previous-version:
-                description: What release to use as a base for release note purposes
-                required: false
-                type: string
+    workflow_dispatch: {}
+    repository_dispatch:
+        types: [upstream-release-notify]
 concurrency: ${{ github.workflow }}
 jobs:
     draft:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: release-drafter/release-drafter@e64b19c4c46173209ed9f2e5a2f4ca7de89a0e86 # v5
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-              with:
-                  disable-autolabeler: true
-                  previous-version: ${{ inputs.previous-version }}
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        with:
+            include-changes: element-hq/element-web~$VERSION

.github/workflows/release.yml

@@ -23,3 +23,17 @@ jobs:
             include-changes: element-hq/element-web@$VERSION
             gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
             expected-asset-count: 1
+
+    check:
+        name: Post release checks
+        needs: release
+        runs-on: ubuntu-latest
+        steps:
+            - name: Wait for desktop packaging
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: master
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-name: Deploy
+                  allowed-conclusions: success

.github/workflows/static_analysis.yaml

@@ -25,6 +25,8 @@ jobs:
     i18n_lint:
         name: "i18n Check"
         uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        with:
+            hardcoded-words: "Element"
 
     js_lint:
         name: "ESLint"

.github/workflows/triage-incoming.yml

@@ -0,0 +1,14 @@
+name: Move new issues into Issue triage board
+
+on:
+    issues:
+        types: [opened]
+
+jobs:
+    automate-project-columns-next:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/add-to-project@main
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/120
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

