v1.12.2

Localazy Download

.github/workflows/build_and_deploy.yaml

@@ -107,7 +107,7 @@ jobs:
         environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
         steps:
             - name: Download artifacts
-              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
 
             - name: Prepare artifacts for deployment
               run: |
@@ -274,14 +274,14 @@ jobs:
             id-token: write # This is required for requesting the JWT
         steps:
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
+              uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5
               with:
                   role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
                   role-session-name: githubaction-run-${{ github.run_id }}
                   aws-region: ${{ env.AWS_REGION }}
 
             - name: Download artifacts
-              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
               with:
                   pattern: win-*
 

.github/workflows/build_and_test.yaml

@@ -51,11 +51,11 @@ jobs:
     tests-done:
         needs: [windows, linux, macos]
         runs-on: ubuntu-24.04
-        if: always()
+        if: ${{ !cancelled() }}
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   cache: "yarn"
                   node-version: "lts/*"
@@ -64,7 +64,7 @@ jobs:
               run: yarn install --frozen-lockfile
 
             - name: Download blob reports from GitHub Actions Artifacts
-              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
               with:
                   pattern: blob-report-*
                   path: all-blob-reports

.github/workflows/build_linux.yaml

@@ -4,6 +4,10 @@
 on:
     workflow_call:
         inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
             arch:
                 type: string
                 required: true
@@ -20,15 +24,54 @@ on:
                 type: boolean
                 required: false
                 description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'webapp'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + changelog.Debian - the changelog file to embed in the Debian package  
+                    + variant.json - the variant configuration to use for the build
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "webapp"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            runs-on:
+                type: string
+                required: false
+                description: "The runner image to use, normally set for you, may be needed for running in private repos."
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "tar.gz deb"
 env:
     SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
     MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
 permissions: {} # No permissions required
 jobs:
     build:
+        name: Build Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
         # We build on native infrastructure as matrix-seshat fails to cross-compile properly
         # https://github.com/matrix-org/seshat/issues/135
-        runs-on: ${{ inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
+        runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
         env:
             HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
         steps:
@@ -60,21 +103,24 @@ jobs:
                         }
                       }
 
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
               with:
-                  name: webapp
+                  repository: element-hq/element-desktop
+                  ref: ${{ inputs.ref }}
+
+            - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
               with:
                   key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
                   path: |
                       ./.hak
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: .node-version
                   cache: "yarn"
@@ -87,7 +133,7 @@ jobs:
 
             - name: "Get modified files"
               id: changed_files
-              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request'
+              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-desktop'
               uses: tj-actions/changed-files@823fcebdb31bb35fdf2229d9f769b400309430d0 # v46
               with:
                   files: |
@@ -95,7 +141,7 @@ jobs:
 
             # This allows contributors to test changes to the dockerbuild image within a pull request
             - name: Build docker image
-              uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
+              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
               if: steps.changed_files.outputs.any_modified == 'true'
               with:
                   file: dockerbuild/Dockerfile
@@ -130,18 +176,20 @@ jobs:
                   fi
 
             # Workaround for https://github.com/electron-userland/electron-builder/issues/6116
+            # and https://github.com/electron-userland/electron-builder/issues/5721
             - name: Install fpm
-              if: inputs.arch == 'arm64'
               run: |
-                  sudo apt-get install ruby-dev build-essential
                   sudo gem install fpm
                   echo "USE_SYSTEM_FPM=true" >> $GITHUB_ENV
 
             - name: Build App
-              run: yarn build --publish never -l ${{ steps.config.outputs.build-args }}
+              run: yarn build --publish never ${{ steps.config.outputs.build-args }} -l ${{ inputs.targets }}
               env:
+                  VARIANT_PATH: variant.json
                   # Only set for Nightly builds
-                  ED_NIGHTLY: ${{ inputs.version }}
+                  VERSION: ${{ inputs.version }}
+                  # Workaround for https://github.com/electron-userland/electron-builder/issues/5721
+                  USE_HARD_LINKS: false
 
             - name: Check native libraries
               run: |
@@ -149,11 +197,9 @@ jobs:
                   shopt -s globstar
 
                   FILES=$(file dist/**/*.node)
-                  echo "$FILES"
+                  echo $FILES
 
-                  if [ grep -v "$ARCH" ]; then
-                      exit 1
-                  fi
+                  ! echo "$FILES" | grep -v "$ARCH"
 
                   LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
                   echo "$LIBS"
@@ -175,27 +221,46 @@ jobs:
             - name: Upload Artifacts
               uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
-                  name: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+                  name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
                   path: |
                       dist
                       !dist/*-unpacked/**
                   retention-days: 1
 
-            - name: Assert all required files are present
+            - name: Assert deb is present and valid
+              if: contains(inputs.targets, 'deb')
               run: |
                   test -f ./dist/element-desktop*$ARCH.deb
-                  test -f ./dist/element-desktop*.tar.gz
+
+                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
+                  echo "deb listing: "
+                  echo "$DEB_LISTING"
+                  ! echo "$DEB_LISTING" | grep '^h'
               env:
                   ARCH: ${{ inputs.arch }}
 
+            - name: Assert tar.gz is present
+              if: contains(inputs.targets, 'tar.gz')
+              run: |
+                  test -f ./dist/element-desktop*.tar.gz
+
+                  TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
+                  echo "tar.gz listing: "
+                  echo "$TAR_GZ_LISTING"
+                  ! echo "$TAR_GZ_LISTING" | grep '^h'
+
     test:
+        name: Test Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
         needs: build
+        if: inputs.test && contains(inputs.targets, 'deb')
         uses: ./.github/workflows/build_test.yaml
         with:
-            artifact: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
-            runs-on: ${{ inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
+            project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+            artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+            runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
             executable: /opt/Element*/element-desktop*
             prepare_cmd: |
                 sudo apt-get -qq update
                 sudo apt install ./dist/*.deb
             blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}

.github/workflows/build_macos.yaml

@@ -15,6 +15,10 @@ on:
             APPLE_CSC_LINK:
                 required: false
         inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
             version:
                 type: string
                 required: false
@@ -31,21 +35,58 @@ on:
                 type: boolean
                 required: false
                 description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'webapp'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + variant.json - the variant configuration to use for the build
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "webapp"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "dmg zip"
 permissions: {} # No permissions required
 jobs:
     build:
+        name: Build macOS Universal
         runs-on: macos-14 # M1
         environment: ${{ inputs.sign && 'packages.element.io' || '' }}
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
               with:
-                  name: webapp
+                  repository: element-hq/element-desktop
+                  ref: ${{ inputs.ref }}
+
+            - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
               with:
                   key: ${{ runner.os }}-${{ hashFiles('hakHash', 'electronVersion') }}
                   path: |
@@ -60,11 +101,11 @@ jobs:
                   rustup target add x86_64-apple-darwin
 
             # M1 macos-14 comes without Python preinstalled
-            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+            - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
               with:
                   python-version: "3.13"
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: .node-version
                   cache: "yarn"
@@ -84,15 +125,16 @@ jobs:
             - name: "[Signed] Build App"
               if: inputs.sign != ''
               run: |
-                  yarn build:universal --publish never
+                  yarn build:universal --publish never -m ${{ inputs.targets }}
               env:
                   APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
                   APPLE_ID: ${{ secrets.APPLE_ID }}
                   APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                   CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
                   CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
+                  VARIANT_PATH: variant.json
                   # Only set for Nightly builds
-                  ED_NIGHTLY: ${{ inputs.version }}
+                  VERSION: ${{ inputs.version }}
 
             - name: Check app was signed & notarised successfully
               if: inputs.sign != ''
@@ -105,9 +147,10 @@ jobs:
             - name: "[Unsigned] Build App"
               if: inputs.sign == ''
               run: |
-                  yarn build:universal --publish never
+                  yarn build:universal --publish never -m ${{ inputs.targets }}
               env:
                   CSC_IDENTITY_AUTO_DISCOVERY: false
+                  VARIANT_PATH: variant.json
 
             - name: Generate releases.json
               if: inputs.base-url
@@ -139,22 +182,30 @@ jobs:
             - name: Upload Artifacts
               uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
-                  name: macos
+                  name: ${{ inputs.artifact-prefix }}macos
                   path: |
                       dist
                       !dist/mac-universal/**
                   retention-days: 1
 
-            - name: Assert all required files are present
+            - name: Assert zip is present
+              if: contains(inputs.targets, 'zip')
               run: |
-                  test -f ./dist/Element*.dmg
                   test -f ./dist/Element*-mac.zip
 
+            - name: Assert dmg is present
+              if: contains(inputs.targets, 'dmg')
+              run: |
+                  test -f ./dist/Element*.dmg
+
     test:
+        name: Test macOS Universal
         needs: build
+        if: inputs.test && contains(inputs.targets, 'dmg')
         uses: ./.github/workflows/build_test.yaml
         with:
-            artifact: macos
+            project: macos
+            artifact: ${{ inputs.artifact-prefix }}macos
             runs-on: macos-14
             executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
             # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
@@ -164,3 +215,4 @@ jobs:
                 rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
                 hdiutil detach /Volumes/Element
             blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}

.github/workflows/build_prepare.yaml

@@ -54,9 +54,9 @@ jobs:
         outputs:
             nightly-version: ${{ steps.versions.outputs.nightly }}
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: .node-version
                   cache: "yarn"
@@ -85,6 +85,11 @@ jobs:
               if: steps.branch-matching.outcome == 'failure' || steps.branch-matching.outcome == 'skipped'
               run: yarn run fetch --noverify -d ${{ inputs.config }} ${{ inputs.version }}
 
+            - name: Copy variant config
+              run: cp "$CONFIG_DIR/build.json" variant.json
+              env:
+                  CONFIG_DIR: ${{ inputs.config }}
+
             # We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
             - name: Generate cache hash files
               run: |
@@ -166,7 +171,7 @@ jobs:
                   retention-days: 1
                   path: |
                       webapp.asar
-                      package.json
                       electronVersion
                       hakHash
                       changelog.Debian
+                      variant.json

.github/workflows/build_test.yaml

@@ -10,6 +10,10 @@ on:
                 type: string
                 required: true
                 description: "The name of the artifact to download"
+            project:
+                type: string
+                required: true
+                description: "The Playwright project to use for testing"
             executable:
                 type: string
                 required: true
@@ -22,14 +26,21 @@ on:
                 type: boolean
                 default: false
                 description: "Whether to upload a blob report instead of the HTML report"
+            args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright, for e.g. skipping specific tests"
 permissions: {}
 jobs:
     test:
+        name: Test ${{ inputs.project }}
         runs-on: ${{ inputs.runs-on }}
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              with:
+                  repository: ${{ github.repository == 'element-hq/element-web-pro' && 'element-hq/element-desktop' || github.repository }}
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: .node-version
                   cache: "yarn"
@@ -37,7 +48,7 @@ jobs:
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
-            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+            - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
               with:
                   name: ${{ inputs.artifact }}
                   path: dist
@@ -69,7 +80,7 @@ jobs:
               uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
               timeout-minutes: 20
               with:
-                  run: yarn test --project=${{ inputs.artifact }} ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} ${{ inputs.blob_report == false && '--reporter=html' || '' }}
+                  run: yarn test --project=${{ inputs.project }} ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} ${{ inputs.blob_report == false && '--reporter=html' || '' }} ${{ inputs.args }}
               env:
                   ELEMENT_DESKTOP_EXECUTABLE: ${{ steps.executable.outputs.path }}
 

.github/workflows/build_windows.yaml

@@ -18,6 +18,10 @@ on:
             ESIGNER_USER_TOTP:
                 required: false
         inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
             arch:
                 type: string
                 required: true
@@ -34,9 +38,48 @@ on:
                 type: boolean
                 required: false
                 description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'webapp'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + variant.json - the variant configuration to use for the build
+
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "webapp"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-runs-on:
+                type: string
+                required: false
+                description: "The runner image to use for testing, normally set for you, may be needed for running in private repos."
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "squirrel msi"
 permissions: {} # No permissions required
 jobs:
     build:
+        name: Build Windows ${{ inputs.arch }}
         runs-on: windows-2025
         environment: ${{ inputs.sign && 'packages.element.io' || '' }}
         env:
@@ -65,15 +108,18 @@ jobs:
                         }
                       }
 
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
               with:
-                  name: webapp
+                  repository: element-hq/element-desktop
+                  ref: ${{ inputs.ref }}
+
+            - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
               with:
                   key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
                   path: |
@@ -102,7 +148,7 @@ jobs:
                   rustup default stable
                   rustup target add ${{ steps.config.outputs.target }}
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: .node-version
                   cache: "yarn"
@@ -186,10 +232,16 @@ jobs:
                   MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
 
             - name: Build App
-              run: yarn build --publish never -w ${{ steps.config.outputs.build-args }}
+              run: yarn build --publish never ${{ steps.config.outputs.build-args }} -w ${{ inputs.targets }}
               env:
+                  VARIANT_PATH: variant.json
                   # Only set for Nightly builds
-                  ED_NIGHTLY: ${{ inputs.version }}
+                  # The windows packager relies on parsing this as semver, so we have to make it look like one.
+                  # This will give our update packages really stupid names, but we probably can't change that either
+                  # because squirrel windows parses them for the version too. We don't really care: nobody sees them.
+                  # We just give the installer a static name, so you'll just see this in the 'about' dialog.
+                  # Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
+                  VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
 
             - name: Trust eSigner sandbox cert
               if: inputs.sign == ''
@@ -208,24 +260,36 @@ jobs:
             - name: Upload Artifacts
               uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
-                  name: win-${{ inputs.arch }}
+                  name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
                   path: |
                       dist
                   retention-days: 1
 
-            - name: Assert all required files are present
+            - name: Assert executable is present
               run: |
                   Test-Path './dist/win-*unpacked/Element*.exe'
+
+            - name: Assert all Squirrel files are present
+              if: contains(inputs.targets, 'squirrel')
+              run: |
                   Test-Path './dist/squirrel-windows*/Element Setup*.exe'
                   Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
                   Test-Path './dist/squirrel-windows*/RELEASES'
+
+            - name: Assert MSI is present
+              if: contains(inputs.targets, 'msi')
+              run: |
                   Test-Path './dist/Element*.msi'
 
     test:
+        name: Test Windows ${{ inputs.arch }}
         needs: build
+        if: inputs.test
         uses: ./.github/workflows/build_test.yaml
         with:
-            artifact: win-${{ inputs.arch }}
-            runs-on: ${{ inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022' }}
+            project: win-${{ inputs.arch }}
+            artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
+            runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
             executable: ./dist/win*-unpacked/Element*.exe
             blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}

.github/workflows/dockerbuild.yaml

@@ -19,18 +19,18 @@ jobs:
             contents: read
             packages: write
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
             - name: Set up QEMU
               uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+              uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
               with:
                   install: true
 
             - name: Build test image
-              uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
+              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
               with:
                   file: dockerbuild/Dockerfile
                   push: false
@@ -42,7 +42,7 @@ jobs:
               run: docker run -v $PWD:/project element-desktop-dockerbuild yarn install
 
             - name: Log in to the Container registry
-              uses: docker/login-action@6d4b68b490aef8836e8fb5e50ee7b3bdfa5894f0
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
               if: github.event_name != 'pull_request'
               with:
                   registry: ${{ env.REGISTRY }}
@@ -52,7 +52,7 @@ jobs:
             - name: Extract metadata for Docker
               id: meta
               if: github.event_name != 'pull_request'
-              uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+              uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
               with:
                   images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
                   tags: |
@@ -61,7 +61,7 @@ jobs:
 
             - name: Build and push Docker image
               if: github.event_name != 'pull_request'
-              uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
+              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
               with:
                   file: dockerbuild/Dockerfile
                   push: true

.github/workflows/static_analysis.yaml

@@ -9,9 +9,9 @@ jobs:
         name: "Typescript Syntax Check"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: package.json
                   cache: "yarn"
@@ -35,9 +35,9 @@ jobs:
         name: "ESLint"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: package.json
                   cache: "yarn"
@@ -53,9 +53,9 @@ jobs:
         name: "Workflow Lint"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: package.json
                   cache: "yarn"
@@ -71,9 +71,9 @@ jobs:
         name: "Analyse Dead Code"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
               with:
                   node-version-file: package.json
                   cache: "yarn"

.github/workflows/triage-stale.yml

@@ -12,7 +12,7 @@ jobs:
             issues: write
             pull-requests: write
         steps:
-            - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
+            - uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10
               with:
                   operations-per-run: 250
                   days-before-issue-stale: -1

