v1.12.13

Upgrade dependency to matrix-js-sdk@41.2.0
[Backport staging] Fix soft crash of room list when trying to open a room (#32872 )
2026-03-24 11:26:49 +00:00 · 2026-03-24 11:23:51 +00:00 · 2026-03-20 15:44:40 +00:00 · 2026-03-17 11:43:46 +00:00 · 2026-03-17 11:41:10 +00:00 · 2026-03-17 08:57:37 +00:00
5108 changed files with 374907 additions and 263193 deletions
@@ -1,13 +0,0 @@
-src/vector/modernizr.js
-test/end-to-end-tests/node_modules/
-test/end-to-end-tests/element/
-test/end-to-end-tests/synapse/
-test/end-to-end-tests/lib/
-# Legacy skinning file that some people might still have
-src/component-index.js
-# Auto-generated file
-src/modules.ts
-src/modules.js
-# Test result files
-/playwright/test-results/
-/playwright/html-report/
@@ -1,360 +0,0 @@
-module.exports = {
-    plugins: ["matrix-org", "eslint-plugin-react-compiler"],
-    extends: ["plugin:matrix-org/babel", "plugin:matrix-org/react", "plugin:matrix-org/a11y"],
-    parserOptions: {
-        project: ["./tsconfig.json"],
-    },
-    env: {
-        browser: true,
-        node: true,
-    },
-    globals: {
-        LANGUAGES_FILE: "readonly",
-    },
-    rules: {
-        // Things we do that break the ideal style
-        "no-constant-condition": "off",
-        "prefer-promise-reject-errors": "off",
-        "no-async-promise-executor": "off",
-        "no-extra-boolean-cast": "off",
-
-        // Bind or arrow functions in props causes performance issues (but we
-        // currently use them in some places).
-        // It's disabled here, but we should using it sparingly.
-        "react/jsx-no-bind": "off",
-        "react/jsx-key": ["error"],
-
-        "no-restricted-properties": [
-            "error",
-            ...buildRestrictedPropertiesOptions(
-                ["window.innerHeight", "window.innerWidth", "window.visualViewport"],
-                "Use UIStore to access window dimensions instead.",
-            ),
-            ...buildRestrictedPropertiesOptions(
-                ["*.mxcUrlToHttp", "*.getHttpUriForMxc"],
-                "Use Media helper instead to centralise access for customisation.",
-            ),
-            ...buildRestrictedPropertiesOptions(["window.setImmediate"], "Use setTimeout instead."),
-        ],
-        "no-restricted-globals": [
-            "error",
-            {
-                name: "setImmediate",
-                message: "Use setTimeout instead.",
-            },
-            {
-                name: "Buffer",
-                message: "Buffer is not available in the web.",
-            },
-        ],
-
-        "import/no-duplicates": ["error"],
-        // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
-        // Ban compound-design-tokens raw svg imports in favour of their React component counterparts
-        "no-restricted-imports": [
-            "error",
-            {
-                paths: [
-                    {
-                        name: "@testing-library/react",
-                        message: "Please use jest-matrix-react instead",
-                    },
-                    {
-                        name: "matrix-js-sdk",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/src",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/src/",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/src/index",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "emojibase-regex",
-                        message:
-                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
-                    },
-                ],
-                patterns: [
-                    {
-                        group: [
-                            "matrix-js-sdk/src/**",
-                            "!matrix-js-sdk/src/matrix",
-                            "!matrix-js-sdk/src/crypto-api",
-                            "!matrix-js-sdk/src/types",
-                            "!matrix-js-sdk/src/testing",
-                            "!matrix-js-sdk/src/utils/**",
-                            "matrix-js-sdk/src/utils/internal/**",
-                            "matrix-js-sdk/lib",
-                            "matrix-js-sdk/lib/",
-                            "matrix-js-sdk/lib/**",
-                            // XXX: Temporarily allow these as they are not available via the main export
-                            "!matrix-js-sdk/src/logger",
-                            "!matrix-js-sdk/src/errors",
-                            "!matrix-js-sdk/src/utils",
-                            "!matrix-js-sdk/src/version-support",
-                            "!matrix-js-sdk/src/randomstring",
-                            "!matrix-js-sdk/src/sliding-sync",
-                            "!matrix-js-sdk/src/browser-index",
-                            "!matrix-js-sdk/src/feature",
-                            "!matrix-js-sdk/src/NamespacedValue",
-                            "!matrix-js-sdk/src/ReEmitter",
-                            "!matrix-js-sdk/src/event-mapper",
-                            "!matrix-js-sdk/src/interactive-auth",
-                            "!matrix-js-sdk/src/secret-storage",
-                            "!matrix-js-sdk/src/room-hierarchy",
-                            "!matrix-js-sdk/src/rendezvous",
-                            "!matrix-js-sdk/src/indexeddb-worker",
-                            "!matrix-js-sdk/src/pushprocessor",
-                            "!matrix-js-sdk/src/extensible_events_v1",
-                            "!matrix-js-sdk/src/extensible_events_v1/PollStartEvent",
-                            "!matrix-js-sdk/src/extensible_events_v1/PollResponseEvent",
-                            "!matrix-js-sdk/src/extensible_events_v1/PollEndEvent",
-                            "!matrix-js-sdk/src/extensible_events_v1/InvalidEventError",
-                            "!matrix-js-sdk/src/oidc",
-                            "!matrix-js-sdk/src/oidc/discovery",
-                            "!matrix-js-sdk/src/oidc/authorize",
-                            "!matrix-js-sdk/src/oidc/validate",
-                            "!matrix-js-sdk/src/oidc/error",
-                            "!matrix-js-sdk/src/oidc/register",
-                            "!matrix-js-sdk/src/webrtc",
-                            "!matrix-js-sdk/src/webrtc/call",
-                            "!matrix-js-sdk/src/webrtc/callFeed",
-                            "!matrix-js-sdk/src/webrtc/mediaHandler",
-                            "!matrix-js-sdk/src/webrtc/callEventTypes",
-                            "!matrix-js-sdk/src/webrtc/callEventHandler",
-                            "!matrix-js-sdk/src/webrtc/groupCallEventHandler",
-                            "!matrix-js-sdk/src/models",
-                            "!matrix-js-sdk/src/models/read-receipt",
-                            "!matrix-js-sdk/src/models/relations-container",
-                            "!matrix-js-sdk/src/models/related-relations",
-                            "!matrix-js-sdk/src/matrixrtc",
-                        ],
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        group: ["emojibase-regex/emoji*"],
-                        message:
-                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
-                    },
-                    {
-                        group: ["@vector-im/compound-design-tokens/icons/*"],
-                        message: "Please use @vector-im/compound-design-tokens/assets/web/icons/* instead",
-                    },
-                ],
-            },
-        ],
-
-        // There are too many a11y violations to fix at once
-        // Turn violated rules off until they are fixed
-        "jsx-a11y/aria-activedescendant-has-tabindex": "off",
-        "jsx-a11y/click-events-have-key-events": "off",
-        "jsx-a11y/interactive-supports-focus": "off",
-        "jsx-a11y/media-has-caption": "off",
-        "jsx-a11y/mouse-events-have-key-events": "off",
-        "jsx-a11y/no-autofocus": "off",
-        "jsx-a11y/no-noninteractive-element-interactions": "off",
-        "jsx-a11y/no-noninteractive-element-to-interactive-role": "off",
-        "jsx-a11y/no-noninteractive-tabindex": "off",
-        "jsx-a11y/no-static-element-interactions": "off",
-        "jsx-a11y/role-supports-aria-props": "off",
-
-        "matrix-org/require-copyright-header": "error",
-
-        "react-compiler/react-compiler": "error",
-    },
-    overrides: [
-        {
-            files: ["src/**/*.{ts,tsx}", "test/**/*.{ts,tsx}", "playwright/**/*.ts"],
-            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
-            rules: {
-                "@typescript-eslint/explicit-function-return-type": [
-                    "error",
-                    {
-                        allowExpressions: true,
-                    },
-                ],
-
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "no-extra-boolean-cast": "off",
-
-                // Remove Babel things manually due to override limitations
-                "@babel/no-invalid-this": ["off"],
-
-                // We're okay being explicit at the moment
-                "@typescript-eslint/no-empty-interface": "off",
-                // We disable this while we're transitioning
-                "@typescript-eslint/no-explicit-any": "off",
-                // We'd rather not do this but we do
-                "@typescript-eslint/ban-ts-comment": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-                "@typescript-eslint/no-empty-object-type": [
-                    "error",
-                    {
-                        // We do this sometimes to brand interfaces
-                        allowInterfaces: "with-single-extends",
-                    },
-                ],
-            },
-        },
-        // temporary override for offending icon require files
-        {
-            files: [
-                "src/SdkConfig.ts",
-                "src/components/structures/FileDropTarget.tsx",
-                "src/components/structures/RoomStatusBar.tsx",
-                "src/components/structures/UserMenu.tsx",
-                "src/components/views/avatars/WidgetAvatar.tsx",
-                "src/components/views/dialogs/AddExistingToSpaceDialog.tsx",
-                "src/components/views/dialogs/ForwardDialog.tsx",
-                "src/components/views/dialogs/InviteDialog.tsx",
-                "src/components/views/dialogs/ModalWidgetDialog.tsx",
-                "src/components/views/dialogs/UploadConfirmDialog.tsx",
-                "src/components/views/dialogs/security/SetupEncryptionDialog.tsx",
-                "src/components/views/elements/AddressTile.tsx",
-                "src/components/views/elements/AppWarning.tsx",
-                "src/components/views/elements/SSOButtons.tsx",
-                "src/components/views/messages/MAudioBody.tsx",
-                "src/components/views/messages/MImageBody.tsx",
-                "src/components/views/messages/MFileBody.tsx",
-                "src/components/views/messages/MStickerBody.tsx",
-                "src/components/views/messages/MVideoBody.tsx",
-                "src/components/views/messages/MVoiceMessageBody.tsx",
-                "src/components/views/right_panel/EncryptionPanel.tsx",
-                "src/components/views/rooms/EntityTile.tsx",
-                "src/components/views/rooms/LinkPreviewGroup.tsx",
-                "src/components/views/rooms/MemberList.tsx",
-                "src/components/views/rooms/MessageComposer.tsx",
-                "src/components/views/rooms/ReplyPreview.tsx",
-                "src/components/views/settings/tabs/room/SecurityRoomSettingsTab.tsx",
-                "src/components/views/settings/tabs/user/GeneralUserSettingsTab.tsx",
-            ],
-            rules: {
-                "@typescript-eslint/no-var-requires": "off",
-            },
-        },
-        {
-            files: ["test/**/*.{ts,tsx}", "playwright/**/*.ts"],
-            extends: ["plugin:matrix-org/jest"],
-            rules: {
-                // We don't need super strict typing in test utilities
-                "@typescript-eslint/explicit-function-return-type": "off",
-                "@typescript-eslint/explicit-member-accessibility": "off",
-                "@typescript-eslint/no-empty-object-type": "off",
-
-                // Jest/Playwright specific
-
-                // Disabled tests are a reality for now but as soon as all of the xits are
-                // eliminated, we should enforce this.
-                "jest/no-disabled-tests": "off",
-                // Also treat "oldBackendOnly" as a test function.
-                // Used in some crypto tests.
-                "jest/no-standalone-expect": [
-                    "error",
-                    {
-                        additionalTestBlockFunctions: ["beforeAll", "beforeEach", "oldBackendOnly"],
-                    },
-                ],
-
-                // These are fine in tests
-                "no-restricted-globals": "off",
-                "react-compiler/react-compiler": "off",
-            },
-        },
-        {
-            files: ["playwright/**/*.ts"],
-            parserOptions: {
-                project: ["./playwright/tsconfig.json"],
-            },
-            rules: {
-                "react-hooks/rules-of-hooks": ["off"],
-                "@typescript-eslint/no-floating-promises": ["error"],
-            },
-        },
-        {
-            files: ["module_system/**/*.{ts,tsx}"],
-            parserOptions: {
-                project: ["./tsconfig.module_system.json"],
-            },
-            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
-            // NOTE: These rules are frozen and new rules should not be added here.
-            // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
-            rules: {
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "quotes": "off",
-
-                // We disable this while we're transitioning
-                "@typescript-eslint/no-explicit-any": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-
-                // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
-                "no-restricted-imports": [
-                    "error",
-                    {
-                        paths: [
-                            {
-                                name: "matrix-js-sdk",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/src",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/src/",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/src/index",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                        ],
-                        patterns: [
-                            {
-                                group: ["matrix-js-sdk/lib", "matrix-js-sdk/lib/", "matrix-js-sdk/lib/**"],
-                                message: "Please use matrix-js-sdk/src/* instead",
-                            },
-                        ],
-                    },
-                ],
-            },
-        },
-    ],
-    settings: {
-        react: {
-            version: "detect",
-        },
-    },
-};
-
-function buildRestrictedPropertiesOptions(properties, message) {
-    return properties.map((prop) => {
-        let [object, property] = prop.split(".");
-        if (object === "*") {
-            object = undefined;
-        }
-        return {
-            object,
-            property,
-            message,
-        };
-    });
-}
@@ -1,25 +1,36 @@
 *                         @element-hq/element-web-reviewers
 /.github/workflows/**     @element-hq/element-web-team
-/package.json             @element-hq/element-web-team
-/yarn.lock                @element-hq/element-web-team
+package.json              @element-hq/element-web-team
+/pnpm-lock.yaml           @element-hq/element-web-team

-/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
-/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
-/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
-/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
-/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
-/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
-/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
-/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
-/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
-/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
-/src/components/views/dialogs/devtools/Crypto.tsx                       @element-hq/element-crypto-web-reviewers
-/playwright/e2e/crypto/                                                 @element-hq/element-crypto-web-reviewers
-/playwright/e2e/settings/encryption-user-tab/                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
+/apps/web/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
+/apps/web/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
+/apps/web/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
+/apps/web/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/dialogs/devtools/Crypto.tsx                       @element-hq/element-crypto-web-reviewers
+/apps/web/playwright/e2e/crypto/                                                 @element-hq/element-crypto-web-reviewers
+/apps/web/playwright/e2e/settings/encryption-user-tab/                           @element-hq/element-crypto-web-reviewers
+/packages/shared-components/src/crypto/                                          @element-hq/element-crypto-web-reviewers
+
+
+/apps/web/src/models/Call.ts                             @element-hq/element-call-reviewers
+/apps/web/src/call-types.ts                              @element-hq/element-call-reviewers
+/apps/web/src/components/views/voip                      @element-hq/element-call-reviewers
+/apps/web/playwright/e2e/voip/element-call.spec.ts       @element-hq/element-call-reviewers

 # Ignore translations as those will be updated by GHA for Localazy download
-/src/i18n/strings
-/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers
-# Ignore the synapse plugin as this is updated by GHA for docker image updating
-/playwright/testcontainers/synapse.ts
+/apps/web/src/i18n/strings
+/packages/shared-components/src/i18n/strings
+/apps/web/src/i18n/strings/en_EN.json                    @element-hq/element-web-reviewers
+/packages/shared-components/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers
+
+# Ignore the synapse & mas plugins as this is updated by GHA for docker image updating
+/apps/web/playwright/testcontainers/synapse.ts
+/apps/web/playwright/testcontainers/mas.ts

@@ -1,6 +1,6 @@
 name: Bug report for the Element desktop app (not in a browser)
 description: File a bug report if you are using the desktop Element application.
-labels: [T-Defect]
+labels: [T-Defect, A-Electron]
 body:
    - type: markdown
      attributes:
@@ -3,3 +3,6 @@ contact_links:
    - name: Questions & support
      url: https://matrix.to/#/#element-web:matrix.org
      about: Please ask and answer questions here.
+    - name: Bug report for the Element flatpak app
+      url: https://github.com/flathub/im.riot.Riot/issues
+      about: Please file bugs with the Flatpak application on the respective repository.
@@ -2,6 +2,7 @@

 ## Checklist

+- [ ] I have read through [review guidelines](https://github.com/element-hq/element-web/blob/develop/docs/review.md) and [CONTRIBUTING.md](https://github.com/element-hq/element-web/blob/develop/CONTRIBUTING.md).
 - [ ] Tests written for new code (and old code if feasible).
 - [ ] New or updated `public`/`exported` symbols have accurate [TSDoc](https://tsdoc.org/) documentation.
 - [ ] Linter and other CI checks pass.
@@ -173,6 +173,12 @@
  color: "bfd4f2"
 - name: "A-Welcome-Page"
  color: "bfd4f2"
+- name: "A-Install"
+  color: "72A447"
+- name: "A-Seshat"
+  color: "8262BE"
+- name: "A-Update"
+  color: "17BE67"
 - name: "backport staging"
  description: "Label to automatically backport PR to staging branch"
  color: "B60205"
@@ -279,3 +285,26 @@
 - name: "Z-Flaky-Test-Disabled"
  description: "The flaking test has been disabled"
  color: "ededed"
+- name: "Z-Skip-Coverage"
+  description: "Skip SonarQube coverage for this PR"
+  color: "ededed"
+- name: "Z-Arch"
+  color: "D601BE"
+- name: "Z-ARM"
+  color: "5DEC5B"
+- name: "Z-Flatpak"
+  color: "0CA856"
+- name: "Z-Linux"
+  color: "7B4A9C"
+- name: "Z-macOS"
+  color: "500605"
+- name: "Z-Official"
+  color: "1D2B20"
+- name: "Z-Snap"
+  color: "29CD95"
+- name: "Z-Suse"
+  color: "79D07B"
+- name: "Z-Wayland"
+  color: "94C519"
+- name: "Z-Windows"
+  color: "0632DE"
@@ -1,4 +1,15 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": ["github>matrix-org/renovate-config-element-web"]
+    "extends": ["github>matrix-org/renovate-config-element-web"],
+    "postUpdateOptions": ["pnpmDedupe"],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "datasourceTemplate": "docker",
+            "versioningTemplate": "loose",
+            "description": "Update testcontainers docker digests",
+            "managerFilePatterns": ["**/testcontainers/*.ts"],
+            "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""]
+        }
+    ]
 }
@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types:
            - closed
            - labeled
@@ -10,9 +10,9 @@ concurrency:
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 # develop pushes and repository_dispatch handled in build_develop.yaml
 env:
-    # These must be set for fetchdep.sh to get the right branch
-    REPOSITORY: ${{ github.repository }}
+    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {} # No permissions required
 jobs:
    build:
@@ -43,42 +43,34 @@ jobs:
            run:
                shell: bash
        steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: actions/setup-node@v4
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  # Disable cache on Windows as it is slower than not caching
                  # https://github.com/actions/setup-node/issues/975
-                  cache: ${{ runner.os != 'Windows' && 'yarn' || '' }}
+                  cache: ${{ runner.os != 'Windows' && 'pnpm' || '' }}
                  node-version: "lts/*"

-            # Workaround for yarn install timeouts, especially on Windows
-            - run: yarn config set network-timeout 300000
-
            - name: Fetch layered build
-              id: layered_build
-              env:
-                  # tell layered.sh to check out the right sha of the JS-SDK & EW, if they were given one
-                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}
-              run: |
-                  scripts/layered.sh
-                  JSSDK_SHA=$(git -C matrix-js-sdk rev-parse --short=12 HEAD)
-                  VECTOR_SHA=$(git rev-parse --short=12 HEAD)
-                  echo "VERSION=$VECTOR_SHA--js-$JSSDK_SHA" >> $GITHUB_OUTPUT
+              run: ./scripts/layered.sh

            - name: Copy config
+              working-directory: apps/web
              run: cp element.io/develop/config.json config.json

            - name: Build
+              working-directory: apps/web
              env:
                  CI_PACKAGE: true
-                  VERSION: "${{ steps.layered_build.outputs.VERSION }}"
-              run: |
-                  yarn build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build

            - name: Upload Artifact
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp-${{ matrix.image }}
-                  path: webapp
+                  path: apps/web/webapp
                  retention-days: 1
@@ -14,14 +14,18 @@ jobs:
            R2_URL: ${{ vars.CF_R2_S3_API }}
            VERSION: ${{ github.ref_name }}
        steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Download package
+              working-directory: apps/web
              run: |
                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz"
                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz.asc"

            - name: Check GPG signature
+              working-directory: apps/web
              run: |
                  wget "https://packages.element.io/element-release-key.gpg"
                  gpg --import element-release-key.gpg
@@ -31,6 +35,7 @@ jobs:
                  FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}

            - name: Prepare
+              working-directory: apps/web
              run: |
                  mkdir -p debian/tmp/DEBIAN
                  find debian -maxdepth 1 -type f -exec cp "{}" debian/tmp/DEBIAN/ \;
@@ -41,6 +46,7 @@ jobs:
                  ln -s /etc/element-web/config.json debian/tmp/usr/share/element-web/config.json

            - name: Write changelog
+              working-directory: apps/web
              run: |
                  VERSION=$(cat package.json | jq -r .version)
                  TIME=$(date -d "$PUBLISHED_AT" -R)
@@ -57,22 +63,23 @@ jobs:
                  PUBLISHED_AT: ${{ github.event.release.published_at }}

            - name: Build deb package
+              working-directory: apps/web
              run: |
                  VERSION=$(cat package.json | jq -r .version)
                  dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
                  dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb

-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: element-web.deb
-                  path: element-web.deb
+                  path: apps/web/element-web.deb
                  retention-days: 14

            - name: Publish to packages.element.io
              if: github.event.release.prerelease == false
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
              with:
-                  file: element-web.deb
+                  file: apps/web/element-web.deb
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  bucket-api: ${{ vars.CF_R2_S3_API }}
                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -9,6 +9,8 @@ on:
 concurrency:
    group: ${{ github.repository_owner }}-${{ github.workflow }}-${{ github.ref_name }}
    cancel-in-progress: true
+env:
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {}
 jobs:
    build:
@@ -26,17 +28,21 @@ jobs:
            R2_URL: ${{ vars.CF_R2_S3_API }}
            R2_PUBLIC_URL: "https://element-web-develop.element.io"
        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Dependencies
              run: "./scripts/layered.sh"

            - name: Build, Package & Upload sourcemaps
+              working-directory: apps/web
              run: "./scripts/ci_package.sh"
              env:
                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
@@ -52,20 +58,21 @@ jobs:
                  CSP_EXTRA_SOURCE: ${{ env.R2_PUBLIC_URL }}

            - run: mv dist/element-*.tar.gz dist/develop.tar.gz
+              working-directory: apps/web

-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
-                  path: dist/develop.tar.gz
+                  path: apps/web/dist/develop.tar.gz
                  retention-days: 1

            - name: Extract webapp
              run: |
                  mkdir _deploy
-                  tar xf dist/develop.tar.gz -C _deploy --strip-components=1
+                  tar xf apps/web/dist/develop.tar.gz -C _deploy --strip-components=1

            - name: Copy config
-              run: cp element.io/develop/config.json _deploy/config.json
+              run: cp apps/web/element.io/develop/config.json _deploy/config.json

            - name: Populate 404.html
              run: echo "404 Not Found" > _deploy/404.html
@@ -104,7 +111,7 @@ jobs:
                  running-workflow-name: "Build & Deploy develop.element.io"
                  repo-token: ${{ secrets.GITHUB_TOKEN }}
                  wait-interval: 10
-                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages).)*$
+                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages|Upload).)*$

            # We keep the latest develop.tar.gz on R2 instead of relying on the github artifact uploaded earlier
            # as the expires after 24h and requires auth to download.
@@ -112,7 +119,7 @@ jobs:
            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
            - name: Deploy to R2
              run: |
-                  aws s3 cp dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
+                  aws s3 cp apps/web/dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
                  aws s3 cp _deploy/ s3://$R2_BUCKET/ --recursive --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
              env:
                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -129,4 +136,6 @@ jobs:
                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}