CHANGELOG.md

@@ -1,3 +1,267 @@
+Changes in [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67) (2024-05-22)
+======================================================================================================
+## ✨ Features
+
+* Tooltip: Improve the accessibility of the composer and the rich text editor ([#12459](https://github.com/matrix-org/matrix-react-sdk/pull/12459)). Contributed by @florianduros.
+* Allow explicit configuration of OIDC dynamic registration metadata ([#12514](https://github.com/matrix-org/matrix-react-sdk/pull/12514)). Contributed by @t3chguy.
+* Tooltip: improve accessibility for messages ([#12487](https://github.com/matrix-org/matrix-react-sdk/pull/12487)). Contributed by @florianduros.
+* Collapse UserSettings tabs to just icons on narrow screens ([#12505](https://github.com/matrix-org/matrix-react-sdk/pull/12505)). Contributed by @dbkr.
+* Add room topic to right panel room info ([#12503](https://github.com/matrix-org/matrix-react-sdk/pull/12503)). Contributed by @t3chguy.
+* OIDC: pass `id_token` via `id_token_hint` on Manage Account interaction ([#12499](https://github.com/matrix-org/matrix-react-sdk/pull/12499)). Contributed by @t3chguy.
+* Tooltip: improve accessibility in room ([#12493](https://github.com/matrix-org/matrix-react-sdk/pull/12493)). Contributed by @florianduros.
+* Tooltip: improve accessibility for call and voice messages ([#12489](https://github.com/matrix-org/matrix-react-sdk/pull/12489)). Contributed by @florianduros.
+* Move the active tab in user settings to the dialog title ([#12481](https://github.com/matrix-org/matrix-react-sdk/pull/12481)). Contributed by @dbkr.
+* Tooltip: improve accessibility of spaces ([#12497](https://github.com/matrix-org/matrix-react-sdk/pull/12497)). Contributed by @florianduros.
+* Tooltip: improve accessibility of the right panel ([#12490](https://github.com/matrix-org/matrix-react-sdk/pull/12490)). Contributed by @florianduros.
+* MSC3575 (Sliding Sync) add well-known proxy support ([#12307](https://github.com/matrix-org/matrix-react-sdk/pull/12307)). Contributed by @EdGeraghty.
+
+## 🐛 Bug Fixes
+
+* Reuse single PlaybackWorker between Playback instances ([#12520](https://github.com/matrix-org/matrix-react-sdk/pull/12520)). Contributed by @t3chguy.
+* Fix well-known lookup for sliding sync labs check ([#12519](https://github.com/matrix-org/matrix-react-sdk/pull/12519)). Contributed by @t3chguy.
+* Fix `element-desktop-ssoid being` included in OIDC Authorization call ([#12495](https://github.com/matrix-org/matrix-react-sdk/pull/12495)). Contributed by @t3chguy.
+* Fix beta notifications reconciliation for intentional mentions push rules ([#12510](https://github.com/matrix-org/matrix-react-sdk/pull/12510)). Contributed by @t3chguy.
+* fix avatar stretched on 1:1 call ([#12494](https://github.com/matrix-org/matrix-react-sdk/pull/12494)). Contributed by @I-lander.
+* Check native sliding sync support against an unstable feature flag ([#12498](https://github.com/matrix-org/matrix-react-sdk/pull/12498)). Contributed by @turt2live.
+* Use OPTIONS for sliding sync detection poke ([#12492](https://github.com/matrix-org/matrix-react-sdk/pull/12492)). Contributed by @turt2live.
+* TAC: hide tooltip when the release announcement is displayed ([#12472](https://github.com/matrix-org/matrix-react-sdk/pull/12472)). Contributed by @florianduros.
+
+
+
+Changes in [1.11.66](https://github.com/element-hq/element-desktop/releases/tag/v1.11.66) (2024-05-07)
+======================================================================================================
+## ✨ Features
+
+* Use a different error message for UTDs when you weren't in the room. ([#12453](https://github.com/matrix-org/matrix-react-sdk/pull/12453)). Contributed by @uhoreg.
+* Take the Threads Activity Centre out of labs ([#12439](https://github.com/matrix-org/matrix-react-sdk/pull/12439)). Contributed by @dbkr.
+* Expected UTDs: use a different message for UTDs sent before login ([#12391](https://github.com/matrix-org/matrix-react-sdk/pull/12391)). Contributed by @richvdh.
+* Add `Tooltip` to `AccessibleButton` ([#12443](https://github.com/matrix-org/matrix-react-sdk/pull/12443)). Contributed by @florianduros.
+* Add analytics to activity toggles ([#12418](https://github.com/matrix-org/matrix-react-sdk/pull/12418)). Contributed by @dbkr.
+* Decrypt events in reverse order without copying the array ([#12445](https://github.com/matrix-org/matrix-react-sdk/pull/12445)). Contributed by @Johennes.
+* Use new compound tooltip ([#12416](https://github.com/matrix-org/matrix-react-sdk/pull/12416)). Contributed by @florianduros.
+* Expected UTDs: report a different Posthog code ([#12389](https://github.com/matrix-org/matrix-react-sdk/pull/12389)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* TAC: Fix accessibility issue when the Release announcement is displayed ([#12484](https://github.com/matrix-org/matrix-react-sdk/pull/12484)). Contributed by @RiotRobot.
+* TAC: Close Release Announcement when TAC button is clicked ([#12485](https://github.com/matrix-org/matrix-react-sdk/pull/12485)). Contributed by @florianduros.
+* MenuItem: fix caption usage ([#12455](https://github.com/matrix-org/matrix-react-sdk/pull/12455)). Contributed by @florianduros.
+* Show the local echo in previews ([#12451](https://github.com/matrix-org/matrix-react-sdk/pull/12451)). Contributed by @langleyd.
+* Fixed the drag and drop of X #27186 ([#12450](https://github.com/matrix-org/matrix-react-sdk/pull/12450)). Contributed by @asimdelvi.
+* Move the TAC to above the button ([#12438](https://github.com/matrix-org/matrix-react-sdk/pull/12438)). Contributed by @dbkr.
+* Use the same logic in previews as the timeline to hide events that should be hidden ([#12434](https://github.com/matrix-org/matrix-react-sdk/pull/12434)). Contributed by @langleyd.
+* Fix selector so maths support doesn't mangle divs ([#12433](https://github.com/matrix-org/matrix-react-sdk/pull/12433)). Contributed by @uhoreg.
+
+
+
+Changes in [1.11.65](https://github.com/element-hq/element-desktop/releases/tag/v1.11.65) (2024-04-23)
+======================================================================================================
+## ✨ Features
+
+* Make empty state copy for TAC depend on the value of the setting ([#12419](https://github.com/matrix-org/matrix-react-sdk/pull/12419)). Contributed by @dbkr.
+* Linkify User Interactive Authentication errors ([#12271](https://github.com/matrix-org/matrix-react-sdk/pull/12271)). Contributed by @t3chguy.
+* Add support for device dehydration v2 ([#12316](https://github.com/matrix-org/matrix-react-sdk/pull/12316)). Contributed by @uhoreg.
+* Replace `SecurityCustomisations` with `CryptoSetupExtension` ([#12342](https://github.com/matrix-org/matrix-react-sdk/pull/12342)). Contributed by @thoraj.
+* Add activity toggle for TAC ([#12413](https://github.com/matrix-org/matrix-react-sdk/pull/12413)). Contributed by @dbkr.
+* Humanize spell check language labels ([#12409](https://github.com/matrix-org/matrix-react-sdk/pull/12409)). Contributed by @t3chguy.
+* Call Guest Access, give user the option to change the acces level so they can generate a call link. ([#12401](https://github.com/matrix-org/matrix-react-sdk/pull/12401)). Contributed by @toger5.
+* TAC: Release Announcement ([#12380](https://github.com/matrix-org/matrix-react-sdk/pull/12380)). Contributed by @florianduros.
+* Show the call and share button if the user can create a guest link. ([#12385](https://github.com/matrix-org/matrix-react-sdk/pull/12385)). Contributed by @toger5.
+* Add analytics for mark all threads unread ([#12384](https://github.com/matrix-org/matrix-react-sdk/pull/12384)). Contributed by @dbkr.
+* Add `EventType.RoomEncryption` to the auto approve capabilities of Element Call widgets ([#12386](https://github.com/matrix-org/matrix-react-sdk/pull/12386)). Contributed by @toger5.
+
+## 🐛 Bug Fixes
+
+* Fix link modal not shown after access upgrade ([#12411](https://github.com/matrix-org/matrix-react-sdk/pull/12411)). Contributed by @toger5.
+* Fix thread navigation in timeline ([#12412](https://github.com/matrix-org/matrix-react-sdk/pull/12412)). Contributed by @florianduros.
+* Fix inability to join a `knock` room via space hierarchy view ([#12404](https://github.com/matrix-org/matrix-react-sdk/pull/12404)). Contributed by @t3chguy.
+* Focus the thread panel when clicking on an item in the TAC ([#12410](https://github.com/matrix-org/matrix-react-sdk/pull/12410)). Contributed by @dbkr.
+* Fix space hierarchy tile busy state being stuck after join error ([#12405](https://github.com/matrix-org/matrix-react-sdk/pull/12405)). Contributed by @t3chguy.
+* Fix room topic in-app links not being handled correctly on topic dialog ([#12406](https://github.com/matrix-org/matrix-react-sdk/pull/12406)). Contributed by @t3chguy.
+
+
+
+Changes in [1.11.64](https://github.com/element-hq/element-desktop/releases/tag/v1.11.64) (2024-04-09)
+======================================================================================================
+## ✨ Features
+
+* Mark all threads as read button ([#12378](https://github.com/matrix-org/matrix-react-sdk/pull/12378)). Contributed by @dbkr.
+* Video call meta space ([#12297](https://github.com/matrix-org/matrix-react-sdk/pull/12297)). Contributed by @toger5.
+* Add leave room warning for last admin ([#9452](https://github.com/matrix-org/matrix-react-sdk/pull/9452)). Contributed by @Arnei.
+* Iterate styles around Link new device via QR ([#12356](https://github.com/matrix-org/matrix-react-sdk/pull/12356)). Contributed by @t3chguy.
+* Improve code-splitting of highlight.js and maplibre-gs libs ([#12349](https://github.com/matrix-org/matrix-react-sdk/pull/12349)). Contributed by @t3chguy.
+* Use data-mx-color for rainbows ([#12325](https://github.com/matrix-org/matrix-react-sdk/pull/12325)). Contributed by @tulir.
+
+## 🐛 Bug Fixes
+
+* Fix external guest access url for unencrypted rooms ([#12345](https://github.com/matrix-org/matrix-react-sdk/pull/12345)). Contributed by @toger5.
+* Fix video rooms not showing share link button ([#12374](https://github.com/matrix-org/matrix-react-sdk/pull/12374)). Contributed by @toger5.
+* Fix space topic jumping on hover/focus ([#12377](https://github.com/matrix-org/matrix-react-sdk/pull/12377)). Contributed by @t3chguy.
+* Allow popping out a Jitsi widget to respect Desktop `web_base_url` config ([#12376](https://github.com/matrix-org/matrix-react-sdk/pull/12376)). Contributed by @t3chguy.
+* Remove the Lazy Loading `InvalidStoreError` Dialogs ([#12358](https://github.com/matrix-org/matrix-react-sdk/pull/12358)). Contributed by @langleyd.
+* Improve readability of badges and pills ([#12360](https://github.com/matrix-org/matrix-react-sdk/pull/12360)). Contributed by @robintown.
+
+
+
+Changes in [1.11.63](https://github.com/element-hq/element-desktop/releases/tag/v1.11.63) (2024-03-28)
+======================================================================================================
+This is a hotfix release to fix a couple of issues: one where the client would sometimes call the client/server API to set a push rule in a loop, and one where authentication was not sent for widgets when it should have been.
+
+## 🐛 Bug Fixes
+
+* Revert "Make EC widget theme reactive - Update widget url when the theme changes" ([#12383](https://github.com/matrix-org/matrix-react-sdk/pull/12383)) in order to fix widgets that require authentication.
+* Update to hotfixed js-sdk to fix an issue where Element could try to set a push rule in a loop.
+
+Changes in [1.11.62](https://github.com/element-hq/element-desktop/releases/tag/v1.11.62) (2024-03-26)
+======================================================================================================
+## ✨ Features
+
+* Change user permission by using a new apply button ([#12346](https://github.com/matrix-org/matrix-react-sdk/pull/12346)). Contributed by @florianduros.
+* Mark as Unread ([#12254](https://github.com/matrix-org/matrix-react-sdk/pull/12254)). Contributed by @dbkr.
+* Refine the colors of some more components ([#12343](https://github.com/matrix-org/matrix-react-sdk/pull/12343)). Contributed by @robintown.
+* TAC: Order rooms by most recent after notification level ([#12329](https://github.com/matrix-org/matrix-react-sdk/pull/12329)). Contributed by @florianduros.
+* Make EC widget theme reactive - Update widget url when the theme changes ([#12295](https://github.com/matrix-org/matrix-react-sdk/pull/12295)). Contributed by @toger5.
+* Refine styles of menus, toasts, popovers, and modals ([#12332](https://github.com/matrix-org/matrix-react-sdk/pull/12332)). Contributed by @robintown.
+* Element Call: fix widget shown while its still loading (`waitForIframeLoad=false`) ([#12292](https://github.com/matrix-org/matrix-react-sdk/pull/12292)). Contributed by @toger5.