.node-version

@@ -1 +1 @@
-v22.15.0
+22.20.0

CHANGELOG.md

@@ -1,3 +1,312 @@
+Changes in [1.12.2](https://github.com/element-hq/element-desktop/releases/tag/v1.12.2) (2025-10-21)
+====================================================================================================
+## ✨ Features
+
+* Allow Desktop app to be auto-started minimised or focused ([#2622](https://github.com/element-hq/element-desktop/pull/2622)). Contributed by @t3chguy.
+* Room List: Extend the viewport to avoid so many black spots when scrolling the room list ([#30867](https://github.com/element-hq/element-web/pull/30867)). Contributed by @langleyd.
+* Hide calling buttons in room header before a room is created ([#30816](https://github.com/element-hq/element-web/pull/30816)). Contributed by @Half-Shot.
+* Improve invite dialog ui - Part 2 ([#30836](https://github.com/element-hq/element-web/pull/30836)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* Fix hardlinks appearing in and breaking deb packages ([#2609](https://github.com/element-hq/element-desktop/pull/2609)). Contributed by @t3chguy.
+* Fix platform settings race condition and make auto-launch tri-state ([#30977](https://github.com/element-hq/element-web/pull/30977)). Contributed by @t3chguy.
+* Fix: member count in header and member list ([#30982](https://github.com/element-hq/element-web/pull/30982)). Contributed by @florianduros.
+* Fix duration of voice message in timeline ([#30973](https://github.com/element-hq/element-web/pull/30973)). Contributed by @florianduros.
+* Fix voice notes rendering at 00:00 when playback had not begun. ([#30961](https://github.com/element-hq/element-web/pull/30961)). Contributed by @Half-Shot.
+* Improve handling of animated images, add support for AVIF animations ([#30932](https://github.com/element-hq/element-web/pull/30932)). Contributed by @t3chguy.
+* Update key storage toggle when key storage status changes ([#30934](https://github.com/element-hq/element-web/pull/30934)). Contributed by @uhoreg.
+* Fix jitsi widget popout ([#30908](https://github.com/element-hq/element-web/pull/30908)). Contributed by @dbkr.
+* Improve keyboard navigation on invite dialog ([#30930](https://github.com/element-hq/element-web/pull/30930)). Contributed by @florianduros.
+* Prefer UIA flows with supported UIA stages ([#30926](https://github.com/element-hq/element-web/pull/30926)). Contributed by @richvdh.
+* Enhance accessibility of dropdown ([#30928](https://github.com/element-hq/element-web/pull/30928)). Contributed by @florianduros.
+* Improve accessibility of the `\<AvatarSetting> component ([#30907](https://github.com/element-hq/element-web/pull/30907)). Contributed by @MidhunSureshR.
+
+
+
+Changes in [1.12.1](https://github.com/element-hq/element-desktop/releases/tag/v1.12.1) (2025-10-07)
+====================================================================================================
+## ✨ Features
+
+* New Room List: Change the order of filters to match those on mobile ([#30905](https://github.com/element-hq/element-web/pull/30905)). Contributed by @langleyd.
+* New Room List: Don't clear filters on space change ([#30903](https://github.com/element-hq/element-web/pull/30903)). Contributed by @langleyd.
+* Add release announcement for the sounds ([#30900](https://github.com/element-hq/element-web/pull/30900)). Contributed by @langleyd.
+* Rich Text Editor: Add emoji suggestion support ([#30873](https://github.com/element-hq/element-web/pull/30873)). Contributed by @langleyd.
+* feat: Disable session lock when running in element-desktop ([#30643](https://github.com/element-hq/element-web/pull/30643)). Contributed by @kaylendog.
+* Improve invite dialog ui - Part 1 ([#30764](https://github.com/element-hq/element-web/pull/30764)). Contributed by @florianduros.
+* Update Message Sound for Element ([#30804](https://github.com/element-hq/element-web/pull/30804)). Contributed by @beatdemon.
+* Add new and improved ringtone ([#30761](https://github.com/element-hq/element-web/pull/30761)). Contributed by @Half-Shot.
+* Disable RTE formatting buttons when the content contains a slash command ([#30802](https://github.com/element-hq/element-web/pull/30802)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* New Room List: Improve robustness of keyboard navigation ([#30888](https://github.com/element-hq/element-web/pull/30888)). Contributed by @langleyd.
+* Fix a11y issue on list in invite dialog ([#30878](https://github.com/element-hq/element-web/pull/30878)). Contributed by @florianduros.
+* Switch Export and Import Icons to match intuition ([#30805](https://github.com/element-hq/element-web/pull/30805)). Contributed by @micartey.
+* Hide breadcrumb option when new room list is enabled ([#30869](https://github.com/element-hq/element-web/pull/30869)). Contributed by @florianduros.
+* Avoid creating multiple call objects for the same widget ([#30839](https://github.com/element-hq/element-web/pull/30839)). Contributed by @robintown.
+* Add a test for #29882, which is fixed by matrix-org/matrix-js-sdk#5016 ([#30835](https://github.com/element-hq/element-web/pull/30835)). Contributed by @andybalaam.
+* fix: use `help_encryption_url` of config instead of hardcoded `https://element.io/help#encryption5` ([#30746](https://github.com/element-hq/element-web/pull/30746)). Contributed by @florianduros.
+* Fix html export when feature\_jump\_to\_date is enabled ([#30828](https://github.com/element-hq/element-web/pull/30828)). Contributed by @langleyd.
+* Fix #30439: "Forgot recovery key" should go to "reset" ([#30771](https://github.com/element-hq/element-web/pull/30771)). Contributed by @andybalaam.
+
+
+
+Changes in [1.12.0](https://github.com/element-hq/element-desktop/releases/tag/v1.12.0) (2025-09-23)
+====================================================================================================
+## 🦖 Deprecations
+
+* Remove remaining support for outdated .well-known settings ([#30702](https://github.com/element-hq/element-web/pull/30702)). Contributed by @richvdh.
+
+## ✨ Features
+
+* Automatically select first source for desktop capture under Wayland ([#2526](https://github.com/element-hq/element-desktop/pull/2526)). Contributed by @byquanton.
+* Add decline button to call notification toast (use new notification event) ([#30729](https://github.com/element-hq/element-web/pull/30729)). Contributed by @toger5.
+* Use the new room list by default ([#30640](https://github.com/element-hq/element-web/pull/30640)). Contributed by @langleyd.
+* "Verify this device" redesign ([#30596](https://github.com/element-hq/element-web/pull/30596)). Contributed by @uhoreg.
+* Set Element Call "intents" when starting and answering DM calls. ([#30730](https://github.com/element-hq/element-web/pull/30730)). Contributed by @Half-Shot.
+* Add axe compliance for new room list ([#30700](https://github.com/element-hq/element-web/pull/30700)). Contributed by @langleyd.
+* Stop ringing and remove toast if another device answers a RTC call. ([#30728](https://github.com/element-hq/element-web/pull/30728)). Contributed by @Half-Shot.
+* Automatically adjust history visibility when making a room private ([#30713](https://github.com/element-hq/element-web/pull/30713)). Contributed by @Half-Shot.
+* Release announcement for new room list ([#30675](https://github.com/element-hq/element-web/pull/30675)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* Update Electron to v38.1.0 to fix Kernel crash on multi-GPU systems ([#2544](https://github.com/element-hq/element-desktop/pull/2544)). Contributed by @Arcitec.
+* Fix Confirm your identity buttons being unclickable ([#2554](https://github.com/element-hq/element-desktop/pull/2554)). Contributed by @dbkr.
+* Ensure dropdown is not a drag element on macOS ([#2540](https://github.com/element-hq/element-desktop/pull/2540)). Contributed by @t3chguy.
+* [Backport staging] Room list: make the filter resize correctly ([#30795](https://github.com/element-hq/element-web/pull/30795)). Contributed by @RiotRobot.
+* [Backport staging] Avoid flicker of the room list filter on resize ([#30794](https://github.com/element-hq/element-web/pull/30794)). Contributed by @RiotRobot.
+* Don't show release announcements while toasts are displayed ([#30770](https://github.com/element-hq/element-web/pull/30770)). Contributed by @dbkr.
+* Fix enabling key backup not working if there is an untrusted key backup ([#30707](https://github.com/element-hq/element-web/pull/30707)). Contributed by @Half-Shot.
+* Force `preload` to be false when setting an intent on an Element Call. ([#30759](https://github.com/element-hq/element-web/pull/30759)). Contributed by @Half-Shot.
+* Fix handling of 413 server response when uploading media ([#30737](https://github.com/element-hq/element-web/pull/30737)). Contributed by @hughns.
+* Make landmark navigation work with new room list ([#30747](https://github.com/element-hq/element-web/pull/30747)). Contributed by @dbkr.
+* Prevent voice message from displaying spurious errors ([#30736](https://github.com/element-hq/element-web/pull/30736)). Contributed by @florianduros.
+* Align default avatar and fix colors in composer pills ([#30739](https://github.com/element-hq/element-web/pull/30739)). Contributed by @florianduros.
+* Use configured URL for link to desktop app in message search settings ([#30742](https://github.com/element-hq/element-web/pull/30742)). Contributed by @t3chguy.
+* Fix history visibility when creating space rooms ([#30745](https://github.com/element-hq/element-web/pull/30745)). Contributed by @dbkr.
+* Check HTML-encoded quotes when handling translations for embedded pages (such as welcome.html) ([#30743](https://github.com/element-hq/element-web/pull/30743)). Contributed by @Half-Shot.
+* Fix local room encryption status always not enabled ([#30461](https://github.com/element-hq/element-web/pull/30461)). Contributed by @BillCarsonFr.
+* fix: make url in topic in room intro clickable ([#30686](https://github.com/element-hq/element-web/pull/30686)). Contributed by @florianduros.
+* Block change recovery key button while a change is ongoing. ([#30664](https://github.com/element-hq/element-web/pull/30664)). Contributed by @Half-Shot.
+* Hide advanced settings during room creation when `UIFeature.advancedSettings=false` ([#30684](https://github.com/element-hq/element-web/pull/30684)). Contributed by @florianduros.
+* A11y: improve accessibility of pinned messages ([#30558](https://github.com/element-hq/element-web/pull/30558)). Contributed by @florianduros.
+
+
+
+Changes in [1.11.112](https://github.com/element-hq/element-desktop/releases/tag/v1.11.112) (2025-09-16)
+========================================================================================================
+Fix [CVE-2025-59161](https://www.cve.org/CVERecord?id=CVE-2025-59161) / [GHSA-m6c8-98f4-75rr](https://github.com/element-hq/element-web/security/advisories/GHSA-m6c8-98f4-75rr)
+
+## This is the last release compatible with macOS Big Sur. It will not update further. Big Sur is End of Life for almost 2 years and the next version of Electron crashes upon startup on Big Sur.
+
+## ✨ Features
+
+* [Backport staging] Handle unsupported macOS versions better ([#2555](https://github.com/element-hq/element-desktop/pull/2555)). Contributed by @RiotRobot.
+
+
+
+Changes in [1.11.111](https://github.com/element-hq/element-desktop/releases/tag/v1.11.111) (2025-09-10)
+========================================================================================================
+## ✨ Features
+
+* Do not hide media from your own user by default ([#29797](https://github.com/element-hq/element-web/pull/29797)). Contributed by @Half-Shot.
+* Remember whether sidebar is shown for calls when switching rooms ([#30262](https://github.com/element-hq/element-web/pull/30262)). Contributed by @bojidar-bg.
+* Open the proper integration settings on integrations disabled error ([#30538](https://github.com/element-hq/element-web/pull/30538)). Contributed by @Half-Shot.
+* Show a "progress" dialog while invites are being sent ([#30561](https://github.com/element-hq/element-web/pull/30561)). Contributed by @richvdh.
+* Move the room list to the new ListView(backed by react-virtuoso)  ([#30515](https://github.com/element-hq/element-web/pull/30515)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Ensure container starts if it is mounted with an empty /modules directory. ([#30705](https://github.com/element-hq/element-web/pull/30705)). Contributed by @RiotRobot.
+* Fix room joining over federation not specifying vias or using aliases ([#30641](https://github.com/element-hq/element-web/pull/30641)). Contributed by @t3chguy.
+* Fix stable-suffixed MSC4133 support ([#30649](https://github.com/element-hq/element-web/pull/30649)). Contributed by @dbkr.
+* Fix i18n of message when a setting is disabled ([#30646](https://github.com/element-hq/element-web/pull/30646)). Contributed by @dbkr.
+* ListView should not handle the arrow keys if there is a modifier applied ([#30633](https://github.com/element-hq/element-web/pull/30633)). Contributed by @langleyd.
+* Make BaseDialog's div keyboard focusable and fix test. ([#30631](https://github.com/element-hq/element-web/pull/30631)). Contributed by @langleyd.
+* Fix: Allow triple-click text selection to flow around pills ([#30349](https://github.com/element-hq/element-web/pull/30349)). Contributed by @AlirezaMrtz.
+* Watch for a 'join' action to know when the call is connected ([#29492](https://github.com/element-hq/element-web/pull/29492)). Contributed by @robintown.
+* Fix: add missing tooltip and aria-label to lock icon next to composer ([#30623](https://github.com/element-hq/element-web/pull/30623)). Contributed by @florianduros.
+* Don't render context menu when scrolling ([#30613](https://github.com/element-hq/element-web/pull/30613)). Contributed by @langleyd.
+
+
+
+Changes in [1.11.110](https://github.com/element-hq/element-desktop/releases/tag/v1.11.110) (2025-08-27)
+========================================================================================================
+## ✨ Features
+
+* Hide recovery key when re-entering it while creating or changing it ([#30499](https://github.com/element-hq/element-web/pull/30499)). Contributed by @andybalaam.
+* Add `?no_universal_links=true` to OIDC url so EX doesn't try to handle it ([#29439](https://github.com/element-hq/element-web/pull/29439)). Contributed by @t3chguy.
+* Show a blue lock for unencrypted rooms and hide the grey shield for encrypted rooms ([#30440](https://github.com/element-hq/element-web/pull/30440)). Contributed by @langleyd.
+* Add support for Module API 1.4 ([#30185](https://github.com/element-hq/element-web/pull/30185)). Contributed by @t3chguy.
+* MVVM - Introduce some helpers for snapshot management ([#30398](https://github.com/element-hq/element-web/pull/30398)). Contributed by @MidhunSureshR.
+
+## 🐛 Bug Fixes
+
+* A11y: move focus to right panel when opened ([#30553](https://github.com/element-hq/element-web/pull/30553)). Contributed by @florianduros.
+* Fix e2e warning icon should be white ([#30539](https://github.com/element-hq/element-web/pull/30539)). Contributed by @florianduros.
+* Remove NoOneHere disabled reason. ([#30524](https://github.com/element-hq/element-web/pull/30524)). Contributed by @toger5.
+* Fix downloading files with authenticated media API ([#30520](https://github.com/element-hq/element-web/pull/30520)). Contributed by @t3chguy.
+* Fix call permissions check confusion around element call ([#30521](https://github.com/element-hq/element-web/pull/30521)). Contributed by @t3chguy.
+* Fix line wrap around emoji verification ([#30523](https://github.com/element-hq/element-web/pull/30523)). Contributed by @t3chguy.
+* Don't highlight redacted events ([#30519](https://github.com/element-hq/element-web/pull/30519)). Contributed by @t3chguy.
+* Fix matrix.to links not being handled in the app ([#30522](https://github.com/element-hq/element-web/pull/30522)). Contributed by @t3chguy.
+* Fix issue of new room list taking up the full width ([#30459](https://github.com/element-hq/element-web/pull/30459)). Contributed by @langleyd.
+* Fix widget persistence in React development mode ([#30509](https://github.com/element-hq/element-web/pull/30509)). Contributed by @robintown.
+* Fix widget initialization in React development mode ([#30463](https://github.com/element-hq/element-web/pull/30463)). Contributed by @robintown.
+
+
+
+Changes in [1.11.109](https://github.com/element-hq/element-desktop/releases/tag/v1.11.109) (2025-08-11)
+========================================================================================================
+This release supports the upcoming v12 ("hydra") Matrix room version and is necessary to view and participate in these rooms.
+
+## ✨ Features
+
+* [Backport staging] Allow /upgraderoom command without developer mode enabled ([#30529](https://github.com/element-hq/element-web/pull/30529)). Contributed by @RiotRobot.
+* [Backport staging] Support for creator/owner power level ([#30526](https://github.com/element-hq/element-web/pull/30526)). Contributed by @RiotRobot.
+* New room list: change icon and label of menu item for to start a DM ([#30470](https://github.com/element-hq/element-web/pull/30470)). Contributed by @florianduros.
+* Implement the member list with virtuoso ([#29869](https://github.com/element-hq/element-web/pull/29869)). Contributed by @langleyd.
+* Add labs option for history sharing on invite ([#30313](https://github.com/element-hq/element-web/pull/30313)). Contributed by @richvdh.
+* Bump wysiwyg to 2.39.0 adding support for pasting rich text content in the Rich Text Edtior ([#30421](https://github.com/element-hq/element-web/pull/30421)). Contributed by @langleyd.
+* Support `EventShieldReason.MISMATCHED_SENDER` ([#30403](https://github.com/element-hq/element-web/pull/30403)). Contributed by @richvdh.
+* Change unencrypted and public pills to blue ([#30399](https://github.com/element-hq/element-web/pull/30399)). Contributed by @florianduros.
+* Change color of public room icon ([#30390](https://github.com/element-hq/element-web/pull/30390)). Contributed by @florianduros.
+* Script for updating storybook screenshots ([#30340](https://github.com/element-hq/element-web/pull/30340)). Contributed by @dbkr.
+* Add toggle to hide empty state in devtools ([#30352](https://github.com/element-hq/element-web/pull/30352)). Contributed by @toger5.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Use userId to filter users in non-federated rooms when showing the InviteDialog ([#30537](https://github.com/element-hq/element-web/pull/30537)). Contributed by @RiotRobot.
+* [Backport staging] Catch error when encountering invalid m.room.pinned\_events event ([#30536](https://github.com/element-hq/element-web/pull/30536)). Contributed by @RiotRobot.
+* Update for compatibility with v12 rooms ([#30452](https://github.com/element-hq/element-web/pull/30452)). Contributed by @dbkr.
+* New room list: fix tooltip on presence ([#30474](https://github.com/element-hq/element-web/pull/30474)). Contributed by @florianduros.
+* New room list: add tooltip for presence and room status ([#30472](https://github.com/element-hq/element-web/pull/30472)). Contributed by @florianduros.
+* Fix: Clicking on an item in the member list causes it to scroll to the top rather than show the profile view ([#30455](https://github.com/element-hq/element-web/pull/30455)). Contributed by @langleyd.
+* Put the 'decrypting' tooltip back ([#30446](https://github.com/element-hq/element-web/pull/30446)). Contributed by @dbkr.
+* Use server name explicitly for via. ([#30362](https://github.com/element-hq/element-web/pull/30362)). Contributed by @Half-Shot.
+* fix: replace hardcoded string in poll history dialog ([#30402](https://github.com/element-hq/element-web/pull/30402)). Contributed by @florianduros.
+* fix: replace hardcoded string on qr code back button ([#30401](https://github.com/element-hq/element-web/pull/30401)). Contributed by @florianduros.
+* Fix color of icon button with outline ([#30361](https://github.com/element-hq/element-web/pull/30361)). Contributed by @florianduros.
+
+
+
+Changes in [1.11.108](https://github.com/element-hq/element-desktop/releases/tag/v1.11.108) (2025-07-30)
+========================================================================================================
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix downloaded attachments not being decrypted ([#30434](https://github.com/element-hq/element-web/pull/30434)). Contributed by @RiotRobot.
+
+
+
+Changes in [1.11.107](https://github.com/element-hq/element-desktop/releases/tag/v1.11.107) (2025-07-29)
+========================================================================================================
+## ✨ Features
+
+* Add support for overlaying notification badges on the Windows Taskbar icon. ([#2443](https://github.com/element-hq/element-desktop/pull/2443)). Contributed by @Half-Shot.
+* Reduce macos titlebar height with the new room list and expand the existing border ([#2446](https://github.com/element-hq/element-desktop/pull/2446)). Contributed by @florianduros.
+* Message preview should show tooltip with the full message on hover ([#30265](https://github.com/element-hq/element-web/pull/30265)). Contributed by @MidhunSureshR.
+* Support rendering notification badges on platforms that do their own icon overlays ([#30315](https://github.com/element-hq/element-web/pull/30315)). Contributed by @Half-Shot.
+* Add SubscriptionViewModel base class ([#30297](https://github.com/element-hq/element-web/pull/30297)). Contributed by @dbkr.
+* Enhancement: Save image on CTRL+S ([#30330](https://github.com/element-hq/element-web/pull/30330)). Contributed by @ioalexander.
+* Add quote functionality to MessageContextMenu (#29893) ([#30323](https://github.com/element-hq/element-web/pull/30323)). Contributed by @AlirezaMrtz.
+* Initial structure for shared component views ([#30216](https://github.com/element-hq/element-web/pull/30216)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* Reduce macos titlebar height with the new room list and expand the existing border ([#2446](https://github.com/element-hq/element-desktop/pull/2446)). Contributed by @florianduros.
+* [Backport staging] Fix e2e shield being invisible in white mode for encrypted room ([#30411](https://github.com/element-hq/element-web/pull/30411)). Contributed by @RiotRobot.
+* Force ED titlebar color for new room list ([#30332](https://github.com/element-hq/element-web/pull/30332)). Contributed by @florianduros.
+* Add a background color to left panel for macos titlebar in element desktop ([#30328](https://github.com/element-hq/element-web/pull/30328)). Contributed by @florianduros.
+* Fix: Prevent page refresh on Enter key in right panel member search ([#30312](https://github.com/element-hq/element-web/pull/30312)). Contributed by @AlirezaMrtz.
+
+
+
+Changes in [1.11.106](https://github.com/element-hq/element-desktop/releases/tag/v1.11.106) (2025-07-15)
+========================================================================================================
+## ✨ Features
+
+* [Backport staging] Fix e2e icon colour ([#30304](https://github.com/element-hq/element-web/pull/30304)). Contributed by @RiotRobot.
+* Add support for module message hint `allowDownloadingMedia` ([#30252](https://github.com/element-hq/element-web/pull/30252)). Contributed by @Half-Shot.
+* Update the mobile\_guide page to the new design and link out to Element X by default. ([#30172](https://github.com/element-hq/element-web/pull/30172)). Contributed by @pixlwave.
+* Filter settings exported when rageshaking ([#30236](https://github.com/element-hq/element-web/pull/30236)). Contributed by @Half-Shot.
+* Allow Element Call to learn the room name ([#30213](https://github.com/element-hq/element-web/pull/30213)). Contributed by @robintown.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix missing image download button ([#30322](https://github.com/element-hq/element-web/pull/30322)). Contributed by @RiotRobot.
+* Fix transparent verification checkmark in dark mode ([#30235](https://github.com/element-hq/element-web/pull/30235)). Contributed by @Banbuii.
+* Fix logic in DeviceListener ([#30230](https://github.com/element-hq/element-web/pull/30230)). Contributed by @uhoreg.
+* Disable file drag-and-drop if insufficient permissions ([#30186](https://github.com/element-hq/element-web/pull/30186)). Contributed by @t3chguy.
+
+
+
+Changes in [1.11.105](https://github.com/element-hq/element-desktop/releases/tag/v1.11.105) (2025-07-01)
+========================================================================================================
+## ✨ Features
+
+* Add support for migrating to kwallet6 ([#2390](https://github.com/element-hq/element-desktop/pull/2390)). Contributed by @t3chguy.
+* New room list: add context menu to room list item ([#29952](https://github.com/element-hq/element-web/pull/29952)). Contributed by @florianduros.
+* Support for custom message components via Module API ([#30074](https://github.com/element-hq/element-web/pull/30074)). Contributed by @Half-Shot.
+* Prompt users to set up recovery ([#30075](https://github.com/element-hq/element-web/pull/30075)). Contributed by @uhoreg.
+* Update `IconButton` colors ([#30124](https://github.com/element-hq/element-web/pull/30124)). Contributed by @florianduros.
+* New room list: filter list can be collapsed  ([#29992](https://github.com/element-hq/element-web/pull/29992)). Contributed by @florianduros.
+* Show `EmptyRoomListView` when low priority filter matches zero rooms ([#30122](https://github.com/element-hq/element-web/pull/30122)). Contributed by @MidhunSureshR.
+
+## 🐛 Bug Fixes
+
+* Fix element-desktop-ssoid profile deeplinking for OIDC ([#2396](https://github.com/element-hq/element-desktop/pull/2396)). Contributed by @t3chguy.
+* Add support for migrating to kwallet6 ([#2390](https://github.com/element-hq/element-desktop/pull/2390)). Contributed by @t3chguy.
+* Fix untranslatable string "People" in notifications beta ([#30165](https://github.com/element-hq/element-web/pull/30165)). Contributed by @t3chguy.
+* Force verification even after logging in via delegate ([#30141](https://github.com/element-hq/element-web/pull/30141)). Contributed by @andybalaam.
+* Hide add integrations button based on UIComponent.AddIntegrations ([#30140](https://github.com/element-hq/element-web/pull/30140)). Contributed by @t3chguy.
+* Use nav for new room list and label sections ([#30134](https://github.com/element-hq/element-web/pull/30134)). Contributed by @dbkr.
+* Spacestore should emit event after rebuilding home space ([#30132](https://github.com/element-hq/element-web/pull/30132)). Contributed by @MidhunSureshR.
+* Handle m.room.pinned\_events being invalid ([#30129](https://github.com/element-hq/element-web/pull/30129)). Contributed by @t3chguy.
+
+
+
+Changes in [1.11.104](https://github.com/element-hq/element-desktop/releases/tag/v1.11.104) (2025-06-17)
+========================================================================================================
+## ✨ Features
+
+* Update the mobile\_guide page to the new design. ([#30006](https://github.com/element-hq/element-web/pull/30006)). Contributed by @pixlwave.
+* Provide a devtool for manually verifying other devices ([#30094](https://github.com/element-hq/element-web/pull/30094)). Contributed by @andybalaam.
+* Implement MSC4155: Invite filtering ([#29603](https://github.com/element-hq/element-web/pull/29603)). Contributed by @Half-Shot.
+* Add low priority avatar decoration to room tile ([#30065](https://github.com/element-hq/element-web/pull/30065)). Contributed by @MidhunSureshR.
+* Add ability to prevent window content being captured by other apps (Desktop) ([#30098](https://github.com/element-hq/element-web/pull/30098)). Contributed by @t3chguy.
+* New room list: move message preview in user settings ([#30023](https://github.com/element-hq/element-web/pull/30023)). Contributed by @florianduros.
+* New room list: change room options icon ([#30029](https://github.com/element-hq/element-web/pull/30029)). Contributed by @florianduros.
+* RoomListStore: Sort low priority rooms to the bottom of the list ([#30070](https://github.com/element-hq/element-web/pull/30070)). Contributed by @MidhunSureshR.
+* Add low priority filter pill to the room list UI ([#30060](https://github.com/element-hq/element-web/pull/30060)). Contributed by @MidhunSureshR.
+* New room list: remove color gradient in space panel ([#29721](https://github.com/element-hq/element-web/pull/29721)). Contributed by @florianduros.
+* /share?msg=foo endpoint using forward message dialog ([#29874](https://github.com/element-hq/element-web/pull/29874)). Contributed by @ara4n.
+
+## 🐛 Bug Fixes
+
+* Fix restart loop in safeStorage ([#2373](https://github.com/element-hq/element-desktop/pull/2373)). Contributed by @dbkr.
+* Do not send empty auth when setting up cross-signing keys ([#29914](https://github.com/element-hq/element-web/pull/29914)). Contributed by @gnieto.
+* Settings: flip local video feed by default ([#29501](https://github.com/element-hq/element-web/pull/29501)). Contributed by @jbtrystram.
+* AccessSecretStorageDialog: various fixes ([#30093](https://github.com/element-hq/element-web/pull/30093)). Contributed by @richvdh.
+* AccessSecretStorageDialog: fix inability to enter recovery key ([#30090](https://github.com/element-hq/element-web/pull/30090)). Contributed by @richvdh.
+* Fix failure to upload thumbnail causing image to send as file ([#30086](https://github.com/element-hq/element-web/pull/30086)). Contributed by @t3chguy.
+* Low priority menu item should be a toggle ([#30071](https://github.com/element-hq/element-web/pull/30071)). Contributed by @MidhunSureshR.
+* Add sanity checks to prevent users from ignoring themselves ([#30079](https://github.com/element-hq/element-web/pull/30079)). Contributed by @MidhunSureshR.
+* Fix issue with duplicate images ([#30073](https://github.com/element-hq/element-web/pull/30073)). Contributed by @fatlewis.
+* Handle errors returned from Seshat ([#30083](https://github.com/element-hq/element-web/pull/30083)). Contributed by @richvdh.
+
+
+
+Changes in [1.11.103](https://github.com/element-hq/element-desktop/releases/tag/v1.11.103) (2025-06-10)
+========================================================================================================
+## 🐛 Bug Fixes
+
++ Check the sender of an event matches owner of session, preventing sender spoofing by homeserver owners.
+[13c1d20](https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55) (High, [GHSA-x958-rvg6-956w](https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w)).
+
+
+
 Changes in [1.11.102](https://github.com/element-hq/element-desktop/releases/tag/v1.11.102) (2025-06-03)
 ========================================================================================================
 ## ✨ Features