            - run: |
-                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
+                  echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
+              env:
+                  STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
@@ -0,0 +1,79 @@
+name: CD # Continuous Delivery
+on:
+    push:
+        branches: [develop]
+concurrency: ${{ github.workflow }}-${{ github.ref_name }}
+
+permissions: {}
+env:
+    NX_DEFAULT_OUTPUT_STYLE: static
+
+jobs:
+    docker:
+        name: Docker Bake
+        runs-on: ubuntu-24.04
+        permissions:
+            id-token: write # needed for signing the images with GitHub OIDC Token
+            packages: write # needed for publishing packages to GHCR
+            # Needed for nx-set-shas
+            contents: read
+            actions: read
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
+                  fetch-depth: 0
+                  # reduce the size of the checkout with tree filtering,
+                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
+                  filter: tree:0
+                  persist-credentials: false
+
+            - name: Prepare nx
+              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
+              with:
+                  main-branch-name: develop
+
+            - name: Install Cosign
+              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
+            - name: Set up Docker Buildx
+              id: builder
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  node-version-file: package.json
+                  cache: "pnpm"
+
+            - name: Install Deps
+              run: "pnpm install --frozen-lockfile"
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - run: pnpm nx affected -t docker:build
+              env:
+                  INPUT_PUSH: true
+                  INPUT_LOAD: false
+                  INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}
+
+            - name: Sign the images with GitHub OIDC token
+              env:
+                  PATTERN: "^ghcr.io/element-hq/element-web*"
+              run: |
+                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
+                    # Check if digest is valid (not <none>)
+                    if [[ "$TARGET" != *"@<none>"* ]]; then
+                      echo "Signing $TARGET..."
+                      cosign sign --yes "$TARGET"
+                    fi
+                  done
@@ -34,7 +34,9 @@ jobs:
        env:
            SITE: ${{ inputs.site || 'staging.element.io' }}
        steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Load GPG key
              run: |
@@ -70,7 +72,7 @@ jobs:
              run: cp -vnpr _current_version/bundles/* _deploy/bundles/

            - name: Copy config
-              run: cp element.io/app/config.json _deploy/config.json
+              run: cp apps/web/element.io/app/config.json _deploy/config.json

            - name: Populate 404.html
              run: echo "404 Not Found" > _deploy/404.html
@@ -20,42 +20,29 @@ jobs:
        env:
            TEST_TAG: vectorim/element-web:test
        steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  fetch-depth: 0 # needed for docker-package to be able to calculate the version
+                  persist-credentials: false

            - name: Install Cosign
-              uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3
+              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
              if: github.event_name != 'pull_request'

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
              with:
                  install: true

-            - name: Login to Docker Hub
-              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-              if: github.event_name != 'pull_request'
-              with:
-                  username: ${{ secrets.DOCKERHUB_USERNAME }}
-                  password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-            - name: Login to GitHub Container Registry
-              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-              if: github.event_name != 'pull_request'
-              with:
-                  registry: ghcr.io
-                  username: ${{ github.repository_owner }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
            - name: Build and load
              id: test-build
-              uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
              with:
                  context: .
+                  file: apps/web/Dockerfile
                  load: true

            - name: Test the image
@@ -96,24 +83,77 @@ jobs:

            - name: Docker meta
              id: meta
-              uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+              uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
              if: github.event_name != 'pull_request'
              with:
                  images: |
                      vectorim/element-web
                      ghcr.io/element-hq/element-web
+                      oci-push.vpn.infra.element.io/element-web
                  tags: |
                      type=ref,event=branch
                      type=ref,event=tag
                  flavor: |
                      latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}

+            - name: Login to Docker Hub
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Connect to Tailscale
+              uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4
+              if: github.event_name != 'pull_request'
+              with:
+                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+                  audience: ${{ secrets.TS_AUDIENCE }}
+                  tags: tag:github-actions
+
+            - name: Compute vault jwt role name
+              id: vault-jwt-role
+              if: github.event_name != 'pull_request'
+              run: |
+                  echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"
+
+            - name: Get team registry token
+              id: import-secrets
+              uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  url: https://vault.infra.ci.i.element.dev
+                  role: ${{ steps.vault-jwt-role.outputs.role_name }}
+                  path: service-management/github-actions
+                  jwtGithubAudience: https://vault.infra.ci.i.element.dev
+                  method: jwt
+                  secrets: |
+                      services/web-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
+                      services/web-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;
+
+            - name: Login to oci.element.io Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  registry: oci-push.vpn.infra.element.io
+                  username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
+                  password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}
+
            - name: Build and push
              id: build-and-push
-              uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
              if: github.event_name != 'pull_request'
              with:
                  context: .
+                  file: apps/web/Dockerfile
                  push: true
                  platforms: linux/amd64,linux/arm64
                  tags: ${{ steps.meta.outputs.tags }}
@@ -132,7 +172,7 @@ jobs:
                  cosign sign --yes ${images}

            - name: Update repo description
-              uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4
+              uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5
              if: github.event_name != 'pull_request'
              continue-on-error: true
              with:
@@ -17,39 +17,45 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - name: Fetch element-desktop
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-desktop
                  path: element-desktop
+                  persist-credentials: false

            - name: Fetch element-web
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  path: element-web
+                  persist-credentials: false

            - name: Fetch matrix-js-sdk
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: matrix-org/matrix-js-sdk
                  path: matrix-js-sdk
+                  persist-credentials: false

-            - uses: actions/setup-node@v4
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
              with:
-                  cache: "yarn"
-                  cache-dependency-path: element-web/yarn.lock
+                  package_json_file: element-web/package.json
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  cache-dependency-path: element-web/pnpm-lock.yaml
                  node-version: "lts/*"

            - name: Generate automations docs
              working-directory: element-web
              run: |
-                  yarn install --frozen-lockfile
-                  yarn ts-node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
+                  pnpm install --frozen-lockfile
+                  pnpm node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
                  echo "-   [Automations](automations.md)" >> docs/SUMMARY.md

            - name: Setup mdBook
-              uses: peaceiris/actions-mdbook@v2
+              uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2
              with:
-                  mdbook-version: "0.4.10"
+                  mdbook-version: "0.5.1"

            - name: Install mdbook extensions
              run: cargo install mdbook-combiner mdbook-mermaid
@@ -88,7 +94,7 @@ jobs:
              run: mdbook build

            - name: Upload artifact
-              uses: actions/upload-pages-artifact@v3
+              uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
              with:
                  path: ./book

@@ -104,4 +110,4 @@ jobs:
        steps:
            - name: Deploy to GitHub Pages
              id: deployment
-              uses: actions/deploy-pages@v4
+              uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
@@ -2,7 +2,9 @@
 # taking the artifact and uploading it to Netlify for easier viewing
 name: Upload End to End Test report to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["End to End Tests"]
        types:
            - completed
@@ -25,7 +27,7 @@ jobs:
            actions: read
        steps:
            - name: Download HTML report
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -33,7 +35,7 @@ jobs:
                  path: playwright-report

            - name: 📤 Deploy to Netlify
-              uses: matrix-org/netlify-pr-preview@v3
+              uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
              with:
                  path: playwright-report
                  owner: ${{ github.event.workflow_run.head_repository.owner.login }}
@@ -37,6 +37,7 @@ env:
    PR_NUMBER: ${{ github.event.pull_request.number }}
    # Use 6 runners in the default case, but 4 when running on a schedule where we run all 5 projects (20 runners total)
    NUM_RUNNERS: ${{ github.event_name == 'schedule' && 4 || 6 }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

@@ -50,46 +51,43 @@ jobs:
            runners-matrix: ${{ steps.runner-vars.outputs.matrix }}
        steps:
            - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
+                  persist-credentials: false

-            - uses: actions/setup-node@v4
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Fetch layered build
-              id: layered_build
              env:
                  # tell layered.sh to check out the right sha of the JS-SDK & EW, if they were given one
                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}
-              run: |
-                  scripts/layered.sh
-                  JSSDK_SHA=$(git -C matrix-js-sdk rev-parse --short=12 HEAD)
-                  VECTOR_SHA=$(git rev-parse --short=12 HEAD)
-                  echo "VERSION=$VECTOR_SHA--js-$JSSDK_SHA" >> $GITHUB_OUTPUT
+              run: scripts/layered.sh

            - name: Copy config
+              working-directory: apps/web
              run: cp element.io/develop/config.json config.json

            - name: Build
              env:
                  CI_PACKAGE: true
-                  VERSION: "${{ steps.layered_build.outputs.VERSION }}"
-              run: |
-                  yarn build
+              working-directory: apps/web
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build

            - name: Upload Artifact
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
-                  path: webapp
+                  path: apps/web/webapp
                  retention-days: 1

            - name: Calculate runner variables
              id: runner-vars
-              uses: actions/github-script@v7
+              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              with:
                  script: |
                      const numRunners = parseInt(process.env.NUM_RUNNERS, 10);
@@ -129,96 +127,114 @@ jobs:
                    - runAllTests: false
                      project: Pinecone
        steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

            - name: 📥 Download artifact
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  name: webapp
-                  path: webapp
+                  path: apps/web/webapp

-            - uses: actions/setup-node@v4
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
-                  cache-dependency-path: yarn.lock
+                  cache: "pnpm"
+                  cache-dependency-path: pnpm-lock.yaml
                  node-version: "lts/*"

            - name: Install dependencies
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Get installed Playwright version
              id: playwright
-              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@v4
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              id: playwright-cache
              with:
-                  path: |
-                      ~/.cache/ms-playwright
-                  key: ${{ runner.os }}-playwright-${{ steps.playwright.outputs.version }}
+                  path: ~/.cache/ms-playwright
+                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}

            - name: Install Playwright browsers
              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: yarn playwright install --with-deps --no-shell
+              working-directory: apps/web
+              run: pnpm playwright install --with-deps --no-shell

            - name: Install system dependencies for WebKit
              # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
              if: matrix.project == 'WebKit' && steps.playwright-cache.outputs.cache-hit == 'true'
-              run: yarn playwright install-deps webkit
+              working-directory: apps/web
+              run: pnpm playwright install-deps webkit

            # We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
            - name: Run Playwright tests
+              working-directory: apps/web
              run: |
-                  yarn playwright test \
-                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                  pnpm playwright test \
+                      --shard "$SHARD" \
                      --project="${{ matrix.project }}" \
                      ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+              env:
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build.outputs.num-runners) }}

            - name: Upload blob report to GitHub Actions Artifacts
              if: always()
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: all-blob-reports-${{ matrix.project }}-${{ matrix.runner }}
-                  path: blob-report
+                  path: apps/web/blob-report
                  retention-days: 1

+    downstream-modules:
+        name: Downstream Playwright tests [element-modules]
+        needs: build
+        if: inputs.skip != true && github.event_name == 'merge_group'
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
+        with:
+            webapp-artifact: webapp
+
    complete:
        name: end-to-end-tests
-        needs: playwright
+        needs:
+            - playwright
+            - downstream-modules
        if: always()
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.skip != true
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: actions/setup-node@v4
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+              if: inputs.skip != true
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              if: inputs.skip != true
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install dependencies
              if: inputs.skip != true
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Download blob reports from GitHub Actions Artifacts
              if: inputs.skip != true
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  pattern: all-blob-reports-*
-                  path: all-blob-reports
+                  path: apps/web/all-blob-reports
                  merge-multiple: true

            - name: Merge into HTML Report
              if: inputs.skip != true
-              run: yarn playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,./playwright/stale-screenshot-reporter.ts ./all-blob-reports
+              working-directory: apps/web
+              run: pnpm playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
              env:
                  # Only pass creds to the flaky-reporter on main branch runs
                  GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
@@ -226,11 +242,12 @@ jobs:
            # Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
            - name: Upload HTML report
              if: always() && inputs.skip != true
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: html-report
-                  path: playwright-report
+                  path: apps/web/playwright-report
                  retention-days: 14
+                  if-no-files-found: error

-            - if: needs.playwright.result != 'skipped' && needs.playwright.result != 'success'
+            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1
@@ -10,7 +10,7 @@ jobs:
        name: Tidy closed issues
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              id: main
              with:
                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
@@ -142,7 +142,7 @@ jobs:
                          });
                        }
                      }
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              name: Close duplicate as Not Planned
              if: steps.main.outputs.closeAsNotPlanned
              with:
@@ -7,6 +7,8 @@ permissions:
    pull-requests: write # needed to auto-approve PRs
 jobs:
    download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
+        with:
+            packageManager: pnpm
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -1,12 +1,14 @@
 name: Localazy Upload
 on:
+    workflow_dispatch: {}
    push:
        branches: [develop]
        paths:
-            - "src/i18n/strings/en_EN.json"
+            - "apps/web/src/i18n/strings/en_EN.json"
+            - "packages/shared-components/src/i18n/strings/en_EN.json"
 permissions: {} # No permissions needed
 jobs:
    upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        secrets:
            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
@@ -2,7 +2,9 @@
 # and uploading it to netlify
 name: Upload Preview Build to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Build"]
        types:
            - completed
@@ -28,7 +30,7 @@ jobs:
                      Exercise caution. Use test accounts.

            - name: 📥 Download artifact
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -36,7 +38,7 @@ jobs:
                  path: webapp

            - name: 📤 Deploy to Netlify
-              uses: matrix-org/netlify-pr-preview@v3
+              uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
              with:
                  path: webapp
                  owner: ${{ github.event.workflow_run.head_repository.owner.login }}
@@ -1,92 +0,0 @@
-name: Pending reviews automation
-on:
-    # The bot exceeded its API rate limit. Disabling for now (adding workflow dispatch so the workflow file stays valid & we can test to see if it starts working again)
-    workflow_dispatch: {}
-    # We run it on a schedule instead of on pull_request_* events to not create confusing messaging in the PR
-    #schedule:
-    #    - cron: "*/10 * * * *"
-concurrency: ${{ github.workflow }}
-permissions: {} # We use ELEMENT_BOT_TOKEN instead
-jobs:
-    bot:
-        name: Pending reviews bot
-        runs-on: ubuntu-24.04
-        environment: Matrix
-        env:
-            URL: "https://github.com/pulls?q=is%3Apr+is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+review-requested%3A%40me+sort%3Aupdated-desc+"
-            RELEASE_BLOCKERS_URL: "https://github.com/pulls?q=is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+sort%3Aupdated-desc+label%3AX-Release-Blocker+"
-        steps:
-            - uses: actions/github-script@v7
-              env:
-                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
-                  ROOM_ID: ${{ secrets.ROOM_ID }}
-                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
-              with:
-                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
-                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  script: |
-                      const { HS_URL, ROOM_ID, TOKEN, URL, RELEASE_BLOCKERS_URL } = process.env;
-
-                      async function updateCounter(counter, link, severity, title, value, clearOnZero) {
-                          const apiUrl = `${HS_URL}/_matrix/client/v3/rooms/${ROOM_ID}/state/re.jki.counter/${counter}`;
-                          const headers = {
-                              "Content-Type": "application/json",
-                              "Authorization": `Bearer ${TOKEN}`,
-                          };
-                          const res = await fetch(apiUrl, {
-                              method: "GET",
-                              headers,
-                          });
-
-                          const data = await res.json();
-
-                          if (data.value === issueCount) {
-                              console.log("Pending review count already correct");
-                              return;
-                          }
-
-                          let body = {};
-                          if (issueCount || !clearOnZero) {
-                              body = JSON.stringify({
-                                  link,
-                                  severity,
-                                  title,
-                                  value,
-                              });
-                          }
-
-                          await fetch(apiUrl, {
-                              method: "PUT",
-                              body,
-                              headers,
-                          });
-                      }
-
-                      const repos = [
-                          "element-hq/element-desktop",
-                          "element-hq/element-web",
-                          "matrix-org/matrix-js-sdk",
-                      ];
-                      const teams = [
-                          "matrix-org/element-web-team",
-                          "matrix-org/element-web-reviewers",
-                          "element-hq/element-web-team",
-                          "element-hq/element-web-reviewers",
-                      ];
-
-                      let issueCount = 0;
-                      for (const team of teams) {
-                          const org = team.split("/", 2)[0];
-                          const reposInOrg = repos.filter(repo => repo.startsWith(org + "/"));
-                          const { data } = await github.rest.search.issuesAndPullRequests({
-                              q: `is:pr is:open review:required ${reposInOrg.map(r => `repo:${r}`).join(" ")} team-review-requested:${team}`,
-                          });
-                          issueCount += data.total_count;
-                      }
-                      await updateCounter("gh_reviews", URL, "warning", "Pending reviews", issueCount);
-
-                      const { data } = await github.rest.search.issuesAndPullRequests({
-                          q: `is:open ${repos.map(repo => `repo:${repo}`).join(" ")} label:X-Release-Blocker`,
-                      });
-                      const blockerCount = data.total_count;
-                      await updateCounter("release_blockers", RELEASE_BLOCKERS_URL, "alert", "Release Blockers", blockerCount, true);
@@ -1,48 +0,0 @@
-name: Update Playwright docker images
-on:
-    workflow_dispatch: {}
-    schedule:
-        - cron: "0 6 * * *" # Every day at 6am UTC
-permissions: {}
-jobs:
-    update:
-        runs-on: ubuntu-24.04
-        permissions:
-            pull-requests: write
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Update synapse image
-              run: |
-                  docker pull "$IMAGE"
-                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
-                  DIGEST=${INSPECT#*@}
-                  sed -i "s/const TAG.*/const TAG = \"develop@$DIGEST\";/" playwright/testcontainers/synapse.ts
-              env:
-                  IMAGE: ghcr.io/element-hq/synapse:develop
-
-            - name: Create Pull Request
-              id: cpr
-              uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
-              with:
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  branch: actions/playwright-image-updates
-                  delete-branch: true
-                  title: Playwright Docker image updates
-                  labels: |
-                      T-Task
-
-            - name: Enable automerge
-              run: gh pr merge --merge --auto "$PR_NUMBER"
-              if: steps.cpr.outputs.pull-request-operation == 'created'
-              env:
-                  GH_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-
-            - name: Enable autoapprove
-              run: |
-                  gh pr review --approve "$PR_NUMBER"
-              if: steps.cpr.outputs.pull-request-operation == 'created'
-              env:
-                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types: [opened, edited, labeled, unlabeled, synchronize]
    merge_group:
        types: [checks_requested]
 permissions: {}
 jobs:
    action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            pull-requests: write
        secrets:
@@ -8,7 +8,7 @@ jobs:
        name: Check PR base branch
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              with:
                  script: |
                      const baseBranch = context.payload.pull_request.base.ref;
@@ -9,4 +9,4 @@ jobs:
    draft:
        permissions:
            contents: write
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
@@ -7,9 +7,10 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # We use ELEMENT_BOT_TOKEN instead
 jobs:
    merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
+            dir: apps/web
            dependencies: |
                matrix-js-sdk
@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
    release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            contents: write
            issues: write
@@ -29,6 +29,7 @@ jobs:
            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
            asset-path: dist/*.tar.gz
            expected-asset-count: 3
+            dir: apps/web

    notify-downstream:
        name: Trigger release drafter downstream
@@ -27,7 +27,7 @@ jobs:
                    - matrix-org/matrix-js-sdk
                    - element-hq/element-web
                    - element-hq/element-desktop
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
@@ -41,7 +41,7 @@ jobs:
            REPOS: matrix-js-sdk element-web element-desktop
        steps:
            - name: Checkout Element Desktop
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-desktop
              with:
                  repository: element-hq/element-desktop
@@ -50,8 +50,9 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Element Web
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-web
              with:
                  repository: element-hq/element-web
@@ -60,8 +61,9 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Matrix JS SDK
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.matrix-js-sdk
              with:
                  repository: matrix-org/matrix-js-sdk
@@ -70,6 +72,7 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true

            - name: Prepare Git
              run: |
@@ -100,7 +103,7 @@ jobs:
                  repo: matrix-org/matrix-js-sdk
                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  wait-interval: 10
-                  check-name: draft
+                  check-name: "draft / draft"
                  allowed-conclusions: success

            - name: Wait for element-web draft
@@ -111,7 +114,7 @@ jobs:
                  repo: element-hq/element-web
                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  wait-interval: 10
-                  check-name: draft
+                  check-name: "draft / draft"
                  allowed-conclusions: success

            - name: Wait for element-desktop draft
@@ -122,5 +125,5 @@ jobs:
                  repo: element-hq/element-desktop
                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  wait-interval: 10
-                  check-name: draft
+                  check-name: "draft / draft"
                  allowed-conclusions: success
@@ -0,0 +1,38 @@
+name: Publish shared component npm package
+on:
+    workflow_dispatch: {}
+
+concurrency: release
+jobs:
+    publish:
+        name: "Publish"
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            id-token: write
+
+        steps:
+            - name: 🧮 Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: 🔧 Set up node environment
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  node-version-file: ".node-version"
+                  registry-url: "https://registry.npmjs.org"
+
+            # Ensure npm 11.5.1 or later is installed
+            - name: Update npm
+              run: npm install -g npm@latest
+
+            # Need to setup element web too as it needs the translations
+            - name: 🛠️ Setup EW
+              run: pnpm install --frozen-lockfile
+
+            - name: 🚀 Publish to npm
+              working-directory: packages/shared-components
+              run: npm publish --access public --provenance
@@ -0,0 +1,38 @@
+name: Build shared component storybook
+on:
+    merge_group: {}
+    pull_request: {}
+    workflow_call: {}
+
+permissions: {}
+
+jobs:
+    doc:
+        name: Build storybook
+        runs-on: ubuntu-latest
+        steps:
+            - name: 🧮 Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: 🔧 Pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  node-version-file: package.json
+
+            - name: 🔨 Install dependencies
+              working-directory: packages/shared-components
+              run: "pnpm install --frozen-lockfile"
+
+            - name: 📖 Build Storybook
+              working-directory: packages/shared-components
+              run: pnpm build:storybook
+
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: shared-components-storybook
+                  path: packages/shared-components/storybook-static
+                  retention-days: 1
@@ -0,0 +1,33 @@
+name: Publish shared component storybook
+on:
+    workflow_dispatch: {}
+    push:
+        branches:
+            - "develop"
+        paths:
+            - "packages/shared-components/**/*"
+
+permissions: {}
+
+jobs:
+    build:
+        name: Build storybook
+        uses: ./.github/workflows/shared-component-storybook-build.yml
+
+    publish:
+        name: Publish storybook
+        runs-on: ubuntu-latest
+        needs: build
+        environment: SharedComponents
+        steps:
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+              with:
+                  name: shared-components-storybook
+                  path: storybook-static
+
+            - name: 🚀 Deploy to Cloudflare Pages
+              uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
+              with:
+                  apiToken: ${{ secrets.CF_PAGES_TOKEN }}
+                  accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
+                  command: pages deploy storybook-static --project-name=shared-components-storybook
@@ -0,0 +1,51 @@
+# Triggers after the shared component tests have finished,
+# It uploads the received images and diffs to netlify, printing the URLs to the console
+name: Upload Shared Component Visual Test Diffs
+on:
+    workflow_run:
+        workflows: ["Shared Component Visual Tests"]
+        types:
+            - completed
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
+    cancel-in-progress: ${{ github.event.workflow_run.event == 'pull_request' }}
+
+permissions: {}
+
+jobs:
+    report:
+        if: github.event.workflow_run.conclusion == 'failure'
+        name: Upload Diffs
+        runs-on: ubuntu-24.04
+        environment: Netlify
+        permissions:
+            actions: read
+            deployments: write
+        steps:
+            - name: Install tree
+              run: "sudo apt-get install -y tree"
+
+            - name: Download Diffs
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  run-id: ${{ github.event.workflow_run.id }}
+                  name: received-images
+                  path: received-images
+
+            - name: Generate Index
+              run: "cd received-images && tree -L 1 --noreport -H '' -o index.html ."
+
+            - name: 📤 Deploy to Netlify
+              uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
+              with:
+                  path: received-images
+                  owner: ${{ github.event.workflow_run.head_repository.owner.login }}
+                  branch: ${{ github.event.workflow_run.head_branch }}
+                  revision: ${{ github.event.workflow_run.head_sha }}
+                  token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+                  site_id: ${{ vars.NETLIFY_SITE_ID }}
+                  desc: Shared Component Visual Diffs
+                  deployment_env: SharedComponentDiffs
+                  prefix: "diffs-"
@@ -0,0 +1,71 @@
+name: Shared Component Visual Tests
+on:
+    pull_request: {}
+    merge_group:
+        types: [checks_requested]
+    push:
+        branches: [develop, master]
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+    cancel-in-progress: true
+
+permissions: {} # No permissions required
+
+jobs:
+    testStorybook:
+        name: "Run Visual Tests"
+        runs-on: ubuntu-24.04
+        permissions:
+            actions: read
+            issues: read
+            pull-requests: read
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+                  repository: element-hq/element-web
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  node-version: "lts/*"
+
+            - name: Install dependencies
+              working-directory: packages/shared-components
+              run: pnpm install --frozen-lockfile
+
+            - name: Get installed Playwright version
+              working-directory: packages/shared-components
+              id: playwright
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
+
+            - name: Cache playwright binaries
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              id: playwright-cache
+              with:
+                  path: ~/.cache/ms-playwright
+                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}-onlyshell
+
+            - name: Install Playwright browsers
+              working-directory: packages/shared-components
+              if: steps.playwright-cache.outputs.cache-hit != 'true'
+              run: "pnpm playwright install --with-deps --only-shell"
+
+            - name: Run Visual tests
+              working-directory: packages/shared-components
+              run: "pnpm test:storybook --run"
+
+            # Workaround for vis silently adding new baselines if they didn't exist
+            # Can be removed once https://github.com/repobuddy/visual-testing/issues/516 is released
+            - run: |
+                  git add -N .
+                  git diff --exit-code
+
+            - name: Upload received images & diffs
+              if: always()
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: received-images
+                  path: packages/shared-components/__vis__/linux
@@ -12,7 +12,7 @@ jobs:
    sonarqube:
        name: 🩻 SonarQube
        if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
-        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            actions: read
            statuses: write
@@ -12,124 +12,117 @@ concurrency:
    cancel-in-progress: true

 env:
-    # These must be set for fetchdep.sh to get the right branch
-    REPOSITORY: ${{ github.repository }}
+    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

 jobs:
-    ts_lint:
-        name: "Typescript Syntax Check"
+    lint:
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - name: Typescript Syntax Check
+                      install: layered
+                      command: "lint:types"
+                    - name: Prettier
+                      install: normal
+                      command: "lint:prettier"
+                    - name: ESLint
+                      install: normal
+                      command: "lint:js"
+                    - name: Style Lint
+                      install: normal
+                      command: "lint:style"
+                    - name: Workflow Lint
+                      install: normal
+                      command: "lint:workflows"
+                    - name: Analyse Dead Code
+                      install: normal
+                      command: "lint:knip"
+                    - name: Rethemendex Check
+                      command: "rethemendex"
+                      assert-diff: true
+        name: ${{ matrix.name }}
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              if: matrix.install != ''
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