+* Improve Forward Dialog a11y by switching to roving tab index interactions ([#12306](https://github.com/matrix-org/matrix-react-sdk/pull/12306)). Contributed by @t3chguy.
+* Call guest access link creation to join calls as a non registered user via the EC SPA ([#12259](https://github.com/matrix-org/matrix-react-sdk/pull/12259)). Contributed by @toger5.
+* Use `strong` element to semantically denote visually emphasised content ([#12320](https://github.com/matrix-org/matrix-react-sdk/pull/12320)). Contributed by @t3chguy.
+* Handle up/down arrow keys as well as left/right for horizontal toolbars for improved a11y ([#12305](https://github.com/matrix-org/matrix-react-sdk/pull/12305)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Remove the glass border from modal spinners ([#12369](https://github.com/matrix-org/matrix-react-sdk/pull/12369)). Contributed by @RiotRobot.
+* Fix incorrect check for private read receipt support ([#12348](https://github.com/matrix-org/matrix-react-sdk/pull/12348)). Contributed by @tulir.
+* TAC: Fix hover state when expanded ([#12337](https://github.com/matrix-org/matrix-react-sdk/pull/12337)). Contributed by @florianduros.
+* Fix the image view ([#12341](https://github.com/matrix-org/matrix-react-sdk/pull/12341)). Contributed by @robintown.
+* Use correct push rule to evaluate room-wide mentions ([#12318](https://github.com/matrix-org/matrix-react-sdk/pull/12318)). Contributed by @t3chguy.
+* Reset power selector on API failure to prevent state mismatch ([#12319](https://github.com/matrix-org/matrix-react-sdk/pull/12319)). Contributed by @t3chguy.
+* Fix spotlight opening in TAC ([#12315](https://github.com/matrix-org/matrix-react-sdk/pull/12315)). Contributed by @florianduros.
+
+
+
+Changes in [1.11.61](https://github.com/element-hq/element-desktop/releases/tag/v1.11.61) (2024-03-14)
+======================================================================================================
+* No changes
+
+## 🐛 Bug Fixes
+
+* Update `@vector-im/compound-design-tokens` in package.json ([#12340](https://github.com/matrix-org/matrix-react-sdk/pull/12340)).
+
+
+
+Changes in [1.11.60](https://github.com/element-hq/element-desktop/releases/tag/v1.11.60) (2024-03-12)
+======================================================================================================
+## ✨ Features
+
+* Refine styles of controls to match Compound ([#12299](https://github.com/matrix-org/matrix-react-sdk/pull/12299)). Contributed by @robintown.
+* Hide the archived section ([#12286](https://github.com/matrix-org/matrix-react-sdk/pull/12286)). Contributed by @dbkr.
+* Add theme data to EC widget Url ([#12279](https://github.com/matrix-org/matrix-react-sdk/pull/12279)). Contributed by @toger5.
+* Update MSC2965 OIDC Discovery implementation ([#12245](https://github.com/matrix-org/matrix-react-sdk/pull/12245)). Contributed by @t3chguy.
+* Use green dot for activity notification in `LegacyRoomHeader` ([#12270](https://github.com/matrix-org/matrix-react-sdk/pull/12270)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* Fix requests for senders to submit auto-rageshakes ([#12304](https://github.com/matrix-org/matrix-react-sdk/pull/12304)). Contributed by @richvdh.
+* fix automatic DM avatar with functional members ([#12157](https://github.com/matrix-org/matrix-react-sdk/pull/12157)). Contributed by @HarHarLinks.
+* Feeds event with relation to unknown to the widget ([#12283](https://github.com/matrix-org/matrix-react-sdk/pull/12283)). Contributed by @maheichyk.
+* Fix TAC opening with keyboard ([#12285](https://github.com/matrix-org/matrix-react-sdk/pull/12285)). Contributed by @florianduros.
+* Allow screenshot update docker to run multiple test files ([#12291](https://github.com/matrix-org/matrix-react-sdk/pull/12291)). Contributed by @dbkr.
+* Fix alignment of user menu avatar ([#12289](https://github.com/matrix-org/matrix-react-sdk/pull/12289)). Contributed by @dbkr.
+* Fix buttons of widget in a room ([#12288](https://github.com/matrix-org/matrix-react-sdk/pull/12288)). Contributed by @florianduros.
+* ModuleAPI: `overwrite_login` action was not stopping the existing client resulting in the action failing with rust-sdk ([#12272](https://github.com/matrix-org/matrix-react-sdk/pull/12272)). Contributed by @BillCarsonFr.
+
+
+
+Changes in [1.11.59](https://github.com/element-hq/element-desktop/releases/tag/v1.11.59) (2024-02-27)
+======================================================================================================
+## 🦖 Deprecations
+
+* Enable custom themes to theme Compound ([#12240](https://github.com/matrix-org/matrix-react-sdk/pull/12240)). Contributed by @robintown.
+* Remove welcome bot `welcome_user_id` support ([#12153](https://github.com/matrix-org/matrix-react-sdk/pull/12153)). Contributed by @t3chguy.
+
+## ✨ Features
+
+* Ignore activity in TAC ([#12269](https://github.com/matrix-org/matrix-react-sdk/pull/12269)). Contributed by @florianduros.
+* Use browser's font size instead of hardcoded `16px` as root font size ([#12246](https://github.com/matrix-org/matrix-react-sdk/pull/12246)). Contributed by @florianduros.
+* Revert "Use Compound primary colors for most actions" ([#12264](https://github.com/matrix-org/matrix-react-sdk/pull/12264)). Contributed by @florianduros.
+* Revert "Refine menu, toast, and popover colors" ([#12263](https://github.com/matrix-org/matrix-react-sdk/pull/12263)). Contributed by @florianduros.
+* Fix Native OIDC for Element Desktop ([#12253](https://github.com/matrix-org/matrix-react-sdk/pull/12253)). Contributed by @t3chguy.
+* Improve client metadata used for OIDC dynamic registration ([#12257](https://github.com/matrix-org/matrix-react-sdk/pull/12257)). Contributed by @t3chguy.
+* Refine menu, toast, and popover colors ([#12247](https://github.com/matrix-org/matrix-react-sdk/pull/12247)). Contributed by @robintown.
+* Call the AsJson forms of import and exportRoomKeys ([#12233](https://github.com/matrix-org/matrix-react-sdk/pull/12233)). Contributed by @andybalaam.
+* Use Compound primary colors for most actions ([#12241](https://github.com/matrix-org/matrix-react-sdk/pull/12241)). Contributed by @robintown.
+* Enable redirected media by default ([#12142](https://github.com/matrix-org/matrix-react-sdk/pull/12142)). Contributed by @turt2live.
+* Reduce TAC width by `16px` ([#12239](https://github.com/matrix-org/matrix-react-sdk/pull/12239)). Contributed by @florianduros.
+* Pop out of Threads Activity Centre ([#12136](https://github.com/matrix-org/matrix-react-sdk/pull/12136)). Contributed by @florianduros.
+* Use new semantic tokens for username colors ([#12209](https://github.com/matrix-org/matrix-react-sdk/pull/12209)). Contributed by @robintown.
+
+## 🐛 Bug Fixes
+
+* Fix the space panel getting bigger when gaining a scroll bar ([#12267](https://github.com/matrix-org/matrix-react-sdk/pull/12267)). Contributed by @dbkr.
+* Fix gradients spacings on the space panel ([#12262](https://github.com/matrix-org/matrix-react-sdk/pull/12262)). Contributed by @dbkr.
+* Remove hardcoded `Element` in tac labs description ([#12266](https://github.com/matrix-org/matrix-react-sdk/pull/12266)). Contributed by @florianduros.
+* Fix branding in "migrating crypto" message ([#12265](https://github.com/matrix-org/matrix-react-sdk/pull/12265)). Contributed by @richvdh.
+* Use h1 as first heading in dialogs ([#12250](https://github.com/matrix-org/matrix-react-sdk/pull/12250)). Contributed by @dbkr.
+* Fix forced lowercase username in login/registration flows ([#9329](https://github.com/matrix-org/matrix-react-sdk/pull/9329)). Contributed by @vrifox.
+* Update the TAC indicator on event decryption ([#12243](https://github.com/matrix-org/matrix-react-sdk/pull/12243)). Contributed by @dbkr.
+* Fix OIDC delegated auth account url check ([#12242](https://github.com/matrix-org/matrix-react-sdk/pull/12242)). Contributed by @t3chguy.
+* New Header edgecase fixes: Close lobby button not shown, disable join button in various places, more... ([#12235](https://github.com/matrix-org/matrix-react-sdk/pull/12235)). Contributed by @toger5.
+* Fix TAC button alignment when expanded ([#12238](https://github.com/matrix-org/matrix-react-sdk/pull/12238)). Contributed by @florianduros.
+* Fix tooltip behaviour in TAC ([#12236](https://github.com/matrix-org/matrix-react-sdk/pull/12236)). Contributed by @florianduros.
+
+
+
+Changes in [1.11.58](https://github.com/element-hq/element-desktop/releases/tag/v1.11.58) (2024-02-13)
+======================================================================================================
+* 🦀  🔒 **The flag to enable the Rust crypto implementation is now set to `true` by default. This means that without any additional configuration every new login will use the new cryptography implementation.**
+* Add Element call related functionality to new room header ([#12091](https://github.com/matrix-org/matrix-react-sdk/pull/12091)). Contributed by @toger5.
+* Add labs flag for Threads Activity Centre ([#12137](https://github.com/matrix-org/matrix-react-sdk/pull/12137)). Contributed by @florianduros.
+* Refactor element call lobby + skip lobby ([#12057](https://github.com/matrix-org/matrix-react-sdk/pull/12057)). Contributed by @toger5.
+* Hide the "Message" button in the sidebar if the CreateRooms components should not be shown ([#9271](https://github.com/matrix-org/matrix-react-sdk/pull/9271)). Contributed by @dhenneke.
+* Add notification dots to thread summary icons ([#12146](https://github.com/matrix-org/matrix-react-sdk/pull/12146)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* Fix logout can take ages ([#12191](https://github.com/matrix-org/matrix-react-sdk/pull/12191)). Contributed by @BillCarsonFr.
+* Fix `Mark all as read` in settings ([#12205](https://github.com/matrix-org/matrix-react-sdk/pull/12205)). Contributed by @florianduros.
+* Fix default thread notification of the new RoomHeader ([#12194](https://github.com/matrix-org/matrix-react-sdk/pull/12194)). Contributed by @florianduros.
+* Fix display of room notification debug info ([#12183](https://github.com/matrix-org/matrix-react-sdk/pull/12183)). Contributed by @dbkr.
+
+Changes in [1.11.57](https://github.com/element-hq/element-desktop/releases/tag/v1.11.57) (2024-01-31)
+======================================================================================================
+## 🦖 Deprecations
+
+* Deprecate welcome bot `welcome_user_id` support ([#26885](https://github.com/element-hq/element-web/pull/26885)). Contributed by @t3chguy.
+
+## 🦖 Deprecations
+
+* Deprecate welcome bot `welcome_user_id` support ([#26885](https://github.com/element-hq/element-web/pull/26885)). Contributed by @t3chguy.
+
+## ✨ Features
+
+* Use jitsi-lobby in video channel (video rooms) ([#26879](https://github.com/element-hq/element-web/pull/26879)). Contributed by @toger5.
+## 🐛 Bug Fixes
+
+* Fix OIDC bugs due to amnesiac stores forgetting OIDC issuer \& other data ([#12166](https://github.com/matrix-org/matrix-react-sdk/pull/12166)). Contributed by @t3chguy.
+* Fix account management link for delegated auth OIDC setups ([#12144](https://github.com/matrix-org/matrix-react-sdk/pull/12144)). Contributed by @t3chguy.
+* Fix Safari IME support ([#11016](https://github.com/matrix-org/matrix-react-sdk/pull/11016)). Contributed by @SuperKenVery.
+* Fix Stickerpicker layout crossing multiple CSS stacking contexts ([#12127](https://github.com/matrix-org/matrix-react-sdk/pull/12127)).
+* Fix Stickerpicker layout crossing multiple CSS stacking contexts ([#12126](https://github.com/matrix-org/matrix-react-sdk/pull/12126)). Contributed by @t3chguy.
+* Fix 1F97A and 1F979 in Twemoji COLR font ([#12177](https://github.com/matrix-org/matrix-react-sdk/pull/12177)).
+## ✨ Features
+
+* Use jitsi-lobby in video channel (video rooms) ([#26879](https://github.com/element-hq/element-web/pull/26879)). Contributed by @toger5.
+## 🐛 Bug Fixes
+* Fix OIDC bugs due to amnesiac stores forgetting OIDC issuer \& other data ([#12166](https://github.com/matrix-org/matrix-react-sdk/pull/12166)). Contributed by @t3chguy.
+* Fix account management link for delegated auth OIDC setups ([#12144](https://github.com/matrix-org/matrix-react-sdk/pull/12144)). Contributed by @t3chguy.
+* Fix Safari IME support ([#11016](https://github.com/matrix-org/matrix-react-sdk/pull/11016)). Contributed by @SuperKenVery.
+* Fix Stickerpicker layout crossing multiple CSS stacking contexts ([#12127](https://github.com/matrix-org/matrix-react-sdk/pull/12127)).
+* Fix Stickerpicker layout crossing multiple CSS stacking contexts ([#12126](https://github.com/matrix-org/matrix-react-sdk/pull/12126)). Contributed by @t3chguy.
+* Fix 1F97A and 1F979 in Twemoji COLR font ([#12177](https://github.com/matrix-org/matrix-react-sdk/pull/12177)).
+
+
+
 Changes in [1.11.54](https://github.com/element-hq/element-desktop/releases/tag/v1.11.54) (2024-01-16)
 ======================================================================================================
 ## 🔧 Security

