v1.11.73

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/build_and_test.yaml

@@ -63,22 +63,22 @@ jobs:
                       os: ubuntu-latest
                       artifact: linux-amd64-sqlcipher-system
                       executable: "/opt/Element/element-desktop"
-                      prepare_cmd: "sudo apt install ./dist/*.deb"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
                     - name: "Linux (amd64) (sqlcipher: static)"
                       os: ubuntu-latest
                       artifact: linux-amd64-sqlcipher-static
                       executable: "/opt/Element/element-desktop"
-                      prepare_cmd: "sudo apt install ./dist/*.deb"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
                     - name: "Linux (arm64) (sqlcipher: system)"
                       os: dind-l-arm64
                       artifact: linux-arm64-sqlcipher-system
                       executable: "/opt/Element/element-desktop"
-                      prepare_cmd: "sudo apt install -y ./dist/*.deb"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
                     - name: "Linux (arm64) (sqlcipher: static)"
                       os: dind-l-arm64
                       artifact: linux-arm64-sqlcipher-static
                       executable: "/opt/Element/element-desktop"
-                      prepare_cmd: "sudo apt install -y ./dist/*.deb"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
                     - name: Windows (x86)
                       os: windows-latest
                       artifact: win-ia32
@@ -94,6 +94,9 @@ jobs:
             - name: Install Yarn
               if: runner.environment == 'self-hosted'
               run: |
+                  # Sanity check that the arch is arm64 as we expect
+                  [[ $(uname -p) == "aarch64" ]] || exit 1
+
                   sudo apt-get -qq update
                   sudo apt-get install -y curl
                   curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
@@ -128,6 +131,12 @@ jobs:
                   # We need sudo on Linux as it is installed in /opt/
                   RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
 
+            - name: Workaround macOS GHA permission issues
+              if: matrix.os == 'macos-latest'
+              run: |
+                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
+                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/opt/off/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
+
             - name: Run tests
               uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
               timeout-minutes: 5

.github/workflows/build_linux.yaml

@@ -38,6 +38,9 @@ jobs:
             - name: Install missing tools
               if: runner.environment == 'self-hosted'
               run: |
+                  # Sanity check that the arch is arm64 as we expect
+                  [[ $(uname -p) == "aarch64" ]] || exit 1
+
                   sudo apt-get -qq update
                   # curl for yarn download, git for tj-actions/changed-files, zstd for actions/cache
                   sudo apt-get install -y curl git zstd
@@ -109,14 +112,14 @@ jobs:
             - name: "Get modified files"
               id: changed_files
               if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request'
-              uses: tj-actions/changed-files@d6babd6899969df1a11d14c368283ea4436bca78 # v44
+              uses: tj-actions/changed-files@cc733854b1f224978ef800d29e4709d5ee2883e4 # v44
               with:
                   files: |
                       dockerbuild/**
 
             # This allows contributors to test changes to the dockerbuild image within a pull request
             - name: Build docker image
-              uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+              uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6
               if: steps.changed_files.outputs.any_modified == 'true'
               with:
                   context: dockerbuild

.github/workflows/dockerbuild.yaml

@@ -20,10 +20,10 @@ jobs:
             - uses: actions/checkout@v4
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3
+              uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3
+              uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3
               with:
                   install: true
 
@@ -43,7 +43,7 @@ jobs:
                       type=ref,event=branch
 
             - name: Build and push Docker image
-              uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+              uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6
               with:
                   context: dockerbuild
                   push: true

.github/workflows/release-drafter.yml

@@ -3,8 +3,6 @@ on:
     push:
         branches: [staging]
     workflow_dispatch: {}
-    repository_dispatch:
-        types: [upstream-release-notify]
 concurrency: ${{ github.workflow }}
 jobs:
     draft:

.github/workflows/release.yml

@@ -20,7 +20,6 @@ jobs:
             GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         with:
             final: ${{ inputs.mode == 'final' }}
-            include-changes: element-hq/element-web@$VERSION
             gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
             expected-asset-count: 1
 