-            - name: Install Dependencies
+            - name: Install Dependencies (layered)
+              if: matrix.install == 'layered'
              run: "./scripts/layered.sh"
+            - name: Install Dependencies (normal)
+              if: matrix.install == 'normal'
+              run: "pnpm install --frozen-lockfile"

-            - name: Typecheck
-              run: "yarn run lint:types"
+            - name: Run ${{ matrix.command }}
+              run: pnpm --if-present run "$CMD" && pnpm -r --if-present run "$CMD"
+              env:
+                  CMD: ${{ matrix.command }}

-    i18n_lint:
-        name: "i18n Check"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+            - name: Assert no changes
+              run: git diff --exit-code
+              if: matrix.assert-diff
+
+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+
+    i18n:
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - name: Element Web
+                      path: "apps/web"
+                      allowed-hardcoded-keys: |
+                          console_dev_note
+                          labs|element_call_video_rooms
+                          labs|feature_disable_call_per_sender_encryption
+                          voip|element_call
+                          error|invalid_json
+                          error|misconfigured
+                          welcome_to_element
+                          devtools|settings|elementCallUrl
+                          labs|sliding_sync_description
+                          settings|voip|noise_suppression_description
+                          settings|voip|echo_cancellation_description
+                    - name: Shared Components
+                      path: "packages/shared-components"
+        name: "i18n Check (${{ matrix.name }})"
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@abf186831e2acb3e98fca13a0711a3fa1364d2b1
        permissions:
            pull-requests: read
        with:
            hardcoded-words: "Element"
-            allowed-hardcoded-keys: |
-                console_dev_note
-                labs|element_call_video_rooms
-                labs|feature_disable_call_per_sender_encryption
-                voip|element_call
-                error|invalid_json
-                error|misconfigured
-                welcome_to_element
-                devtools|settings|elementCallUrl
+            packageManager: pnpm
+            path: ${{ matrix.path }}
+            allowed-hardcoded-keys: ${{ matrix.allowed-hardcoded-keys }}

-    rethemendex_lint:
-        name: "Rethemendex Check"
+    # Dummy job to simplify branch protections
+    ci:
+        name: Static Analysis
+        needs: [lint, i18n]
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@v4
-
-            - run: ./res/css/rethemendex.sh
-
-            - run: git diff --exit-code
-
-    js_lint:
-        name: "ESLint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn run lint:js"
-
-    style_lint:
-        name: "Style Lint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install"
-
-            - name: Run Linter
-              run: "yarn run lint:style"
-
-    workflow_lint:
-        name: "Workflow Lint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn lint:workflows"
-
-    analyse_dead_code:
-        name: "Analyse Dead Code"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run linter
-              run: "yarn run lint:knip"
+            - run: echo "Ok"
@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead

 jobs:
    sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@dac99c67f08f8f2a079e885ffb682a2f39cd3960
        with:
            LABELS: |
                element-hq/element-meta
@@ -25,12 +25,13 @@ env:
    ENABLE_COVERAGE: ${{ github.event_name != 'merge_group' && inputs.disable_coverage != 'true' }}
    # fetchdep.sh needs to know our PR number
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {}

 jobs:
-    jest:
-        name: Jest
+    jest_ew:
+        name: Jest (Element Web)
        runs-on: ubuntu-24.04
        strategy:
            fail-fast: false
@@ -39,15 +40,17 @@ jobs:
                runner: [1, 2]
        steps:
            - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - name: Yarn cache
-              uses: actions/setup-node@v4
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  node-version: "lts/*"
-                  cache: "yarn"
+                  cache: "pnpm"

            - name: Install Deps
              run: "./scripts/layered.sh"
@@ -55,56 +58,62 @@ jobs:
                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}

            - name: Jest Cache
-              uses: actions/cache@v4
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              with:
                  path: /tmp/jest_cache
-                  key: ${{ hashFiles('**/yarn.lock') }}
+                  key: ${{ hashFiles('**/pnpm-lock.yaml') }}

            - name: Get number of CPU cores
              id: cpu-cores
              uses: SimenB/github-actions-cpu-cores@97ba232459a8e02ff6121db9362b09661c875ab8 # v2

            - name: Run tests
+              working-directory: apps/web
              run: |
-                  yarn test \
-                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                  pnpm test \
+                      --coverage=$ENABLE_COVERAGE \
                      --ci \
-                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
-                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --max-workers $MAX_WORKERS \
+                      --shard "$SHARD" \
                      --cacheDirectory /tmp/jest_cache
              env:
                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true

                  # tell jest to use coloured output
                  FORCE_COLOR: true
+                  MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}

            - name: Move coverage files into place
              if: env.ENABLE_COVERAGE == 'true'
-              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+              working-directory: apps/web
+              run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
+              env:
+                  NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: coverage-${{ matrix.runner }}
                  path: |
-                      coverage
-                      !coverage/lcov-report
+                      apps/web/coverage
+                      !apps/web/coverage/lcov-report

    complete:
        name: jest-tests
-        needs: jest
+        needs: [jest_ew, vitest_sc]
        if: always()
        runs-on: ubuntu-24.04
        permissions:
            statuses: write
        steps:
-            - if: needs.jest.result != 'skipped' && needs.jest.result != 'success'
+            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1

            - name: Skip SonarCloud in merge queue
              if: github.event_name == 'merge_group' || inputs.disable_coverage == 'true'
-              uses: guibranco/github-status-action-v2@fe98467f9071758c7fc214af9dbac7f301bd23d4
+              uses: guibranco/github-status-action-v2@9bfa8773cdbdc6c185747fd43cd7faa9d7c32f09
              with:
                  authToken: ${{ secrets.GITHUB_TOKEN }}
                  state: success
@@ -112,3 +121,62 @@ jobs:
                  context: SonarCloud Code Analysis
                  sha: ${{ github.sha }}
                  target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+    vitest_sc:
+        name: Vitest (Shared Components)
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  node-version: "lts/*"
+                  cache: "pnpm"
+
+            - name: Install Shared Component Deps
+              working-directory: "packages/shared-components"
+              run: "pnpm install"
+
+            - name: Cache storybook & vitest
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              with:
+                  path: |
+                      packages/shared-components/node_modules/.cache
+                      packages/shared-components/node_modules/.vite/vitest
+                  key: ${{ hashFiles('pnpm-lock.yaml') }}
+
+            - name: Get installed Playwright version
+              working-directory: packages/shared-components
+              id: playwright
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
+
+            - name: Cache playwright binaries
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              id: playwright-cache
+              with:
+                  path: ~/.cache/ms-playwright
+                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}-onlyshell
+
+            - name: Install Playwright browsers
+              working-directory: packages/shared-components
+              if: steps.playwright-cache.outputs.cache-hit != 'true'
+              run: "pnpm playwright install --with-deps --only-shell"
+
+            - name: Run tests
+              working-directory: "packages/shared-components"
+              run: pnpm test:unit --coverage=$ENABLE_COVERAGE
+
+            - name: Upload Artifact
+              if: env.ENABLE_COVERAGE == 'true'
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: coverage-sharedcomponents
+                  path: |
+                      packages/shared-components/coverage
+                      !packages/shared-components/coverage/lcov-report
@@ -11,10 +11,11 @@ jobs:
        runs-on: ubuntu-24.04
        if: |
            contains(github.event.issue.assignees.*.login, 't3chguy') ||
-            contains(github.event.issue.assignees.*.login, 'andybalaam') ||
+            contains(github.event.issue.assignees.*.login, 'florianduros') ||
+            contains(github.event.issue.assignees.*.login, 'dbkr') ||
            contains(github.event.issue.assignees.*.login, 'MidhunSureshR')
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/67
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -10,7 +10,7 @@ jobs:
    automate-project-columns:
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/120
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -27,7 +27,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor') ||
            contains(github.event.issue.labels.*.name, 'A-Element-Call')
        steps:
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              with:
                  script: |
                      github.rest.issues.addLabels({
@@ -44,7 +44,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'good first issue') ||
            contains(github.event.issue.labels.*.name, 'Hacktoberfest')
        steps:
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              with:
                  script: |
                      github.rest.issues.addLabels({
@@ -61,7 +61,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'X-Needs-Info')
        steps:
            - id: add_to_project
-              uses: actions/add-to-project@v1.0.2
+              uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: ${{ env.PROJECT_URL }}
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -84,7 +84,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'Z-Flaky-Test')
        steps:
            - id: add_to_project
-              uses: actions/add-to-project@v1.0.2
+              uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: ${{ env.PROJECT_URL }}
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -112,7 +112,7 @@ jobs:
             contains(github.event.issue.labels.*.name, 'O-Frequent') ||
             contains(github.event.issue.labels.*.name, 'A11y'))
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/18
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -123,7 +123,7 @@ jobs:
        if: >
            contains(github.event.issue.labels.*.name, 'X-Needs-Product')
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/28
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -134,7 +134,7 @@ jobs:
        if: >
            contains(github.event.issue.labels.*.name, 'A-New-Search-Experience')
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/48
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -145,20 +145,20 @@ jobs:
        if: >
            contains(github.event.issue.labels.*.name, 'Team: VoIP')
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/41
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

-    verticals_feature:
-        name: Add labelled issues to Verticals Feature project
+    crypto:
+        name: Add labelled issues to Crypto project
        runs-on: ubuntu-24.04
        if: >
-            contains(github.event.issue.labels.*.name, 'Team: Verticals Feature')
+            contains(github.event.issue.labels.*.name, 'Team: Crypto')
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
-                  project-url: https://github.com/orgs/element-hq/projects/57
+                  project-url: https://github.com/orgs/element-hq/projects/76
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

    tech_debt:
@@ -172,7 +172,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'A-Testing') ||
            contains(github.event.issue.labels.*.name, 'Z-Flaky-Test')
        steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
              with:
                  project-url: https://github.com/orgs/element-hq/projects/101
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -9,7 +9,7 @@ jobs:
        name: Move PRs asking for design review to the design board
        runs-on: ubuntu-24.04
        steps:
-            - uses: octokit/graphql-action@v2.x
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: find_team_members
              with:
                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
@@ -52,7 +52,7 @@ jobs:
                  fi
              env:
                  TEAM: "design"
-            - uses: octokit/graphql-action@v2.x
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: add_to_project
              if: steps.any_matching_reviewers.outputs.match == 'true'
              with:
@@ -76,7 +76,7 @@ jobs:
        name: Move PRs asking for design review to the design board
        runs-on: ubuntu-24.04
        steps:
-            - uses: octokit/graphql-action@v2.x
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: find_team_members
              with:
                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
@@ -119,7 +119,7 @@ jobs:
                  fi
              env:
                  TEAM: "product"
-            - uses: octokit/graphql-action@v2.x
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: add_to_project
              if: steps.any_matching_reviewers.outputs.match == 'true'
              with:
@@ -12,15 +12,17 @@ jobs:
            issues: write
            pull-requests: write
        steps:
-            - uses: actions/stale@v9
+            - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
              with:
                  operations-per-run: 100
+
                  # Flaky test issue closing
-                  only-issue-labels: "Z-Flaky-Test"
+                  any-of-issue-labels: "Z-Flaky-Test-Chrome,Z-Flaky-Test-Firefox,Z-Flaky-Test-Webkit"
                  days-before-issue-stale: 14
                  days-before-issue-close: 0
                  close-issue-message: "This flaky test issue has not been updated in 14 days. It is being closed as presumed resolved."
                  exempt-issue-labels: "Z-Flaky-Test-Disabled"
+
                  # Stale PR closing
                  days-before-pr-stale: 180
                  days-before-pr-close: 0
@@ -5,44 +5,25 @@ on:
        types: [unlabeled]
 permissions: {}
 jobs:
-    Move_Unabeled_Issue_On_Project_Board:
+    move_no_longer_needs_info_issues:
        name: Move no longer X-Needs-Info issues to Triaged
        runs-on: ubuntu-24.04
-        permissions:
-            repository-projects: read
        if: >
-            ${{
-            !contains(github.event.issue.labels.*.name, 'X-Needs-Info') }}
-        env:
-            BOARD_NAME: "Issue triage"
-            OWNER: ${{ github.repository_owner }}
-            REPO: ${{ github.event.repository.name }}
-            ISSUE: ${{ github.event.issue.number }}
+            !contains(github.event.issue.labels.*.name, 'X-Needs-Info')
        steps:
-            - name: Check if issue is already in "${{ env.BOARD_NAME }}"
-              run: |
-                  json=$(curl -s -H 'Content-Type: application/json' -H "Authorization: bearer ${{ secrets.GITHUB_TOKEN }}" -X POST -d '{"query": "query($issue: Int!, $owner: String!, $repo: String!) { repository(owner: $owner, name: $repo) { issue(number: $issue) { projectCards { nodes { project { name } isArchived } } } } } ", "variables" : "{ \"issue\": '${ISSUE}', \"owner\": \"'${OWNER}'\", \"repo\": \"'${REPO}'\" }" }' https://api.github.com/graphql)
-                  if echo $json | jq '.data.repository.issue.projectCards.nodes | length'; then
-                    if [[ $(echo $json | jq '.data.repository.issue.projectCards.nodes[0].project.name') =~ "${BOARD_NAME}" ]]; then
-                      if [[ $(echo $json | jq '.data.repository.issue.projectCards.nodes[0].isArchived') == 'true' ]]; then
-                        echo "Issue is already in Project '$BOARD_NAME', but is archived - skipping workflow";
-                        echo "SKIP_ACTION=true" >> $GITHUB_ENV
-                      else
-                        echo "Issue is already in Project '$BOARD_NAME', proceeding";
-                        echo "ALREADY_IN_BOARD=true" >> $GITHUB_ENV
-                      fi
-                    else
-                      echo "Issue is not in project '$BOARD_NAME', cancelling this workflow"
-                      echo "ALREADY_IN_BOARD=false" >> $GITHUB_ENV
-                    fi
-                  fi
-            - name: Move issue
-              uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36
-              if: ${{ env.ALREADY_IN_BOARD == 'true' && env.SKIP_ACTION != 'true' }}
+            - id: set_fields
+              uses: nipe0324/update-project-v2-item-field@c4af58452d1c5a788c1ea4f20e073fa722ec4a6b #v2.0.2
              with:
-                  project: Issue triage
-                  column: Triaged
-                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  project-url: ${{ env.PROJECT_URL }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  skip-update-script: |
+                      const isIssue = item.type === 'ISSUE'
+                      const status = item.fieldValues['Status']
+                      return !isIssue || status !== 'Needs info'
+                  field-name: Status
+                  field-value: "Triaged"
+        env:
+            PROJECT_URL: https://github.com/orgs/element-hq/projects/120

    remove_Z-Labs_label:
        name: Remove Z-Labs label when features behind labs flags are removed
@@ -62,7 +43,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'A-Element-Call')) &&
            contains(github.event.issue.labels.*.name, 'Z-Labs')
        steps:
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              with:
                  script: |
                      github.rest.issues.removeLabel({
@@ -9,21 +9,25 @@ jobs:
    update:
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
+              run: "pnpm install --frozen-lockfile"

            - name: Fetch Jitsi
-              run: "yarn update:jitsi"
+              working-directory: apps/web
+              run: "pnpm vendor:jitsi"

            - name: Create Pull Request
-              uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
+              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  branch: actions/jitsi-update
@@ -22,17 +22,17 @@ jobs:
        runs-on: ubuntu-24.04
        environment: Matrix
        steps:
-            - uses: actions/github-script@v7
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              env:
                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
                  LOBBY_ROOM_ID: ${{ secrets.ROOM_ID }}
-                  PUBLIC_ROOM_ID: "!YTvKGNlinIzlkMTVRl:matrix.org"
-                  ANNOUNCEMENT_ROOM_ID: "!bijaLdadorKgNGtHdA:matrix.org"
+                  PUBLIC_DISCUSSION_ROOM_ID: "!xUW4PpAe1CmThA3r2wI8IrgwwsK006-zqWdJCljpd10"
+                  ANNOUNCEMENT_ROOM_ID: "!ars5ndgI6IIYZXECiJ-u8YljHNzShJn3nHdB-3rYI2M"
                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
                  RELEASE_STATUS: "Release status: ${{ inputs.expected_status }} expected ${{ inputs.expected_date }}"
              with:
                  script: |
-                      const { HS_URL, TOKEN, RELEASE_STATUS, LOBBY_ROOM_ID, PUBLIC_ROOM_ID, ANNOUNCEMENT_ROOM_ID } = process.env;
+                      const { HS_URL, TOKEN, RELEASE_STATUS, LOBBY_ROOM_ID, PUBLIC_DISCUSSION_ROOM_ID, ANNOUNCEMENT_ROOM_ID } = process.env;

                      const repo = context.repo;
                      const { data } = await github.rest.repos.getLatestRelease({
@@ -71,13 +71,23 @@ jobs:
                          const data = await res.json();
                          console.log(roomId, "got event", data);

+                          if (!regex.test(data.topic)) {
+                              core.setFailed("Topic format is incorrect for room " + roomId);
+                              return;
+                          }
+
                          const topic = data.topic.replace(regex, releaseTopic);
                          if (topic === data.topic) {
                              console.log(roomId, "nothing to do");
                              return;
                          }
                          if (data["org.matrix.msc3765.topic"]) {
-                              data["org.matrix.msc3765.topic"].forEach(d => {
+                              data["org.matrix.msc3765.topic"]?.["m.text"].forEach(d => {
+                                  d.body = d.body.replace(regex, releaseTopic);
+                              });
+                          }
+                          if (data["m.topic"]) {
+                              data["m.topic"]?.["m.text"].forEach(d => {
                                  d.body = d.body.replace(regex, releaseTopic);
                              });
                          }
@@ -92,12 +102,18 @@ jobs:
                          });

                          if (res.ok) {
-                              console.log(roomId, "topic updated:", topic);
+                              const resJson = res.json();
+                              if (resJson.errcode) {
+                                  core.setFailed(`Error updating ${roomId}: ${resJson.error}`);
+                              } else {
+                                  console.log(roomId, "topic updated:", topic);
+                              }
                          } else {
-                              console.log(roomId, await res.text());
+                              const errText = await res.text();
+                              core.setFailed(`Error updating ${roomId}: ${errText}`);
                          }
                      }

                      await updateReleaseInTopic(LOBBY_ROOM_ID);
-                      await updateReleaseInTopic(PUBLIC_ROOM_ID);
+                      await updateReleaseInTopic(PUBLIC_DISCUSSION_ROOM_ID);
                      await updateReleaseInTopic(ANNOUNCEMENT_ROOM_ID);
@@ -3,32 +3,38 @@
 /dist
 /key.pem
 /lib
-/node_modules
-/packages/
-/webapp
+node_modules
 /.npmrc
 /*.log
 package-lock.json
 .DS_Store
-electron/dist
-electron/pub
 **/.idea
-/config.json
-/config.json.*
-/config.local*.json
-# Legacy skinning file that some people might still have
-/src/component-index.js
-/.tmp
 /webpack-stats.json
+/.tmp
 .vscode
 .vscode/
 .env
-/coverage
-# Auto-generated file
-/src/modules.ts
-/src/modules.js
-/build_config.yaml
+.env.*
+coverage
 /book
 /index.html
 # version file and tarball created by `npm pack` / `yarn pack`
 /git-revision.txt
+jest-sonar.xml
+
+*storybook.log
+storybook-static
+
+/packages/shared-components/node_modules
+/packages/shared-components/dist
+/packages/shared-components/src/i18nKeys.d.ts
+
+# TSC incremental compilation information
+*.tsbuildinfo
+
+/.link-config
+
+.nx/cache
+.nx/workspace-data
+
+.pnpm-store
@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname "$0")/_/husky.sh"
-
 npx lint-staged --concurrent false
@@ -1,7 +1,3 @@
 {
-    "*": "prettier --write",
-    "src/**/*.(ts|tsx)": ["eslint --fix"],
-    "scripts/**/*.(ts|tsx)": ["eslint --fix"],
-    "module_system/**/*.(ts|tsx)": ["eslint --fix"],
-    "*.pcss": ["stylelint --fix"]
+    "*": "prettier --write --ignore-unknown"
 }
@@ -1 +1 @@
-22
+24
@@ -1,31 +1,30 @@
 /build
 /dist
 /lib
-/node_modules
-/packages/
-/webapp
+node_modules
+/apps/web/webapp
 /*.log
-yarn.lock
+pnpm-lock.yaml
 electron/dist
 electron/pub
 **/.idea
 /.tmp
-/webpack-stats.json
+webpack-stats.json
 .vscode
 .vscode/
 .env
-/coverage
+coverage
 # Auto-generated file
-/src/modules.ts
-/src/modules.js
-/src/i18n/strings
-/build_config.yaml
+/apps/web/src/modules.ts
+/apps/web/src/modules.js
+src/i18n/strings
+/apps/web//build_config.yaml
 # Raises an error because it contains a template var breaking the script tag
-src/vector/index.html
-src/vector/modernizr.js
+/apps/web/src/vector/index.html
+/apps/web/src/vector/modernizr.cjs
 /docs/lib
 /book
-/debian/tmp
+debian/tmp
 /.npmrc
 package-lock.json