dockerbuild/Dockerfile

@@ -1,6 +1,6 @@
 # Docker image to facilitate building Element Desktop's native bits using a glibc version (2.31)
 # with broader compatibility, down to Debian bullseye & Ubuntu focal.
-FROM rust:bullseye@sha256:f40b8cc3195deda321031e8dfe23c7d2586e3db7c4103fa36946982d9fd6d588
+FROM rust:bullseye@sha256:65dd7bbc1811b11827fcc842491b90dcd5ebc7153132596911986932a59a0e12
 
 ENV DEBIAN_FRONTEND=noninteractive
 

dockerbuild/setup.sh

@@ -3,6 +3,9 @@
 set -x
 declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
 ARCH="${archMap["$TARGETARCH"]}"
-NODE_VERSION=$(cat /.node-version)
-curl --proto "=https" -L "https://nodejs.org/dist/$NODE_VERSION/node-$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+# The .node-version file generally doesn't have the 'v' (renovate does not put the 'v' and will
+# strip it on upgrade if it's there) but the 'v' is also widely supported so we probably ought
+# to just work either way.
+NODE_VERSION=$(cat /.node-version | sed -e 's/^v//')
+curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
   unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md

electron-builder.ts

@@ -1,12 +1,12 @@
 import * as os from "node:os";
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { type Configuration as BaseConfiguration, type Protocol } from "electron-builder";
 
 /**
  * This script has different outputs depending on your os platform.
  *
  * On Windows:
- *  Prefixes the nightly version with `0.0.1-nightly.` as it breaks if it is not semver
  *  Passes $ED_SIGNTOOL_THUMBPRINT and $ED_SIGNTOOL_SUBJECT_NAME to
  *      build.win.signtoolOptions.signingHashAlgorithms and build.win.signtoolOptions.certificateSubjectName respectively if specified.
  *
@@ -16,32 +16,68 @@ import { type Configuration as BaseConfiguration, type Protocol } from "electron
  *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
  */
 
-const DEFAULT_APP_ID = "im.riot.app";
-const NIGHTLY_APP_ID = "im.riot.nightly";
-const NIGHTLY_DEB_NAME = "element-nightly";
-
-const DEFAULT_PROTOCOL_SCHEME = "io.element.desktop";
-const NIGHTLY_PROTOCOL_SCHEME = "io.element.nightly";
-
+/**
+ * Interface describing relevant fields of the package.json file.
+ */
 interface Pkg {
+    version: string;
+}
+
+/**
+ * Base metadata fields, used in both package.json and the variant configuration.
+ */
+interface Metadata {
     name: string;
     productName: string;
     description: string;
-    version: string;
+}
+
+/**
+ * Extra metadata fields that are injected into the build to pass to the app at runtime.
+ */
+interface ExtraMetadata extends Metadata {
+    electron_appId: string;
+    electron_protocol: string;
+}
+
+/**
+ * Interface describing the variant configuration format.
+ */
+interface Variant extends Metadata {
+    "appId": string;
+    "linux.executableName"?: string;
+    "linux.deb.name"?: string;
+    "protocols": string[];
 }
 
 type Writable<T> = NonNullable<
     T extends Function ? T : T extends object ? { -readonly [K in keyof T]: Writable<T[K]> } : T
 >;
 