CHANGELOG.md

@@ -1,3 +1,74 @@
+Changes in [1.11.73](https://github.com/element-hq/element-desktop/releases/tag/v1.11.73) (2024-08-06)
+======================================================================================================
+Fixes for CVE-2024-42347 / GHSA-f83w-wqhc-cfp4
+
+
+
+Changes in [1.11.72](https://github.com/element-hq/element-desktop/releases/tag/v1.11.72) (2024-07-30)
+======================================================================================================
+## ✨ Features
+
+* Support authenticated media downloads in Desktop too ([#1757](https://github.com/element-hq/element-desktop/pull/1757)). Contributed by @turt2live.
+* Polyfill Intl.Segmenter for wider web browser compatibility ([#27803](https://github.com/element-hq/element-web/pull/27803)). Contributed by @dbkr.
+* Enable audio/webaudio Modernizr rule ([#27772](https://github.com/element-hq/element-web/pull/27772)). Contributed by @t3chguy.
+* Add release announcement for the new room header ([#12802](https://github.com/matrix-org/matrix-react-sdk/pull/12802)). Contributed by @MidhunSureshR.
+* Default the room header to on ([#12803](https://github.com/matrix-org/matrix-react-sdk/pull/12803)). Contributed by @MidhunSureshR.
+* Update Thread Panel to match latest designs ([#12797](https://github.com/matrix-org/matrix-react-sdk/pull/12797)). Contributed by @t3chguy.
+* Close any open modals on logout ([#12777](https://github.com/matrix-org/matrix-react-sdk/pull/12777)). Contributed by @dbkr.
+* Iterate design of right panel empty state ([#12796](https://github.com/matrix-org/matrix-react-sdk/pull/12796)). Contributed by @t3chguy.
+* Update styling of UserInfo right panel card ([#12788](https://github.com/matrix-org/matrix-react-sdk/pull/12788)). Contributed by @t3chguy.
+* Accessibility: Add Landmark navigation ([#12190](https://github.com/matrix-org/matrix-react-sdk/pull/12190)). Contributed by @akirk.
+* Let Element Call widget receive m.room.create ([#12710](https://github.com/matrix-org/matrix-react-sdk/pull/12710)). Contributed by @AndrewFerr.
+* Let Element Call widget set session memberships ([#12713](https://github.com/matrix-org/matrix-react-sdk/pull/12713)). Contributed by @AndrewFerr.
+* Update right panel base card styling to match Compound ([#12768](https://github.com/matrix-org/matrix-react-sdk/pull/12768)). Contributed by @t3chguy.
+* Align `widget_build_url_ignore_dm` with call behaviour switch between 1:1 and Widget ([#12760](https://github.com/matrix-org/matrix-react-sdk/pull/12760)). Contributed by @t3chguy.
+* Move integrations switch ([#12733](https://github.com/matrix-org/matrix-react-sdk/pull/12733)). Contributed by @dbkr.
+* Element-R: Report events with withheld keys separately to Posthog. ([#12755](https://github.com/matrix-org/matrix-react-sdk/pull/12755)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* Fix Docker tooling for building native components ([#1779](https://github.com/element-hq/element-desktop/pull/1779)). Contributed by @t3chguy.
+* Add a modernizr check for WebAssembly support ([#27776](https://github.com/element-hq/element-web/pull/27776)). Contributed by @dbkr.
+* Test for lack of WebAssembly support ([#12792](https://github.com/matrix-org/matrix-react-sdk/pull/12792)). Contributed by @dbkr.
+* Fix stray 'account' heading ([#12791](https://github.com/matrix-org/matrix-react-sdk/pull/12791)). Contributed by @dbkr.
+* Add test for the unsupported browser screen ([#12787](https://github.com/matrix-org/matrix-react-sdk/pull/12787)). Contributed by @dbkr.
+* Fix HTML export test ([#12778](https://github.com/matrix-org/matrix-react-sdk/pull/12778)). Contributed by @dbkr.
+* Fix HTML export missing a bunch of Compound variables ([#12774](https://github.com/matrix-org/matrix-react-sdk/pull/12774)). Contributed by @t3chguy.