@@ -34,14 +33,22 @@ package-lock.json
 /docs/changelogs

 # Legacy skinning file that some people might still have
-/src/component-index.js
+/apps/web/src/component-index.js

 # Downloaded and already minified
-res/jitsi_external_api.min.js
+/apps/web/res/jitsi_external_api.min.js

 # This file is also machine-generated
-/playwright/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
-/playwright/test-results/
-/playwright/html-report/
-/playwright/logs/
-/playwright/snapshots/
+/apps/web/playwright/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
+/apps/web/playwright/test-results/
+/apps/web/playwright/html-report/
+/apps/web/playwright/logs/
+/apps/web/playwright/snapshots/
+
+# Shared components generated files
+/packages/shared-components/dist/
+/packages/shared-components/src/i18n/i18nKeys.d.ts
+/packages/shared-components/typedoc/
+/packages/shared-components/storybook-static/
+
+/.nx/
@@ -1 +0,0 @@
-module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");
@@ -1,74 +0,0 @@
-module.exports = {
-    extends: ["stylelint-config-standard"],
-    customSyntax: "postcss-scss",
-    plugins: ["stylelint-scss", "stylelint-value-no-unknown-custom-properties"],
-    rules: {
-        "comment-empty-line-before": null,
-        "declaration-empty-line-before": null,
-        "length-zero-no-unit": null,
-        "rule-empty-line-before": null,
-        "color-hex-length": null,
-        "at-rule-no-unknown": null,
-        "no-descending-specificity": null,
-        "scss/at-rule-no-unknown": [
-            true,
-            {
-                // https://github.com/vector-im/element-web/issues/10544
-                ignoreAtRules: ["define-mixin"],
-            },
-        ],
-        // Disable `&_kind`-style selectors while our unused CSS approach is "Find & Replace All"
-        // rather than a CI thing. Shorthand selectors are harder to detect when searching for a
-        // class name. This regex is trying to *allow* anything except `&words`, such as `&::before`,
-        // `&.mx_Class`, etc.
-        "selector-nested-pattern": "^((&[ :.\\[,])|([^&]))",
-        // Disable some defaults
-        "selector-class-pattern": null,
-        "custom-property-pattern": null,
-        "selector-id-pattern": null,
-        "keyframes-name-pattern": null,
-        "alpha-value-notation": null,
-        "color-function-notation": null,
-        "selector-not-notation": null,
-        "import-notation": null,
-        "value-keyword-case": null,
-        "declaration-block-no-redundant-longhand-properties": null,
-        "shorthand-property-no-redundant-values": null,
-        "property-no-vendor-prefix": null,
-        "selector-no-vendor-prefix": null,
-        "media-feature-name-no-vendor-prefix": null,
-        "number-max-precision": null,
-        "no-invalid-double-slash-comments": true,
-        "media-feature-range-notation": null,
-        "declaration-property-value-no-unknown": null,
-        "declaration-property-value-keyword-no-deprecated": null,
-        "csstools/value-no-unknown-custom-properties": [
-            true,
-            {
-                importFrom: [
-                    { from: "res/css/_common.pcss", type: "css" },
-                    { from: "res/themes/light/css/_light.pcss", type: "css" },
-                    // Right now our styles share vars all over the place, this is not ideal but acceptable for now
-                    { from: "res/css/views/rooms/_EventTile.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_IRCLayout.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_EventBubbleTile.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_ReadReceiptGroup.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_EditMessageComposer.pcss", type: "css" },
-                    { from: "res/css/views/right_panel/_BaseCard.pcss", type: "css" },
-                    { from: "res/css/views/messages/_MessageTimestamp.pcss", type: "css" },
-                    { from: "res/css/views/messages/_EventTileBubble.pcss", type: "css" },
-                    { from: "res/css/views/messages/_MessageActionBar.pcss", type: "css" },
-                    { from: "res/css/views/voip/LegacyCallView/_LegacyCallViewButtons.pcss", type: "css" },
-                    { from: "res/css/views/elements/_ToggleSwitch.pcss", type: "css" },
-                    { from: "res/css/views/settings/tabs/_SettingsTab.pcss", type: "css" },
-                    { from: "res/css/structures/_RoomView.pcss", type: "css" },
-                    // Compound vars
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-base.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-semantic.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-base-mq.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-semantic-mq.css",
-                ],
-            },
-        ],
-    },
-};
@@ -19,3 +19,6 @@ include:

 * Thom Cleary (https://github.com/thomcatdotrocks)
  Small update for tarball deployment
+
+* Alexander (https://github.com/ioalexander)
+  Save image on CTRL + S shortcut
@@ -1,3 +1,731 @@
+Changes in [1.12.13](https://github.com/element-hq/element-web/releases/tag/v1.12.13) (2026-03-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove automatic rageshakes on UTD labs feature ([#32778](https://github.com/element-hq/element-web/pull/32778)). Contributed by @Half-Shot.
+* Remove automaticErrorReporting labs feature ([#32781](https://github.com/element-hq/element-web/pull/32781)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Upgrade Element Call for new picture-in-picture designs ([#32816](https://github.com/element-hq/element-web/pull/32816)). Contributed by @robintown.
+* Room list: add sections to shared components ([#32735](https://github.com/element-hq/element-web/pull/32735)). Contributed by @florianduros.
+* feat: Devtool for sticky events MSC4354 ([#32741](https://github.com/element-hq/element-web/pull/32741)). Contributed by @BillCarsonFr.
+* Port URL Preview components to MVVM ([#32525](https://github.com/element-hq/element-web/pull/32525)). Contributed by @Half-Shot.
+* Add support for Widget \& Room Header Buttons module APIs ([#32734](https://github.com/element-hq/element-web/pull/32734)). Contributed by @dbkr.
+* Port over linkifyJS to shared-components. ([#32731](https://github.com/element-hq/element-web/pull/32731)). Contributed by @Half-Shot.
+* Redesign widget pip and move into shared component ([#32654](https://github.com/element-hq/element-web/pull/32654)). Contributed by @toger5.
+* Implement customisations \& login component Module API 1.11.0 ([#32687](https://github.com/element-hq/element-web/pull/32687)). Contributed by @t3chguy.
+* Realign MessageActionBar to Figma designs ([#32722](https://github.com/element-hq/element-web/pull/32722)). Contributed by @t3chguy.
+* Implement new widget permissions module api ([#32565](https://github.com/element-hq/element-web/pull/32565)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix soft crash of room list when trying to open a room ([#32872](https://github.com/element-hq/element-web/pull/32872)). Contributed by @RiotRobot.
+* Fix "key storage out of sync" appearing when key storage is actually fine ([#32811](https://github.com/element-hq/element-web/pull/32811)). Contributed by @andybalaam.
+* Fix remove button styling in local address list of room settings ([#32798](https://github.com/element-hq/element-web/pull/32798)). Contributed by @florianduros.
+* Always check \& update the users timezone on their profile on startup ([#32764](https://github.com/element-hq/element-web/pull/32764)). Contributed by @Half-Shot.
+* Fix nx configuration to actually run type linter ([#32776](https://github.com/element-hq/element-web/pull/32776)). Contributed by @richvdh.
+* Fix expand space panel button not being shown on keyboard focus ([#32746](https://github.com/element-hq/element-web/pull/32746)). Contributed by @t3chguy.
+* Reset key storage if restoring from Recovery encounters the wrong decryption key ([#32668](https://github.com/element-hq/element-web/pull/32668)). Contributed by @andybalaam.
+
+
+Changes in [1.12.12](https://github.com/element-hq/element-web/releases/tag/v1.12.12) (2026-03-10)
+==================================================================================================
+## ✨ Features
+
+* Add stable support for MSC4380 invite blocking ([#31966](https://github.com/element-hq/element-web/pull/31966)). Contributed by @richvdh.
+* Hide the names of banned users behind a spoiler tag ([#32424](https://github.com/element-hq/element-web/pull/32424)). Contributed by @andybalaam.
+* Room list: remove bold effect on selected room ([#32593](https://github.com/element-hq/element-web/pull/32593)). Contributed by @florianduros.
+* Use Compound buttons in auth screens ([#32562](https://github.com/element-hq/element-web/pull/32562)). Contributed by @t3chguy.
+* Track room list sorting algorithm changes ([#32556](https://github.com/element-hq/element-web/pull/32556)). Contributed by @MidhunSureshR.
+* Update `sso_redirect_options` to work for Native OIDC ([#32537](https://github.com/element-hq/element-web/pull/32537)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Room list: avoid excessive re-renders on room list store update or filter change ([#32663](https://github.com/element-hq/element-web/pull/32663)). Contributed by @florianduros.
+* Room list: listen to call event to check number of participants ([#32677](https://github.com/element-hq/element-web/pull/32677)). Contributed by @florianduros.
+* Fix invite-specific join errors not being shown ([#32621](https://github.com/element-hq/element-web/pull/32621)). Contributed by @Half-Shot.
+* Prevent logging lots of "Browser unsupported" lines ([#32647](https://github.com/element-hq/element-web/pull/32647)). Contributed by @Half-Shot.
+* Update critical gradient for room status bar ([#32575](https://github.com/element-hq/element-web/pull/32575)). Contributed by @Half-Shot.
+* Room list: avoid header overflowing when too long ([#32645](https://github.com/element-hq/element-web/pull/32645)). Contributed by @florianduros.
+* Room list: center focus outline of room list item ([#32637](https://github.com/element-hq/element-web/pull/32637)). Contributed by @florianduros.
+* Fix misaligned cross in complete security dialog ([#32614](https://github.com/element-hq/element-web/pull/32614)). Contributed by @dbkr.
+* Room list: fix keyboard navigation ([#32585](https://github.com/element-hq/element-web/pull/32585)). Contributed by @florianduros.
+* Don't show empty privacy section ([#32582](https://github.com/element-hq/element-web/pull/32582)). Contributed by @dbkr.
+* Disable room list image dragging ([#32590](https://github.com/element-hq/element-web/pull/32590)). Contributed by @florianduros.
+* Update UserMenu theme toggle to use IconButton ([#32591](https://github.com/element-hq/element-web/pull/32591)). Contributed by @t3chguy.
+* Room list: make room list item scales with large font size ([#32523](https://github.com/element-hq/element-web/pull/32523)). Contributed by @florianduros.
+
+
+Changes in [1.12.11](https://github.com/element-hq/element-web/releases/tag/v1.12.11) (2026-02-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove UIFeature.BulkUnverifiedSessionsReminder setting ([#31943](https://github.com/element-hq/element-web/pull/31943)). Contributed by @andybalaam.
+* Remove unused function to auto-rageshake when key backup is not set up ([#31942](https://github.com/element-hq/element-web/pull/31942)). Contributed by @andybalaam.
+
+## ✨ Features
+
+* Room list: update the visuals in order to have better contrast ([#32421](https://github.com/element-hq/element-web/pull/32421)). Contributed by @florianduros.
+*  Set history visibility to "invited" for DMs and new non-public rooms when creating a room ([#31974](https://github.com/element-hq/element-web/pull/31974)). Contributed by @langleyd.
+* Remove server acl status/summaries from timeline  ([#32461](https://github.com/element-hq/element-web/pull/32461)). Contributed by @langleyd.
+* Update `globalBlacklistUnverifiedDevices` on setting change ([#31983](https://github.com/element-hq/element-web/pull/31983)). Contributed by @kaylendog.
+* Add badge for history visibiltity to room info panel ([#31927](https://github.com/element-hq/element-web/pull/31927)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* Default useOnlyCurrentProfiles to true ([#32524](https://github.com/element-hq/element-web/pull/32524)). Contributed by @dbkr.
+* Keep custom theme active after reload ([#32506](https://github.com/element-hq/element-web/pull/32506)). Contributed by @florianduros.
+* Update font format from 'ttf' to 'truetype' ([#32493](https://github.com/element-hq/element-web/pull/32493)). Contributed by @all-yall.
+* Fix videos on Firefox ([#32497](https://github.com/element-hq/element-web/pull/32497)). Contributed by @p1gp1g.
+* Use a dedicated FAQ/help entry for key storage. ([#32480](https://github.com/element-hq/element-web/pull/32480)). Contributed by @mxandreas.
+* Avoid showing two chat timelines side by side after a call ([#32484](https://github.com/element-hq/element-web/pull/32484)). Contributed by @robintown.
+* Update screenshot for reactive display name disambiguation ([#32431](https://github.com/element-hq/element-web/pull/32431)). Contributed by @aditya-cherukuru.
+* Fix Status Bar being unreadable when the user overrides the default OS light/dark theme. ([#32442](https://github.com/element-hq/element-web/pull/32442)). Contributed by @Half-Shot.
+* fix: Remove state\_key: null from Seshat search results ([#31524](https://github.com/element-hq/element-web/pull/31524)). Contributed by @shinaoka.
+* Fix user pill deserialisation ([#31947](https://github.com/element-hq/element-web/pull/31947)). Contributed by @t3chguy.
+
+
+Changes in [1.12.10](https://github.com/element-hq/element-web/releases/tag/v1.12.10) (2026-02-10)
+==================================================================================================
+## ✨ Features
+
+* Support additional\_creators in /upgraderoom (MSC4289) ([#31934](https://github.com/element-hq/element-web/pull/31934)). Contributed by @andybalaam.
+* Update room header icon for world\_readable rooms ([#31915](https://github.com/element-hq/element-web/pull/31915)). Contributed by @richvdh.
+* Show an icon in the room header for shared history ([#31879](https://github.com/element-hq/element-web/pull/31879)). Contributed by @richvdh.
+* Remove "history may be shared" banner. ([#31881](https://github.com/element-hq/element-web/pull/31881)). Contributed by @kaylendog.
+* Allow dismissing 'Key storage out of sync' temporarily ([#31455](https://github.com/element-hq/element-web/pull/31455)). Contributed by @andybalaam.
+* Add `resolutions` entry for `matrix-widget-api` to package.json ([#31851](https://github.com/element-hq/element-web/pull/31851)). Contributed by @toger5.
+* Improve visibility under contrast control mode ([#31847](https://github.com/element-hq/element-web/pull/31847)). Contributed by @t3chguy.
+* Unread Sorting - Add option for sorting in `OptionsMenuView` ([#31754](https://github.com/element-hq/element-web/pull/31754)). Contributed by @MidhunSureshR.
+* Unread sorting - Implement sorter and use it in the room list store ([#31723](https://github.com/element-hq/element-web/pull/31723)). Contributed by @MidhunSureshR.
+* Allow Element Call widgets to receive sticky events ([#31843](https://github.com/element-hq/element-web/pull/31843)). Contributed by @robintown.
+* Improve icon rendering accessibility ([#31791](https://github.com/element-hq/element-web/pull/31791)). Contributed by @t3chguy.
+* Add message preview toggle to room list header option ([#31821](https://github.com/element-hq/element-web/pull/31821)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix room list not being cleared ([#32438](https://github.com/element-hq/element-web/pull/32438)). Contributed by @RiotRobot.
+* Fix failure to update room info panel on joinrule change ([#31938](https://github.com/element-hq/element-web/pull/31938)). Contributed by @richvdh.
+* Throttle space notification state calculation ([#31922](https://github.com/element-hq/element-web/pull/31922)). Contributed by @dbkr.
+* Fix emoji verification responsive layout ([#31899](https://github.com/element-hq/element-web/pull/31899)). Contributed by @t3chguy.
+* Add patch for linkify to fix doctype handling ([#31900](https://github.com/element-hq/element-web/pull/31900)). Contributed by @dbkr.
+* Fix rooms with no messages appearing at the top of the room list ([#31798](https://github.com/element-hq/element-web/pull/31798)). Contributed by @MidhunSureshR.
+* Fix room list menu flashes when menu is closed ([#31868](https://github.com/element-hq/element-web/pull/31868)). Contributed by @florianduros.
+* Message preview toggle is inverted in room list header ([#31865](https://github.com/element-hq/element-web/pull/31865)). Contributed by @florianduros.
+* Fix duplicate toasts appearing for the same call if two events appear. ([#31693](https://github.com/element-hq/element-web/pull/31693)). Contributed by @Half-Shot.
+* Fix ability to send rageshake during session restore failure ([#31848](https://github.com/element-hq/element-web/pull/31848)). Contributed by @t3chguy.
+* Fix mis-alignment of `Threads` right panel title ([#31849](https://github.com/element-hq/element-web/pull/31849)). Contributed by @t3chguy.
+* Unset buttons does not include color inherit ([#31801](https://github.com/element-hq/element-web/pull/31801)). Contributed by @Philldomd.
+
+
+Changes in [1.12.9](https://github.com/element-hq/element-web/releases/tag/v1.12.9) (2026-01-27)
+================================================================================================
+## ✨ Features
+
+* Allow local log downloads when a rageshake URL is not configured. ([#31716](https://github.com/element-hq/element-web/pull/31716)). Contributed by @Half-Shot.
+* Improve icon rendering accessibility ([#31776](https://github.com/element-hq/element-web/pull/31776)). Contributed by @t3chguy.
+* Show "Bob shared this message" on messages shared via MSC4268 ([#31684](https://github.com/element-hq/element-web/pull/31684)). Contributed by @richvdh.
+* Update the way we render icons for accessibility ([#31731](https://github.com/element-hq/element-web/pull/31731)). Contributed by @t3chguy.
+* Switch from css masks to rendering svg ([#31681](https://github.com/element-hq/element-web/pull/31681)). Contributed by @t3chguy.
+* Support for stable MSC4191 account management action parameter ([#31701](https://github.com/element-hq/element-web/pull/31701)). Contributed by @hughns.
+* Support for stable m.oauth UIA stage from MSC4312 ([#31704](https://github.com/element-hq/element-web/pull/31704)). Contributed by @hughns.
+* Switch to Compound icons to replace old icons ([#31667](https://github.com/element-hq/element-web/pull/31667)). Contributed by @t3chguy.
+* Switch from svg masks to svg rendering in more places ([#31652](https://github.com/element-hq/element-web/pull/31652)). Contributed by @t3chguy.
+* Switch from svg masks to svg rendering in more places ([#31650](https://github.com/element-hq/element-web/pull/31650)). Contributed by @t3chguy.
+* Update notification icons using Compound icons ([#31671](https://github.com/element-hq/element-web/pull/31671)). Contributed by @t3chguy.
+* Memoise ListView context  ([#31668](https://github.com/element-hq/element-web/pull/31668)). Contributed by @t3chguy.
+* Switch emoji picker to use emoji for header icons ([#31645](https://github.com/element-hq/element-web/pull/31645)). Contributed by @t3chguy.
+* Replace icons with Compound alternatives ([#31642](https://github.com/element-hq/element-web/pull/31642)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Fix avatar decorations in thread activity centre not being atop avatar ([#31789](https://github.com/element-hq/element-web/pull/31789)). Contributed by @t3chguy.
+* Fix room settings roles tab getting confused if power level change fails ([#31768](https://github.com/element-hq/element-web/pull/31768)). Contributed by @t3chguy.
+* Custom themes now import highlights in css ([#31758](https://github.com/element-hq/element-web/pull/31758)). Contributed by @Philldomd.
+* Use correct translation for url preview settings ([#31740](https://github.com/element-hq/element-web/pull/31740)). Contributed by @florianduros.
+* Fix error shown if accepting a 3pid invite ([#31735](https://github.com/element-hq/element-web/pull/31735)). Contributed by @dbkr.
+* Ensure correct focus configuration for Element Call before allowing users to call. ([#31490](https://github.com/element-hq/element-web/pull/31490)). Contributed by @Half-Shot.
+* Fix emoji font in emoji picker header buttons ([#31679](https://github.com/element-hq/element-web/pull/31679)). Contributed by @t3chguy.
+* fix flaky test by waiting for chat panel before counting messages ([#31633](https://github.com/element-hq/element-web/pull/31633)). Contributed by @BillCarsonFr.
+
+
+Changes in [1.12.8](https://github.com/element-hq/element-web/releases/tag/v1.12.8) (2026-01-13)
+================================================================================================
+## 🦖 Deprecations
+
+* Remove `element_call.participant_limit` config and associated code. ([#31638](https://github.com/element-hq/element-web/pull/31638)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Switch to rendering svg icons rather than masking them ([#31557](https://github.com/element-hq/element-web/pull/31557)). Contributed by @t3chguy.
+* Update history visibility UX ([#31635](https://github.com/element-hq/element-web/pull/31635)). Contributed by @langleyd.
+* Show correct call icon for joining a call. ([#31489](https://github.com/element-hq/element-web/pull/31489)). Contributed by @Half-Shot.
+* Update StopGapWidgetDriver to support sticky events ([#31205](https://github.com/element-hq/element-web/pull/31205)). Contributed by @Half-Shot.
+* Remove release announcements for new sounds \& room list ([#31544](https://github.com/element-hq/element-web/pull/31544)). Contributed by @t3chguy.
+* Add button to restore from backup into /devtools ([#31581](https://github.com/element-hq/element-web/pull/31581)). Contributed by @mxandreas.
+* Switch to non-solid compound icons for room settings \& composer ([#31561](https://github.com/element-hq/element-web/pull/31561)). Contributed by @t3chguy.
+* Support encrypted state events MSC4362 ([#31513](https://github.com/element-hq/element-web/pull/31513)). Contributed by @andybalaam.
+* Update prop type \& documentation for HistoryVisibleBanner and VM. ([#31545](https://github.com/element-hq/element-web/pull/31545)). Contributed by @kaylendog.
+* Switch to Compound icons in more places ([#31560](https://github.com/element-hq/element-web/pull/31560)). Contributed by @t3chguy.
+* Switch to rendering svg icons rather than masking them ([#31550](https://github.com/element-hq/element-web/pull/31550)). Contributed by @t3chguy.
+* Make AccessibleButton contrast control compatible ([#31308](https://github.com/element-hq/element-web/pull/31308)). Contributed by @t3chguy.
+* Switch to compound-design-tokens for platform icons ([#31543](https://github.com/element-hq/element-web/pull/31543)). Contributed by @t3chguy.
+* Switch to rendering svg icons rather than masking them ([#31531](https://github.com/element-hq/element-web/pull/31531)). Contributed by @t3chguy.
+* Switch to rendering svg icons rather than css masking ([#31517](https://github.com/element-hq/element-web/pull/31517)). Contributed by @t3chguy.
+* Auto approve matrix rtc member event (`m.rtc.member`) (sticky events) ([#31452](https://github.com/element-hq/element-web/pull/31452)). Contributed by @toger5.
+* Size Autocomplete relative to the RoomView height rather than the viewport height ([#31425](https://github.com/element-hq/element-web/pull/31425)). Contributed by @langleyd.
+* Implement UI for history visibility acknowledgement. ([#31156](https://github.com/element-hq/element-web/pull/31156)). Contributed by @kaylendog.
+* Export disposing hook from package ([#31498](https://github.com/element-hq/element-web/pull/31498)). Contributed by @MidhunSureshR.
+* Change `header-panel-bg-hover` to use `var(--cpd-color-bg-action-secondary-hovered)` for better custom theming ([#31457](https://github.com/element-hq/element-web/pull/31457)). Contributed by @th0mcat.
+* Improve icon rendering in iconized context menu ([#31458](https://github.com/element-hq/element-web/pull/31458)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix space settings visibility tab crashing ([#31705](https://github.com/element-hq/element-web/pull/31705)). Contributed by @RiotRobot.
+* Fix expand/collapse reply preview not showing in some cases ([#31639](https://github.com/element-hq/element-web/pull/31639)). Contributed by @t3chguy.
+* Fix bundled font or custom font not applied after theme switch ([#31591](https://github.com/element-hq/element-web/pull/31591)). Contributed by @florianduros.
+* Add ol override CSS for markdown-body ([#31618](https://github.com/element-hq/element-web/pull/31618)). Contributed by @niamu.
+* Fix reaction left margin in timeline card ([#31625](https://github.com/element-hq/element-web/pull/31625)). Contributed by @t3chguy.
+* Open right panel timeline when jumping to event with maximised widget ([#31626](https://github.com/element-hq/element-web/pull/31626)). Contributed by @t3chguy.
+* Fix Compound Link elements not having an underline. ([#31583](https://github.com/element-hq/element-web/pull/31583)). Contributed by @Half-Shot.
+* Recalculate mentions metadata of forwarded messages based on message body ([#31193](https://github.com/element-hq/element-web/pull/31193)). Contributed by @twassman.
+* Fix Room Preview Card Layout ([#31611](https://github.com/element-hq/element-web/pull/31611)). Contributed by @germain-gg.
+* Fix: WidgetMessaging not properly closed causing side effects and bugs ([#31598](https://github.com/element-hq/element-web/pull/31598)). Contributed by @BillCarsonFr.
+* Handle cross-signing keys missing locally and/or from secret storage ([#31367](https://github.com/element-hq/element-web/pull/31367)). Contributed by @uhoreg.
+* fix: Allow wrapping in `Banner` component. ([#31532](https://github.com/element-hq/element-web/pull/31532)). Contributed by @kaylendog.
+* Update algorithm for history visible banner. ([#31577](https://github.com/element-hq/element-web/pull/31577)). Contributed by @kaylendog.
+* Fix styling issue when using EW modules ([#31533](https://github.com/element-hq/element-web/pull/31533)). Contributed by @florianduros.
+* Prevent history visible banner from displaying in threads. ([#31535](https://github.com/element-hq/element-web/pull/31535)). Contributed by @kaylendog.
+* Make the feedback icon be the right color in dark theme ([#31527](https://github.com/element-hq/element-web/pull/31527)). Contributed by @robintown.
+
+
+Changes in [1.12.7](https://github.com/element-hq/element-web/releases/tag/v1.12.7) (2025-12-16)
+================================================================================================
+## ✨ Features
+
+* Replace legacy icons with compound ([#31424](https://github.com/element-hq/element-web/pull/31424)). Contributed by @t3chguy.
+* Update polls UX to match EX Mobile and improve accessibility ([#31245](https://github.com/element-hq/element-web/pull/31245)). Contributed by @langleyd.
+* Add option to enable read receipt and marker when user interact with UI ([#31353](https://github.com/element-hq/element-web/pull/31353)). Contributed by @florianduros.
+* Introduce a hook to auto dispose view models ([#31178](https://github.com/element-hq/element-web/pull/31178)). Contributed by @MidhunSureshR.
+* Update settings toggles to use consistent design across app. ([#30169](https://github.com/element-hq/element-web/pull/30169)). Contributed by @Half-Shot.
+* Add ability to the room view to hide widgets ([#31400](https://github.com/element-hq/element-web/pull/31400)). Contributed by @langleyd.
+* call: Pass the echo cancellation and noise suppression settings to EC ([#31317](https://github.com/element-hq/element-web/pull/31317)). Contributed by @BillCarsonFr.
+* Tweak rendering of icons for a11y ([#31358](https://github.com/element-hq/element-web/pull/31358)). Contributed by @t3chguy.
+* Implement new `renderNotificationDecoration` from module API  ([#31389](https://github.com/element-hq/element-web/pull/31389)). Contributed by @MidhunSureshR.
+* Replace more icons with compound ([#31381](https://github.com/element-hq/element-web/pull/31381)). Contributed by @t3chguy.
+* Replace more icons with compound ([#31378](https://github.com/element-hq/element-web/pull/31378)). Contributed by @t3chguy.
+* `<Banner/>`: Hide `Dismiss` button if `onClose` handler is not provided. ([#31362](https://github.com/element-hq/element-web/pull/31362)). Contributed by @kaylendog.
+* Replace batch of legacy icons with compound design tokens ([#31360](https://github.com/element-hq/element-web/pull/31360)). Contributed by @t3chguy.
+* MSC4380: Invite blocking ([#31268](https://github.com/element-hq/element-web/pull/31268)). Contributed by @richvdh.
+* Tweak rendering of icons for accessibility ([#31346](https://github.com/element-hq/element-web/pull/31346)). Contributed by @t3chguy.
+* Implement a shared `Banner` component. ([#31266](https://github.com/element-hq/element-web/pull/31266)). Contributed by @kaylendog.
+* Allow the Login screen to use the dark theme ([#31293](https://github.com/element-hq/element-web/pull/31293)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Amend e2e normal icon from lock-solid to info ([#31559](https://github.com/element-hq/element-web/pull/31559)). Contributed by @t3chguy.
+* [Backport staging] Fix CSS specificity causing icon issues in e2e verification ([#31548](https://github.com/element-hq/element-web/pull/31548)). Contributed by @RiotRobot.
+* [Backport staging] Fix e2e icons in CompleteSecurity \& SetupEncryptionBody ([#31522](https://github.com/element-hq/element-web/pull/31522)). Contributed by @RiotRobot.
+* [Backport staging] Remove an extra paragraph in advanced room settings ([#31511](https://github.com/element-hq/element-web/pull/31511)). Contributed by @RiotRobot.
+* [Backport staging] Don't show the key storage out of sync toast when backup disabled ([#31507](https://github.com/element-hq/element-web/pull/31507)). Contributed by @RiotRobot.
+* Fix composer button visibility in contrast colour mode ([#31255](https://github.com/element-hq/element-web/pull/31255)). Contributed by @t3chguy.
+* Ensure correct room version is used and permissions are appropriately sert when creating rooms ([#31464](https://github.com/element-hq/element-web/pull/31464)). Contributed by @Half-Shot.
+* Fix e2e icon rendering ([#31454](https://github.com/element-hq/element-web/pull/31454)). Contributed by @t3chguy.
+* EventIndexer: ensure we add initial checkpoints when the db is first opened ([#31448](https://github.com/element-hq/element-web/pull/31448)). Contributed by @richvdh.
+* Fix `/join <alias>` command failing due to race condition ([#31433](https://github.com/element-hq/element-web/pull/31433)). Contributed by @MidhunSureshR.
+* MessageEventIndexDialog: distinguish indexed rooms ([#31436](https://github.com/element-hq/element-web/pull/31436)). Contributed by @richvdh.
+* Move `EditInPlace` out of `Form` (Fixes: reloading EW on EC url update) ([#31434](https://github.com/element-hq/element-web/pull/31434)). Contributed by @toger5.
+* Fixes issue where cursor would jump to the beginning of the input field after converting Japanese text and pressing Tab ([#31432](https://github.com/element-hq/element-web/pull/31432)). Contributed by @shinaoka.
+* Fix widgets getting stuck in loading states ([#31314](https://github.com/element-hq/element-web/pull/31314)). Contributed by @robintown.
+* Room list: fix room options remaining on room item after mouse leaving ([#31414](https://github.com/element-hq/element-web/pull/31414)). Contributed by @florianduros.
+* Make `RoomList.showMessagePreview` configurable by `config.json` ([#31419](https://github.com/element-hq/element-web/pull/31419)). Contributed by @florianduros.
+* Fix bug which caused app not to load correctly when `force_verification` is enabled ([#31265](https://github.com/element-hq/element-web/pull/31265)). Contributed by @richvdh.
+* Room list: display the menu option on the room list item when clicked/opened ([#31380](https://github.com/element-hq/element-web/pull/31380)). Contributed by @florianduros.
+* Fix handling of SVGs ([#31359](https://github.com/element-hq/element-web/pull/31359)). Contributed by @t3chguy.
+* Fix word wrapping in expanded left panel buttons ([#31377](https://github.com/element-hq/element-web/pull/31377)). Contributed by @t3chguy.
+* Fix aspect ratio on error view background ([#31361](https://github.com/element-hq/element-web/pull/31361)). Contributed by @t3chguy.
+* Fix failure to request persistent storage perms ([#31299](https://github.com/element-hq/element-web/pull/31299)). Contributed by @richvdh.
+* Fix calls sometimes not knowing that they're presented ([#31313](https://github.com/element-hq/element-web/pull/31313)). Contributed by @robintown.
+
+
+Changes in [1.12.6](https://github.com/element-hq/element-web/releases/tag/v1.12.6) (2025-12-03)
+================================================================================================
+This release fixes a bug where 1:1 calling was incorrectly not available if no Element Call focus was set.
+
+## 🐛 Bug Fixes
+
+* Add option to pick call options for voice calls. ([#31413](https://github.com/element-hq/element-web/pull/31413)).
+
+Changes in [1.12.5](https://github.com/element-hq/element-web/releases/tag/v1.12.5) (2025-12-02)
+================================================================================================
+## ✨ Features
+
+* Update Emojibase to v17 ([#31307](https://github.com/element-hq/element-web/pull/31307)). Contributed by @t3chguy.
+* Adds tooltip for compose menu ([#31122](https://github.com/element-hq/element-web/pull/31122)). Contributed by @byteplow.
+* Add option to hide pinned message banner in room view ([#31296](https://github.com/element-hq/element-web/pull/31296)). Contributed by @florianduros.
+* update twemoji to not monochromise emoji with BLACK in their name ([#31281](https://github.com/element-hq/element-web/pull/31281)). Contributed by @ara4n.
+* upgrade to twemoji 17.0.2 and fix #14695 ([#31267](https://github.com/element-hq/element-web/pull/31267)). Contributed by @ara4n.
+* Add options to hide right panel in room view ([#31252](https://github.com/element-hq/element-web/pull/31252)). Contributed by @florianduros.
+* Delayed event management: split endpoints, no auth  ([#31183](https://github.com/element-hq/element-web/pull/31183)). Contributed by @AndrewFerr.
+* Support using Element Call for voice calls in DMs ([#30817](https://github.com/element-hq/element-web/pull/30817)). Contributed by @Half-Shot.
+* Improve screen reader accessibility of auth pages ([#31236](https://github.com/element-hq/element-web/pull/31236)). Contributed by @t3chguy.
+* Add posthog tracking for key backup toasts ([#31195](https://github.com/element-hq/element-web/pull/31195)). Contributed by @Half-Shot.
+
+## 🐛 Bug Fixes
+
+* Return to using Fira Code as the default monospace font ([#31302](https://github.com/element-hq/element-web/pull/31302)). Contributed by @ara4n.
+* Fix case of home screen being displayed erroneously  ([#31301](https://github.com/element-hq/element-web/pull/31301)). Contributed by @langleyd.
+* Fix message edition and reply when multiple rooms at displayed the same moment ([#31280](https://github.com/element-hq/element-web/pull/31280)). Contributed by @florianduros.
+* Key storage out of sync: reset key backup when needed ([#31279](https://github.com/element-hq/element-web/pull/31279)). Contributed by @uhoreg.
+* Fix invalid events crashing entire room rather than just their tile ([#31256](https://github.com/element-hq/element-web/pull/31256)). Contributed by @t3chguy.
+* Fix expand button of space panel getting cut off at the edges ([#31259](https://github.com/element-hq/element-web/pull/31259)). Contributed by @MidhunSureshR.
+* Fix pill buttons in dialogs ([#31246](https://github.com/element-hq/element-web/pull/31246)). Contributed by @dbkr.
+* Fix blank sections at the top and bottom of the member list when scrolling ([#31198](https://github.com/element-hq/element-web/pull/31198)). Contributed by @langleyd.
+* Fix emoji category selection with keyboard ([#31162](https://github.com/element-hq/element-web/pull/31162)). Contributed by @langleyd.
+
+
+Changes in [1.12.4](https://github.com/element-hq/element-web/releases/tag/v1.12.4) (2025-11-18)
+================================================================================================
+## ✨ Features
+
+* Apply aria-hidden to emoji in SAS verification ([#31204](https://github.com/element-hq/element-web/pull/31204)). Contributed by @t3chguy.
+* Add options to hide header and composer of room view for the module api ([#31095](https://github.com/element-hq/element-web/pull/31095)). Contributed by @florianduros.
+* Experimental Module API Additions ([#30863](https://github.com/element-hq/element-web/pull/30863)). Contributed by @dbkr.
+* Change polls to use fieldset/legend markup ([#31160](https://github.com/element-hq/element-web/pull/31160)). Contributed by @langleyd.
+* Use compound Button styles for Jitsi button ([#31159](https://github.com/element-hq/element-web/pull/31159)). Contributed by @Half-Shot.
+* Add FocusLock to emoji picker ([#31146](https://github.com/element-hq/element-web/pull/31146)). Contributed by @langleyd.
+* Move room name, avatar, and topic to IOpts. ([#30981](https://github.com/element-hq/element-web/pull/30981)). Contributed by @kaylendog.
+* Add a devtool for looking at users and their devices ([#30983](https://github.com/element-hq/element-web/pull/30983)). Contributed by @uhoreg.
+
+## 🐛 Bug Fixes
+
+* Fix room list handling of membership changes ([#31197](https://github.com/element-hq/element-web/pull/31197)). Contributed by @t3chguy.
+* Fix room list unable to be resized when displayed after a module ([#31186](https://github.com/element-hq/element-web/pull/31186)). Contributed by @florianduros.
+* Inhibit keyboard highlights in dialogs when effector is not in focus ([#31181](https://github.com/element-hq/element-web/pull/31181)). Contributed by @t3chguy.
+* Strip mentions from forwarded messages ([#30884](https://github.com/element-hq/element-web/pull/30884)). Contributed by @twassman.
+* Don't allow pin or edit of messages with a send status ([#31158](https://github.com/element-hq/element-web/pull/31158)). Contributed by @langleyd.
+* Hide room header buttons if the room hasn't been created yet. ([#31092](https://github.com/element-hq/element-web/pull/31092)). Contributed by @Half-Shot.
+* Fix screen readers not indicating the emoji picker search field is focused. ([#31128](https://github.com/element-hq/element-web/pull/31128)). Contributed by @langleyd.
+* Fix emoji picker highlight missing when not active element ([#31148](https://github.com/element-hq/element-web/pull/31148)). Contributed by @t3chguy.
+* Add relevant aria attribute for selected emoji in the emoji picker ([#31125](https://github.com/element-hq/element-web/pull/31125)). Contributed by @t3chguy.
+* Fix tooltips within context menu portals being unreliable ([#31129](https://github.com/element-hq/element-web/pull/31129)). Contributed by @t3chguy.
+* Avoid excessive re-render of room list and member list ([#31131](https://github.com/element-hq/element-web/pull/31131)). Contributed by @florianduros.
+* Make emoji picker height responsive. ([#31130](https://github.com/element-hq/element-web/pull/31130)). Contributed by @langleyd.
+* Emoji Picker: Focused emoji does not move with the arrow keys ([#30893](https://github.com/element-hq/element-web/pull/30893)). Contributed by @langleyd.
+* Fix audio player seek bar position  ([#31127](https://github.com/element-hq/element-web/pull/31127)). Contributed by @florianduros.
+* Add aria label to emoji picker search ([#31126](https://github.com/element-hq/element-web/pull/31126)). Contributed by @langleyd.
+
+
+Changes in [1.12.3](https://github.com/element-hq/element-web/releases/tag/v1.12.3) (2025-11-04)
+================================================================================================
+## 🦖 Deprecations
+
+* Remove allowVoipWithNoMedia feature flag ([#31087](https://github.com/element-hq/element-web/pull/31087)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Change module API to be an instance getter ([#31025](https://github.com/element-hq/element-web/pull/31025)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* Show hover elements when keyboard focus is within an event tile ([#31078](https://github.com/element-hq/element-web/pull/31078)). Contributed by @t3chguy.
+* Ensure toolbar navigation pattern works in MessageActionBar ([#31080](https://github.com/element-hq/element-web/pull/31080)). Contributed by @t3chguy.
+* Ensure sent markers are hidden when showing thread summary. ([#31076](https://github.com/element-hq/element-web/pull/31076)). Contributed by @Half-Shot.
+* Fix translation in dev mode ([#31045](https://github.com/element-hq/element-web/pull/31045)). Contributed by @florianduros.
+* Fix sort order in space hierarchy ([#30975](https://github.com/element-hq/element-web/pull/30975)). Contributed by @t3chguy.
+* New Room list: don't display message preview of thread ([#31043](https://github.com/element-hq/element-web/pull/31043)). Contributed by @florianduros.
+* Revert "A11y: move focus to right panel when opened" ([#30999](https://github.com/element-hq/element-web/pull/30999)). Contributed by @florianduros.
+* Fix highlights in messages (or search results) breaking links ([#30264](https://github.com/element-hq/element-web/pull/30264)). Contributed by @bojidar-bg.
+* Add prepare script ([#31030](https://github.com/element-hq/element-web/pull/31030)). Contributed by @dbkr.
+* Fix html exports by adding SDKContext ([#30987](https://github.com/element-hq/element-web/pull/30987)). Contributed by @t3chguy.
+
+
+Changes in [1.12.2](https://github.com/element-hq/element-web/releases/tag/v1.12.2) (2025-10-21)
+================================================================================================
+## ✨ Features
+
+* Room List: Extend the viewport to avoid so many black spots when scrolling the room list ([#30867](https://github.com/element-hq/element-web/pull/30867)). Contributed by @langleyd.
+* Hide calling buttons in room header before a room is created ([#30816](https://github.com/element-hq/element-web/pull/30816)). Contributed by @Half-Shot.
+* Improve invite dialog ui - Part 2 ([#30836](https://github.com/element-hq/element-web/pull/30836)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* Fix platform settings race condition and make auto-launch tri-state ([#30977](https://github.com/element-hq/element-web/pull/30977)). Contributed by @t3chguy.
+* Fix: member count in header and member list ([#30982](https://github.com/element-hq/element-web/pull/30982)). Contributed by @florianduros.
+* Fix duration of voice message in timeline ([#30973](https://github.com/element-hq/element-web/pull/30973)). Contributed by @florianduros.