dockerbuild/Dockerfile

@@ -1,49 +1,25 @@
-# Docker image to facilitate building Element Desktop with native bits using a glibc version with broader compatibility
-FROM buildpack-deps:buster-curl
+# Docker image to facilitate building Element Desktop's native bits using a glibc version with broader compatibility
+FROM rust:buster
 
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN curl --proto "=https" -L https://yarnpkg.com/latest.tar.gz | tar xvz && mv yarn-* /yarn && ln -s /yarn/bin/yarn /usr/bin/yarn
 RUN apt-get -qq update && apt-get -qq dist-upgrade && \
-  # add repo for git-lfs
-  curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \
-  # git ssh for using as docker image on CircleCI
-  # python for node-gyp
-  # rpm is required for FPM to build rpm package
+  apt-get -qq install --no-install-recommends \
   # tclsh is required for building SQLite as part of SQLCipher
+  tcl \
   # libsecret-1-dev is required even for prebuild keytar
-  apt-get -qq install --no-install-recommends qtbase5-dev bsdtar build-essential autoconf libssl-dev gcc-multilib g++-multilib lzip rpm python libcurl4 git git-lfs ssh unzip tcl \
   libsecret-1-dev \
-  libopenjp2-tools \
-  # Used by github actions \
-  jq grep file \
   # Used by seshat (when not SQLCIPHER_STATIC) \
   libsqlcipher-dev && \
-  # git-lfs
-  git lfs install && \
   apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /project
-
-# fix error /usr/local/bundle/gems/fpm-1.5.0/lib/fpm/package/freebsd.rb:72:in `encode': "\xE2" from ASCII-8BIT to UTF-8 (Encoding::UndefinedConversionError)
-# http://jaredmarkell.com/docker-and-locales/
-# http://askubuntu.com/a/601498
-ENV LANG C.UTF-8
-ENV LANGUAGE C.UTF-8
-ENV LC_ALL C.UTF-8
+RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip
 
 ENV DEBUG_COLORS true
 ENV FORCE_COLOR true
-ENV NODE_VERSION 16.18.1
 
-# this package is used for snapcraft and we should not clear apt list - to avoid apt-get update during snap build
-RUN curl --proto "=https" -L https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz | tar xz -C /usr/local --strip-components=1 && \
-  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md && \
-  # https://github.com/npm/npm/issues/4531
-  npm config set unsafe-perm true
-
-ENV RUSTUP_HOME=/usr/local/rustup \
-    CARGO_HOME=/usr/local/cargo \
-    PATH=/usr/local/cargo/bin:$PATH
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal
+ENV NODE_VERSION 18.19.0
+ARG TARGETOS
+ARG TARGETARCH
+COPY setup.sh /setup.sh
+RUN /setup.sh

dockerbuild/aarch64/.cargo/config.toml

@@ -1,3 +0,0 @@
-[target.aarch64-unknown-linux-gnu]
-linker = "aarch64-linux-gnu-gcc"
-rustflags = ["-L/usr/lib/aarch64-linux-gnu"]

dockerbuild/aarch64/.env

@@ -1,11 +0,0 @@
-AS=/usr/bin/aarch64-linux-gnu-as
-STRIP=/usr/bin/aarch64-linux-gnu-strip
-AR=/usr/bin/aarch64-linux-gnu-ar
-CC=/usr/bin/aarch64-linux-gnu-gcc
-CPP=/usr/bin/aarch64-linux-gnu-cpp
-CXX=/usr/bin/aarch64-linux-gnu-g++
-LD=/usr/bin/aarch64-linux-gnu-ld
-FC=/usr/bin/aarch64-linux-gnu-gfortran
-PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig
-CFLAGS=-L/usr/lib/aarch64-linux-gnu
-RUSTFLAGS=-L/usr/lib/aarch64-linux-gnu

dockerbuild/setup.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -x
+declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
+ARCH="${archMap["$TARGETARCH"]}"
+curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md

docs/packaging.md

@@ -22,12 +22,7 @@ For releasing Element Desktop, we assume the following prerequisites:
 
 **Both of these are done automatically when you run the release automation.**
 
-Once those are ready, the **manual** release build can be manually invoked using https://github.com/vector-im/element-desktop/actions/workflows/build_and_deploy.yaml
-
-1. Click `Run workflow`
-1. Specify the `master` branch
-1. Switch type to release
-1. Click the green `Run workflow`
+The packaging is kicked off automagically for you when a Github Release for Element Desktop is published.
 