-const pkg: Pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+// Load the default variant as a base configuration
+const DEFAULT_VARIANT = path.join("element.io", "release", "build.json");
+let variant: Variant = JSON.parse(fs.readFileSync(DEFAULT_VARIANT, "utf8"));
+
+/**
+ * If a variant is specified, we will use it to override the build-specific values.
+ * This allows us to have different builds for different purposes (e.g. stable, nightly).
+ */
+if (process.env.VARIANT_PATH) {
+    console.log(`Using variant configuration from '${process.env.VARIANT_PATH}':`);
+    variant = {
+        ...variant,
+        ...JSON.parse(fs.readFileSync(`${process.env.VARIANT_PATH}`, "utf8")),
+    };
+} else {
+    console.warn(`No VARIANT_PATH specified, using default variant configuration '${DEFAULT_VARIANT}':`);
+}
+
+for (const key in variant) {
+    console.log(`${key}: ${variant[key]}`);
+}
 
 interface Configuration extends BaseConfiguration {
-    extraMetadata: Partial<Pick<Pkg, "version">> &
-        Omit<Pkg, "version"> & {
-            electron_appId: string;
-            electron_protocol: string;
-        };
+    extraMetadata: Partial<Pick<Pkg, "version">> & ExtraMetadata;
     linux: BaseConfiguration["linux"];
     win: BaseConfiguration["win"];
     mac: BaseConfiguration["mac"];
@@ -58,7 +94,7 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
     // Make all fuses required to ensure they are all explicitly specified
     electronFuses: Required<Configuration["electronFuses"]>;
 } = {
-    appId: DEFAULT_APP_ID,
+    appId: variant.appId,
     asarUnpack: "**/*.node",
     electronFuses: {
         enableCookieEncryption: true,
@@ -82,25 +118,19 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
         },
         "lib/**",
     ],
-    extraResources: [
-        {
-            from: "res/img",
-            to: "img",
-        },
-        "webapp.asar",
-    ],
+    extraResources: ["build/icon.*", "webapp.asar"],
     extraMetadata: {
-        name: pkg.name,
-        productName: pkg.productName,
-        description: pkg.description,
-        electron_appId: DEFAULT_APP_ID,
-        electron_protocol: DEFAULT_PROTOCOL_SCHEME,
+        name: variant.name,
+        productName: variant.productName,
+        description: variant.description,
+        electron_appId: variant.appId,
+        electron_protocol: variant.protocols[0],
     },
     linux: {
         target: ["tar.gz", "deb"],
         category: "Network;InstantMessaging;Chat",
-        maintainer: "support@element.io",
-        icon: "build/icons",
+        icon: "icon.png",
+        executableName: variant.name, // element-desktop or element-desktop-nightly
     },
     deb: {
         packageCategory: "net",
@@ -118,24 +148,17 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
             "libgbm1",
         ],
         recommends: ["libsqlcipher0", "element-io-archive-keyring"],
-        fpm: [
-            "--deb-field",
-            "Replaces: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
-            "--deb-field",
-            "Breaks: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
-            "--deb-pre-depends",
-            "libc6 (>= 2.31)",
-        ],
+        fpm: ["--deb-pre-depends", "libc6 (>= 2.31)"],
     },
     mac: {
+        target: ["dmg", "zip"],
         category: "public.app-category.social-networking",
         darkModeSupport: true,
         hardenedRuntime: true,
         gatekeeperAssess: true,
-        // XXX: we cannot specify this due to https://github.com/electron/osx-sign/issues/344
-        // strictVerify: true,
+        strictVerify: true,
         entitlements: "./build/entitlements.mac.plist",
-        icon: "build/icons/icon.icns",
+        icon: "build/icon.icns",
         mergeASARs: true,
         x64ArchFiles: "**/matrix-seshat/*.node", // hak already runs lipo
     },
@@ -144,7 +167,7 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
         signtoolOptions: {
             signingHashAlgorithms: ["sha256"],
         },
-        icon: "build/icons/icon.ico",
+        icon: "build/icon.ico",
     },
     msi: {
         perMachine: true,
@@ -153,14 +176,27 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
         output: "dist",
     },
     protocols: {
-        name: "element",
-        schemes: [DEFAULT_PROTOCOL_SCHEME, "element"],
+        name: variant.productName,
+        schemes: variant.protocols,
     },
     nativeRebuilder: "sequential",
     nodeGypRebuild: false,
     npmRebuild: true,
 };
 
+/**
+ * Allow specifying the version via env var.
+ * If unspecified, it will default to the version in package.json.
+ * @param {string} process.env.VERSION
+ */
+if (process.env.VERSION) {
+    config.extraMetadata.version = process.env.VERSION;
+}
+
+if (variant["linux.deb.name"]) {
+    config.deb.fpm.push("--name", variant["linux.deb.name"]);
+}
+
 /**
  * Allow specifying windows signing cert via env vars
  * @param {string} process.env.ED_SIGNTOOL_SUBJECT_NAME
@@ -171,32 +207,6 @@ if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT)
     config.win.signtoolOptions!.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
 }
 
-/**
- * Allow specifying nightly version via env var
- * @param {string} process.env.ED_NIGHTLY
- */
-if (process.env.ED_NIGHTLY) {
-    config.deb.fpm = []; // Clear the fpm as the breaks deb fields don't apply to nightly
-
-    config.appId = config.extraMetadata.electron_appId = NIGHTLY_APP_ID;
-    config.extraMetadata.productName += " Nightly";
-    config.extraMetadata.name += "-nightly";
-    config.extraMetadata.description += " (nightly unstable build)";
-    config.deb.fpm.push("--name", NIGHTLY_DEB_NAME);
-    (config.protocols as Protocol).schemes[0] = config.extraMetadata.electron_protocol = NIGHTLY_PROTOCOL_SCHEME;
-
-    let version = process.env.ED_NIGHTLY;
-    if (os.platform() === "win32") {
-        // The windows packager relies on parsing this as semver, so we have to make it look like one.
-        // This will give our update packages really stupid names, but we probably can't change that either
-        // because squirrel windows parses them for the version too. We don't really care: nobody sees them.
-        // We just give the installer a static name, so you'll just see this in the 'about' dialog.
-        // Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
-        version = "0.0.1-nightly." + version;
-    }
-    config.extraMetadata.version = version;
-}
-
 if (os.platform() === "linux") {
     // Electron crashes on debian if there's a space in the path.
     // https://github.com/vector-im/element-web/issues/13171

element.io/nightly/build.json

@@ -0,0 +1,9 @@
+{
+    "appId": "im.riot.nightly",
+    "name": "element-desktop-nightly",
+    "productName": "Element Nightly",
+    "description": "Element: the future of secure communication (nightly unstable build)",
+    "protocols": ["io.element.nightly", "element"],
+    "linux.executableName": "element-desktop-nightly",
+    "linux.deb.name": "element-nightly"
+}

element.io/release/build.json

@@ -0,0 +1,7 @@
+{
+    "appId": "im.riot.app",
+    "name": "element-desktop",
+    "productName": "Element",
+    "description": "Element: the future of secure communication",
+    "protocols": ["io.element.desktop", "element"]
+}

knip.ts

@@ -1,7 +1,7 @@
 import { KnipConfig } from "knip";
 
 export default {
-    entry: ["src/electron-main.ts", "src/preload.ts", "electron-builder.ts", ".eslintrc-*.js", "scripts/**", "hak/**"],
+    entry: ["src/preload.cts", "electron-builder.ts", "scripts/**", "hak/**"],
     project: ["**/*.{js,ts}"],
     ignoreDependencies: [
         // Brought in via hak scripts
@@ -10,6 +10,8 @@ export default {
         "@action-validator/*",
         // Used for git pre-commit hooks
         "husky",
+        // Required for `patch-package`
+        "postinstall-postinstall",
     ],
     ignoreBinaries: ["jq", "scripts/in-docker.sh"],
 } satisfies KnipConfig;

package.json

@@ -3,9 +3,12 @@
     "productName": "Element",
     "main": "lib/electron-main.js",
     "exports": "./lib/electron-main.js",
-    "version": "1.11.102",
+    "version": "1.12.2",
     "description": "Element: the future of secure communication",
-    "author": "Element",
+    "author": {
+        "name": "Element",
+        "email": "support@element.io"
+    },
     "homepage": "https://element.io",
     "repository": {
         "type": "git",
@@ -54,19 +57,18 @@
         "test:open": "yarn test --ui",
         "test:screenshots:build": "docker build playwright -t element-desktop-playwright --platform linux/amd64",
         "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright",
-        "postinstall": "electron-builder install-app-deps"
+        "postinstall": "patch-package && electron-builder install-app-deps"
     },
     "dependencies": {
-        "@sentry/electron": "^6.0.0",
-        "@standardnotes/electron-clear-data": "^1.0.5",
+        "@sentry/electron": "^7.0.0",
         "auto-launch": "^5.0.5",
         "counterpart": "^0.18.6",
         "electron-store": "^10.0.0",
         "electron-window-state": "^5.0.3",
         "keytar-forked": "7.10.0",
         "minimist": "^1.2.6",
-        "png-to-ico": "^2.1.1",
-        "uuid": "^11.0.0"
+        "png-to-ico": "^3.0.0",
+        "uuid": "^13.0.0"
     },
     "devDependencies": {
         "@action-validator/cli": "^0.6.0",
@@ -74,22 +76,22 @@
         "@babel/core": "^7.18.10",
         "@babel/preset-env": "^7.18.10",
         "@babel/preset-typescript": "^7.18.6",
-        "@electron/asar": "3.4.1",
-        "@playwright/test": "1.52.0",
-        "@stylistic/eslint-plugin": "^4.0.0",
+        "@electron/asar": "4.0.1",
+        "@playwright/test": "1.55.1",
+        "@stylistic/eslint-plugin": "^5.0.0",
         "@types/auto-launch": "^5.0.1",
         "@types/counterpart": "^0.18.1",
         "@types/minimist": "^1.2.1",
-        "@types/node": "18.19.100",
+        "@types/node": "18.19.127",
         "@types/pacote": "^11.1.1",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
         "@typescript-eslint/parser": "^8.0.0",
-        "app-builder-lib": "26.0.15",
+        "app-builder-lib": "26.0.20",
         "chokidar": "^4.0.0",
         "detect-libc": "^2.0.0",
-        "electron": "36.2.0",
-        "electron-builder": "26.0.15",
-        "electron-builder-squirrel-windows": "26.0.15",
+        "electron": "38.2.0",
+        "electron-builder": "26.0.20",
+        "electron-builder-squirrel-windows": "26.0.20",
         "electron-devtools-installer": "^4.0.0",
         "eslint": "^8.26.0",
         "eslint-config-google": "^0.14.0",
@@ -105,18 +107,20 @@
         "matrix-web-i18n": "^3.2.1",
         "mkdirp": "^3.0.0",
         "pacote": "^21.0.0",
+        "patch-package": "^8.0.1",
+        "postinstall-postinstall": "^2.1.0",
         "prettier": "^3.0.0",
         "rimraf": "^6.0.0",
         "tar": "^7.0.0",
         "tsx": "^4.19.2",
-        "typescript": "5.8.3"
+        "typescript": "5.9.2"
     },
     "hakDependencies": {
         "matrix-seshat": "^4.0.1"
     },
     "resolutions": {
-        "@types/node": "18.19.100",
+        "@types/node": "18.19.127",
         "config-file-ts": "0.2.8-rc1",
-        "node-abi": "4.8.0"
+        "node-abi": "4.14.0"
     }
 }

patches/@types+auto-launch+5.0.5.patch

@@ -0,0 +1,18 @@
+diff --git a/node_modules/@types/auto-launch/index.d.ts b/node_modules/@types/auto-launch/index.d.ts
+index a30a77c..e512ce1 100644
+--- a/node_modules/@types/auto-launch/index.d.ts
++++ b/node_modules/@types/auto-launch/index.d.ts
+@@ -25,6 +25,13 @@ interface AutoLaunchOptions {
+ declare class AutoLaunch {
+     constructor(options: AutoLaunchOptions);
+ 
++    /**
++     * This type describes the internal options of the `auto-launch` package which allows us to update options after initialization.
++     */
++    readonly opts: {
++        isHiddenOnLaunch: boolean;
++    };
++
+     /**
+      * Enables auto-launch at start up.
+      */

playwright/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/playwright:v1.52.0-jammy@sha256:ff2946177f0756c87482c0ef958b7cfbf389b92525ace78a1c9890281d0d60f4
+FROM mcr.microsoft.com/playwright:v1.55.1-jammy@sha256:a012a91c32e36b3300514684c5bdb60c07f01464abd03380320179e5273427ab
 
 WORKDIR /work/element-desktop
 

src/@types/global.d.ts

@@ -7,7 +7,6 @@ Please see LICENSE files in the repository root for full details.
 
 import { type BrowserWindow } from "electron";
 
-import type AutoLaunch from "auto-launch";
 import { type AppLocalization } from "../language-helper.js";
 
 // global type extensions need to use var for whatever reason
@@ -18,7 +17,6 @@ declare global {
     var mainWindow: BrowserWindow | null;
     var appQuitting: boolean;
     var appLocalization: AppLocalization;
-    var launcher: AutoLaunch;
     var vectorConfig: IConfigOptions;
     var trayConfig: {
         // eslint-disable-next-line camelcase

src/auto-launch.ts

@@ -0,0 +1,50 @@
+/*
+Copyright 2025 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import BaseAutoLaunch from "auto-launch";
+
+import Store from "./store.js";
+
+export type AutoLaunchState = "enabled" | "minimised" | "disabled";
+
+// Wrapper around auto-launch to get/set the `isHidden` option
+export class AutoLaunch extends BaseAutoLaunch {
+    private static internalInstance?: AutoLaunch;
+
+    public static get instance(): AutoLaunch {
+        if (!AutoLaunch.internalInstance) {
+            if (!Store.instance) throw new Error("Store not initialized");
+            AutoLaunch.internalInstance = new AutoLaunch({
+                name: global.vectorConfig.brand || "Element",
+                isHidden: Store.instance.get("openAtLoginMinimised"),
+                mac: {
+                    useLaunchAgent: true,
+                },
+            });
+        }
+        return AutoLaunch.internalInstance;
+    }
+
+    public async getState(): Promise<AutoLaunchState> {
+        if (!(await this.isEnabled())) {
+            return "disabled";
+        }
+        return this.opts.isHiddenOnLaunch ? "minimised" : "enabled";
+    }
+
+    public async setState(state: AutoLaunchState): Promise<void> {
+        const openAtLoginMinimised = state === "minimised";
+        Store.instance?.set("openAtLoginMinimised", openAtLoginMinimised);
+        this.opts.isHiddenOnLaunch = openAtLoginMinimised;
+
+        if (state !== "disabled") {
+            return this.enable();
+        } else {
+            return this.disable();
+        }
+    }
+}

src/badge.ts

@@ -0,0 +1,49 @@
+/*
+Copyright 2025 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { app, ipcMain, type IpcMainEvent, nativeImage } from "electron";
+
+import { _t } from "./language-helper.js";
+
+// Handles calculating the correct "badge" for the window, for notifications and error states.
+// Tray icon updates are handled in tray.ts
+
+if (process.platform === "win32") {
+    // We only use setOverlayIcon on Windows as it's only supported on that platform, but has good support
+    // from all the Windows variants we support.
+    // https://www.electronjs.org/docs/latest/api/browser-window#winsetoverlayiconoverlay-description-windows
+    ipcMain.on(
+        "setBadgeCount",
+        function (_ev: IpcMainEvent, count: number, imageBuffer?: Buffer, isError?: boolean): void {
+            if (count === 0) {
+                // Flash frame is set to true in ipc.ts "loudNotification"
+                global.mainWindow?.flashFrame(false);
+            }
+            if (imageBuffer) {
+                global.mainWindow?.setOverlayIcon(
+                    nativeImage.createFromBuffer(Buffer.from(imageBuffer)),
+                    isError
+                        ? _t("icon_overlay|description_error")
+                        : _t("icon_overlay|description_notifications", { count }),
+                );
+            } else {
+                global.mainWindow?.setOverlayIcon(null, "");
+            }
+        },
+    );
+} else {
+    // only set badgeCount on Mac/Linux, the docs say that only those platforms support it but turns out Electron
+    // has some Windows support too, and in some Windows environments this leads to two badges rendering atop
+    // each other. See https://github.com/vector-im/element-web/issues/16942
+    ipcMain.on("setBadgeCount", function (_ev: IpcMainEvent, count: number): void {
+        if (count === 0) {
+            // Flash frame is set to true in ipc.ts "loudNotification"
+            global.mainWindow?.flashFrame(false);
+        }
+        app.badgeCount = count;
+    });
+}

src/electron-main.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2018-2024 New Vector Ltd.
+Copyright 2018-2025 New Vector Ltd.
 Copyright 2017-2019 Michael Telatynski <7t3chguy@gmail.com>
 Copyright 2016 Aviral Dasgupta
 Copyright 2016 OpenMarket Ltd
@@ -10,10 +10,20 @@ Please see LICENSE files in the repository root for full details.
 