+* Fix voice notes rendering at 00:00 when playback had not begun. ([#30961](https://github.com/element-hq/element-web/pull/30961)). Contributed by @Half-Shot.
+* Improve handling of animated images, add support for AVIF animations ([#30932](https://github.com/element-hq/element-web/pull/30932)). Contributed by @t3chguy.
+* Update key storage toggle when key storage status changes ([#30934](https://github.com/element-hq/element-web/pull/30934)). Contributed by @uhoreg.
+* Fix jitsi widget popout ([#30908](https://github.com/element-hq/element-web/pull/30908)). Contributed by @dbkr.
+* Improve keyboard navigation on invite dialog ([#30930](https://github.com/element-hq/element-web/pull/30930)). Contributed by @florianduros.
+* Prefer UIA flows with supported UIA stages ([#30926](https://github.com/element-hq/element-web/pull/30926)). Contributed by @richvdh.
+* Enhance accessibility of dropdown ([#30928](https://github.com/element-hq/element-web/pull/30928)). Contributed by @florianduros.
+* Improve accessibility of the `\<AvatarSetting> component ([#30907](https://github.com/element-hq/element-web/pull/30907)). Contributed by @MidhunSureshR.
+
+
+Changes in [1.12.1](https://github.com/element-hq/element-web/releases/tag/v1.12.1) (2025-10-07)
+================================================================================================
+## ✨ Features
+
+* New Room List: Change the order of filters to match those on mobile ([#30905](https://github.com/element-hq/element-web/pull/30905)). Contributed by @langleyd.
+* New Room List: Don't clear filters on space change ([#30903](https://github.com/element-hq/element-web/pull/30903)). Contributed by @langleyd.
+* Add release announcement for the sounds ([#30900](https://github.com/element-hq/element-web/pull/30900)). Contributed by @langleyd.
+* Rich Text Editor: Add emoji suggestion support ([#30873](https://github.com/element-hq/element-web/pull/30873)). Contributed by @langleyd.
+* feat: Disable session lock when running in element-desktop ([#30643](https://github.com/element-hq/element-web/pull/30643)). Contributed by @kaylendog.
+* Improve invite dialog ui - Part 1 ([#30764](https://github.com/element-hq/element-web/pull/30764)). Contributed by @florianduros.
+* Update Message Sound for Element ([#30804](https://github.com/element-hq/element-web/pull/30804)). Contributed by @beatdemon.
+* Add new and improved ringtone ([#30761](https://github.com/element-hq/element-web/pull/30761)). Contributed by @Half-Shot.
+* Disable RTE formatting buttons when the content contains a slash command ([#30802](https://github.com/element-hq/element-web/pull/30802)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* New Room List: Improve robustness of keyboard navigation ([#30888](https://github.com/element-hq/element-web/pull/30888)). Contributed by @langleyd.
+* Fix a11y issue on list in invite dialog ([#30878](https://github.com/element-hq/element-web/pull/30878)). Contributed by @florianduros.
+* Switch Export and Import Icons to match intuition ([#30805](https://github.com/element-hq/element-web/pull/30805)). Contributed by @micartey.
+* Hide breadcrumb option when new room list is enabled ([#30869](https://github.com/element-hq/element-web/pull/30869)). Contributed by @florianduros.
+* Avoid creating multiple call objects for the same widget ([#30839](https://github.com/element-hq/element-web/pull/30839)). Contributed by @robintown.
+* Add a test for #29882, which is fixed by matrix-org/matrix-js-sdk#5016 ([#30835](https://github.com/element-hq/element-web/pull/30835)). Contributed by @andybalaam.
+* fix: use `help_encryption_url` of config instead of hardcoded `https://element.io/help#encryption5` ([#30746](https://github.com/element-hq/element-web/pull/30746)). Contributed by @florianduros.
+* Fix html export when feature\_jump\_to\_date is enabled ([#30828](https://github.com/element-hq/element-web/pull/30828)). Contributed by @langleyd.
+* Fix #30439: "Forgot recovery key" should go to "reset" ([#30771](https://github.com/element-hq/element-web/pull/30771)). Contributed by @andybalaam.
+
+
+Changes in [1.12.0](https://github.com/element-hq/element-web/releases/tag/v1.12.0) (2025-09-23)
+================================================================================================
+## 🦖 Deprecations
+
+* Remove remaining support for outdated .well-known settings ([#30702](https://github.com/element-hq/element-web/pull/30702)). Contributed by @richvdh.
+
+## ✨ Features
+
+* Add decline button to call notification toast (use new notification event) ([#30729](https://github.com/element-hq/element-web/pull/30729)). Contributed by @toger5.
+* Use the new room list by default ([#30640](https://github.com/element-hq/element-web/pull/30640)). Contributed by @langleyd.
+* "Verify this device" redesign ([#30596](https://github.com/element-hq/element-web/pull/30596)). Contributed by @uhoreg.
+* Set Element Call "intents" when starting and answering DM calls. ([#30730](https://github.com/element-hq/element-web/pull/30730)). Contributed by @Half-Shot.
+* Add axe compliance for new room list ([#30700](https://github.com/element-hq/element-web/pull/30700)). Contributed by @langleyd.
+* Stop ringing and remove toast if another device answers a RTC call. ([#30728](https://github.com/element-hq/element-web/pull/30728)). Contributed by @Half-Shot.
+* Automatically adjust history visibility when making a room private ([#30713](https://github.com/element-hq/element-web/pull/30713)). Contributed by @Half-Shot.
+* Release announcement for new room list ([#30675](https://github.com/element-hq/element-web/pull/30675)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Room list: make the filter resize correctly ([#30795](https://github.com/element-hq/element-web/pull/30795)). Contributed by @RiotRobot.
+* [Backport staging] Avoid flicker of the room list filter on resize ([#30794](https://github.com/element-hq/element-web/pull/30794)). Contributed by @RiotRobot.
+* Don't show release announcements while toasts are displayed ([#30770](https://github.com/element-hq/element-web/pull/30770)). Contributed by @dbkr.
+* Fix enabling key backup not working if there is an untrusted key backup ([#30707](https://github.com/element-hq/element-web/pull/30707)). Contributed by @Half-Shot.
+* Force `preload` to be false when setting an intent on an Element Call. ([#30759](https://github.com/element-hq/element-web/pull/30759)). Contributed by @Half-Shot.
+* Fix handling of 413 server response when uploading media ([#30737](https://github.com/element-hq/element-web/pull/30737)). Contributed by @hughns.
+* Make landmark navigation work with new room list ([#30747](https://github.com/element-hq/element-web/pull/30747)). Contributed by @dbkr.
+* Prevent voice message from displaying spurious errors ([#30736](https://github.com/element-hq/element-web/pull/30736)). Contributed by @florianduros.
+* Align default avatar and fix colors in composer pills ([#30739](https://github.com/element-hq/element-web/pull/30739)). Contributed by @florianduros.
+* Use configured URL for link to desktop app in message search settings ([#30742](https://github.com/element-hq/element-web/pull/30742)). Contributed by @t3chguy.
+* Fix history visibility when creating space rooms ([#30745](https://github.com/element-hq/element-web/pull/30745)). Contributed by @dbkr.
+* Check HTML-encoded quotes when handling translations for embedded pages (such as welcome.html) ([#30743](https://github.com/element-hq/element-web/pull/30743)). Contributed by @Half-Shot.
+* Fix local room encryption status always not enabled ([#30461](https://github.com/element-hq/element-web/pull/30461)). Contributed by @BillCarsonFr.
+* fix: make url in topic in room intro clickable ([#30686](https://github.com/element-hq/element-web/pull/30686)). Contributed by @florianduros.
+* Block change recovery key button while a change is ongoing. ([#30664](https://github.com/element-hq/element-web/pull/30664)). Contributed by @Half-Shot.
+* Hide advanced settings during room creation when `UIFeature.advancedSettings=false` ([#30684](https://github.com/element-hq/element-web/pull/30684)). Contributed by @florianduros.
+* A11y: improve accessibility of pinned messages ([#30558](https://github.com/element-hq/element-web/pull/30558)). Contributed by @florianduros.
+
+
+Changes in [1.11.112](https://github.com/element-hq/element-web/releases/tag/v1.11.112) (2025-09-16)
+====================================================================================================
+Fix [CVE-2025-59161](https://www.cve.org/CVERecord?id=CVE-2025-59161) / [GHSA-m6c8-98f4-75rr](https://github.com/element-hq/element-web/security/advisories/GHSA-m6c8-98f4-75rr)
+
+
+Changes in [1.11.111](https://github.com/element-hq/element-web/releases/tag/v1.11.111) (2025-09-10)
+====================================================================================================
+## ✨ Features
+
+* Do not hide media from your own user by default ([#29797](https://github.com/element-hq/element-web/pull/29797)). Contributed by @Half-Shot.
+* Remember whether sidebar is shown for calls when switching rooms ([#30262](https://github.com/element-hq/element-web/pull/30262)). Contributed by @bojidar-bg.
+* Open the proper integration settings on integrations disabled error ([#30538](https://github.com/element-hq/element-web/pull/30538)). Contributed by @Half-Shot.
+* Show a "progress" dialog while invites are being sent ([#30561](https://github.com/element-hq/element-web/pull/30561)). Contributed by @richvdh.
+* Move the room list to the new ListView(backed by react-virtuoso)  ([#30515](https://github.com/element-hq/element-web/pull/30515)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Ensure container starts if it is mounted with an empty /modules directory. ([#30705](https://github.com/element-hq/element-web/pull/30705)). Contributed by @RiotRobot.
+* Fix room joining over federation not specifying vias or using aliases ([#30641](https://github.com/element-hq/element-web/pull/30641)). Contributed by @t3chguy.
+* Fix stable-suffixed MSC4133 support ([#30649](https://github.com/element-hq/element-web/pull/30649)). Contributed by @dbkr.
+* Fix i18n of message when a setting is disabled ([#30646](https://github.com/element-hq/element-web/pull/30646)). Contributed by @dbkr.
+* ListView should not handle the arrow keys if there is a modifier applied ([#30633](https://github.com/element-hq/element-web/pull/30633)). Contributed by @langleyd.
+* Make BaseDialog's div keyboard focusable and fix test. ([#30631](https://github.com/element-hq/element-web/pull/30631)). Contributed by @langleyd.
+* Fix: Allow triple-click text selection to flow around pills ([#30349](https://github.com/element-hq/element-web/pull/30349)). Contributed by @AlirezaMrtz.
+* Watch for a 'join' action to know when the call is connected ([#29492](https://github.com/element-hq/element-web/pull/29492)). Contributed by @robintown.
+* Fix: add missing tooltip and aria-label to lock icon next to composer ([#30623](https://github.com/element-hq/element-web/pull/30623)). Contributed by @florianduros.
+* Don't render context menu when scrolling ([#30613](https://github.com/element-hq/element-web/pull/30613)). Contributed by @langleyd.
+
+
+Changes in [1.11.110](https://github.com/element-hq/element-web/releases/tag/v1.11.110) (2025-08-27)
+====================================================================================================
+## ✨ Features
+
+* Hide recovery key when re-entering it while creating or changing it ([#30499](https://github.com/element-hq/element-web/pull/30499)). Contributed by @andybalaam.
+* Add `?no_universal_links=true` to OIDC url so EX doesn't try to handle it ([#29439](https://github.com/element-hq/element-web/pull/29439)). Contributed by @t3chguy.
+* Show a blue lock for unencrypted rooms and hide the grey shield for encrypted rooms ([#30440](https://github.com/element-hq/element-web/pull/30440)). Contributed by @langleyd.
+* Add support for Module API 1.4 ([#30185](https://github.com/element-hq/element-web/pull/30185)). Contributed by @t3chguy.
+* MVVM - Introduce some helpers for snapshot management ([#30398](https://github.com/element-hq/element-web/pull/30398)). Contributed by @MidhunSureshR.
+
+## 🐛 Bug Fixes
+
+* A11y: move focus to right panel when opened ([#30553](https://github.com/element-hq/element-web/pull/30553)). Contributed by @florianduros.
+* Fix e2e warning icon should be white ([#30539](https://github.com/element-hq/element-web/pull/30539)). Contributed by @florianduros.
+* Remove NoOneHere disabled reason. ([#30524](https://github.com/element-hq/element-web/pull/30524)). Contributed by @toger5.
+* Fix downloading files with authenticated media API ([#30520](https://github.com/element-hq/element-web/pull/30520)). Contributed by @t3chguy.
+* Fix call permissions check confusion around element call ([#30521](https://github.com/element-hq/element-web/pull/30521)). Contributed by @t3chguy.
+* Fix line wrap around emoji verification ([#30523](https://github.com/element-hq/element-web/pull/30523)). Contributed by @t3chguy.
+* Don't highlight redacted events ([#30519](https://github.com/element-hq/element-web/pull/30519)). Contributed by @t3chguy.
+* Fix matrix.to links not being handled in the app ([#30522](https://github.com/element-hq/element-web/pull/30522)). Contributed by @t3chguy.
+* Fix issue of new room list taking up the full width ([#30459](https://github.com/element-hq/element-web/pull/30459)). Contributed by @langleyd.
+* Fix widget persistence in React development mode ([#30509](https://github.com/element-hq/element-web/pull/30509)). Contributed by @robintown.
+* Fix widget initialization in React development mode ([#30463](https://github.com/element-hq/element-web/pull/30463)). Contributed by @robintown.
+
+
+Changes in [1.11.109](https://github.com/element-hq/element-web/releases/tag/v1.11.109) (2025-08-11)
+====================================================================================================
+This release supports the upcoming v12 ("hydra") Matrix room version and is necessary to view and participate in these rooms.
+
+## ✨ Features
+
+* [Backport staging] Allow /upgraderoom command without developer mode enabled ([#30529](https://github.com/element-hq/element-web/pull/30529)). Contributed by @RiotRobot.
+* [Backport staging] Support for creator/owner power level ([#30526](https://github.com/element-hq/element-web/pull/30526)). Contributed by @RiotRobot.
+* New room list: change icon and label of menu item for to start a DM ([#30470](https://github.com/element-hq/element-web/pull/30470)). Contributed by @florianduros.
+* Implement the member list with virtuoso ([#29869](https://github.com/element-hq/element-web/pull/29869)). Contributed by @langleyd.
+* Add labs option for history sharing on invite ([#30313](https://github.com/element-hq/element-web/pull/30313)). Contributed by @richvdh.
+* Bump wysiwyg to 2.39.0 adding support for pasting rich text content in the Rich Text Edtior ([#30421](https://github.com/element-hq/element-web/pull/30421)). Contributed by @langleyd.
+* Support `EventShieldReason.MISMATCHED_SENDER` ([#30403](https://github.com/element-hq/element-web/pull/30403)). Contributed by @richvdh.
+* Change unencrypted and public pills to blue ([#30399](https://github.com/element-hq/element-web/pull/30399)). Contributed by @florianduros.
+* Change color of public room icon ([#30390](https://github.com/element-hq/element-web/pull/30390)). Contributed by @florianduros.
+* Script for updating storybook screenshots ([#30340](https://github.com/element-hq/element-web/pull/30340)). Contributed by @dbkr.
+* Add toggle to hide empty state in devtools ([#30352](https://github.com/element-hq/element-web/pull/30352)). Contributed by @toger5.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Use userId to filter users in non-federated rooms when showing the InviteDialog ([#30537](https://github.com/element-hq/element-web/pull/30537)). Contributed by @RiotRobot.
+* [Backport staging] Catch error when encountering invalid m.room.pinned\_events event ([#30536](https://github.com/element-hq/element-web/pull/30536)). Contributed by @RiotRobot.
+* Update for compatibility with v12 rooms ([#30452](https://github.com/element-hq/element-web/pull/30452)). Contributed by @dbkr.
+* New room list: fix tooltip on presence ([#30474](https://github.com/element-hq/element-web/pull/30474)). Contributed by @florianduros.
+* New room list: add tooltip for presence and room status ([#30472](https://github.com/element-hq/element-web/pull/30472)). Contributed by @florianduros.
+* Fix: Clicking on an item in the member list causes it to scroll to the top rather than show the profile view ([#30455](https://github.com/element-hq/element-web/pull/30455)). Contributed by @langleyd.
+* Put the 'decrypting' tooltip back ([#30446](https://github.com/element-hq/element-web/pull/30446)). Contributed by @dbkr.
+* Use server name explicitly for via. ([#30362](https://github.com/element-hq/element-web/pull/30362)). Contributed by @Half-Shot.
+* fix: replace hardcoded string in poll history dialog ([#30402](https://github.com/element-hq/element-web/pull/30402)). Contributed by @florianduros.
+* fix: replace hardcoded string on qr code back button ([#30401](https://github.com/element-hq/element-web/pull/30401)). Contributed by @florianduros.
+* Fix color of icon button with outline ([#30361](https://github.com/element-hq/element-web/pull/30361)). Contributed by @florianduros.
+
+
+Changes in [1.11.108](https://github.com/element-hq/element-web/releases/tag/v1.11.108) (2025-07-30)
+====================================================================================================
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix downloaded attachments not being decrypted ([#30434](https://github.com/element-hq/element-web/pull/30434)). Contributed by @RiotRobot.
+
+
+Changes in [1.11.107](https://github.com/element-hq/element-web/releases/tag/v1.11.107) (2025-07-29)
+====================================================================================================
+## ✨ Features
+
+* Message preview should show tooltip with the full message on hover ([#30265](https://github.com/element-hq/element-web/pull/30265)). Contributed by @MidhunSureshR.
+* Support rendering notification badges on platforms that do their own icon overlays ([#30315](https://github.com/element-hq/element-web/pull/30315)). Contributed by @Half-Shot.
+* Add SubscriptionViewModel base class ([#30297](https://github.com/element-hq/element-web/pull/30297)). Contributed by @dbkr.
+* Enhancement: Save image on CTRL+S ([#30330](https://github.com/element-hq/element-web/pull/30330)). Contributed by @ioalexander.
+* Add quote functionality to MessageContextMenu (#29893) ([#30323](https://github.com/element-hq/element-web/pull/30323)). Contributed by @AlirezaMrtz.
+* Initial structure for shared component views ([#30216](https://github.com/element-hq/element-web/pull/30216)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix e2e shield being invisible in white mode for encrypted room ([#30411](https://github.com/element-hq/element-web/pull/30411)). Contributed by @RiotRobot.
+* Force ED titlebar color for new room list ([#30332](https://github.com/element-hq/element-web/pull/30332)). Contributed by @florianduros.
+* Add a background color to left panel for macos titlebar in element desktop ([#30328](https://github.com/element-hq/element-web/pull/30328)). Contributed by @florianduros.
+* Fix: Prevent page refresh on Enter key in right panel member search ([#30312](https://github.com/element-hq/element-web/pull/30312)). Contributed by @AlirezaMrtz.
+
+
+Changes in [1.11.106](https://github.com/element-hq/element-web/releases/tag/v1.11.106) (2025-07-15)
+====================================================================================================
+## ✨ Features
+
+* [Backport staging] Fix e2e icon colour ([#30304](https://github.com/element-hq/element-web/pull/30304)). Contributed by @RiotRobot.
+* Add support for module message hint `allowDownloadingMedia` ([#30252](https://github.com/element-hq/element-web/pull/30252)). Contributed by @Half-Shot.
+* Update the mobile\_guide page to the new design and link out to Element X by default. ([#30172](https://github.com/element-hq/element-web/pull/30172)). Contributed by @pixlwave.
+* Filter settings exported when rageshaking ([#30236](https://github.com/element-hq/element-web/pull/30236)). Contributed by @Half-Shot.
+* Allow Element Call to learn the room name ([#30213](https://github.com/element-hq/element-web/pull/30213)). Contributed by @robintown.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix missing image download button ([#30322](https://github.com/element-hq/element-web/pull/30322)). Contributed by @RiotRobot.
+* Fix transparent verification checkmark in dark mode ([#30235](https://github.com/element-hq/element-web/pull/30235)). Contributed by @Banbuii.
+* Fix logic in DeviceListener ([#30230](https://github.com/element-hq/element-web/pull/30230)). Contributed by @uhoreg.
+* Disable file drag-and-drop if insufficient permissions ([#30186](https://github.com/element-hq/element-web/pull/30186)). Contributed by @t3chguy.
+
+
+Changes in [1.11.105](https://github.com/element-hq/element-web/releases/tag/v1.11.105) (2025-07-01)
+====================================================================================================
+## ✨ Features
+
+* New room list: add context menu to room list item ([#29952](https://github.com/element-hq/element-web/pull/29952)). Contributed by @florianduros.
+* Support for custom message components via Module API ([#30074](https://github.com/element-hq/element-web/pull/30074)). Contributed by @Half-Shot.
+* Prompt users to set up recovery ([#30075](https://github.com/element-hq/element-web/pull/30075)). Contributed by @uhoreg.
+* Update `IconButton` colors ([#30124](https://github.com/element-hq/element-web/pull/30124)). Contributed by @florianduros.
+* New room list: filter list can be collapsed  ([#29992](https://github.com/element-hq/element-web/pull/29992)). Contributed by @florianduros.
+* Show `EmptyRoomListView` when low priority filter matches zero rooms ([#30122](https://github.com/element-hq/element-web/pull/30122)). Contributed by @MidhunSureshR.
+
+## 🐛 Bug Fixes
+
+* Fix untranslatable string "People" in notifications beta ([#30165](https://github.com/element-hq/element-web/pull/30165)). Contributed by @t3chguy.
+* Force verification even after logging in via delegate ([#30141](https://github.com/element-hq/element-web/pull/30141)). Contributed by @andybalaam.
+* Hide add integrations button based on UIComponent.AddIntegrations ([#30140](https://github.com/element-hq/element-web/pull/30140)). Contributed by @t3chguy.
+* Use nav for new room list and label sections ([#30134](https://github.com/element-hq/element-web/pull/30134)). Contributed by @dbkr.
+* Spacestore should emit event after rebuilding home space ([#30132](https://github.com/element-hq/element-web/pull/30132)). Contributed by @MidhunSureshR.
+* Handle m.room.pinned\_events being invalid ([#30129](https://github.com/element-hq/element-web/pull/30129)). Contributed by @t3chguy.
+
+
+Changes in [1.11.104](https://github.com/element-hq/element-web/releases/tag/v1.11.104) (2025-06-17)
+====================================================================================================
+## ✨ Features
+
+* Update the mobile\_guide page to the new design. ([#30006](https://github.com/element-hq/element-web/pull/30006)). Contributed by @pixlwave.
+* Provide a devtool for manually verifying other devices ([#30094](https://github.com/element-hq/element-web/pull/30094)). Contributed by @andybalaam.
+* Implement MSC4155: Invite filtering ([#29603](https://github.com/element-hq/element-web/pull/29603)). Contributed by @Half-Shot.
+* Add low priority avatar decoration to room tile ([#30065](https://github.com/element-hq/element-web/pull/30065)). Contributed by @MidhunSureshR.
+* Add ability to prevent window content being captured by other apps (Desktop) ([#30098](https://github.com/element-hq/element-web/pull/30098)). Contributed by @t3chguy.
+* New room list: move message preview in user settings ([#30023](https://github.com/element-hq/element-web/pull/30023)). Contributed by @florianduros.
+* New room list: change room options icon ([#30029](https://github.com/element-hq/element-web/pull/30029)). Contributed by @florianduros.
+* RoomListStore: Sort low priority rooms to the bottom of the list ([#30070](https://github.com/element-hq/element-web/pull/30070)). Contributed by @MidhunSureshR.
+* Add low priority filter pill to the room list UI ([#30060](https://github.com/element-hq/element-web/pull/30060)). Contributed by @MidhunSureshR.
+* New room list: remove color gradient in space panel ([#29721](https://github.com/element-hq/element-web/pull/29721)). Contributed by @florianduros.
+* /share?msg=foo endpoint using forward message dialog ([#29874](https://github.com/element-hq/element-web/pull/29874)). Contributed by @ara4n.
+
+## 🐛 Bug Fixes
+
+* Do not send empty auth when setting up cross-signing keys ([#29914](https://github.com/element-hq/element-web/pull/29914)). Contributed by @gnieto.
+* Settings: flip local video feed by default ([#29501](https://github.com/element-hq/element-web/pull/29501)). Contributed by @jbtrystram.
+* AccessSecretStorageDialog: various fixes ([#30093](https://github.com/element-hq/element-web/pull/30093)). Contributed by @richvdh.
+* AccessSecretStorageDialog: fix inability to enter recovery key ([#30090](https://github.com/element-hq/element-web/pull/30090)). Contributed by @richvdh.
+* Fix failure to upload thumbnail causing image to send as file ([#30086](https://github.com/element-hq/element-web/pull/30086)). Contributed by @t3chguy.
+* Low priority menu item should be a toggle ([#30071](https://github.com/element-hq/element-web/pull/30071)). Contributed by @MidhunSureshR.
+* Add sanity checks to prevent users from ignoring themselves ([#30079](https://github.com/element-hq/element-web/pull/30079)). Contributed by @MidhunSureshR.
+* Fix issue with duplicate images ([#30073](https://github.com/element-hq/element-web/pull/30073)). Contributed by @fatlewis.
+* Handle errors returned from Seshat ([#30083](https://github.com/element-hq/element-web/pull/30083)). Contributed by @richvdh.
+
+
+Changes in [1.11.103](https://github.com/element-hq/element-web/releases/tag/v1.11.103) (2025-06-10)
+====================================================================================================
+## 🐛 Bug Fixes
+
+ Check the sender of an event matches owner of session, preventing sender spoofing by homeserver owners.
+[13c1d20](https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55) (High, [GHSA-x958-rvg6-956w](https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w)).
+
+Changes in [1.11.102](https://github.com/element-hq/element-web/releases/tag/v1.11.102) (2025-06-03)
+====================================================================================================
+## ✨ Features
+
+* EW: Modernize the recovery key input modal ([#29819](https://github.com/element-hq/element-web/pull/29819)). Contributed by @uhoreg.
+* New room list: move secondary filters into primary filters ([#29972](https://github.com/element-hq/element-web/pull/29972)). Contributed by @florianduros.
+* Prompt the user when key storage is unexpectedly off ([#29912](https://github.com/element-hq/element-web/pull/29912)). Contributed by @andybalaam.
+* New room list: move sort menu in room list header ([#29983](https://github.com/element-hq/element-web/pull/29983)). Contributed by @florianduros.
+* New room list: rework spacing of room list item ([#29965](https://github.com/element-hq/element-web/pull/29965)). Contributed by @florianduros.
+* RLS: Remove forgotten room from skiplist ([#29933](https://github.com/element-hq/element-web/pull/29933)). Contributed by @MidhunSureshR.
+* Add room list sorting ([#29951](https://github.com/element-hq/element-web/pull/29951)). Contributed by @dbkr.
+* Don't use the minimised width(68px) on the new room list ([#29778](https://github.com/element-hq/element-web/pull/29778)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Close call options popup menu when option has been selected ([#30054](https://github.com/element-hq/element-web/pull/30054)). Contributed by @RiotRobot.
+* RoomListStoreV3: Only add new rooms that pass `VisibilityProvider` check ([#29974](https://github.com/element-hq/element-web/pull/29974)). Contributed by @MidhunSureshR.
+* Re-order primary filters ([#29957](https://github.com/element-hq/element-web/pull/29957)). Contributed by @dbkr.
+* Fix leaky CSS adding `!` to all H1 elements ([#29964](https://github.com/element-hq/element-web/pull/29964)). Contributed by @t3chguy.
+* Fix extensions panel style ([#29273](https://github.com/element-hq/element-web/pull/29273)). Contributed by @langleyd.
+* Fix state events being hidden from widgets in read\_events actions ([#29954](https://github.com/element-hq/element-web/pull/29954)). Contributed by @robintown.
+* Remove old filter test ([#29963](https://github.com/element-hq/element-web/pull/29963)). Contributed by @dbkr.
+
+
+Changes in [1.11.101](https://github.com/element-hq/element-web/releases/tag/v1.11.101) (2025-05-20)
+====================================================================================================
+## ✨ Features
+
+* New room list: add keyboard navigation support ([#29805](https://github.com/element-hq/element-web/pull/29805)). Contributed by @florianduros.
+* Use the JoinRuleSettings component for the guest link access prompt. ([#28614](https://github.com/element-hq/element-web/pull/28614)). Contributed by @toger5.
+* Add loading state to the new room list view ([#29725](https://github.com/element-hq/element-web/pull/29725)). Contributed by @langleyd.
+* Make OIDC identity reset consistent with EX ([#29854](https://github.com/element-hq/element-web/pull/29854)). Contributed by @andybalaam.
+* Support error code for email / phone adding unsupported (MSC4178) ([#29855](https://github.com/element-hq/element-web/pull/29855)). Contributed by @dbkr.
+* Update identity reset UI (Make consistent with EX) ([#29701](https://github.com/element-hq/element-web/pull/29701)). Contributed by @andybalaam.
+* Add secondary filters to the new room list ([#29818](https://github.com/element-hq/element-web/pull/29818)). Contributed by @dbkr.
+* Fix battery drain from Web Audio ([#29203](https://github.com/element-hq/element-web/pull/29203)). Contributed by @mbachry.
+
+## 🐛 Bug Fixes
+
+* Fix go home shortcut on macos and change toggle action events shortcut ([#29929](https://github.com/element-hq/element-web/pull/29929)). Contributed by @florianduros.
+* New room list: fix outdated message preview when space or filter change ([#29925](https://github.com/element-hq/element-web/pull/29925)). Contributed by @florianduros.
+* Stop migrating to MSC4278 if the config exists. ([#29924](https://github.com/element-hq/element-web/pull/29924)). Contributed by @Half-Shot.
+* Ensure consistent download file name on download from ImageView ([#29913](https://github.com/element-hq/element-web/pull/29913)). Contributed by @t3chguy.
+* Add error toast when service worker registration fails ([#29895](https://github.com/element-hq/element-web/pull/29895)). Contributed by @t3chguy.
+* New Room List: Prevent old tombstoned rooms from appearing in the list ([#29881](https://github.com/element-hq/element-web/pull/29881)). Contributed by @MidhunSureshR.
+* Remove lag in search field ([#29885](https://github.com/element-hq/element-web/pull/29885)). Contributed by @florianduros.
+* Respect UIFeature.Voip ([#29873](https://github.com/element-hq/element-web/pull/29873)). Contributed by @langleyd.
+* Allow jumping to message search from spotlight ([#29850](https://github.com/element-hq/element-web/pull/29850)). Contributed by @t3chguy.
+
+
+Changes in [1.11.100](https://github.com/element-hq/element-web/releases/tag/v1.11.100) (2025-05-06)
+====================================================================================================
+## ✨ Features
+
+* Move rich topics out of labs / stabilise MSC3765 ([#29817](https://github.com/element-hq/element-web/pull/29817)). Contributed by @Johennes.
+* Spell out that Element Web does \*not\* work on mobile. ([#29211](https://github.com/element-hq/element-web/pull/29211)). Contributed by @ara4n.
+* Add message preview support to the new room list ([#29784](https://github.com/element-hq/element-web/pull/29784)). Contributed by @dbkr.
+* Global configuration flag for media previews ([#29582](https://github.com/element-hq/element-web/pull/29582)). Contributed by @Half-Shot.
+* New room list: add partial keyboard shortcuts support ([#29783](https://github.com/element-hq/element-web/pull/29783)). Contributed by @florianduros.
+* MVVM RoomSummaryCard Topic ([#29710](https://github.com/element-hq/element-web/pull/29710)). Contributed by @MarcWadai.
+* Warn on self change from settings > roles ([#28926](https://github.com/element-hq/element-web/pull/28926)). Contributed by @MarcWadai.
+* New room list: new visual for invitation ([#29773](https://github.com/element-hq/element-web/pull/29773)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* Fix incorrect display of the user info display name ([#29826](https://github.com/element-hq/element-web/pull/29826)). Contributed by @langleyd.
+* RoomListStore: Remove invite rooms on decline ([#29804](https://github.com/element-hq/element-web/pull/29804)). Contributed by @MidhunSureshR.
+* Fix the buttons not being displayed with long preview text ([#29811](https://github.com/element-hq/element-web/pull/29811)). Contributed by @dbkr.
+* New room list: fix missing/incorrect notification decoration  ([#29796](https://github.com/element-hq/element-web/pull/29796)). Contributed by @florianduros.
+* New Room List: Prevent potential scroll jump/flicker when switching spaces ([#29781](https://github.com/element-hq/element-web/pull/29781)). Contributed by @MidhunSureshR.
+* New room list: fix incorrect decoration ([#29770](https://github.com/element-hq/element-web/pull/29770)). Contributed by @florianduros.
+
+
+Changes in [1.11.99](https://github.com/element-hq/element-web/releases/tag/v1.11.99) (2025-04-23)
+==================================================================================================
+No changes, just bumping the version to accommodate a new Element Desktop release
+
+Changes in [1.11.98](https://github.com/element-hq/element-web/releases/tag/v1.11.98) (2025-04-22)
+==================================================================================================
+## ✨ Features
+
+* print better errors in the search view instead of a blocking modal ([#29724](https://github.com/element-hq/element-web/pull/29724)). Contributed by @Jujure.
+* New room list: video room and video call decoration  ([#29693](https://github.com/element-hq/element-web/pull/29693)). Contributed by @florianduros.
+* Remove Secure Backup, Cross-signing and Cryptography sections in `Security & Privacy` user settings ([#29088](https://github.com/element-hq/element-web/pull/29088)). Contributed by @florianduros.
+* Allow reporting a room when rejecting an invite. ([#29570](https://github.com/element-hq/element-web/pull/29570)). Contributed by @Half-Shot.
+* RoomListViewModel: Reset primary and secondary filters on space change ([#29672](https://github.com/element-hq/element-web/pull/29672)). Contributed by @MidhunSureshR.
+* RoomListStore: Support specific sorting requirements for muted rooms ([#29665](https://github.com/element-hq/element-web/pull/29665)). Contributed by @MidhunSureshR.
+* New room list: add notification options menu ([#29639](https://github.com/element-hq/element-web/pull/29639)). Contributed by @florianduros.
+* Room List: Scroll to top of the list when active room is not in the list ([#29650](https://github.com/element-hq/element-web/pull/29650)). Contributed by @MidhunSureshR.
+
+## 🐛 Bug Fixes
+
+* Fix unwanted form submit behaviour in memberlist ([#29747](https://github.com/element-hq/element-web/pull/29747)). Contributed by @MidhunSureshR.
+* New room list: fix public room icon visibility when filter change ([#29737](https://github.com/element-hq/element-web/pull/29737)). Contributed by @florianduros.
+* Fix custom theme support for short hex \& rgba hex strings ([#29726](https://github.com/element-hq/element-web/pull/29726)). Contributed by @t3chguy.
+* New room list: minor visual fixes ([#29723](https://github.com/element-hq/element-web/pull/29723)). Contributed by @florianduros.
+* Fix getOidcCallbackUrl for Element Desktop ([#29711](https://github.com/element-hq/element-web/pull/29711)). Contributed by @t3chguy.
+* Fix some webp images improperly marked as animated ([#29713](https://github.com/element-hq/element-web/pull/29713)). Contributed by @Petersmit27.
+* Revert deletion of hydrateSession ([#29703](https://github.com/element-hq/element-web/pull/29703)). Contributed by @Jujure.
+* Fix converttoroom \& converttodm not working ([#29705](https://github.com/element-hq/element-web/pull/29705)). Contributed by @t3chguy.
+* Ensure forceCloseAllModals also closes priority/static modals ([#29706](https://github.com/element-hq/element-web/pull/29706)). Contributed by @t3chguy.
+* Continue button is disabled when uploading a recovery key file ([#29695](https://github.com/element-hq/element-web/pull/29695)). Contributed by @Giwayume.
+* Catch errors after syncing recovery ([#29691](https://github.com/element-hq/element-web/pull/29691)). Contributed by @andybalaam.
+* New room list: fix multiple visual issues ([#29673](https://github.com/element-hq/element-web/pull/29673)). Contributed by @florianduros.
+* New Room List: Fix mentions filter matching rooms with any highlight ([#29668](https://github.com/element-hq/element-web/pull/29668)). Contributed by @MidhunSureshR.
+*  Fix truncated emoji label during emoji SAS ([#29643](https://github.com/element-hq/element-web/pull/29643)). Contributed by @florianduros.
+* Remove duplicate jitsi link ([#29642](https://github.com/element-hq/element-web/pull/29642)). Contributed by @dbkr.
+
+
 Changes in [1.11.97](https://github.com/element-hq/element-web/releases/tag/v1.11.97) (2025-04-08)
 ==================================================================================================
 ## ✨ Features
@@ -2,6 +2,11 @@