 ### More detail on the github actions
 

electron-builder.ts

@@ -1,10 +1,8 @@
-const os = require("os");
-const fs = require("fs");
-const path = require("path");
-const Arch = require("electron-builder").Arch;
-const { flipFuses, FuseVersion, FuseV1Options } = require("@electron/fuses");
-
-// Typescript conversion blocked on https://github.com/electron-userland/electron-builder/issues/7775
+import * as os from "os";
+import * as fs from "fs";
+import * as path from "path";
+import { Arch, Configuration as BaseConfiguration, AfterPackContext } from "electron-builder";
+import { flipFuses, FuseVersion, FuseV1Options } from "@electron/fuses";
 
 /**
  * This script has different outputs depending on your os platform.
@@ -26,24 +24,45 @@ const { flipFuses, FuseVersion, FuseV1Options } = require("@electron/fuses");
 const NIGHTLY_APP_ID = "im.riot.nightly";
 const NIGHTLY_DEB_NAME = "element-nightly";
 
-const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+interface Pkg {
+    name: string;
+    productName: string;
+    description: string;
+    version: string;
+}
+
+type Writable<T> = NonNullable<
+    T extends Function ? T : T extends object ? { -readonly [K in keyof T]: Writable<T[K]> } : T
+>;
+
+const pkg: Pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+
+interface Configuration extends BaseConfiguration {
+    extraMetadata: Partial<Pick<Pkg, "version">> & Omit<Pkg, "version">;
+    linux: BaseConfiguration["linux"];
+    win: BaseConfiguration["win"];
+    mac: BaseConfiguration["mac"];
+    deb: {
+        fpm: string[];
+    } & BaseConfiguration["deb"];
+}
 
 /**
  * @type {import('electron-builder').Configuration}
  * @see https://www.electron.build/configuration/configuration
  */
-const config = {
+const config: Writable<Configuration> = {
     appId: "im.riot.app",
     asarUnpack: "**/*.node",
-    afterPack: async (context) => {
+    afterPack: async (context: AfterPackContext) => {
         if (context.electronPlatformName !== "darwin" || context.arch === Arch.universal) {
             // Burn in electron fuses for proactive security hardening.
             // On macOS, we only do this for the universal package, as the constituent arm64 and amd64 packages are embedded within.
-            const ext = {
+            const ext = (<Record<string, string>>{
                 darwin: ".app",
                 win32: ".exe",
                 linux: "",
-            }[context.electronPlatformName];
+            })[context.electronPlatformName];
 
             let executableName = context.packager.appInfo.productFilename;
             if (context.electronPlatformName === "linux") {
@@ -97,9 +116,6 @@ const config = {
         category: "Network;InstantMessaging;Chat",
         maintainer: "support@element.io",
         icon: "build/icons",
-        desktop: {
-            MimeType: "x-scheme-handler/element",
-        },
     },
     deb: {
         packageCategory: "net",
@@ -115,7 +131,6 @@ const config = {
             "libsecret-1-0",
             "libasound2",
             "libgbm1",
-            "libc6 (>= 2.28)",
         ],
         recommends: ["libsqlcipher0", "element-io-archive-keyring"],
         fpm: [
@@ -134,17 +149,20 @@ const config = {
         icon: "build/icons/icon.icns",
     },
     win: {
-        target: ["squirrel"],
+        target: ["squirrel", "msi"],
         signingHashAlgorithms: ["sha256"],
         icon: "build/icons/icon.ico",
     },
+    msi: {
+        perMachine: true,
+    },
     directories: {
         output: "dist",
     },
     protocols: [
         {
             name: "element",
-            schemes: ["element"],
+            schemes: ["io.element.desktop", "element"],
         },
     ],
 };
@@ -213,4 +231,4 @@ if (os.platform() === "linux") {
     }
 }
 
-exports.default = config;
+export default config;

element.io/nightly/config.json

@@ -49,8 +49,13 @@
     },
     "privacy_policy_url": "https://element.io/cookie-policy",
     "features": {
+        "threadsActivityCentre": true,
         "feature_spotlight": true,
-        "feature_video_rooms": true
+        "feature_video_rooms": true,
+        "feature_element_call_video_rooms": true
+    },
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 100
     },
     "element_call": {
         "url": "https://call.element.dev"

element.io/release/config.json

@@ -44,5 +44,8 @@
         "api_host": "https://posthog.element.io"
     },
     "privacy_policy_url": "https://element.io/cookie-policy",
-    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 30
+    }
 }

hak/keytar/build.ts

@@ -32,6 +32,9 @@ export default async function buildKeytar(hakEnv: HakEnv, moduleInfo: Dependency
                 cwd: moduleInfo.moduleBuildDir,
                 env,
                 stdio: "inherit",
+                // We need shell mode on Windows to be able to launch `.cmd` executables
+                // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+                shell: hakEnv.isWin(),
             },
         );
         proc.on("exit", (code) => {

hak/tsconfig.json

@@ -5,10 +5,10 @@
         "target": "es2016",
         "sourceMap": false,
         "strict": true,
-        "lib": ["es2020"],
+        "lib": ["es2020"]
     },
     "include": ["../scripts/@types/*.d.ts", "./**/*.ts"],
     "ts-node": {
-        "transpileOnly": true,
-    },
+        "transpileOnly": true
+    }
 }

knip.ts

@@ -1,7 +1,7 @@
 import { KnipConfig } from "knip";
 
 export default {
-    entry: ["src/electron-main.ts", "src/preload.ts", "electron-builder.js", ".eslintrc-*.js", "scripts/**", "hak/**"],
+    entry: ["src/electron-main.ts", "src/preload.ts", "electron-builder.ts", ".eslintrc-*.js", "scripts/**", "hak/**"],
     project: ["**/*.{js,ts}"],
     ignoreDependencies: [
         // Brought in via hak scripts
@@ -9,6 +9,7 @@ export default {
         "matrix-seshat",
         // Needed by `electron-builder`
         "electron-builder-squirrel-windows",
+        "@types/yargs",
         // Required for `action-validator`
         "@action-validator/*",
     ],