 // Squirrel on windows starts the app with various flags as hooks to tell us when we've been installed/uninstalled etc.
 import "./squirrelhooks.js";
-import { app, BrowserWindow, Menu, autoUpdater, dialog, type Input, type Event, session, protocol } from "electron";
+import {
+    app,
+    BrowserWindow,
+    Menu,
+    autoUpdater,
+    dialog,
+    type Input,
+    type Event,
+    session,
+    protocol,
+    desktopCapturer,
+} from "electron";
 // eslint-disable-next-line n/file-extension-in-import
 import * as Sentry from "@sentry/electron/main";
-import AutoLaunch from "auto-launch";
 import path, { dirname } from "node:path";
 import windowStateKeeper from "electron-window-state";
 import fs, { promises as afs } from "node:fs";
@@ -23,6 +33,7 @@ import minimist from "minimist";
 import "./ipc.js";
 import "./seshat.js";
 import "./settings.js";
+import "./badge.js";
 import * as tray from "./tray.js";
 import Store from "./store.js";
 import { buildMenuTemplate } from "./vectormenu.js";
@@ -157,59 +168,74 @@ function loadLocalConfigFile(): Json {
     }
 }
 
+let loadConfigPromise: Promise<void> | undefined;
 // Loads the config from asar, and applies a config.json from userData atop if one exists
-// Writes config to `global.vectorConfig`. Does nothing if `global.vectorConfig` is already set.
-async function loadConfig(): Promise<void> {
-    if (global.vectorConfig) return;
+// Writes config to `global.vectorConfig`. Idempotent, returns the same promise on subsequent calls.
+function loadConfig(): Promise<void> {
+    if (loadConfigPromise) return loadConfigPromise;
 
-    const asarPath = await getAsarPath();
+    async function actuallyLoadConfig(): Promise<void> {
+        const asarPath = await getAsarPath();
 
-    try {
-        console.log(`Loading app config: ${path.join(asarPath, LocalConfigFilename)}`);
-        global.vectorConfig = loadJsonFile(asarPath, LocalConfigFilename);
-    } catch {
-        // it would be nice to check the error code here and bail if the config
-        // is unparsable, but we get MODULE_NOT_FOUND in the case of a missing
-        // file or invalid json, so node is just very unhelpful.
-        // Continue with the defaults (ie. an empty config)
-        global.vectorConfig = {};
-    }
-
-    try {
-        // Load local config and use it to override values from the one baked with the build
-        const localConfig = loadLocalConfigFile();
-
-        // If the local config has a homeserver defined, don't use the homeserver from the build
-        // config. This is to avoid a problem where Riot thinks there are multiple homeservers
-        // defined, and panics as a result.
-        if (Object.keys(localConfig).find((k) => homeserverProps.includes(<any>k))) {
-            // Rip out all the homeserver options from the vector config
-            global.vectorConfig = Object.keys(global.vectorConfig)
-                .filter((k) => !homeserverProps.includes(<any>k))
-                .reduce(
-                    (obj, key) => {
-                        obj[key] = global.vectorConfig[key];
-                        return obj;
-                    },
-                    {} as Omit<Partial<(typeof global)["vectorConfig"]>, keyof typeof homeserverProps>,
-                );
+        try {
+            console.log(`Loading app config: ${path.join(asarPath, LocalConfigFilename)}`);
+            global.vectorConfig = loadJsonFile(asarPath, LocalConfigFilename);
+        } catch {
+            // it would be nice to check the error code here and bail if the config
+            // is unparsable, but we get MODULE_NOT_FOUND in the case of a missing
+            // file or invalid json, so node is just very unhelpful.
+            // Continue with the defaults (ie. an empty config)
+            global.vectorConfig = {};
         }
 
-        global.vectorConfig = Object.assign(global.vectorConfig, localConfig);
-    } catch (e) {
-        if (e instanceof SyntaxError) {
-            void dialog.showMessageBox({
-                type: "error",
-                title: `Your ${global.vectorConfig.brand || "Element"} is misconfigured`,
-                message:
-                    `Your custom ${global.vectorConfig.brand || "Element"} configuration contains invalid JSON. ` +
-                    `Please correct the problem and reopen ${global.vectorConfig.brand || "Element"}.`,
-                detail: e.message || "",
+        try {
+            // Load local config and use it to override values from the one baked with the build
+            const localConfig = loadLocalConfigFile();
+
+            // If the local config has a homeserver defined, don't use the homeserver from the build
+            // config. This is to avoid a problem where Riot thinks there are multiple homeservers
+            // defined, and panics as a result.
+            if (Object.keys(localConfig).find((k) => homeserverProps.includes(<any>k))) {
+                // Rip out all the homeserver options from the vector config
+                global.vectorConfig = Object.keys(global.vectorConfig)
+                    .filter((k) => !homeserverProps.includes(<any>k))
+                    .reduce(
+                        (obj, key) => {
+                            obj[key] = global.vectorConfig[key];
+                            return obj;
+                        },
+                        {} as Omit<Partial<(typeof global)["vectorConfig"]>, keyof typeof homeserverProps>,
+                    );
+            }
+
+            global.vectorConfig = Object.assign(global.vectorConfig, localConfig);
+        } catch (e) {
+            if (e instanceof SyntaxError) {
+                void dialog.showMessageBox({
+                    type: "error",
+                    title: `Your ${global.vectorConfig.brand || "Element"} is misconfigured`,
+                    message:
+                        `Your custom ${global.vectorConfig.brand || "Element"} configuration contains invalid JSON. ` +
+                        `Please correct the problem and reopen ${global.vectorConfig.brand || "Element"}.`,
+                    detail: e.message || "",
+                });
+            }
+
+            // Could not load local config, this is expected in most cases.
+        }
+
+        // Tweak modules paths as they assume the root is at the same level as webapp, but for `vector://vector/webapp` it is not.
+        if (Array.isArray(global.vectorConfig.modules)) {
+            global.vectorConfig.modules = global.vectorConfig.modules.map((m) => {
+                if (m.startsWith("/")) {
+                    return "/webapp" + m;
+                }
+                return m;
             });
         }
-
-        // Could not load local config, this is expected in most cases.
     }
+    loadConfigPromise = actuallyLoadConfig();
+    return loadConfigPromise;
 }
 
 // Configure Electron Sentry and crashReporter using sentry.dsn in config.json if one is present.
@@ -227,54 +253,17 @@ async function configureSentry(): Promise<void> {
     }
 }
 
-// Set up globals for Tray and AutoLaunch
+// Set up globals for Tray
 async function setupGlobals(): Promise<void> {
     const asarPath = await getAsarPath();
     await loadConfig();
 
-    // we assume the resources path is in the same place as the asar
-    const resPath = await tryPaths("res", path.dirname(asarPath), [
-        // If run from the source checkout
-        "res",
-        // if run from packaged application
-        "",
-    ]);
-
-    // The tray icon
-    // It's important to call `path.join` so we don't end up with the packaged asar in the final path.
-    const iconFile = `element.${process.platform === "win32" ? "ico" : "png"}`;
+    // Figure out the tray icon path & brand name
+    const iconFile = `icon.${process.platform === "win32" ? "ico" : "png"}`;
     global.trayConfig = {
-        icon_path: path.join(resPath, "img", iconFile),
+        icon_path: path.join(path.dirname(asarPath), "build", iconFile),
         brand: global.vectorConfig.brand || "Element",
     };
-
-    // launcher
-    global.launcher = new AutoLaunch({
-        name: global.vectorConfig.brand || "Element",
-        isHidden: true,
-        mac: {
-            useLaunchAgent: true,
-        },
-    });
-}
-
-// Look for an auto-launcher under 'Riot' and if we find one,
-// port its enabled/disabled-ness over to the new 'Element' launcher
-async function moveAutoLauncher(): Promise<void> {
-    if (!global.vectorConfig.brand || global.vectorConfig.brand === "Element") {
-        const oldLauncher = new AutoLaunch({
-            name: "Riot",
-            isHidden: true,
-            mac: {
-                useLaunchAgent: true,
-            },
-        });
-        const wasEnabled = await oldLauncher.isEnabled();
-        if (wasEnabled) {
-            await oldLauncher.disable();
-            await global.launcher.enable();
-        }
-    }
 }
 
 global.appQuitting = false;
@@ -363,7 +352,6 @@ app.on("ready", async () => {
     try {
         asarPath = await getAsarPath();
         await setupGlobals();
-        await moveAutoLauncher();
     } catch (e) {
         console.log("App setup failed: exiting", e);
         process.exit(1);
@@ -441,7 +429,6 @@ app.on("ready", async () => {
     if (argv["update"] === false) {
         console.log("Auto update disabled via command line flag");
     } else if (global.vectorConfig["update_base_url"]) {
-        console.log(`Starting auto update with base URL: ${global.vectorConfig["update_base_url"]}`);
         void updater.start(global.vectorConfig["update_base_url"]);
     } else {
         console.log("No update_base_url is defined: auto update is disabled");
@@ -453,14 +440,6 @@ app.on("ready", async () => {
         store,
     });
 
-    try {
-        console.debug("Ensuring storage is ready");
-        await store.safeStorageReady();
-    } catch (e) {
-        console.error(e);
-        app.exit(1);
-    }
-
     // Load the previous window state with fallback to defaults
     const mainWindowState = windowStateKeeper({
         defaultWidth: 1024,
@@ -492,6 +471,17 @@ app.on("ready", async () => {
             webgl: true,
         },
     });
+
+    global.mainWindow.setContentProtection(store.get("enableContentProtection"));
+
+    try {
+        console.debug("Ensuring storage is ready");
+        if (!(await store.prepareSafeStorage(global.mainWindow.webContents.session))) return;
+    } catch (e) {
+        console.error(e);
+        app.exit(1);
+    }
+
     void global.mainWindow.loadURL("vector://vector/webapp/");
 
     if (process.platform === "darwin") {
@@ -579,10 +569,28 @@ app.on("ready", async () => {
 
     webContentsHandler(global.mainWindow.webContents);
 
-    session.defaultSession.setDisplayMediaRequestHandler((_, callback) => {
-        global.mainWindow?.webContents.send("openDesktopCapturerSourcePicker");
-        setDisplayMediaCallback(callback);
-    });
+    session.defaultSession.setDisplayMediaRequestHandler(
+        (_, callback) => {
+            if (process.env.XDG_SESSION_TYPE === "wayland") {
+                // On Wayland, calling getSources() opens the xdg-desktop-portal picker.
+                // The user can only select a single source there, so Electron will return an array with exactly one entry.
+                desktopCapturer
+                    .getSources({ types: ["screen", "window"] })
+                    .then((sources) => {
+                        callback({ video: sources[0] });
+                    })
+                    .catch((err) => {
+                        // If the user cancels the dialog an error occurs "Failed to get sources"
+                        console.error("Wayland: failed to get user-selected source:", err);
+                        callback({ video: { id: "", name: "" } }); // The promise does not return if no dummy is passed here as source
+                    });
+            } else {
+                global.mainWindow?.webContents.send("openDesktopCapturerSourcePicker");
+            }
+            setDisplayMediaCallback(callback);
+        },
+        { useSystemPicker: true },
+    ); // Use Mac OS 15+ native picker
 
     setupMediaAuth(global.mainWindow);
 });

src/i18n/strings/cs.json

@@ -32,9 +32,22 @@
         "speech_start_speaking": "Spustit nahrávání hlasu",
         "speech_stop_speaking": "Zastavit nahrávání hlasu"
     },
+    "eol": {
+        "no_more_updates": "Používáte nepodporovanou verzi systému macOS. Prosím upgradujte %(brand)s pro získání aktualizací.",
+        "title": "Systém není podporován",
+        "warning": "Používáte nepodporovanou verzi systému macOS. Proveďte prosím upgrade %(brand)s , aby byl stále funkční."
+    },
     "file_menu": {
         "label": "Soubor"
     },
+    "icon_overlay": {
+        "description_error": "Chyba",
+        "description_notifications": {
+            "one": "Máte %(count)s nepřečtené oznámení.",
+            "few": "Máte %(count)s nepřečtená oznámení.",
+            "other": "Máte %(count)s nepřečtených oznámení."
+        }
+    },
     "menu": {
         "hide": "Skrýt",
         "hide_others": "Skrýt ostatní",

src/i18n/strings/cy.json

@@ -32,9 +32,22 @@
         "speech_start_speaking": "Cychwyn Llefaru",
         "speech_stop_speaking": "Peidio Llefaru"
     },
+    "eol": {
+        "no_more_updates": "Rydych chi'n rhedeg fersiwn o macOS nad yw'n cael ei chefnogi. Uwchraddiwch i dderbyn diweddariadau %(brand)s.",
+        "title": "System heb ei chefnogi",
+        "warning": "Rydych chi'n rhedeg fersiwn o macOS nad yw'n cael ei chefnogi. Uwchraddiwch i sicrhau bod %(brand)s yn parhau i weithio."
+    },
     "file_menu": {
         "label": "Ffeil"
     },
+    "icon_overlay": {
+        "description_error": "Gwall",
+        "description_notifications": {
+            "Mae gennych chi %(count)s hysbysiadau heb eu darllen.": "zero",
+            "Mae gennych chi %(count)s hysbysiad heb ei ddarllen.": "one",
+            "Mae gennych chi %(count)s hysbysiad heb eu darllen.": "other"
+        }
+    },
     "menu": {
         "hide": "Cuddio",
         "hide_others": "Cuddio'r Gweddill",
@@ -61,7 +74,9 @@
             "backend_no_encryption_title": "Dim cefnogaeth amgryptio",
             "unsupported_keyring": "Mae gan eich system allweddell nad yw'n cael ei chefnogi sy'n golygu nad oes modd agor y gronfa ddata.",
             "unsupported_keyring_detail": "Heb ganfod allweddell Electron gefn. Gallwch geisio ffurfweddu'r gefn â llaw trwy gychwyn %(brand)s gyda dadl llinell orchymyn, gweithrediad untro. Gweler %(link)s.",
-            "unsupported_keyring_title": "System heb ei chefnogi"
+            "unsupported_keyring_title": "System heb ei chefnogi",
+            "unsupported_keyring_use_basic_text": "Defnyddiwch amgryptio gwannach",
+            "unsupported_keyring_use_plaintext": "Peidiwch â defnyddio amgryptio"
         }
     },
     "view_menu": {

src/i18n/strings/de_DE.json

@@ -32,9 +32,21 @@
         "speech_start_speaking": "Aufnahme starten",
         "speech_stop_speaking": "Aufnahme beenden"
     },
+    "eol": {
+        "no_more_updates": "Du benutzt eine nicht unterstützte Version von macOS. Bitte aktualisiere, um Updates für %(brand)s zu erhalten.",
+        "title": "System nicht unterstützt",
+        "warning": "Du benutzt eine nicht unterstützte Version von macOS. Bitte aktualisiere, damit %(brand)s weiter funktioniert."
+    },
     "file_menu": {
         "label": "Datei"
     },
+    "icon_overlay": {
+        "description_error": "Fehler",
+        "description_notifications": {
+            "one": "Du hast %(count)s ungelesene Benachrichtigung.",
+            "other": "Du hast %(count)s ungelesene Benachrichtigungen."
+        }
+    },
     "menu": {
         "hide": "Verstecken",
         "hide_others": "Andere verstecken",
@@ -57,11 +69,13 @@
             "backend_changed_detail": "Zugriff auf Schlüssel im Systemschlüsselbund nicht möglich, er scheint sich geändert zu haben.",
             "backend_changed_title": "Datenbank konnte nicht geladen werden",
             "backend_no_encryption": "Ihr System verfügt über einen unterstützten Keyring, aber die Verschlüsselung ist nicht verfügbar.",
-            "backend_no_encryption_detail": "Electron hat festgestellt, dass Verschlüsselung in Ihrem Keyring %(backend)s nicht verfügbar ist. Bitte stellen Sie sicher, dass Sie den Keyringinstalliert haben. Wenn Sie den Keyring installiert haben, starten Sie ihn bitte neu und versuchen Sie es erneut. Optional können Sie die Verwendung einer schwächeren Form der Verschlüsselung zulassen %(brand)s.",
+            "backend_no_encryption_detail": "Electron hat festgestellt, dass der Keyring von %(backend)s keine Verschlüsselung bietet. Wenn du den Keyring installiert hast, starte den Rechner bitte neu und versuche es erneut. Optional kann %(brand)s auch eine abgeschwächte Verschlüsselung nutzen.",
             "backend_no_encryption_title": "Keine Verschlüsselungsunterstützung",
-            "unsupported_keyring": "Der Schlüsselbund ihres Systems wird nicht unterstützt, wodurch die Datenbank nicht geöffnet werden kann.",
-            "unsupported_keyring_detail": "Die Schlüsselbunderkennung von Electron hat kein unterstütztes Backend gefunden. Möglicherweise können sie dennoch den ihres Systemes verwenden. Infos unter %(link)s.",
-            "unsupported_keyring_title": "System nicht unterstützt"
+            "unsupported_keyring": "Der Keyring des Systems wird nicht unterstützt. Daher kann die Datenbank nicht geöffnet werden kann.",
+            "unsupported_keyring_detail": "Die Keyring-Erkennung von Electron hat kein unterstütztes Backend gefunden. Du kannst einmalig versuchen, eine manuelle Konfiguration von %(brand)s über die Kommandozeile vorzunehmen. Infos unter %(link)s.",
+            "unsupported_keyring_title": "System nicht unterstützt",
+            "unsupported_keyring_use_basic_text": "Schwächere Verschlüsselung verwenden",
+            "unsupported_keyring_use_plaintext": "Verwende keine Verschlüsselung"
         }
     },
     "view_menu": {