 Everyone is welcome to contribute code to Element Web, provided that they are willing to license their contributions to Element under a [Contributor License Agreement](https://cla-assistant.io/element-hq/element-web) (CLA). This ensures that their contribution will be made available under an OSI-approved open-source license, currently licensed under Affero General Public License v3 (AGPLv3) or General Public License v3 (GPLv3) at your choice.

+If you're contributing, or thinking about contributing, please come & chat to
+us in our development room, [#element-dev](https://matrix.to/#/#element-dev:matrix.org).
+This is the best place to ask questions about the code, how to work on the project
+or whether a change is likely to be accepted.
+
 ## How to contribute

 The preferred and easiest way to contribute changes to the project is to fork
@@ -41,6 +46,9 @@ As for your PR description, it should include these things:
 - Add comments to the diff for the reviewer that might help them to understand
  why the change is necessary or how they might better understand and review it.

+Please **_do not use force push_** in your PRs. Doing so means we can't see what
+has changed. We use squash merge to get a "clean" git history.
+
 ### Changelogs

 There's no need to manually add Changelog entries: we use information in the
@@ -179,6 +187,16 @@ Please ensure your changes match the cosmetic style of the existing project,
 and **_never_** mix cosmetic and functional changes in the same commit, as it
 makes it horribly hard to review otherwise.

+## Shared Components
+
+When creating new UI components, consider whether they should be added to the shared components package (`packages/shared-components`) rather than directly in the main `src/` directory. Components should be placed in shared components if they:
+
+- Are reusable across different parts of the application
+- Could potentially be used by other Element projects (Element Desktop, Aurora, Element modules...)
+- Follow established patterns and don't have tight coupling to specific application logic
+
+For more details, see the [shared components README](./packages/shared-components/README.md).
+
 ## Attribution

 Everyone who contributes anything to Matrix is welcome to be listed in the
@@ -1,46 +0,0 @@
-# syntax=docker.io/docker/dockerfile:1.14-labs
-
-# Builder
-FROM --platform=$BUILDPLATFORM node:22-bullseye AS builder
-
-# Support custom branch of the js-sdk. This also helps us build images of element-web develop.
-ARG USE_CUSTOM_SDKS=false
-ARG JS_SDK_REPO="https://github.com/matrix-org/matrix-js-sdk.git"
-ARG JS_SDK_BRANCH="master"
-
-WORKDIR /src
-
-COPY --exclude=docker . /src
-RUN /src/scripts/docker-link-repos.sh
-RUN yarn --network-timeout=200000 install
-RUN /src/scripts/docker-package.sh
-
-# Copy the config now so that we don't create another layer in the app image
-RUN cp /src/config.sample.json /src/webapp/config.json
-
-# App
-FROM nginxinc/nginx-unprivileged:alpine-slim
-
-# Need root user to install packages & manipulate the usr directory
-USER root
-
-# Install jq and moreutils for sponge, both used by our entrypoints
-RUN apk add jq moreutils
-
-COPY --from=builder /src/webapp /app
-
-# Override default nginx config. Templates in `/etc/nginx/templates` are passed
-# through `envsubst` by the nginx docker image entry point.
-COPY /docker/nginx-templates/* /etc/nginx/templates/
-COPY /docker/docker-entrypoint.d/* /docker-entrypoint.d/
-
-RUN rm -rf /usr/share/nginx/html \
-  && ln -s /app /usr/share/nginx/html
-
-# Run as nginx user by default
-USER nginx
-
-# HTTP listen port
-ENV ELEMENT_WEB_PORT=80
-
-HEALTHCHECK --start-period=5s CMD wget -q --spider http://localhost:$ELEMENT_WEB_PORT/config.json
@@ -9,7 +9,7 @@

 # Element

-Element (formerly known as Vector and Riot) is a Matrix web client built using the [Matrix
+Element (formerly known as Vector and Riot) is a Matrix web & desktop client built using the [Matrix
 JS SDK](https://github.com/matrix-org/matrix-js-sdk).

 # Supported Environments
@@ -27,7 +27,7 @@ Element has several tiers of support for different environments:
 - Best effort
    - Definition:
        - Issues **accepted**, regressions **do not block** the release
-        - The wider Element Products(including Element Call and the Enterprise Server Suite) do still not officially support these browsers.
+        - The wider Element Products (including Element Call and the Enterprise Server Suite) do still not officially support these browsers.
        - The element web project and its contributors should keep the client functioning and gracefully degrade where other sibling features (E.g. Element Call) may not function.
    - Last major release of Firefox ESR and Chrome/Edge Extended Stable
 - Community Supported
@@ -42,8 +42,8 @@ Element has several tiers of support for different environments:
 The period of support for these tiers should last until the releases specified above, plus 1 app release cycle(2 weeks). In the case of Firefox ESR this is extended further to allow it land in Debian Stable.

 For accessing Element on an Android or iOS device, we currently recommend the
-native apps [element-android](https://github.com/element-hq/element-android)
-and [element-ios](https://github.com/element-hq/element-ios).
+native apps [element-x-android](https://github.com/element-hq/element-x-android)
+and [element-x-ios](https://github.com/element-hq/element-x-ios).

 # Getting Started

@@ -55,91 +55,16 @@ To host your own instance of Element see [Installing Element Web](docs/install.m

 To install Element as a desktop application, see [Running as a desktop app](#running-as-a-desktop-app) below.

-# Important Security Notes
+---

-## Separate domains
+# Monorepo

-We do not recommend running Element from the same domain name as your Matrix
-homeserver. The reason is the risk of XSS (cross-site-scripting)
-vulnerabilities that could occur if someone caused Element to load and render
-malicious user generated content from a Matrix API which then had trusted
-access to Element (or other apps) due to sharing the same domain.
+This repository is a monorepo hosting Element Web and other related projects in various subdirectories.
+You can read more about the structure [here](docs/monorepo.md).

-We have put some coarse mitigations into place to try to protect against this
-situation, but it's still not good practice to do it in the first place. See
-<https://github.com/element-hq/element-web/issues/1977> for more details.
+# Element Web

-## Configuration best practices
-
-Unless you have special requirements, you will want to add the following to
-your web server configuration when hosting Element Web:
-
- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
-  framed and protect from [clickjacking][owasp-clickjacking].
- The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
-  header, as the modern replacement for `X-Frame-Options` (though both should be
-  included since not all browsers support it yet, see
-  [this][owasp-clickjacking-csp]).
- The `X-Content-Type-Options: nosniff` header, to [disable MIME
-  sniffing][mime-sniffing].
- The `X-XSS-Protection: 1; mode=block;` header, for basic XSS protection in
-  legacy browsers.
-
-[mime-sniffing]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing
-[owasp-clickjacking-csp]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#content-security-policy-frame-ancestors-examples
-[owasp-clickjacking]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
-
-If you are using nginx, this would look something like the following:
-
-```
-add_header X-Frame-Options SAMEORIGIN;
-add_header X-Content-Type-Options nosniff;
-add_header X-XSS-Protection "1; mode=block";
-add_header Content-Security-Policy "frame-ancestors 'self'";
-```
-
-For Apache, the configuration looks like:
-
-```
-Header set X-Frame-Options SAMEORIGIN
-Header set X-Content-Type-Options nosniff
-Header set X-XSS-Protection "1; mode=block"
-Header set Content-Security-Policy "frame-ancestors 'self'"
-```
-
-Note: In case you are already setting a `Content-Security-Policy` header
-elsewhere, you should modify it to include the `frame-ancestors` directive
-instead of adding that last line.
-
-# Building From Source
-
-Element is a modular webapp built with modern ES6 and uses a Node.js build system.
-Ensure you have the latest LTS version of Node.js installed.
-
-Using `yarn` instead of `npm` is recommended. Please see the Yarn [install
-guide](https://classic.yarnpkg.com/en/docs/install) if you do not have it already.
-
-1. Install or update `node.js` so that your `node` is at least the current recommended LTS.
-1. Install `yarn` if not present already.
-1. Clone the repo: `git clone https://github.com/element-hq/element-web.git`.
-1. Switch to the element-web directory: `cd element-web`.
-1. Install the prerequisites: `yarn install`.
-    - If you're using the `develop` branch, then it is recommended to set up a
-      proper development environment (see [Setting up a dev
-      environment](#setting-up-a-dev-environment) below). Alternatively, you
-      can use <https://develop.element.io> - the continuous integration release of
-      the develop branch.
-1. Configure the app by copying `config.sample.json` to `config.json` and
-   modifying it. See the [configuration docs](docs/config.md) for details.
-1. `yarn dist` to build a tarball to deploy. Untaring this file will give
-   a version-specific directory containing all the files that need to go on your
-   web server.
-
-Note that `yarn dist` is not supported on Windows, so Windows users can run `yarn build`,
-which will build all the necessary files into the `webapp` directory. The version of Element
-will not appear in Settings without using the dist script. You can then mount the
-`webapp` directory on your web server to actually serve up the app, which is
-entirely static content.
+To learn more about Element Web [click here](apps/web/README.md)

 # Running as a Desktop app

@@ -153,33 +78,6 @@ Many thanks to @aviraldg for the initial work on the Electron integration.

 The [configuration docs](docs/config.md#desktop-app-configuration) show how to override the desktop app's default settings if desired.

-# config.json
-
-Element supports a variety of settings to configure default servers, behaviour, themes, etc.
-See the [configuration docs](docs/config.md) for more details.
-
-# Labs Features
-
-Some features of Element may be enabled by flags in the `Labs` section of the settings.
-Some of these features are described in [labs.md](https://github.com/element-hq/element-web/blob/develop/docs/labs.md).
-
-# Caching requirements
-
-Element requires the following URLs not to be cached, when/if you are serving Element from your own webserver:
-
-```
-/config.*.json
-/i18n
-/home
-/sites
-/index.html
-```
-
-We also recommend that you force browsers to re-validate any cached copy of Element on page load by configuring your
-webserver to return `Cache-Control: no-cache` for `/`. This ensures the browser will fetch a new version of Element on
-the next page load after it's been deployed. Note that this is already configured for you in the nginx config of our
-Dockerfile.
-
 # Development

 Please read through the following:
@@ -214,3 +112,6 @@ This software is multi licensed by New Vector Ltd (Element). It can be used eith