package.json

@@ -2,7 +2,7 @@
     "name": "element-desktop",
     "productName": "Element",
     "main": "lib/electron-main.js",
-    "version": "1.11.54",
+    "version": "1.11.67",
     "description": "A feature-rich client for Matrix.org",
     "author": "Element",
     "homepage": "https://element.io",
@@ -74,55 +74,57 @@
         "uuid": "^9.0.0"
     },
     "devDependencies": {
-        "@action-validator/cli": "^0.5.3",
-        "@action-validator/core": "^0.5.3",
+        "@action-validator/cli": "^0.6.0",
+        "@action-validator/core": "^0.6.0",
         "@babel/core": "^7.18.10",
         "@babel/preset-env": "^7.18.10",
         "@babel/preset-typescript": "^7.18.6",
         "@electron/asar": "^3.2.3",
         "@electron/fuses": "^1.7.0",
-        "@playwright/test": "1.40.1",
+        "@mapbox/node-pre-gyp": "^1.0.11",
+        "@playwright/test": "1.43.1",
         "@types/auto-launch": "^5.0.1",
         "@types/counterpart": "^0.18.1",
         "@types/minimist": "^1.2.1",
-        "@types/mkdirp": "^1.0.2",
-        "@types/node": "18.19.8",
+        "@types/mkdirp": "^2.0.0",
+        "@types/node": "18.19.31",
         "@types/pacote": "^11.1.1",
         "@types/tar": "^6.1.3",
         "@types/uuid": "^9.0.2",
-        "@typescript-eslint/eslint-plugin": "^6.0.0",
-        "@typescript-eslint/parser": "^6.0.0",
-        "app-builder-lib": "24.11.0",
+        "@types/yargs": "^17.0.32",
+        "@typescript-eslint/eslint-plugin": "^7.0.0",
+        "@typescript-eslint/parser": "^7.0.0",
+        "app-builder-lib": "24.13.3",
         "chokidar": "^3.5.2",
         "detect-libc": "^2.0.0",
-        "electron": "^28.0.0",
-        "electron-builder": "24.9.1",
-        "electron-builder-squirrel-windows": "24.11.0",
+        "electron": "^29.0.0",
+        "electron-builder": "24.13.3",
+        "electron-builder-squirrel-windows": "24.13.3",
         "electron-devtools-installer": "^3.2.0",
         "eslint": "^8.26.0",
         "eslint-config-google": "^0.14.0",
         "eslint-config-prettier": "^9.0.0",
         "eslint-plugin-import": "^2.25.4",
         "eslint-plugin-matrix-org": "^1.0.0",
-        "eslint-plugin-unicorn": "^50.0.0",
+        "eslint-plugin-unicorn": "^52.0.0",
         "find-npm-prefix": "^1.0.2",
         "glob": "^10.0.0",
-        "knip": "^4.0.1",
-        "matrix-web-i18n": "^3.1.3",
+        "knip": "^5.0.0",
+        "matrix-web-i18n": "^3.2.1",
         "mkdirp": "^3.0.0",
-        "node-pre-gyp": "^0.17.0",
-        "pacote": "^17.0.0",
+        "pacote": "^18.0.0",
         "prettier": "^3.0.0",
         "rimraf": "^5.0.0",
-        "tar": "^6.1.2",
+        "tar": "^6.2.1",
         "ts-node": "^10.9.1",
-        "typescript": "5.3.3"
+        "typescript": "5.4.5"
     },
     "hakDependencies": {
         "matrix-seshat": "^3.0.1",
         "keytar": "^7.9.0"
     },
     "resolutions": {
-        "@types/node": "18.19.8"
+        "@types/node": "18.19.31",
+        "config-file-ts": "0.2.8-rc1"
     }
 }

playwright/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/playwright:v1.41.0-jammy
+FROM mcr.microsoft.com/playwright:v1.43.1-jammy
 
 WORKDIR /work/element-desktop
 

playwright/e2e/launch/launch.spec.ts

@@ -16,11 +16,33 @@ limitations under the License.
 
 import { test, expect } from "../../element-desktop-test";
 
+declare global {
+    interface Window {
+        mxPlatformPeg: {
+            get(): {
+                getEventIndexingManager():
+                    | {
+                          supportsEventIndexing(): Promise<boolean>;
+                      }
+                    | undefined;
+            };
+        };
+    }
+}
+
 test.describe("App launch", () => {
-    test("should launch and render the welcome view successfully", async ({ page }) => {
+    test.slow();
+    test("should launch and render the welcome view successfully and support seshat", async ({ page }) => {
         await page.locator("#matrixchat").waitFor();
         await page.locator(".mx_Welcome").waitFor();
         await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
         await expect(page).toHaveScreenshot();
+
+        const supported = await page.evaluate<boolean>(async () => {
+            const indexManager = window.mxPlatformPeg.get()?.getEventIndexingManager();
+            return await indexManager?.supportsEventIndexing();
+        });
+
+        expect(supported).toBe(true);
     });
 });

playwright/element-desktop-test.ts

@@ -33,7 +33,7 @@ export const test = base.extend<{ app: ElectronApplication; tmpDir: string }>({
         const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
         if (!executablePath) {
             // Unpackaged mode testing
-            args.unshift("./lib/electron-main.js");
+            args.unshift(path.join(__dirname, "..", "lib", "electron-main.js"));
         }
 
         const app = await electron.launch({
@@ -42,6 +42,9 @@ export const test = base.extend<{ app: ElectronApplication; tmpDir: string }>({
             args,
         });
 
+        app.process().stdout.pipe(process.stdout);
+        app.process().stderr.pipe(process.stderr);
+
         await app.firstWindow();
         await use(app);
     },

playwright/tsconfig.json

@@ -5,7 +5,7 @@
         "esModuleInterop": true,
         "target": "es2017",
         "module": "es2022",
-        "lib": ["ESNext", "es2021", "dom"],
+        "lib": ["ESNext", "es2021", "dom"]
     },
-    "include": ["**/*.ts"],
+    "include": ["**/*.ts"]
 }

release.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-#
-# Script to perform a release of element-desktop.
-
-set -e
-
-cd "$(dirname "$0")"
-
-./node_modules/matrix-js-sdk/release.sh "$@"

scripts/@types/node-pre-gyp.d.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-declare module "node-pre-gyp/lib/util/versioning" {
+declare module "@mapbox/node-pre-gyp/lib/util/versioning" {
     // eslint-disable-next-line @typescript-eslint/naming-convention
     export function get_runtime_abi(runtime: string, version: string): string;
 }

scripts/glibc-check.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Source https://gist.github.com/vladimyr/9a03481154cd3048a486bdf71e5e1535/57e57a6ace6fb2c8bba948bce726df7a96c3f99f
+# This scripts lets you check which minimum GLIBC version an executable requires.
+# Simply run './glibc-check.sh path/to/your/binary'
+MAX_VER="${MAX_VER:-2.28}"
+
+BINARY="$1"
+
+# Version comparison function in bash
+vercomp() {
+  if [[ $1 == "$2" ]]; then
+    return 0
+  fi
+  local i ver1 ver2
+  IFS="." read -ra ver1 <<<"$1"
+  IFS="." read -ra ver2 <<<"$2"
+  # fill empty fields in ver1 with zeros
+  for ((i = ${#ver1[@]}; i < ${#ver2[@]}; i++)); do
+    ver1[i]=0
+  done
+  for ((i = 0; i < ${#ver1[@]}; i++)); do
+    if [[ -z ${ver2[i]} ]]; then
+      # fill empty fields in ver2 with zeros
+      ver2[i]=0
+    fi
+    if ((10#${ver1[i]} > 10#${ver2[i]})); then
+      return 1
+    fi
+    if ((10#${ver1[i]} < 10#${ver2[i]})); then
+      return 2
+    fi
+  done
+  return 0
+}
+
+IFS="
+"
+VERS=$(objdump -T "$BINARY" | grep GLIBC_ | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -u)
+
+for VER in $VERS; do
+  vercomp "$VER" "$MAX_VER"
+  COMP=$?
+  if [[ $COMP -eq 1 ]]; then
+    echo "Error! ${BINARY} requests GLIBC ${VER}, which is higher than target ${MAX_VER}"
+    echo "Affected symbols:"
+    objdump -T "$BINARY" | grep -F "GLIBC_${VER}"
+    echo "Looking for symbols in libraries..."
+    for LIBRARY in $(ldd "$BINARY" | cut -d ' ' -f 3); do
+      echo "$LIBRARY"
+      objdump -T "$LIBRARY" | grep -F "GLIBC_${VER}"
+    done
+    exit 27
+  else
+    echo "Found version ${VER}"
+  fi
+done

scripts/hak/fetch.ts

@@ -44,6 +44,9 @@ export default async function fetch(hakEnv: HakEnv, moduleInfo: DependencyInfo):
         const proc = childProcess.spawn(hakEnv.isWin() ? "yarn.cmd" : "yarn", ["install", "--ignore-scripts"], {
             stdio: "inherit",
             cwd: moduleInfo.moduleBuildDir,
+            // We need shell mode on Windows to be able to launch `.cmd` executables
+            // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: hakEnv.isWin(),
         });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();

scripts/hak/hakEnv.ts

@@ -16,18 +16,18 @@ limitations under the License.
 