+* Fix inability to change accent colour consistently in custom theming ([#12772](https://github.com/matrix-org/matrix-react-sdk/pull/12772)). Contributed by @t3chguy.
+* Fix edge case of landing on 3pid email link with registration disabled ([#12771](https://github.com/matrix-org/matrix-react-sdk/pull/12771)). Contributed by @t3chguy.
+
+
+
+Changes in [1.11.71](https://github.com/element-hq/element-desktop/releases/tag/v1.11.71) (2024-07-16)
+======================================================================================================
+## ✨ Features
+
+* Add Modernizr rule for Intl.Segmenter ([#27677](https://github.com/element-hq/element-web/pull/27677)). Contributed by @t3chguy.
+* Add tabs to the right panel ([#12672](https://github.com/matrix-org/matrix-react-sdk/pull/12672)). Contributed by @MidhunSureshR.
+* Promote new room header from labs to Beta ([#12739](https://github.com/matrix-org/matrix-react-sdk/pull/12739)). Contributed by @t3chguy.
+* Redesign room search interface ([#12677](https://github.com/matrix-org/matrix-react-sdk/pull/12677)). Contributed by @t3chguy.
+* Move language settings to 'preferences' ([#12723](https://github.com/matrix-org/matrix-react-sdk/pull/12723)). Contributed by @dbkr.
+* New layout selector ui in user settings ([#12676](https://github.com/matrix-org/matrix-react-sdk/pull/12676)). Contributed by @florianduros.
+* Prevent Element appearing in system media controls  ([#10995](https://github.com/matrix-org/matrix-react-sdk/pull/10995)). Contributed by @SuperKenVery.
+* Move the account management button ([#12663](https://github.com/matrix-org/matrix-react-sdk/pull/12663)). Contributed by @dbkr.
+* Disable profile controls if the HS doesn't allow them to be set ([#12652](https://github.com/matrix-org/matrix-react-sdk/pull/12652)). Contributed by @dbkr.
+* New theme ui in user settings ([#12576](https://github.com/matrix-org/matrix-react-sdk/pull/12576)). Contributed by @florianduros.
+* Adjust room header hover transition from 300ms to 200ms ([#12703](https://github.com/matrix-org/matrix-react-sdk/pull/12703)). Contributed by @t3chguy.
+* Split out email \& phone number settings to separate components \& move discovery to privacy tab ([#12670](https://github.com/matrix-org/matrix-react-sdk/pull/12670)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* Ensure we do not load matrix-react-sdk is a manner which can white-screen ([#27685](https://github.com/element-hq/element-web/pull/27685)). Contributed by @t3chguy.
+* Fix incoming call toast crash due to audio refactor ([#12737](https://github.com/matrix-org/matrix-react-sdk/pull/12737)). Contributed by @t3chguy.
+* Improve new room header accessibility ([#12725](https://github.com/matrix-org/matrix-react-sdk/pull/12725)). Contributed by @t3chguy.
+* Fix closing all modals ([#12728](https://github.com/matrix-org/matrix-react-sdk/pull/12728)). Contributed by @dbkr.
+* Fix close button on forgot password flow ([#12732](https://github.com/matrix-org/matrix-react-sdk/pull/12732)). Contributed by @dbkr.
+* Don't consider textual characters to be emoji ([#12582](https://github.com/matrix-org/matrix-react-sdk/pull/12582)). Contributed by @robintown.
+* Clear autocomplete input on selection accept ([#12709](https://github.com/matrix-org/matrix-react-sdk/pull/12709)). Contributed by @dbkr.
+* Fix `Match system theme` toggle ([#12719](https://github.com/matrix-org/matrix-react-sdk/pull/12719)). Contributed by @florianduros.
+
+
+
 Changes in [1.11.70](https://github.com/element-hq/element-desktop/releases/tag/v1.11.70) (2024-07-08)
 ======================================================================================================
 ## ✨ Features

dockerbuild/Dockerfile

@@ -18,7 +18,9 @@ RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip
 ENV DEBUG_COLORS true
 ENV FORCE_COLOR true
 