src/i18n/strings/en_EN.json

@@ -32,9 +32,21 @@
         "speech_start_speaking": "Start Speaking",
         "speech_stop_speaking": "Stop Speaking"
     },
+    "eol": {
+        "no_more_updates": "You are running an unsupported version of macOS. Please upgrade to receive %(brand)s updates.",
+        "title": "System unsupported",
+        "warning": "You are running an unsupported version of macOS. Please upgrade to ensure %(brand)s keeps working."
+    },
     "file_menu": {
         "label": "File"
     },
+    "icon_overlay": {
+        "description_error": "Error",
+        "description_notifications": {
+            "one": "You have %(count)s unread notification.",
+            "other": "You have %(count)s unread notifications."
+        }
+    },
     "menu": {
         "hide": "Hide",
         "hide_others": "Hide Others",

src/i18n/strings/et.json

@@ -32,9 +32,21 @@
         "speech_start_speaking": "Alusta rääkimist",
         "speech_stop_speaking": "Lõpeta rääkimine"
     },
+    "eol": {
+        "no_more_updates": "Sa kasutad macOS-i toetamata versiooni. %(brand)s rakenduse tulevaste versioonide kasutamiseks palun uuenda operatsioonisüsteemi.",
+        "title": "Süsteem pole toetatud",
+        "warning": "Sa kasutad macOS-i toetamata versiooni. Et %(brand)s toimiks ka edaspidi, palun uuenda operatsioonisüsteemi."
+    },
     "file_menu": {
         "label": "Fail"
     },
+    "icon_overlay": {
+        "description_error": "Viga",
+        "description_notifications": {
+            "one": "Sul on %(count)s lugemata teavitus",
+            "other": "Sul on %(count)s lugemata teavitust"
+        }
+    },
     "menu": {
         "hide": "Peida",
         "hide_others": "Peida muud",

src/i18n/strings/fr.json

@@ -32,9 +32,21 @@
         "speech_start_speaking": "Commencer la dictée",
         "speech_stop_speaking": "Arrêter la dictée"
     },
+    "eol": {
+        "no_more_updates": "Vous utilisez une version de macOS non prise en charge. Veuillez mettre à jour macOS pour recevoir les mises à jour de %(brand)s.",
+        "title": "Système non pris en charge",
+        "warning": "Vous utilisez une version de macOS non prise en charge. Veuillez mettre à jour macOS afin que %(brand)s continue de fonctionner."
+    },
     "file_menu": {
         "label": "Fichier"
     },
+    "icon_overlay": {
+        "description_error": "Erreur",
+        "description_notifications": {
+            "one": "Vous avez %(count)s notification non lue.",
+            "other": "Vous avez %(count)s notifications non lues."
+        }
+    },
     "menu": {
         "hide": "Masquer",
         "hide_others": "Masquer les autres",
@@ -48,7 +60,7 @@
         "copy_image_url": "Copier l'adresse de l'image",
         "copy_link_url": "Copier l’adresse du lien",
         "save_image_as": "Enregistrer l’image sous…",
-        "save_image_as_error_description": "L’image n’a pas pu être sauvegardée",
+        "save_image_as_error_description": "L’image n’a pas pu être enregistrée",
         "save_image_as_error_title": "Échec de la sauvegarde de l’image"
     },
     "store": {
@@ -56,9 +68,14 @@
             "backend_changed": "Effacer les données et recharger ?",
             "backend_changed_detail": "Impossible d'accéder aux secrets depuis le trousseau de clés du système, il semble avoir changé.",
             "backend_changed_title": "Impossible de charger la base de données",
+            "backend_no_encryption": "Votre système dispose d'un trousseau de clés compatible mais le chiffrement est indisponible.",
+            "backend_no_encryption_detail": "Electron a détecté que le chiffrement n'est pas disponible pour le trousseau %(backend)s. Veuillez vérifier que votre trousseau est installé. Si c'est le cas, redémarrez et réessayez. Comme alternative, vous pouvez autoriser %(brand)s à utiliser une option de chiffrement moins sécurisée.",
+            "backend_no_encryption_title": "Aucune prise en charge du chiffrement",
             "unsupported_keyring": "Votre système possède un trousseau de clés non pris en charge, la base de données ne peut pas être ouverte.",
             "unsupported_keyring_detail": "La détection du porte-clés par Electron n'a pas permis de trouver de backend compatible. Vous pouvez essayer de configurer manuellement le backend en utilisant %(brand)s avec un argument de ligne de commande. Cette opération doit être effectuer une seule fois. Voir%(link)s.",
-            "unsupported_keyring_title": "Système non pris en charge"
+            "unsupported_keyring_title": "Système non pris en charge",
+            "unsupported_keyring_use_basic_text": "Utiliser un chiffrement plus faible",
+            "unsupported_keyring_use_plaintext": "N'utilise pas de chiffrement"
         }
     },
     "view_menu": {

src/i18n/strings/hu.json

@@ -32,9 +32,21 @@
         "speech_start_speaking": "Kezdjen beszélni",
         "speech_stop_speaking": "Fejezze be a beszédet"
     },
+    "eol": {
+        "no_more_updates": "A macOS egy nem támogatott verzióját futtatja. Frissítse, hogy megkapja az %(brand)s új frissítéseit.",
+        "title": "A rendszer nem támogatott",
+        "warning": "A macOS egy nem támogatott verzióját futtatja. Frissítse a rendszert, hogy biztosítsa az %(brand)s további működését."
+    },
     "file_menu": {
         "label": "Fájl"
     },
+    "icon_overlay": {
+        "description_error": "Hiba",
+        "description_notifications": {
+            "one": "%(count)s olvasatlan értesítése van.",
+            "other": "%(count)s olvasatlan értesítése van."
+        }
+    },
     "menu": {
         "hide": "Elrejtés",
         "hide_others": "Mások elrejtése",
@@ -56,9 +68,14 @@
             "backend_changed": "Adatok törlése és újratöltés?",
             "backend_changed_detail": "Nem sikerült hozzáférni a rendszerkulcstartó titkos kódjához, úgy tűnik, megváltozott.",
             "backend_changed_title": "Nem sikerült betölteni az adatbázist",
+            "backend_no_encryption": "A rendszer támogatott kulcstartóval rendelkezik, de a titkosítás nem érhető el.",
+            "backend_no_encryption_detail": "Az Electron észlelte, hogy a titkosítás nem érhető el a(z) %(backend)s kulcstartóján. Győződjön meg róla, hogy telepítve van-e a kulcstartó. Ha telepítve van, indítsa újra és próbálja újra. Esetleg engedélyezheti a gyengébb titkosítást az %(brand)s számára.",
+            "backend_no_encryption_title": "Nincs titkosítási támogatás",
             "unsupported_keyring": "A rendszer nem támogatott kulcstartóval rendelkezik, ami azt jelenti, hogy az adatbázis nem nyitható meg.",
             "unsupported_keyring_detail": "Az Electron kulcstartóészlelése nem talált támogatott háttérrendszert. Megpróbálhatja kézileg beállítani a háttérrendszert az %(brand)s egyszeri, parancssori argumentummal való indításával. Lásd: %(link)s.",
-            "unsupported_keyring_title": "A rendszer nem támogatott"
+            "unsupported_keyring_title": "A rendszer nem támogatott",
+            "unsupported_keyring_use_basic_text": "Gyengébb titkosítás használata",
+            "unsupported_keyring_use_plaintext": "Ne használjon titkosítást"
         }
     },
     "view_menu": {

src/i18n/strings/hy.json

@@ -0,0 +1,87 @@
+{
+    "action": {
+        "cancel": "Չեղարկել",
+        "close": "Փակել",
+        "close_brand": "Փակել %(brand)s",
+        "copy": "Պատճենել",
+        "cut": "Կտրել",
+        "delete": "Ջնջել",
+        "edit": "Խմբագրել",
+        "minimise": "Նվազագույնի հասցնել",
+        "paste": "Տեղադրել",
+        "paste_match_style": "Տեղադրել և համապատասխանեցնել ոճը",
+        "quit": "Դուրս գալ",
+        "redo": "Կրկնել",
+        "select_all": "Ընտրել բոլորը",
+        "show_hide": "Ցուցադրել/Թաքցնել",
+        "undo": "Հետարկել",
+        "zoom_in": "Մեծացնել",
+        "zoom_out": "Փոքրացնել"
+    },
+    "common": {
+        "about": "Կենսագրություն",
+        "brand_help": "%(brand)s Օգնություն",
+        "help": "Օգնություն",
+        "no": "Ոչ",
+        "preferences": "Նախապատվություններ",
+        "yes": "Այո"
+    },
+    "confirm_quit": "Վստա՞հ եք, որ ուզում եք դուրս գալ։",
+    "edit_menu": {
+        "speech": "Խոսք/Ելույթ",
+        "speech_start_speaking": "Սկսեք խոսել",
+        "speech_stop_speaking": "Դադարեցրեք խոսելը"
+    },
+    "file_menu": {
+        "label": "Ֆայլ"
+    },
+    "icon_overlay": {
+        "description_error": "Սխալ",
+        "description_notifications": {
+            "one": "Դուք ունեք %(count)s չկարդացված ծանուցում։",
+            "other": "Դուք ունեք %(count)s չկարդացված ծանուցումներ։"
+        }
+    },
+    "menu": {
+        "hide": "Թաքցնել",
+        "hide_others": "Թաքցնել մյուսները",
+        "services": "Ծառայություններ",
+        "unhide": "Ապաթաքցնել"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "Ավելացնել բառարանում",
+        "copy_email": "Պատճենել էլ․ հասցեն",
+        "copy_image": "Պատճենել պատկերը",
+        "copy_image_url": "Պատճենել պատկերի հասցեն",
+        "copy_link_url": "Պատճենել հղման հասցեն",
+        "save_image_as": "Պահպանել պատկերը որպես...",
+        "save_image_as_error_description": "Պատկերը չհաջողվեց պահպանել",
+        "save_image_as_error_title": "Չհաջողվեց պահպանել պատկերը"
+    },
+    "store": {
+        "error": {
+            "backend_changed": "Մաքրե՞լ տվյալները և վերաբեռնե՞լ",
+            "backend_changed_detail": "Գաղտնի տվյալները հասանելի չեն համակարգի բանալիների պահոցից(keyring), կարծես թե այն փոխվել է։",
+            "backend_changed_title": "Չհաջողվեց բեռնել տվյալների բազան",
+            "backend_no_encryption": "Ձեր համակարգը ունի աջակցվող բանալիների պահոց, բայց գաղտնագրումը հասանելի չէ։",
+            "backend_no_encryption_detail": "Electron-ը հայտնաբերել է, որ ձեր բանալիների պահոցում %(backend)s գաղտնագրումը հասանելի չէ։ Խնդրում ենք համոզվել, որ բանալիների պահոցը տեղադրված է։ Եթե այն արդեն տեղադրված է, վերագործարկեք համակարգը և փորձեք կրկին։ Ցանկության դեպքում կարող եք թույլատրել %(brand)s-ին կիրառել ավելի թույլ գաղտնագրման տարբերակ։",
+            "backend_no_encryption_title": "Գաղտնագրման աջակցություն չկա",
+            "unsupported_keyring": "Համակարգում օգտագործվող բանալիների պահոցը(keyring) չի աջակցվում, ինչը նշանակում է, որ տվյալների բազան հնարավոր չէ բացել։",
+            "unsupported_keyring_detail": "Electron-ի բանալիների պահոցի ստուգումը չգտավ համատեղելի backend։ Կարող եք փորձել ձեռքով կարգավորել backend-ը` մեկնարկելով %(brand)s-ը command-line արգումենտով, մեկանգամյա գործողությամբ։ Տես %(link)s։",
+            "unsupported_keyring_title": "Համակարգը չի աջակցվում",
+            "unsupported_keyring_use_basic_text": "Օգտագործել ավելի թույլ գաղտնագրում",
+            "unsupported_keyring_use_plaintext": "Չօգտագործել գաղտնագրում"
+        }
+    },
+    "view_menu": {
+        "actual_size": "Իրական չափս",
+        "toggle_developer_tools": "Միացնել/անջատել ծրագրավորողի գործիքները",
+        "toggle_full_screen": "Միացնել/անջատել ամբողջական էկրանը",
+        "view": "Դիտել"
+    },
+    "window_menu": {
+        "bring_all_to_front": "Բերեք բոլորին առջևի պլան",
+        "label": "Պատուհան",
+        "zoom": "Մեծացնել"
+    }
+}

src/i18n/strings/id.json

@@ -32,9 +32,20 @@
         "speech_start_speaking": "Mulai Berbicara",
         "speech_stop_speaking": "Berhenti Berbicara"
     },
+    "eol": {
+        "no_more_updates": "Anda menggunakan versi macOS yang tidak didukung. Harap tingkatkan untuk menerima pembaruan %(brand)s.",
+        "title": "Sistem tidak didukung",
+        "warning": "Anda menggunakan versi macOS yang tidak didukung. Harap perbarui untuk memastikan%(brand)s terus bekerja."
+    },
     "file_menu": {
         "label": "Berkas"
     },
+    "icon_overlay": {
+        "description_error": "Kesalahan",
+        "description_notifications": {
+            "other": "Anda memiliki %(count)s notifikasi yang belum dibaca."
+        }
+    },
     "menu": {
         "hide": "Sembunyikan",
         "hide_others": "Sembunyikan yang Lain",

src/i18n/strings/nb_NO.json

@@ -23,7 +23,7 @@
         "brand_help": "%(brand)s Hjelp",
         "help": "Hjelp",
         "no": "Nei",
-        "preferences": "Brukervalg",
+        "preferences": "Innstillinger",
         "yes": "Ja"
     },
     "confirm_quit": "Er du sikker på at du vil slutte?",
@@ -32,9 +32,21 @@
         "speech_start_speaking": "Begynn å snakke",
         "speech_stop_speaking": "Slutt å snakke"
     },
+    "eol": {
+        "no_more_updates": "Du kjører en versjon av macOS som ikke støttes. Oppgrader for å motta oppdateringer fr %(brand)s.",
+        "title": "Systemet støttes ikke",
+        "warning": "Du bruker en versjon av macOS som ikke støttes. Oppgrader for å sikre at %(brand)s fortsetter å fungere."
+    },
     "file_menu": {
         "label": "Fil"
     },
+    "icon_overlay": {
+        "description_error": "Feil",
+        "description_notifications": {
+            "one": "Du har %(count)s ulest varsel.",
+            "other": "Du har %(count)s uleste varsler."
+        }
+    },
     "menu": {
         "hide": "Skjul",
         "hide_others": "Skjul andre",