 import path from "path";
 import os from "os";
-import nodePreGypVersioning from "node-pre-gyp/lib/util/versioning";
-import { getElectronVersion } from "app-builder-lib/out/electron/electronVersion";
+import nodePreGypVersioning from "@mapbox/node-pre-gyp/lib/util/versioning";
+import { getElectronVersionFromInstalled } from "app-builder-lib/out/electron/electronVersion";
 
 import { Arch, Target, TARGETS, getHost, isHostId, TargetId } from "./target";
 
 async function getRuntime(projectRoot: string): Promise<string> {
-    const electronVersion = await getElectronVersion(projectRoot);
+    const electronVersion = await getElectronVersionFromInstalled(projectRoot);
     return electronVersion ? "electron" : "node-webkit";
 }
 
 async function getRuntimeVersion(projectRoot: string): Promise<string> {
-    const electronVersion = await getElectronVersion(projectRoot);
+    const electronVersion = await getElectronVersionFromInstalled(projectRoot);
     if (electronVersion) {
         return electronVersion;
     } else {

scripts/hak/link.ts

@@ -53,6 +53,9 @@ export default async function link(hakEnv: HakEnv, moduleInfo: DependencyInfo):
         const proc = childProcess.spawn(yarnCmd, ["link"], {
             cwd: moduleInfo.moduleOutDir,
             stdio: "inherit",
+            // We need shell mode on Windows to be able to launch `.cmd` executables
+            // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: hakEnv.isWin(),
         });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();
@@ -63,6 +66,9 @@ export default async function link(hakEnv: HakEnv, moduleInfo: DependencyInfo):
         const proc = childProcess.spawn(yarnCmd, ["link", moduleInfo.name], {
             cwd: hakEnv.projectRoot,
             stdio: "inherit",
+            // We need shell mode on Windows to be able to launch `.cmd` executables
+            // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: hakEnv.isWin(),
         });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();

scripts/set-version.ts

@@ -32,6 +32,11 @@ export async function setPackageVersion(ver: string): Promise<void> {
                 "--new-version",
                 ver,
             ],
+            {
+                // We need shell mode on Windows to be able to launch `.cmd` executables
+                // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+                shell: process.platform === "win32",
+            },
             (err) => {
                 if (err) {
                     reject(err);

scripts/tsconfig.json

@@ -7,10 +7,10 @@
         "module": "commonjs",
         "sourceMap": false,
         "strict": true,
-        "lib": ["es2020", "dom"],
+        "lib": ["es2020", "dom"]
     },
     "include": ["../src/@types", "./**/*.ts"],
     "ts-node": {
-        "transpileOnly": true,
-    },
+        "transpileOnly": true
+    }
 }

src/electron-main.ts

@@ -41,6 +41,7 @@ import { getProfileFromDeeplink, protocolInit } from "./protocol";
 import { _t, AppLocalization } from "./language-helper";
 import { setDisplayMediaCallback } from "./displayMediaCallback";
 import { setupMacosTitleBar } from "./macos-titlebar";
+import { loadJsonFile } from "./utils";
 
 const argv = minimist(process.argv, {
     alias: { help: "h" },
@@ -143,8 +144,7 @@ async function loadConfig(): Promise<void> {
     const asarPath = await getAsarPath();
 
     try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        global.vectorConfig = require(asarPath + "config.json");
+        global.vectorConfig = loadJsonFile(asarPath, "config.json");
     } catch (e) {
         // it would be nice to check the error code here and bail if the config
         // is unparsable, but we get MODULE_NOT_FOUND in the case of a missing
@@ -155,8 +155,7 @@ async function loadConfig(): Promise<void> {
 
     try {
         // Load local config and use it to override values from the one baked with the build
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const localConfig = require(path.join(app.getPath("userData"), "config.json"));
+        const localConfig = loadJsonFile(app.getPath("userData"), "config.json");
 
         // If the local config has a homeserver defined, don't use the homeserver from the build
         // config. This is to avoid a problem where Riot thinks there are multiple homeservers

src/i18n/strings/fa.json

@@ -20,6 +20,7 @@
     },
     "common": {
         "about": "درباره",
+        "brand_help": "کمک %(brand)s",
         "help": "راهنما",
         "preferences": "ترجیحات"
     },

src/i18n/strings/he.json

@@ -2,6 +2,7 @@
     "action": {
         "cancel": "ביטול",
         "close": "סגור",
+        "close_brand": "סגור%(brand)s",
         "copy": "העתק",
         "cut": "גזור",
         "delete": "מחק",
@@ -19,6 +20,7 @@
     },
     "common": {
         "about": "אודות",
+        "brand_help": "%(brand)s עזרה",
         "help": "עזרה",
         "preferences": "העדפות"
     },

src/i18n/strings/it.json

@@ -57,6 +57,7 @@
     },
     "window_menu": {
         "bring_all_to_front": "Porta tutto in primo piano",
-        "label": "Finestra"
+        "label": "Finestra",
+        "zoom": "Ingrandisci"
     }
 }

src/i18n/strings/pl.json

@@ -51,8 +51,8 @@
     },
     "view_menu": {
         "actual_size": "Rozmiar rzeczywisty",
-        "toggle_developer_tools": "Przełącz na narzędzia deweloperskie",
-        "toggle_full_screen": "Przełącz na pełny ekran",
+        "toggle_developer_tools": "Przełącz narzędzia deweloperskie",
+        "toggle_full_screen": "Przełącz pełny ekran",
         "view": "Wyświetl"
     },
     "window_menu": {

src/ipc.ts

@@ -98,9 +98,8 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
         case "focusWindow":
             if (global.mainWindow.isMinimized()) {
                 global.mainWindow.restore();
-            } else if (!global.mainWindow.isVisible()) {
-                global.mainWindow.show();
             } else {
+                global.mainWindow.show();
                 global.mainWindow.focus();
             }
             break;

src/language-helper.ts

@@ -19,6 +19,7 @@ import { TranslationKey as TKey } from "matrix-web-i18n";
 
 import type Store from "electron-store";
 import type EN from "./i18n/strings/en_EN.json";
+import { loadJsonFile } from "./utils";
 
 const FALLBACK_LOCALE = "en";
 
@@ -105,7 +106,7 @@ export class AppLocalization {
     public fetchTranslationJson(locale: string): Record<string, string> {
         try {
             console.log("Fetching translation json for locale: " + locale);
-            return require(`./i18n/strings/${this.denormalize(locale)}.json`);
+            return loadJsonFile(__dirname, "i18n", "strings", `${this.denormalize(locale)}.json`);
         } catch (e) {
             console.log(`Could not fetch translation json for locale: '${locale}'`, e);
             return {};

src/protocol.ts

@@ -19,7 +19,8 @@ import { URL } from "url";
 import path from "path";
 import fs from "fs";
 
-const PROTOCOL = "element:";
+const LEGACY_PROTOCOL = "element";
+const PROTOCOL = "io.element.desktop";
 const SEARCH_PARAM = "element-desktop-ssoid";
 const STORE_FILE_NAME = "sso-sessions.json";
 