-ENV NODE_VERSION 18.19.0
+WORKDIR /project
+
+ENV NODE_VERSION 20.15.1
 ARG TARGETOS
 ARG TARGETARCH
 COPY setup.sh /setup.sh

element.io/nightly/config.json

@@ -23,7 +23,7 @@
     "uisi_autorageshake_app": "element-auto-uisi",
     "show_labs_settings": true,
     "room_directory": {
-        "servers": ["matrix.org", "gitter.im", "libera.chat"]
+        "servers": ["matrix.org", "gitter.im"]
     },
     "enable_presence_by_hs_url": {
         "https://matrix.org": false,

element.io/release/config.json

@@ -22,7 +22,7 @@
     "bug_report_endpoint_url": "https://element.io/bugreports/submit",
     "uisi_autorageshake_app": "element-auto-uisi",
     "room_directory": {
-        "servers": ["matrix.org", "gitter.im", "libera.chat"]
+        "servers": ["matrix.org", "gitter.im"]
     },
     "show_labs_settings": false,
     "enable_presence_by_hs_url": {

package.json

@@ -2,7 +2,7 @@
     "name": "element-desktop",
     "productName": "Element",
     "main": "lib/electron-main.js",
-    "version": "1.11.70",
+    "version": "1.11.73",
     "description": "A feature-rich client for Matrix.org",
     "author": "Element",
     "homepage": "https://element.io",
@@ -82,14 +82,14 @@
         "@electron/asar": "^3.2.3",
         "@electron/fuses": "^1.7.0",
         "@mapbox/node-pre-gyp": "^1.0.11",
-        "@playwright/test": "1.44.1",
+        "@playwright/test": "1.45.2",
         "@types/auto-launch": "^5.0.1",
         "@types/counterpart": "^0.18.1",
         "@types/minimist": "^1.2.1",
-        "@types/node": "18.19.34",
+        "@types/node": "18.19.39",
         "@types/pacote": "^11.1.1",
         "@types/tar": "^6.1.3",
-        "@types/uuid": "^9.0.2",
+        "@types/uuid": "^10.0.0",
         "@types/yargs": "^17.0.32",
         "@typescript-eslint/eslint-plugin": "^7.0.0",
         "@typescript-eslint/parser": "^7.0.0",
@@ -105,24 +105,24 @@
         "eslint-config-prettier": "^9.0.0",
         "eslint-plugin-import": "^2.25.4",
         "eslint-plugin-matrix-org": "^1.0.0",
-        "eslint-plugin-unicorn": "^53.0.0",
-        "glob": "^10.0.0",
+        "eslint-plugin-unicorn": "^54.0.0",
+        "glob": "^11.0.0",
         "knip": "^5.0.0",
         "matrix-web-i18n": "^3.2.1",
         "mkdirp": "^3.0.0",
         "pacote": "^18.0.0",
         "prettier": "^3.0.0",
-        "rimraf": "^5.0.0",
+        "rimraf": "^6.0.0",
         "tar": "^6.2.1",
         "ts-node": "^10.9.1",
-        "typescript": "5.4.5"
+        "typescript": "5.5.3"
     },
     "hakDependencies": {
         "matrix-seshat": "^4.0.0",
         "keytar": "^7.9.0"
     },
     "resolutions": {
-        "@types/node": "18.19.34",
+        "@types/node": "18.19.39",
         "config-file-ts": "0.2.8-rc1"
     }
 }

playwright.config.ts

@@ -29,5 +29,5 @@ export default defineConfig({
     reporter: [["html", { outputFolder: "playwright/html-report" }]],
     snapshotDir: "playwright/snapshots",
     snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
-    timeout: 10 * 1000,
+    timeout: 30 * 1000,
 });

playwright/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/playwright:v1.44.1-jammy
+FROM mcr.microsoft.com/playwright:v1.45.1-jammy
 