src/i18n/strings/pl.json

@@ -32,9 +32,22 @@
         "speech_start_speaking": "Zacznij mówić",
         "speech_stop_speaking": "Przestań mówić"
     },
+    "eol": {
+        "no_more_updates": "Korzystasz z nieobsługiwanej wersji systemu macOS. Zaktualizuj system, aby uzyskać aktualizacje %(brand)s.",
+        "title": "System nie jest obsługiwany",
+        "warning": "Korzystasz z nieobsługiwanej wersji systemu macOS. Zaktualizuj system, aby dalej korzystać z %(brand)s."
+    },
     "file_menu": {
         "label": "Plik"
     },
+    "icon_overlay": {
+        "description_error": "Błąd",
+        "description_notifications": {
+            "one": "Masz %(count)s nieprzeczytane powiadomienie.",
+            "few": "Masz %(count)s nieprzeczytane powiadomienia.",
+            "many": "Masz %(count)s nieprzeczytanych powiadomień."
+        }
+    },
     "menu": {
         "hide": "Ukryj",
         "hide_others": "Ukryj inne",
@@ -56,9 +69,14 @@
             "backend_changed": "Wyczyścić dane i przeładować?",
             "backend_changed_detail": "Nie można uzyskać dostępu do sekretnego magazynu, wygląda na to, że uległ zmianie.",
             "backend_changed_title": "Nie udało się załadować bazy danych",
+            "backend_no_encryption": "Twój system posiada wspierany keyring, ale szyfrowanie nie jest dostępne.",
+            "backend_no_encryption_detail": "Elektron wykrył, że szyfrowanie nie jest dostępne w twoim keyring'u %(backend)s. Upewnij się, że keyring został zainstalowany. Jeśli tak, uruchom ponownie urządzenie i spróbuj ponownie. Opcjonalnie, zezwól %(brand)s, aby korzystał ze słabszego szyfrowania.",
+            "backend_no_encryption_title": "Szyfrowanie nie jest obsługiwane",
             "unsupported_keyring": "System zawiera niewspierany keyring, nie można otworzyć bazy danych.",
             "unsupported_keyring_detail": "Wykrywanie keyringu Electron nie znalazł wspieranego backendu. Możesz spróbować ręcznie ustawić backed, uruchamiając %(brand)s za pomocą wiesza poleceń. Zobacz %(link)s.",
-            "unsupported_keyring_title": "System niewspierany"
+            "unsupported_keyring_title": "System niewspierany",
+            "unsupported_keyring_use_basic_text": "Użyj słabszego szyfrowania",
+            "unsupported_keyring_use_plaintext": "Nie używaj szyfrowania"
         }
     },
     "view_menu": {

src/i18n/strings/pt_BR.json

@@ -32,9 +32,21 @@
         "speech_start_speaking": "Começar a Falar",
         "speech_stop_speaking": "Parar de Falar"
     },
+    "eol": {
+        "no_more_updates": "Você está usando uma versão não suportada do macOS. Atualize para receber as atualizações d %(brand)s.",
+        "title": "Sistema não suportado",
+        "warning": "Você está usando uma versão não compatível do macOS. Faça a atualização para garantir que o %(brand)s continue funcionando."
+    },
     "file_menu": {
         "label": "Arquivo"
     },
+    "icon_overlay": {
+        "description_error": "Erro",
+        "description_notifications": {
+            "one": "Você tem %(count)s notificação não lida.",
+            "other": "Você tem %(count)s notificações não lidas."
+        }
+    },
     "menu": {
         "hide": "Esconder",
         "hide_others": "Esconder Outras(os)",

src/i18n/strings/ru.json

@@ -22,7 +22,9 @@
         "about": "О программе",
         "brand_help": "Помощь %(brand)s",
         "help": "Помощь",
-        "preferences": "Предпочтения"
+        "no": "Нет",
+        "preferences": "Предпочтения",
+        "yes": "Да"
     },
     "confirm_quit": "Вы уверены, что хотите выйти?",
     "edit_menu": {
@@ -30,9 +32,15 @@
         "speech_start_speaking": "Говорите",
         "speech_stop_speaking": "Перестаньте говорить"
     },
+    "eol": {
+        "title": "Система не поддерживается"
+    },
     "file_menu": {
         "label": "Файл"
     },
+    "icon_overlay": {
+        "description_error": "Ошибка"
+    },
     "menu": {
         "hide": "Скрыть",
         "hide_others": "Скрыть прочие",

src/i18n/strings/sk.json

@@ -35,6 +35,14 @@
     "file_menu": {
         "label": "Súbor"
     },
+    "icon_overlay": {
+        "description_error": "Chyba",
+        "description_notifications": {
+            "one": "Máte %(count)s neprečítané oznámenie.",
+            "few": "Máte %(count)s neprečítané oznámenia.",
+            "other": "Máte %(count)s neprečítaných oznámení."
+        }
+    },
     "menu": {
         "hide": "Skryť",
         "hide_others": "Skryť ostatné",

src/i18n/strings/sv.json

@@ -22,7 +22,9 @@
         "about": "Om",
         "brand_help": "%(brand)s-hjälp",
         "help": "Hjälp",
-        "preferences": "Inställningar"
+        "no": "Nej",
+        "preferences": "Inställningar",
+        "yes": "Ja"
     },
     "confirm_quit": "Är du säker att du vill avsluta?",
     "edit_menu": {
@@ -33,6 +35,13 @@
     "file_menu": {
         "label": "Arkiv"
     },
+    "icon_overlay": {
+        "description_error": "Fel",
+        "description_notifications": {
+            "one": "Du har %(count)s oläst avisering.",
+            "other": "Du har %(count)s olästa aviseringar."
+        }
+    },
     "menu": {
         "hide": "Göm",
         "hide_others": "Göm övriga",
@@ -49,6 +58,21 @@
         "save_image_as_error_description": "Bilden sparades inte",
         "save_image_as_error_title": "Misslyckades med att spara bilden"
     },
+    "store": {
+        "error": {
+            "backend_changed": "Rensa data och ladda om?",
+            "backend_changed_detail": "Kunde inte komma åt hemligheten från systemnyckelringen, det verkar ha ändrats.",
+            "backend_changed_title": "Misslyckades att ladda databasen",
+            "backend_no_encryption": "Ditt system har en nyckelring som stöds men kryptering är inte tillgänglig.",
+            "backend_no_encryption_detail": "Electron har upptäckt att kryptering inte är tillgänglig på din nyckelring %(backend)s. Se till att du har nyckelringen installerad. Om du har nyckelringen installerad, starta om och försök igen. Alternativt kan du tillåta %(brand)s att använda en svagare form av kryptering.",
+            "backend_no_encryption_title": "Inget krypteringsstöd",
+            "unsupported_keyring": "Ditt system har en nyckelring som inte stöds, vilket innebär att databasen inte kan öppnas.",
+            "unsupported_keyring_detail": "Electrons nyckelringsdetektering hittade inte en backend som stöds. Du kan försöka konfigurera backend manuellt genom att starta %(brand)s med ett kommandoradsargument, en engångsåtgärd. Se %(link)s.",
+            "unsupported_keyring_title": "Systemet stöds inte",
+            "unsupported_keyring_use_basic_text": "Använd svagare kryptering",
+            "unsupported_keyring_use_plaintext": "Använd ingen kryptering"
+        }
+    },
     "view_menu": {
         "actual_size": "Verklig storlek",
         "toggle_developer_tools": "Växla utvecklarverktyg",

src/i18n/strings/uk.json

@@ -35,6 +35,14 @@
     "file_menu": {
         "label": "Файл"
     },
+    "icon_overlay": {
+        "description_error": "Помилка",
+        "description_notifications": {
+            "one": "У вас є %(count)s непрочитане сповіщення.",
+            "few": "У вас є %(count)s непрочитані сповіщення.",
+            "many": "У вас є %(count)s непрочитаних сповіщень."
+        }
+    },
     "menu": {
         "hide": "Сховати",
         "hide_others": "Сховати інші",
@@ -56,9 +64,14 @@
             "backend_changed": "Очистити дані та перезавантажити?",
             "backend_changed_detail": "Не вдається отримати доступ до таємного ключа з системного набору ключів, видається, він змінився.",
             "backend_changed_title": "Не вдалося завантажити базу даних",
+            "backend_no_encryption": "Ваша система підтримує сховище ключів, але шифрування недоступне.",
+            "backend_no_encryption_detail": "Electron виявив, що шифрування недоступне у вашому сховищі ключів %(backend)s. Переконайтеся, що у вас встановлено сховище ключів. Якщо так, тоді перезавантажте комп'ютер і повторіть спробу. За бажанням, ви можете дозволити %(brand)s використовувати слабшу форму шифрування.",
+            "backend_no_encryption_title": "Шифрування не підтримується",
             "unsupported_keyring": "Ваша система має непідтримуваний набір ключів. Це означає, що базу даних неможливо відкрити.",
             "unsupported_keyring_detail": "Electron не виявив підтримуваного бекенда для роботи зі сховищем паролів. Ви можете вручну налаштувати його, запустивши %(brand)s з відповідним аргументом у командному рядку. Цю дію потрібно виконати лише один раз. Докладніше – %(link)s.",
-            "unsupported_keyring_title": "Система не підтримується"
+            "unsupported_keyring_title": "Система не підтримується",
+            "unsupported_keyring_use_basic_text": "Використовувати слабше шифрування",
+            "unsupported_keyring_use_plaintext": "Не використовувати шифрування"
         }
     },
     "view_menu": {

src/ipc.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2022-2024 New Vector Ltd.
+Copyright 2022-2025 New Vector Ltd.
 
 SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
 Please see LICENSE files in the repository root for full details.
@@ -9,22 +9,9 @@ import { app, autoUpdater, desktopCapturer, ipcMain, powerSaveBlocker, TouchBar,
 
 import IpcMainEvent = Electron.IpcMainEvent;
 import { randomArray } from "./utils.js";
-import { Settings } from "./settings.js";
 import { getDisplayMediaCallback, setDisplayMediaCallback } from "./displayMediaCallback.js";
 import Store, { clearDataAndRelaunch } from "./store.js";
 
-ipcMain.on("setBadgeCount", function (_ev: IpcMainEvent, count: number): void {
-    if (process.platform !== "win32") {
-        // only set badgeCount on Mac/Linux, the docs say that only those platforms support it but turns out Electron
-        // has some Windows support too, and in some Windows environments this leads to two badges rendering atop
-        // each other. See https://github.com/vector-im/element-web/issues/16942
-        app.badgeCount = count;
-    }
-    if (count === 0) {
-        global.mainWindow?.flashFrame(false);
-    }
-});
-
 let focusHandlerAttached = false;
 ipcMain.on("loudNotification", function (): void {
     if (process.platform === "win32" || process.platform === "linux") {
@@ -69,18 +56,6 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
         case "getUpdateFeedUrl":
             ret = autoUpdater.getFeedURL();
             break;
-        case "getSettingValue": {
-            const [settingName] = args;
-            const setting = Settings[settingName];
-            ret = await setting.read();
-            break;
-        }
-        case "setSettingValue": {
-            const [settingName, value] = args;
-            const setting = Settings[settingName];
-            await setting.write(value);
-            break;
-        }
         case "setLanguage":
             global.appLocalization.setAppLocale(args[0]);
             break;
@@ -174,7 +149,7 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
             break;
 
         case "clearStorage":
-            await clearDataAndRelaunch();
+            await clearDataAndRelaunch(global.mainWindow.webContents.session);
             return; // the app is about to stop, we don't need to reply to the IPC
 
         case "breadcrumbs": {
@@ -243,3 +218,10 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
 });
 
 ipcMain.handle("getConfig", () => global.vectorConfig);
+
+const initialisePromiseWithResolvers = Promise.withResolvers<void>();
+export const initialisePromise = initialisePromiseWithResolvers.promise;
+
+ipcMain.once("initialise", () => {
+    initialisePromiseWithResolvers.resolve();
+});

src/macos-titlebar.ts

@@ -52,8 +52,10 @@ export function setupMacosTitleBar(window: BrowserWindow): void {
                 -webkit-app-region: drag;
             }
             /* Exclude the main content elements from being drag handles */
+            .mx_AuthPage .mx_AuthPage_modalContent,
             .mx_AuthPage .mx_AuthPage_modalBlur,
-            .mx_AuthPage .mx_AuthFooter > * {
+            .mx_AuthPage .mx_AuthFooter > *,
+            .mx_AuthPage .mx_Dropdown_menu {
                 -webkit-app-region: no-drag;
             }
         
@@ -117,6 +119,12 @@ export function setupMacosTitleBar(window: BrowserWindow): void {
                 height: 20px;
                 -webkit-app-region: drag;
             }
+            
+            .mx_LeftPanel_newRoomList::before {
+                /* Aligned with the room header */
+                height: 13px;
+                border-right: 1px solid var(--cpd-color-bg-subtle-primary);
+            }
 
             .mx_RoomView::before,
             .mx_SpaceRoomView::before {

src/preload.cts

@@ -32,6 +32,7 @@ const CHANNELS = [
     "userAccessToken",
     "homeserverUrl",
     "serverSupportedVersions",
+    "showToast",
 ];
 
 contextBridge.exposeInMainWorld("electron", {
@@ -54,11 +55,25 @@ contextBridge.exposeInMainWorld("electron", {
         protocol: string;
         sessionId: string;
         config: IConfigOptions;
+        supportedSettings: Record<string, boolean>;
+        /**
+         * Do we need to render badge overlays for new notifications?
+         */
+        supportsBadgeOverlay: boolean;
     }> {
-        const [{ protocol, sessionId }, config] = await Promise.all([
+        ipcRenderer.emit("initialise");
+        const [{ protocol, sessionId }, config, supportedSettings] = await Promise.all([
             ipcRenderer.invoke("getProtocol"),
             ipcRenderer.invoke("getConfig"),
+            ipcRenderer.invoke("getSupportedSettings"),
         ]);
-        return { protocol, sessionId, config };
+        return { protocol, sessionId, config, supportedSettings, supportsBadgeOverlay: process.platform === "win32" };
+    },
+
+    async setSettingValue(settingName: string, value: any): Promise<void> {
+        return ipcRenderer.invoke("setSettingValue", settingName, value);
+    },
+    async getSettingValue(settingName: string): Promise<any> {
+        return ipcRenderer.invoke("getSettingValue", settingName);
     },
 });

src/protocol.ts

@@ -121,7 +121,7 @@ export default class ProtocolHandler {
     public getProfileFromDeeplink(args: string[]): string | undefined {
         // check if we are passed a profile in the SSO callback url
         const deeplinkUrl = args.find(
-            (arg) => arg.startsWith(`${this.protocol}://`) || arg.startsWith(`${LEGACY_PROTOCOL}://`),
+            (arg) => arg.startsWith(`${this.protocol}:/`) || arg.startsWith(`${LEGACY_PROTOCOL}://`),
         );
         if (deeplinkUrl?.includes(SEARCH_PARAM)) {
             const parsedUrl = new URL(deeplinkUrl);

src/seshat.ts

@@ -43,7 +43,7 @@ const seshatDefaultPassphrase = "DEFAULT_PASSPHRASE";
 async function getOrCreatePassphrase(store: Store, key: string): Promise<string> {
     try {
         const storedPassphrase = await store.getSecret(key);
-        if (storedPassphrase !== null) {
+        if (storedPassphrase !== undefined) {
             return storedPassphrase;
         }
     } catch (e) {

src/settings.ts

@@ -5,25 +5,25 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */
 
+import { ipcMain } from "electron";
+
 import * as tray from "./tray.js";
 import Store from "./store.js";
+import { AutoLaunch, type AutoLaunchState } from "./auto-launch.js";
 
 interface Setting {
     read(): Promise<any>;
     write(value: any): Promise<void>;
+    supported?(): boolean; // if undefined, the setting is always supported
 }
 
-export const Settings: Record<string, Setting> = {
+const Settings: Record<string, Setting> = {
     "Electron.autoLaunch": {
-        async read(): Promise<any> {
-            return global.launcher.isEnabled();
+        async read(): Promise<AutoLaunchState> {
+            return AutoLaunch.instance.getState();
         },
-        async write(value: any): Promise<void> {
-            if (value) {
-                return global.launcher.enable();
-            } else {
-                return global.launcher.disable();
-            }
+        async write(value: AutoLaunchState): Promise<void> {
+            return AutoLaunch.instance.setState(value);
         },
     },
     "Electron.warnBeforeExit": {
@@ -35,7 +35,10 @@ export const Settings: Record<string, Setting> = {
         },
     },
     "Electron.alwaysShowMenuBar": {
-        // not supported on macOS
+        // This isn't relevant on Mac as Menu bars don't live in the app window
+        supported(): boolean {
+            return process.platform !== "darwin";
+        },
         async read(): Promise<any> {
             return !global.mainWindow!.autoHideMenuBar;
         },
@@ -46,7 +49,10 @@ export const Settings: Record<string, Setting> = {
         },
     },
     "Electron.showTrayIcon": {
-        // not supported on macOS
+        // Things other than Mac support tray icons
+        supported(): boolean {
+            return process.platform !== "darwin";
+        },
         async read(): Promise<any> {
             return tray.hasTray();
         },
@@ -68,4 +74,43 @@ export const Settings: Record<string, Setting> = {
             Store.instance?.set("disableHardwareAcceleration", !value);
         },
     },
+    "Electron.enableContentProtection": {
+        // Unsupported on Linux https://www.electronjs.org/docs/latest/api/browser-window#winsetcontentprotectionenable-macos-windows
+        // Broken on macOS https://github.com/electron/electron/issues/19880
+        supported(): boolean {
+            return process.platform === "win32";
+        },
+        async read(): Promise<any> {
+            return Store.instance?.get("enableContentProtection");
+        },
+        async write(value: any): Promise<void> {
+            global.mainWindow?.setContentProtection(value);
+            Store.instance?.set("enableContentProtection", value);
+        },
+    },
 };
+
+ipcMain.handle("getSupportedSettings", async () => {
+    const supportedSettings: Record<string, boolean> = {};
+    for (const [key, setting] of Object.entries(Settings)) {
+        supportedSettings[key] = setting.supported?.() ?? true;
+    }
+    return supportedSettings;
+});
+ipcMain.handle("setSettingValue", async (_ev, settingName: string, value: any) => {
+    const setting = Settings[settingName];
+    if (!setting) {
+        throw new Error(`Unknown setting: ${settingName}`);
+    }
+    console.debug(`Writing setting value for: ${settingName} = ${value}`);
+    await setting.write(value);
+});
+ipcMain.handle("getSettingValue", async (_ev, settingName: string) => {
+    const setting = Settings[settingName];
+    if (!setting) {
+        throw new Error(`Unknown setting: ${settingName}`);
+    }
+    const value = await setting.read();
+    console.debug(`Reading setting value for: ${settingName} = ${value}`);
+    return value;
+});

src/store.ts

@@ -16,8 +16,7 @@ limitations under the License.
 