@@ -33,7 +34,7 @@ function processUrl(url: string): void {
     // sanity check: we only register for the one protocol, so we shouldn't
     // be getting anything else unless the user is forcing a URL to open
     // with the Element app.
-    if (parsed.protocol !== PROTOCOL) {
+    if (parsed.protocol !== `${PROTOCOL}:` && parsed.protocol !== `${LEGACY_PROTOCOL}:`) {
         console.log("Ignoring unexpected protocol: ", parsed.protocol);
         return;
     }
@@ -82,12 +83,17 @@ export function recordSSOSession(sessionID: string): void {
 
 export function getProfileFromDeeplink(args: string[]): string | undefined {
     // check if we are passed a profile in the SSO callback url
-    const deeplinkUrl = args.find((arg) => arg.startsWith(PROTOCOL + "//"));
+    const deeplinkUrl = args.find((arg) => arg.startsWith(`${PROTOCOL}://`) || arg.startsWith(`${LEGACY_PROTOCOL}://`));
     if (deeplinkUrl?.includes(SEARCH_PARAM)) {
         const parsedUrl = new URL(deeplinkUrl);
-        if (parsedUrl.protocol === PROTOCOL) {
-            const ssoID = parsedUrl.searchParams.get(SEARCH_PARAM)!;
+        if (parsedUrl.protocol === `${PROTOCOL}:` || parsedUrl.protocol === `${LEGACY_PROTOCOL}:`) {
             const store = readStore();
+            let ssoID = parsedUrl.searchParams.get(SEARCH_PARAM);
+            if (!ssoID) {
+                // In OIDC, we must shuttle the value in the `state` param rather than `element-desktop-ssoid`
+                // We encode it as a suffix like `:element-desktop-ssoid:XXYYZZ`
+                ssoID = parsedUrl.searchParams.get("state")!.split(`:${SEARCH_PARAM}:`)[1];
+            }
             console.log("Forwarding to profile: ", store[ssoID]);
             return store[ssoID];
         }
@@ -100,11 +106,13 @@ export function protocolInit(): void {
     // --profile/--profile-dir are passed via the SEARCH_PARAM var in the callback url
     const args = process.argv.slice(1).filter((arg) => arg !== "--hidden" && arg !== "-hidden");
     if (app.isPackaged) {
-        app.setAsDefaultProtocolClient("element", process.execPath, args);
+        app.setAsDefaultProtocolClient(PROTOCOL, process.execPath, args);
+        app.setAsDefaultProtocolClient(LEGACY_PROTOCOL, process.execPath, args);
     } else if (process.platform === "win32") {
         // on Mac/Linux this would just cause the electron binary to open
         // special handler for running without being packaged, e.g `electron .` by passing our app path to electron
-        app.setAsDefaultProtocolClient("element", process.execPath, [app.getAppPath(), ...args]);
+        app.setAsDefaultProtocolClient(PROTOCOL, process.execPath, [app.getAppPath(), ...args]);
+        app.setAsDefaultProtocolClient(LEGACY_PROTOCOL, process.execPath, [app.getAppPath(), ...args]);
     }
 
     if (process.platform === "darwin") {
@@ -117,7 +125,7 @@ export function protocolInit(): void {
         // Protocol handler for win32/Linux
         app.on("second-instance", (ev, commandLine) => {
             const url = commandLine[commandLine.length - 1];
-            if (!url.startsWith(PROTOCOL + "//")) return;
+            if (!url.startsWith(`${PROTOCOL}://`) && !url.startsWith(`${LEGACY_PROTOCOL}://`)) return;
             processUrl(url);
         });
     }

src/squirrelhooks.ts

@@ -18,12 +18,16 @@ import path from "path";
 import { spawn } from "child_process";
 import { app } from "electron";
 
+export function getSquirrelExecutable(): string {
+    return path.resolve(path.dirname(process.execPath), "..", "Update.exe");
+}
+
 function runUpdateExe(args: string[]): Promise<void> {
     // Invokes Squirrel's Update.exe which will do things for us like create shortcuts
     // Note that there's an Update.exe in the app-x.x.x directory and one in the parent
     // directory: we need to run the one in the parent directory, because it discovers
     // information about the app by inspecting the directory it's run from.
-    const updateExe = path.resolve(path.dirname(process.execPath), "..", "Update.exe");
+    const updateExe = getSquirrelExecutable();
     console.log(`Spawning '${updateExe}' with args '${args}'`);
     return new Promise((resolve) => {
         spawn(updateExe, args, {

src/tray.ts

@@ -72,7 +72,9 @@ export function create(config: IConfig): void {
         guid = uuidv5(`${app.getName()}-${app.getPath("userData")}`, getUuid());
     }
 
-    trayIcon = new Tray(defaultIcon, guid);
+    // Passing guid=undefined on Windows will cause it to throw `Error: Invalid GUID format`
+    // The type here is wrong, the param must be omitted, never undefined.
+    trayIcon = guid ? new Tray(defaultIcon, guid) : new Tray(defaultIcon);
     trayIcon.setToolTip(config.brand);
     initApplicationMenu();
     trayIcon.on("click", toggleWin);

src/updater.ts

@@ -15,6 +15,9 @@ limitations under the License.
 */
 
 import { app, autoUpdater, ipcMain } from "electron";
+import fs from "node:fs/promises";
+
+import { getSquirrelExecutable } from "./squirrelhooks";
 
 const UPDATE_POLL_INTERVAL_MS = 60 * 60 * 1000;
 const INITIAL_UPDATE_DELAY_MS = 30 * 1000;
@@ -74,10 +77,12 @@ async function pollForUpdates(): Promise<void> {
     }
 }
 
-export function start(updateBaseUrl: string): void {
+export async function start(updateBaseUrl: string): Promise<void> {
+    if (!(await available(updateBaseUrl))) return;
     if (updateBaseUrl.slice(-1) !== "/") {
         updateBaseUrl = updateBaseUrl + "/";
     }
+
     try {
         let url: string;
         let serverType: "json" | undefined;
@@ -93,7 +98,6 @@ export function start(updateBaseUrl: string): void {
             // Squirrel / electron only supports auto-update on these two platforms.
             // I'm not even going to try to guess which feed style they'd use if they
             // implemented it on Linux, or if it would be different again.
-            console.log("Auto update not supported on this platform");
             return;
         }
 
@@ -116,6 +120,26 @@ export function start(updateBaseUrl: string): void {
     }
 }
 
+async function available(updateBaseUrl?: string): Promise<boolean> {
+    if (process.platform === "linux") {
+        // Auto update is not supported on Linux
+        console.log("Auto update not supported on this platform");
+        return false;
+    }
+
+    if (process.platform === "win32") {
+        try {
+            await fs.access(getSquirrelExecutable());
+        } catch {
+            console.log("Squirrel not found, auto update not supported");
+            return false;
+        }
+    }
+
+    // Otherwise we're either on macOS or Windows with Squirrel
+    return !!updateBaseUrl;
+}
+
 ipcMain.on("install_update", installUpdate);
 ipcMain.on("check_updates", pollForUpdates);
 

src/utils.ts

@@ -15,6 +15,8 @@ limitations under the License.
 */
 
 import crypto from "crypto";
+import fs from "node:fs";
+import path from "node:path";
 
 export async function randomArray(size: number): Promise<string> {
     return new Promise((resolve, reject) => {
@@ -27,3 +29,20 @@ export async function randomArray(size: number): Promise<string> {
         });
     });
 }
+
+type JsonValue = null | string | number;
+type JsonArray = Array<JsonValue | JsonObject | JsonArray>;
+interface JsonObject {
+    [key: string]: JsonObject | JsonArray | JsonValue;
+}
+type Json = JsonArray | JsonObject;
+
+/**
+ * Synchronously load a JSON file from the local filesystem.
+ * Unlike `require`, will never execute any javascript in a loaded file.
+ * @param paths - An array of path segments which will be joined using the system's path delimiter.
+ */
+export function loadJsonFile<T extends Json>(...paths: string[]): T {
+    const file = fs.readFileSync(path.join(...paths), { encoding: "utf-8" });
+    return JSON.parse(file);
+}

src/webcontents-handler.ts

@@ -33,7 +33,7 @@ import {
 import url from "url";
 import fs from "fs";
 import fetch from "node-fetch";
-import { pipeline } from "stream";
+import { pipeline } from "stream/promises";
 import path from "path";
 
 import { _t } from "./language-helper";
@@ -165,7 +165,7 @@ function onLinkContextMenu(ev: Event, params: ContextMenuParams, webContents: We
                             const resp = await fetch(url);
                             if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
                             if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
-                            pipeline(resp.body, fs.createWriteStream(filePath));
+                            await pipeline(resp.body, fs.createWriteStream(filePath));
                         }
                     } catch (err) {
                         console.error(err);

tsconfig.json

@@ -12,7 +12,7 @@
         "typeRoots": ["src/@types", "node_modules/@types"],
         "lib": ["es2020", "dom"],
         "types": ["node"],
-        "strict": true,
+        "strict": true
     },
-    "include": ["./src/**/*.ts"],
+    "include": ["./src/**/*.ts"]
 }