 WORKDIR /work/element-desktop
 

src/@types/glob.d.ts

@@ -1,6 +0,0 @@
-import { GlobOptions } from "glob";
-
-declare module "glob" {
-    // Workaround for @electron/asar importing IOptions instead of GlobOptions
-    export type IOptions = GlobOptions;
-}

src/electron-main.ts

@@ -19,7 +19,7 @@ limitations under the License.
 
 // Squirrel on windows starts the app with various flags as hooks to tell us when we've been installed/uninstalled etc.
 import "./squirrelhooks";
-import { app, BrowserWindow, Menu, autoUpdater, protocol, dialog, Input, Event, session } from "electron";
+import { app, BrowserWindow, Menu, autoUpdater, protocol, dialog, Input, Event, session, ipcMain } from "electron";
 import * as Sentry from "@sentry/electron/main";
 import AutoLaunch from "auto-launch";
 import path from "path";
@@ -549,6 +549,51 @@ app.on("ready", async () => {
         global.mainWindow?.webContents.send("openDesktopCapturerSourcePicker");
         setDisplayMediaCallback(callback);
     });
+
+    session.defaultSession.webRequest.onBeforeRequest((req, callback) => {
+        // This handler emulates the element-web service worker, where URLs are rewritten late in the request
+        // for backwards compatibility. As authenticated media becomes more prevalent, this should be replaced
+        // by the app using authenticated URLs from the outset.
+        let url = req.url;
+        if (!url.includes("/_matrix/media/v3/download") && !url.includes("/_matrix/media/v3/thumbnail")) {
+            return callback({}); // not a URL we care about
+        }
+
+        // Check for feature support from the server. This requires asking the renderer process for supported
+        // versions.
+        ipcMain.once("serverSupportedVersions", (_, versionsResponse) => {
+            if (versionsResponse?.versions?.includes("v1.11")) {
+                url = url.replace(/\/media\/v3\/(.*)\//, "/client/v1/media/$1/");
+                return callback({ redirectURL: url });
+            } else {
+                return callback({}); // no support == no modification
+            }
+        });
+        global.mainWindow!.webContents.send("serverSupportedVersions"); // ping now that the listener exists
+
+        // we don't invoke callback() in this function - see the ipcMain.once above for callback usage.
+    });
+
+    session.defaultSession.webRequest.onBeforeSendHeaders((req, callback) => {
+        if (!req.url.includes("/_matrix/client/v1/media")) {
+            return callback({}); // invoke unmodified
+        }
+
+        // Only add authorization header to authenticated media URLs. This emulates the service worker
+        // behaviour in element-web.
+
+        // We need to get the access token from the renderer process to do that, though.
+        ipcMain.once("userAccessToken", (_, accessToken) => {
+            // `accessToken` can be falsy, but if we're trying to download media without authentication
+            // then we should expect failure anyway.
+            const headers = { ...req.requestHeaders };
+            headers["Authorization"] = `Bearer ${accessToken}`;
+            return callback({ requestHeaders: headers });
+        });
+        global.mainWindow!.webContents.send("userAccessToken");
+
+        // we don't invoke callback() in this function - see the ipcMain.once above for callback usage.
+    });
 });
 
 app.on("window-all-closed", () => {

src/preload.ts

@@ -35,6 +35,8 @@ const CHANNELS = [
     "userDownloadCompleted",
     "userDownloadAction",
     "openDesktopCapturerSourcePicker",
+    "userAccessToken",
+    "serverSupportedVersions",
 ];
 
 contextBridge.exposeInMainWorld("electron", {