 import ElectronStore from "electron-store";
 import keytar from "keytar-forked";
-import { app, safeStorage, dialog, type SafeStorage } from "electron";
-import { clearAllUserData, relaunchApp } from "@standardnotes/electron-clear-data";
+import { app, safeStorage, dialog, type SafeStorage, type Session } from "electron";
 
 import { _t } from "./language-helper.js";
 
@@ -51,22 +50,27 @@ type SaneSafeStorageBackend = Exclude<SafeStorageBackend, "unknown">;
  * kwallet6 cannot be specified via command line
  * https://www.electronjs.org/docs/latest/api/safe-storage#safestoragegetselectedstoragebackend-linux
  */
-const safeStorageBackendMap: Omit<
-    Record<SafeStorageBackend, string>,
-    "unknown" | "kwallet6" | "system" | "plaintext"
-> = {
+const safeStorageBackendMap: Omit<Record<SaneSafeStorageBackend, string>, "system" | "plaintext"> = {
     basic_text: "basic",
     gnome_libsecret: "gnome-libsecret",
     kwallet: "kwallet",
     kwallet5: "kwallet5",
+    kwallet6: "kwallet6",
 };
 
+function relaunchApp(): void {
+    console.info("Relaunching app...");
+    app.relaunch();
+    app.exit();
+}
+
 /**
  * Clear all data and relaunch the app.
  */
-export async function clearDataAndRelaunch(): Promise<void> {
+export async function clearDataAndRelaunch(electronSession: Session): Promise<void> {
     Store.instance?.clear();
-    clearAllUserData();
+    electronSession.flushStorageData();
+    await electronSession.clearStorageData();
     relaunchApp();
 }
 
@@ -77,6 +81,7 @@ interface StoreData {
     autoHideMenuBar: boolean;
     locale?: string | string[];
     disableHardwareAcceleration: boolean;
+    enableContentProtection: boolean;
     safeStorage?: Record<string, string>;
     /** the safeStorage backend used for the safeStorage data as written */
     safeStorageBackend?: SafeStorageBackend;
@@ -84,6 +89,8 @@ interface StoreData {
     safeStorageBackendOverride?: boolean;
     /** whether to perform a migration of the safeStorage data */
     safeStorageBackendMigrate?: boolean;
+    /** whether to open the app at login minimised, only valid when app.openAtLogin is true */
+    openAtLoginMinimised: boolean;
 }
 
 /**
@@ -100,7 +107,7 @@ class StorageWriter {
         this.store.set(this.getKey(key), secret);
     }
 
-    public get(key: string): string | null {
+    public get(key: string): string | undefined {
         return this.store.get(this.getKey(key));
     }
 
@@ -117,7 +124,7 @@ class SafeStorageWriter extends StorageWriter {
         this.store.set(this.getKey(key), safeStorage.encryptString(secret).toString("base64"));
     }
 
-    public get(key: string): string | null {
+    public get(key: string): string | undefined {
         const ciphertext = this.store.get<string, string | undefined>(this.getKey(key));
         if (ciphertext) {
             try {
@@ -127,7 +134,7 @@ class SafeStorageWriter extends StorageWriter {
                 console.error("...ciphertext:", JSON.stringify(ciphertext));
             }
         }
-        return null;
+        return undefined;
     }
 }
 
@@ -211,6 +218,10 @@ class Store extends ElectronStore<StoreData> {
                     type: "boolean",
                     default: false,
                 },
+                enableContentProtection: {
+                    type: "boolean",
+                    default: false,
+                },
                 safeStorage: {
                     type: "object",
                 },
@@ -223,14 +234,18 @@ class Store extends ElectronStore<StoreData> {
                 safeStorageBackendMigrate: {
                     type: "boolean",
                 },
+                openAtLoginMinimised: {
+                    type: "boolean",
+                    default: true,
+                },
             },
         });
     }
 
-    private safeStorageReadyPromise?: Promise<unknown>;
+    private safeStorageReadyPromise?: Promise<boolean>;
     public async safeStorageReady(): Promise<void> {
         if (!this.safeStorageReadyPromise) {
-            this.safeStorageReadyPromise = this.prepareSafeStorage();
+            throw new Error("prepareSafeStorage must be called before using storage methods");
         }
         await this.safeStorageReadyPromise;
     }
@@ -270,8 +285,18 @@ class Store extends ElectronStore<StoreData> {
      * Prepare the safeStorage backend for use.
      * We don't eagerly import from keytar as that would bring in data for all Element profiles and not just the current one,
      * so we import lazily in getSecret.
+     *
+     * This will relaunch the app in some cases, in which case it will return false and the caller should abort startup.
+     *
+     * @param electronSession - The Electron session to use for storage (will be used to clear storage if necessary).
+     * @returns true if safeStorage was initialised successfully or false if the app will be relaunched
      */
-    private async prepareSafeStorage(): Promise<void> {
+    public async prepareSafeStorage(electronSession: Session): Promise<boolean> {
+        this.safeStorageReadyPromise = this.reallyPrepareSafeStorage(electronSession);
+        return this.safeStorageReadyPromise;
+    }
+
+    private async reallyPrepareSafeStorage(electronSession: Session): Promise<boolean> {
         await app.whenReady();
 
         // The backend the existing data is written with if any
@@ -282,11 +307,13 @@ class Store extends ElectronStore<StoreData> {
         // Handle migrations
         if (existingSafeStorageBackend) {
             if (existingSafeStorageBackend === "basic_text" && backend !== "plaintext" && backend !== "basic_text") {
-                return this.prepareMigrateBasicTextToPlaintext();
+                this.prepareMigrateBasicTextToPlaintext();
+                return false;
             }
 
             if (this.get("safeStorageBackendMigrate") && backend === "basic_text") {
-                return this.migrateBasicTextToPlaintext();
+                this.migrateBasicTextToPlaintext();
+                return false;
             }
 
             if (existingSafeStorageBackend === "plaintext" && backend !== "plaintext") {
@@ -305,13 +332,21 @@ class Store extends ElectronStore<StoreData> {
             // Store the backend used for the safeStorage data so we can detect if it changes, and we know how the data is encoded
             this.recordSafeStorageBackend(backend);
         } else if (existingSafeStorageBackend !== backend) {
+            // We already appear to have started using a backend other than the one that we picked, so
+            // set the override flag and relaunch with the backend we were previously using, unless we
+            // already have the override flag, in which case we must assume the previous backend is no
+            // longer usable, in which case we should fall into the next block and warn the user we can't
+            // migrate.
             console.warn(`safeStorage backend changed from ${existingSafeStorageBackend} to ${backend}`);
 
-            if (existingSafeStorageBackend in safeStorageBackendMap) {
+            if (existingSafeStorageBackend in safeStorageBackendMap && !this.get("safeStorageBackendOverride")) {
                 this.set("safeStorageBackendOverride", true);
-                return relaunchApp();
+                relaunchApp();
+                return false;
             } else {
-                await this.consultUserBackendChangedUnableToMigrate();
+                // This will either relaunch the app or throw an execption
+                await this.consultUserBackendChangedUnableToMigrate(electronSession);
+                return false;
             }
         }
 
@@ -321,9 +356,11 @@ class Store extends ElectronStore<StoreData> {
         } else {
             this.secrets = new StorageWriter(this);
         }
+
+        return true;
     }
 
-    private async consultUserBackendChangedUnableToMigrate(): Promise<void> {
+    private async consultUserBackendChangedUnableToMigrate(electronSession: Session): Promise<void> {
         const { response } = await dialog.showMessageBox({
             title: _t("store|error|backend_changed_title"),
             message: _t("store|error|backend_changed"),
@@ -336,7 +373,7 @@ class Store extends ElectronStore<StoreData> {
         if (response === 0) {
             throw new Error("safeStorage backend changed and cannot migrate");
         }
-        return clearDataAndRelaunch();
+        return clearDataAndRelaunch(electronSession);
     }
 
     private async consultUserConsentDegradedMode(backend: "plaintext" | "basic_text"): Promise<void> {
@@ -431,7 +468,7 @@ class Store extends ElectronStore<StoreData> {
      *
      * @returns A promise for the secret string.
      */
-    public async getSecret(key: string): Promise<string | null> {
+    public async getSecret(key: string): Promise<string | undefined> {
         await this.safeStorageReady();
         let secret = this.secrets!.get(key);
         if (secret) return secret;
@@ -487,9 +524,11 @@ class Store extends ElectronStore<StoreData> {
     /**
      * @deprecated will be removed in the near future
      */
-    private async getSecretKeytar(key: string): Promise<string | null> {
+    private async getSecretKeytar(key: string): Promise<string | undefined> {
         return (
-            (await keytar.getPassword(KEYTAR_SERVICE, key)) ?? (await keytar.getPassword(LEGACY_KEYTAR_SERVICE, key))
+            (await keytar.getPassword(KEYTAR_SERVICE, key)) ??
+            (await keytar.getPassword(LEGACY_KEYTAR_SERVICE, key)) ??
+            undefined
         );
     }
 

src/tray.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2024 New Vector Ltd.
+Copyright 2024-2025 New Vector Ltd.
 Copyright 2017 Karl Glatz <karl@glatz.biz>
 Copyright 2017 OpenMarket Ltd
 
@@ -8,10 +8,10 @@ Please see LICENSE files in the repository root for full details.
 */
 
 import { app, Tray, Menu, nativeImage } from "electron";
+import { v5 as uuidv5 } from "uuid";
+import { writeFile } from "node:fs/promises";
 import pngToIco from "png-to-ico";
 import path from "node:path";
-import fs from "node:fs";
-import { v5 as uuidv5 } from "uuid";
 
 import { _t } from "./language-helper.js";
 
@@ -38,18 +38,13 @@ function toggleWin(): void {
     }
 }
 
-interface IConfig {
-    icon_path: string; // eslint-disable-line camelcase
-    brand: string;
-}
-
 function getUuid(): string {
     // The uuid field is optional and only needed on unsigned Windows packages where the executable path changes
     // The hardcoded uuid is an arbitrary v4 uuid generated on https://www.uuidgenerator.net/version4
     return global.vectorConfig["uuid"] || "eba84003-e499-4563-8e9d-166e34b5cc25";
 }
 
-export function create(config: IConfig): void {
+export function create(config: (typeof global)["trayConfig"]): void {
     // no trays on darwin
     if (process.platform === "darwin" || trayIcon) return;
     const defaultIcon = nativeImage.createFromPath(config.icon_path);
@@ -71,6 +66,7 @@ export function create(config: IConfig): void {
     initApplicationMenu();
     trayIcon.on("click", toggleWin);
 
+    // See also, badge.ts
     let lastFavicon: string | null = null;
     global.mainWindow?.webContents.on("page-favicon-updated", async function (ev, favicons) {
         if (!favicons || favicons.length <= 0 || !favicons[0].startsWith("data:")) {
@@ -92,15 +88,17 @@ export function create(config: IConfig): void {
         if (process.platform === "win32") {
             try {
                 const icoPath = path.join(app.getPath("temp"), "win32_element_icon.ico");
-                fs.writeFileSync(icoPath, await pngToIco(newFavicon.toPNG()));
+                await writeFile(icoPath, await pngToIco(newFavicon.toPNG()));
                 newFavicon = nativeImage.createFromPath(icoPath);
             } catch (e) {
                 console.error("Failed to make win32 ico", e);
             }
+            // Always update the tray icon for Windows.
+            trayIcon?.setImage(newFavicon);
+        } else {
+            trayIcon?.setImage(newFavicon);
+            global.mainWindow?.setIcon(newFavicon);
         }
-
-        trayIcon?.setImage(newFavicon);
-        global.mainWindow?.setIcon(newFavicon);
     });
 
     global.mainWindow?.webContents.on("page-title-updated", function (ev, title) {

src/updater.ts

@@ -7,8 +7,11 @@ Please see LICENSE files in the repository root for full details.
 
 import { app, autoUpdater, ipcMain } from "electron";
 import fs from "node:fs/promises";
+import os from "node:os";
 
 import { getSquirrelExecutable } from "./squirrelhooks.js";
+import { _t } from "./language-helper.js";
+import { initialisePromise } from "./ipc.js";
 
 const UPDATE_POLL_INTERVAL_MS = 60 * 60 * 1000;
 const INITIAL_UPDATE_DELAY_MS = 30 * 1000;
@@ -69,7 +72,8 @@ async function pollForUpdates(): Promise<void> {
 }
 
 export async function start(updateBaseUrl: string): Promise<void> {
-    if (!(await available(updateBaseUrl))) return;
+    if (!(await available())) return;
+    console.log(`Starting auto update with base URL: ${updateBaseUrl}`);
     if (!updateBaseUrl.endsWith("/")) {
         updateBaseUrl = updateBaseUrl + "/";
     }
@@ -111,10 +115,15 @@ export async function start(updateBaseUrl: string): Promise<void> {
     }
 }
 
-async function available(updateBaseUrl?: string): Promise<boolean> {
+/**
+ * Check if auto update is available on this platform.
+ * Has a side effect of firing showToast on EOL platforms so must only be called once!
+ * @returns True if auto update is available
+ */
+async function available(): Promise<boolean> {
     if (process.platform === "linux") {
         // Auto update is not supported on Linux
-        console.log("Auto update not supported on this platform");
+        console.warn("Auto update not supported on this platform");
         return false;
     }
 
@@ -122,13 +131,42 @@ async function available(updateBaseUrl?: string): Promise<boolean> {
         try {
             await fs.access(getSquirrelExecutable());
         } catch {
-            console.log("Squirrel not found, auto update not supported");
+            console.warn("Squirrel not found, auto update not supported");
             return false;
         }
     }
 
     // Otherwise we're either on macOS or Windows with Squirrel
-    return !!updateBaseUrl;
+    if (process.platform === "darwin") {
+        // OS release returns the Darwin kernel version, not the macOS version, see
+        // https://en.wikipedia.org/wiki/Darwin_(operating_system)#Release_history to interpret it
+        const release = os.release();
+        const major = parseInt(release.split(".")[0], 10);
+
+        if (major < 21) {
+            // If the macOS version is too old for modern Electron support then disable auto update to prevent the app updating and bricking itself.
+            // The oldest macOS version supported by Chromium/Electron 38 is Monterey (12.x) which started with Darwin 21.0
+            initialisePromise.then(() => {
+                ipcMain.emit("showToast", {
+                    title: _t("eol|title"),
+                    description: _t("eol|no_more_updates", { brand: global.trayConfig.brand }),
+                });
+            });
+            console.warn("Auto update not supported, macOS version too old");
+            return false;
+        } else if (major < 22) {
+            // If the macOS version is EOL then show a warning message.
+            // The oldest macOS version still supported by Apple is Ventura (13.x) which started with Darwin 22.0
+            initialisePromise.then(() => {
+                ipcMain.emit("showToast", {
+                    title: _t("eol|title"),
+                    description: _t("eol|warning", { brand: global.trayConfig.brand }),
+                });
+            });
+        }
+    }
+
+    return true;
 }
 
 ipcMain.on("install_update", installUpdate);

tsconfig.json

@@ -11,7 +11,7 @@
         "rootDir": "./src",
         "declaration": true,
         "typeRoots": ["src/@types", "node_modules/@types"],
-        "lib": ["es2022"],
+        "lib": ["es2022", "es2024.promise"],
         "types": ["node"],
         "strict": true
     },