 (3) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
 Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
+
+Please contact [licensing@element.io](mailto:licensing@element.io) to purchase
+an Element commercial license for this software.
@@ -7,6 +7,7 @@ karma-reports/
 .idea/
 .tmp/
 config.json*
+.link-config
 # Exclude the playwright directory as much as we can as the snapshots are huge and we bind mount it in
 playwright/
 !playwright/docker-entrypoint.sh
@@ -0,0 +1,18 @@
+src/vector/modernizr.cjs
+test/end-to-end-tests/node_modules/
+test/end-to-end-tests/element/
+test/end-to-end-tests/synapse/
+test/end-to-end-tests/lib/
+# Legacy skinning file that some people might still have
+src/component-index.js
+# Auto-generated file
+src/modules.ts
+src/modules.js
+# Test result files
+/playwright/test-results/
+/playwright/html-report/
+
+# Shared components generated files
+/packages/shared-components/dist/
+/packages/shared-components/src/i18n/i18nKeys.d.ts
+/packages/shared-components/typedoc/
@@ -0,0 +1,347 @@
+/*
+Copyright 2025 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+module.exports = {
+    plugins: ["matrix-org", "eslint-plugin-react-compiler"],
+    extends: ["plugin:matrix-org/babel", "plugin:matrix-org/react", "plugin:matrix-org/a11y"],
+    parserOptions: {
+        project: ["./tsconfig.json"],
+        tsconfigRootDir: __dirname,
+    },
+    env: {
+        browser: true,
+        node: true,
+    },
+    globals: {
+        LANGUAGES_FILE: "readonly",
+    },
+    rules: {
+        // Things we do that break the ideal style
+        "no-constant-condition": "off",
+        "prefer-promise-reject-errors": "off",
+        "no-async-promise-executor": "off",
+        "no-extra-boolean-cast": "off",
+
+        // Bind or arrow functions in props causes performance issues (but we
+        // currently use them in some places).
+        // It's disabled here, but we should using it sparingly.
+        "react/jsx-no-bind": "off",
+        "react/jsx-key": ["error"],
+
+        "no-restricted-properties": [
+            "error",
+            ...buildRestrictedPropertiesOptions(
+                ["window.innerHeight", "window.innerWidth", "window.visualViewport"],
+                "Use UIStore to access window dimensions instead.",
+            ),
+            ...buildRestrictedPropertiesOptions(
+                ["React.forwardRef", "*.forwardRef", "forwardRef"],
+                "Use ref props instead.",
+            ),
+            ...buildRestrictedPropertiesOptions(
+                ["*.mxcUrlToHttp", "*.getHttpUriForMxc"],
+                "Use Media helper instead to centralise access for customisation.",
+            ),
+            ...buildRestrictedPropertiesOptions(["window.setImmediate"], "Use setTimeout instead."),
+        ],
+        "no-restricted-globals": [
+            "error",
+            {
+                name: "setImmediate",
+                message: "Use setTimeout instead.",
+            },
+            {
+                name: "Buffer",
+                message: "Buffer is not available in the web.",
+            },
+        ],
+
+        "import/no-duplicates": ["error"],
+        // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
+        // Ban compound-design-tokens raw svg imports in favour of their React component counterparts
+        "no-restricted-imports": [
+            "error",
+            {
+                paths: [
+                    {
+                        name: "react",
+                        importNames: ["forwardRef"],
+                        message: "Use ref props instead.",
+                    },
+                    {
+                        name: "@testing-library/react",
+                        message: "Please use jest-matrix-react instead",
+                    },
+                    {
+                        name: "matrix-js-sdk",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/src",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/src/",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/src/index",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "emojibase-regex",
+                        message:
+                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
+                    },
+                ],
+                patterns: [
+                    {
+                        group: [
+                            "matrix-js-sdk/src/**",
+                            "!matrix-js-sdk/src/matrix",
+                            "!matrix-js-sdk/src/crypto-api",
+                            "!matrix-js-sdk/src/types",
+                            "!matrix-js-sdk/src/testing",
+                            "!matrix-js-sdk/src/utils/**",
+                            "matrix-js-sdk/src/utils/internal/**",
+                            "matrix-js-sdk/lib",
+                            "matrix-js-sdk/lib/",
+                            "matrix-js-sdk/lib/**",
+                            // XXX: Temporarily allow these as they are not available via the main export
+                            "!matrix-js-sdk/src/logger",
+                            "!matrix-js-sdk/src/errors",
+                            "!matrix-js-sdk/src/utils",
+                            "!matrix-js-sdk/src/version-support",
+                            "!matrix-js-sdk/src/randomstring",
+                            "!matrix-js-sdk/src/sliding-sync",
+                            "!matrix-js-sdk/src/browser-index",
+                            "!matrix-js-sdk/src/feature",
+                            "!matrix-js-sdk/src/NamespacedValue",
+                            "!matrix-js-sdk/src/ReEmitter",
+                            "!matrix-js-sdk/src/event-mapper",
+                            "!matrix-js-sdk/src/interactive-auth",
+                            "!matrix-js-sdk/src/secret-storage",
+                            "!matrix-js-sdk/src/room-hierarchy",
+                            "!matrix-js-sdk/src/rendezvous",
+                            "!matrix-js-sdk/src/indexeddb-worker",
+                            "!matrix-js-sdk/src/pushprocessor",
+                            "!matrix-js-sdk/src/extensible_events_v1",
+                            "!matrix-js-sdk/src/extensible_events_v1/PollStartEvent",
+                            "!matrix-js-sdk/src/extensible_events_v1/PollResponseEvent",
+                            "!matrix-js-sdk/src/extensible_events_v1/PollEndEvent",
+                            "!matrix-js-sdk/src/extensible_events_v1/InvalidEventError",
+                            "!matrix-js-sdk/src/oidc",
+                            "!matrix-js-sdk/src/oidc/discovery",
+                            "!matrix-js-sdk/src/oidc/authorize",
+                            "!matrix-js-sdk/src/oidc/validate",
+                            "!matrix-js-sdk/src/oidc/error",
+                            "!matrix-js-sdk/src/oidc/register",
+                            "!matrix-js-sdk/src/webrtc",
+                            "!matrix-js-sdk/src/webrtc/call",
+                            "!matrix-js-sdk/src/webrtc/callFeed",
+                            "!matrix-js-sdk/src/webrtc/mediaHandler",
+                            "!matrix-js-sdk/src/webrtc/callEventTypes",
+                            "!matrix-js-sdk/src/webrtc/callEventHandler",
+                            "!matrix-js-sdk/src/webrtc/groupCallEventHandler",
+                            "!matrix-js-sdk/src/models",
+                            "!matrix-js-sdk/src/models/read-receipt",
+                            "!matrix-js-sdk/src/models/relations-container",
+                            "!matrix-js-sdk/src/models/related-relations",
+                            "!matrix-js-sdk/src/matrixrtc",
+                        ],
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        group: ["emojibase-regex/emoji*"],
+                        message:
+                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
+                    },
+                    {
+                        group: ["@vector-im/compound-design-tokens/icons/*"],
+                        message: "Please use @vector-im/compound-design-tokens/assets/web/icons/* instead",
+                    },
+                    {
+                        group: ["**/packages/shared-components/**", "../packages/shared-components/**"],
+                        message: "Please use @element-hq/web-shared-components",
+                    },
+                ],
+            },
+        ],
+
+        // There are too many a11y violations to fix at once
+        // Turn violated rules off until they are fixed
+        "jsx-a11y/aria-activedescendant-has-tabindex": "off",
+        "jsx-a11y/click-events-have-key-events": "off",
+        "jsx-a11y/interactive-supports-focus": "off",
+        "jsx-a11y/media-has-caption": "off",
+        "jsx-a11y/mouse-events-have-key-events": "off",
+        "jsx-a11y/no-autofocus": "off",
+        "jsx-a11y/no-noninteractive-element-interactions": "off",
+        "jsx-a11y/no-noninteractive-element-to-interactive-role": "off",
+        "jsx-a11y/no-noninteractive-tabindex": "off",
+        "jsx-a11y/no-static-element-interactions": "off",
+        "jsx-a11y/role-supports-aria-props": "off",
+
+        "matrix-org/require-copyright-header": "error",
+
+        "react-compiler/react-compiler": "error",
+    },
+    overrides: [
+        {
+            files: ["src/**/*.{ts,tsx}", "test/**/*.{ts,tsx}", "playwright/**/*.ts", "*.ts"],
+            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
+            rules: {
+                "@typescript-eslint/unbound-method": ["error", { ignoreStatic: true }],
+                "@typescript-eslint/explicit-function-return-type": [
+                    "error",
+                    {
+                        allowExpressions: true,
+                    },
+                ],
+
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "no-extra-boolean-cast": "off",
+
+                // Remove Babel things manually due to override limitations
+                "@babel/no-invalid-this": ["off"],
+
+                // We're okay being explicit at the moment
+                "@typescript-eslint/no-empty-interface": "off",
+                // We disable this while we're transitioning
+                "@typescript-eslint/no-explicit-any": "off",
+                // We'd rather not do this but we do
+                "@typescript-eslint/ban-ts-comment": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+                "@typescript-eslint/no-empty-object-type": [
+                    "error",
+                    {
+                        // We do this sometimes to brand interfaces
+                        allowInterfaces: "with-single-extends",
+                    },
+                ],
+            },
+        },
+        {
+            files: ["test/**/*.{ts,tsx}", "playwright/**/*.ts"],
+            extends: ["plugin:matrix-org/jest"],
+            rules: {
+                // We don't need super strict typing in test utilities
+                "@typescript-eslint/explicit-function-return-type": "off",
+                "@typescript-eslint/explicit-member-accessibility": "off",
+                "@typescript-eslint/no-empty-object-type": "off",
+                "@typescript-eslint/unbound-method": "off",
+
+                // Jest/Playwright specific
+
+                // Disabled tests are a reality for now but as soon as all of the xits are
+                // eliminated, we should enforce this.
+                "jest/no-disabled-tests": "off",
+                // Also treat "oldBackendOnly" as a test function.
+                // Used in some crypto tests.
+                "jest/no-standalone-expect": [
+                    "error",
+                    {
+                        additionalTestBlockFunctions: ["beforeAll", "beforeEach", "oldBackendOnly"],
+                    },
+                ],
+
+                // These are fine in tests
+                "no-restricted-globals": "off",
+                "react-compiler/react-compiler": "off",
+            },
+        },
+        {
+            files: ["playwright/**/*.ts"],
+            parserOptions: {
+                project: ["./playwright/tsconfig.json"],
+            },
+            rules: {
+                "react-hooks/rules-of-hooks": ["off"],
+                "@typescript-eslint/no-floating-promises": ["error"],
+            },
+        },
+        {
+            files: ["module_system/**/*.{ts,tsx}"],
+            parserOptions: {
+                project: ["./tsconfig.module_system.json"],
+            },
+            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
+            // NOTE: These rules are frozen and new rules should not be added here.
+            // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                // We disable this while we're transitioning
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+
+                // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
+                "no-restricted-imports": [
+                    "error",
+                    {
+                        paths: [
+                            {
+                                name: "matrix-js-sdk",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/src",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/src/",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/src/index",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                        ],
+                        patterns: [
+                            {
+                                group: ["matrix-js-sdk/lib", "matrix-js-sdk/lib/", "matrix-js-sdk/lib/**"],
+                                message: "Please use matrix-js-sdk/src/* instead",
+                            },
+                        ],
+                    },
+                ],
+            },
+        },
+    ],
+    settings: {
+        react: {
+            version: "detect",
+        },
+    },
+};
+
+function buildRestrictedPropertiesOptions(properties, message) {
+    return properties.map((prop) => {
+        let [object, property] = prop.split(".");
+        if (object === "*") {
+            object = undefined;
+        }
+        return {
+            object,
+            property,
+            message,
+        };
+    });
+}
@@ -0,0 +1,9 @@
+/webapp
+/config.json
+/config.json.*
+/config.local*.json
+# Legacy skinning file that some people might still have
+/src/component-index.js
+# Auto-generated file
+/src/modules.js
+/build_config.yaml
@@ -0,0 +1,7 @@
+{
+    "*": "prettier --write --ignore-unknown",
+    "src/**/*.(ts|tsx)": ["eslint --fix"],
+    "scripts/**/*.(ts|tsx)": ["eslint --fix"],
+    "module_system/**/*.(ts|tsx)": ["eslint --fix"],
+    "*.pcss": ["stylelint --fix"]
+}
@@ -0,0 +1,80 @@
+module.exports = {
+    extends: ["stylelint-config-standard"],
+    customSyntax: "postcss-scss",
+    plugins: ["stylelint-scss", "stylelint-value-no-unknown-custom-properties"],
+    rules: {
+        "comment-empty-line-before": null,
+        "declaration-empty-line-before": null,
+        "length-zero-no-unit": null,
+        "rule-empty-line-before": null,
+        "color-hex-length": null,
+        "at-rule-no-unknown": null,
+        "no-descending-specificity": null,
+        "scss/at-rule-no-unknown": [
+            true,
+            {
+                // https://github.com/vector-im/element-web/issues/10544
+                ignoreAtRules: ["define-mixin"],
+            },
+        ],
+        // Disable `&_kind`-style selectors while our unused CSS approach is "Find & Replace All"
+        // rather than a CI thing. Shorthand selectors are harder to detect when searching for a
+        // class name. This regex is trying to *allow* anything except `&words`, such as `&::before`,
+        // `&.mx_Class`, etc.
+        "selector-nested-pattern": "^((&[ :.\\[,])|([^&]))",
+        // Disable some defaults
+        "selector-class-pattern": null,
+        "custom-property-pattern": null,
+        "selector-id-pattern": null,
+        "keyframes-name-pattern": null,
+        "alpha-value-notation": null,
+        "color-function-notation": null,
+        "selector-not-notation": null,
+        "import-notation": null,
+        "value-keyword-case": null,
+        "declaration-block-no-redundant-longhand-properties": null,
+        "shorthand-property-no-redundant-values": null,
+        "property-no-vendor-prefix": null,
+        "selector-no-vendor-prefix": null,
+        "media-feature-name-no-vendor-prefix": null,
+        "number-max-precision": null,
+        "no-invalid-double-slash-comments": true,
+        "media-feature-range-notation": null,
+        "declaration-property-value-no-unknown": null,
+        "declaration-property-value-keyword-no-deprecated": null,
+        "csstools/value-no-unknown-custom-properties": [
+            true,
+            {
+                importFrom: [
+                    { from: "res/css/_common.pcss", type: "css" },
+                    { from: "res/themes/light/css/_light.pcss", type: "css" },
+                    // Right now our styles share vars all over the place, this is not ideal but acceptable for now
+                    { from: "res/css/views/rooms/_EventTile.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_IRCLayout.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_EventBubbleTile.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_ReadReceiptGroup.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_EditMessageComposer.pcss", type: "css" },
+                    { from: "res/css/views/right_panel/_BaseCard.pcss", type: "css" },
+                    { from: "res/css/views/messages/_MessageActionBar.pcss", type: "css" },
+                    { from: "res/css/views/voip/LegacyCallView/_LegacyCallViewButtons.pcss", type: "css" },
+                    { from: "res/css/views/elements/_ToggleSwitch.pcss", type: "css" },
+                    { from: "res/css/views/settings/tabs/_SettingsTab.pcss", type: "css" },
+                    { from: "res/css/structures/_RoomView.pcss", type: "css" },
+                    // Compound vars
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-base.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-semantic.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-base-mq.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-semantic-mq.css",
+                ],
+            },
+        ],
+        "property-no-deprecated": [
+            true,
+            {
+                ignoreProperties: ["-webkit-box-orient", "word-wrap"],
+            },
+        ],
+        "nesting-selector-no-missing-scoping-root": null,
+        "no-invalid-position-declaration": null,
+    },
+};
@@ -0,0 +1,8 @@
+/*
+ * Copyright 2025 New Vector Ltd.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+ * Please see LICENSE files in the repository root for full details.
+ */
+
+declare module "*.module.css";
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-easings" {
+    export default function (): void;
+}
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-hexrgba" {
+    export default function (): void;
+}
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-mixins" {
+    export default function (): void;
+}
@@ -0,0 +1,19 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "webpack-version-file-plugin" {
+    interface Opts {
+        outputFile: string;
+        template?: string;
+        templateString?: string;
+        extras?: Record<string, string>;
+    }
+
+    export default class VersionFilePlugin {
+        public constructor(opts: Opts);
+    }
+}
@@ -0,0 +1,47 @@
+# syntax=docker.io/docker/dockerfile:1.21-labs@sha256:2e681d22e86e738a057075f930b81b2ab8bc2a34cd16001484a7453cfa7a03fb
+
+# Builder
+FROM --platform=$BUILDPLATFORM node:24-bullseye@sha256:d83f76ec9956d35fe14221022e8b5a87a5de6fcdb4edb1187eddeb7dc80cba71 AS builder
+
+# Support custom branch of the js-sdk. This also helps us build images of element-web develop.
+ARG USE_CUSTOM_SDKS=false
+ARG JS_SDK_REPO="https://github.com/matrix-org/matrix-js-sdk.git"
+ARG JS_SDK_BRANCH="master"
+
+WORKDIR /src
+
+COPY --exclude=docker . /src
+RUN corepack enable
+RUN /src/scripts/docker-link-repos.sh
+RUN pnpm install
+RUN /src/scripts/docker-package.sh
+
+# Copy the config now so that we don't create another layer in the app image
+RUN cp /src/apps/web/config.sample.json /src/apps/web/webapp/config.json
+
+# App
+FROM nginxinc/nginx-unprivileged:alpine-slim@sha256:800307aaf07c143f5d90aa9d4269cc1971dcfe5aee7cabd11579ac4c6bcf198f
+
+# Need root user to install packages & manipulate the usr directory
+USER root
+
+# Install jq and moreutils for sponge, both used by our entrypoints
+RUN apk add jq moreutils
+
+COPY --from=builder /src/apps/web/webapp /app
+
+# Override default nginx config. Templates in `/etc/nginx/templates` are passed
+# through `envsubst` by the nginx docker image entry point.
+COPY /apps/web/docker/nginx-templates/* /etc/nginx/templates/
+COPY /apps/web/docker/docker-entrypoint.d/* /docker-entrypoint.d/
+
+RUN rm -rf /usr/share/nginx/html \
+  && ln -s /app /usr/share/nginx/html
+
+# Run as nginx user by default
+USER nginx
+
+# HTTP listen port
+ENV ELEMENT_WEB_PORT=80
+
+HEALTHCHECK --start-period=5s CMD wget -q --spider http://localhost:$ELEMENT_WEB_PORT/config.json
@@ -0,0 +1,123 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import webpack from "webpack";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import _ from "lodash";
+import { type Translations } from "matrix-web-i18n";
+
+interface Options {
+    // Path to the strings for the application, will be used to deduce what languages are supported
+    stringsPath: string;
+    // Additional paths to strings which will be merged into the application's own strings for supported languages
+    additionalStringsPaths?: string[];
+}
+
+async function exists(path: string): Promise<boolean> {
+    try {
+        await fs.access(path);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+export class I18nWebpackPlugin {
+    private readonly options: Options;
+
+    public constructor(options: Options) {
+        this.options = options;
+    }
+
+    public apply(compiler: webpack.Compiler): void {
+        const { RawSource } = compiler.webpack.sources;
+
+        compiler.hooks.thisCompilation.tap("I18nWebpackPlugin", (compilation) => {
+            compilation.hooks.processAssets.tapPromise(
+                {
+                    name: "I18nWebpackPlugin",
+                    stage: webpack.Compilation.PROCESS_ASSETS_STAGE_ADDITIONS,
+                },
+                async () => {
+                    const paths = [this.options.stringsPath, ...(this.options.additionalStringsPaths ?? [])].map((p) =>
+                        path.resolve(compiler.context, p),
+                    );
+
+                    const logger = compilation.getLogger("I18nWebpackPlugin");
+
+                    for (const p of paths) {
+                        compilation.contextDependencies.add(p);
+
+                        if (!(await exists(p))) {
+                            compilation.errors.push(
+                                new webpack.WebpackError(`I18nWebpackPlugin: strings path not found: ${p}`),
+                            );
+                            return;
+                        }
+                    }
+
+                    const primaryPath = paths[0];
+                    const includeLangs = [...new Set([...(await fs.readdir(primaryPath))])]
+                        .filter((fn) => fn.endsWith(".json"))
+                        .map((f) => f.slice(0, -5));
+
+                    const langFileMap: Record<string, string> = {};
+
+                    for (const lang of includeLangs) {
+                        let translations: Translations = {};
+                        for (const p of paths) {
+                            const f = path.join(p, lang + ".json");
+
+                            if (await exists(f)) {
+                                try {
+                                    const content = await fs.readFile(f, "utf-8");
+                                    translations = _.merge(translations, JSON.parse(content));
+                                    compilation.fileDependencies.add(f);
+                                } catch (e) {
+                                    compilation.errors.push(
+                                        new webpack.WebpackError(
+                                            `I18nWebpackPlugin: Failed to read or parse ${f}: ${e}`,
+                                        ),
+                                    );
+                                }
+                            }
+                        }
+
+                        const json = JSON.stringify(translations, null, 4);
+                        const jsonBuffer = Buffer.from(json);
+                        const digest = compiler.webpack.util
+                            .createHash("xxhash64")
+                            .update(jsonBuffer)
+                            .digest("hex")
+                            .slice(0, 7);
+                        const filename = `${lang}.${digest}.json`;
+
+                        compilation.emitAsset(`i18n/${filename}`, new RawSource(jsonBuffer));
+                        langFileMap[lang] = filename;
+                        logger.debug(`Generated language file: ${filename}`);
+                    }
+
+                    // Generate languages.json
+                    const languages: Record<string, string> = {};
+                    includeLangs.forEach((lang) => {
+                        const normalizedLanguage = lang.toLowerCase().replace("_", "-");
+                        const languageParts = normalizedLanguage.split("-");
+                        if (languageParts.length == 2 && languageParts[0] == languageParts[1]) {
+                            languages[languageParts[0]] = langFileMap[lang];
+                        } else {
+                            languages[normalizedLanguage] = langFileMap[lang];
+                        }
+                    });
+
+                    compilation.emitAsset("i18n/languages.json", new RawSource(JSON.stringify(languages, null, 4)));
+                    logger.info("Generated languages.json and language files");
+                },
+            );
+        });
+    }
+}
@@ -0,0 +1,131 @@
+# Important Security Notes
+
+## Separate domains
+
+We do not recommend running Element from the same domain name as your Matrix
+homeserver. The reason is the risk of XSS (cross-site-scripting)
+vulnerabilities that could occur if someone caused Element to load and render
+malicious user generated content from a Matrix API which then had trusted
+access to Element (or other apps) due to sharing the same domain.
+
+We have put some coarse mitigations into place to try to protect against this
+situation, but it's still not good practice to do it in the first place. See
+<https://github.com/element-hq/element-web/issues/1977> for more details.
+
+## Configuration best practices
+
+Unless you have special requirements, you will want to add the following to
+your web server configuration when hosting Element Web:
+
+- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
+  framed and protect from [clickjacking][owasp-clickjacking].
+- The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
+  header, as the modern replacement for `X-Frame-Options` (though both should be
+  included since not all browsers support it yet, see
+  [this][owasp-clickjacking-csp]).
+- The `X-Content-Type-Options: nosniff` header, to [disable MIME
+  sniffing][mime-sniffing].
+- The `X-XSS-Protection: 1; mode=block;` header, for basic XSS protection in
+  legacy browsers.
+
+[mime-sniffing]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing
+[owasp-clickjacking-csp]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#content-security-policy-frame-ancestors-examples
+[owasp-clickjacking]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
+
+If you are using nginx, this would look something like the following:
+
+```
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header Content-Security-Policy "frame-ancestors 'self'";
+```
+
+For Apache, the configuration looks like:
+
+```
+Header set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Content-Security-Policy "frame-ancestors 'self'"
+```
+
+Note: In case you are already setting a `Content-Security-Policy` header
+elsewhere, you should modify it to include the `frame-ancestors` directive
+instead of adding that last line.
+
+# Building From Source
+
+Element is a modular webapp built with modern ES6 and uses a Node.js build system.
+Ensure you have the latest LTS version of Node.js installed.
+
+Using `pnpm` instead of `npm` is recommended. Please see the pnpm [install
+guide](https://pnpm.io/installation#using-corepack) if you do not have it already.
+
+1. Install or update `node.js` so that your `node` is at least the current recommended LTS.
+1. Install `pnpm` if not present already.
+1. Clone the repo: `git clone https://github.com/element-hq/element-web.git`.
+1. Switch to the element-web directory: `cd element-web/apps/web`.
+1. Install the prerequisites: `pnpm install`.
+    - If you're using the `develop` branch, then it is recommended to set up a
+      proper development environment (see [Setting up a dev
+      environment](../../developer_guide.md#setting-up-a-dev-environment) below). Alternatively, you
+      can use <https://develop.element.io> - the continuous integration release of
+      the develop branch.
+1. Configure the app by copying `config.sample.json` to `config.json` and
+   modifying it. See the [configuration docs](../../docs/config.md) for details.
+1. `pnpm dist` to build a tarball to deploy. Untaring this file will give
+   a version-specific directory containing all the files that need to go on your
+   web server.
+
+Note that `pnpm dist` is not supported on Windows, so Windows users can run `pnpm build`,
+which will build all the necessary files into the `webapp` directory. The version of Element
+will not appear in Settings without using the dist script. You can then mount the
+`webapp` directory on your web server to actually serve up the app, which is
+entirely static content.
+
+# config.json
+
+Element supports a variety of settings to configure default servers, behaviour, themes, etc.
+See the [configuration docs](../../docs/config.md) for more details.
+
+# Labs Features
+
+Some features of Element may be enabled by flags in the `Labs` section of the settings.
+Some of these features are described in [labs.md](https://github.com/element-hq/element-web/blob/develop/docs/labs.md).
+
+# Caching requirements
+
+Element requires the following URLs not to be cached, when/if you are serving Element from your own webserver:
+
+```
+/config.*.json
+/i18n
+/home
+/sites
+/index.html
+```
+
+We also recommend that you force browsers to re-validate any cached copy of Element on page load by configuring your
+webserver to return `Cache-Control: no-cache` for `/`. This ensures the browser will fetch a new version of Element on
+the next page load after it's been deployed. Note that this is already configured for you in the nginx config of our
+Dockerfile.
+
+# Development
+
+Please read through the following:
+
+1. [Developer guide](../../developer_guide.md)
+2. [Code style](../../code_style.md)
+3. [Contribution guide](../../CONTRIBUTING.md)
+
+# Extending Element Web with Modules
+
+Element Web supports a module system that allows you to extend or modify functionality at runtime. Modules are loaded dynamically and provide a safe, predictable API for customization.
+
+## What are modules?
+
+Modules are extensions that can add or modify Element Web's functionality. They are:
+
+- Built using the [`@element-hq/element-web-module-api`](https://github.com/element-hq/element-modules/tree/main/packages/element-web-module-api)
+- Loaded in EW via [config.json](../../docs/config.md#modules)
@@ -16,7 +16,7 @@
 # The modules to install. See ./docs/modules.md for more information on
 # what modules are.
 #
-# The values of this are provided to `yarn add` for inclusion.
+# The values of this are provided to `pnpm add` for inclusion.
 modules:
    # An example of pulling a module from NPM
    - "@vector-im/element-web-ilag-module@^0.0.1"
@@ -20,8 +20,7 @@
        "https://scalar.vector.im/_matrix/integrations/v1",
        "https://scalar.vector.im/api",
        "https://scalar-staging.vector.im/_matrix/integrations/v1",
-        "https://scalar-staging.vector.im/api",
-        "https://scalar-staging.riot.im/scalar/api"
+        "https://scalar-staging.vector.im/api"
    ],
    "default_widget_container_height": 280,
    "default_country_code": "GB",
@@ -44,7 +43,6 @@
    },
    "element_call": {
        "url": "https://call.element.io",
-        "participant_limit": 8,
        "brand": "Element Call"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
@@ -14,10 +14,9 @@ entrypoint_log() {
 mkdir -p /tmp/element-web-config
 cp /app/config*.json /tmp/element-web-config/

-# If there are modules to be loaded
-if [ -d "/modules" ]; then
+# If the module directory exists AND the module directory has modules in it
+if [ -d "/modules" ] && [ "$( ls -A '/modules' )" ]; then
    cd /modules
-
    for MODULE in *
    do
        # If the module has a package.json, use its main field as the entrypoint
@@ -0,0 +1,56 @@
+{
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "show_labs_settings": false,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 60
+    },
+    "features": {
+        "feature_video_rooms": true,
+        "feature_group_calls": true,
+        "feature_element_call_video_rooms": true
+    },
+    "element_call": {
+        "url": "https://call.element.io"
+    }
+}
@@ -0,0 +1,62 @@
+{
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "show_labs_settings": true,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "sentry": {
+        "dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6",
+        "environment": "develop"
+    },
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "features": {
+        "threadsActivityCentre": true,
+        "feature_video_rooms": true,
+        "feature_group_calls": true,
+        "feature_element_call_video_rooms": true
+    },
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 100,
+        "Registration.mobileRegistrationHelper": true
+    },
+    "element_call": {
+        "url": "https://call.element.dev"
+    },
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+}
@@ -0,0 +1,78 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { env } from "process";
+
+import type { Config } from "jest";
+
+const config: Config = {
+    testEnvironment: "jest-fixed-jsdom",
+    testEnvironmentOptions: {
+        url: "http://localhost/",
+        // This is needed to be able to load dual CJS/ESM WASM packages e.g. rust crypto & matrix-wywiwyg
+        customExportConditions: ["browser", "node"],
+    },
+    transform: {
+        "\\.[jt]sx?$": "babel-jest",
+    },
+    testMatch: ["<rootDir>/test/**/*-test.[tj]s?(x)"],
+    globalSetup: "<rootDir>/test/globalSetup.ts",
+    setupFiles: ["jest-canvas-mock", "web-streams-polyfill/polyfill"],
+    setupFilesAfterEnv: ["<rootDir>/test/setupTests.ts"],
+    moduleNameMapper: {
+        // Support CSS module
+        "\\.(module.css)$": "identity-obj-proxy",
+        "\\.(css|scss|pcss)$": "<rootDir>/__mocks__/cssMock.js",
+        "\\.(gif|png|ttf|woff2)$": "<rootDir>/__mocks__/imageMock.js",
+        "\\.svg$": "<rootDir>/__mocks__/svg.js",
+        "\\$webapp/i18n/languages.json": "<rootDir>/__mocks__/languages.json",
+        "^react$": "<rootDir>/../../node_modules/react",
+        "^react-dom$": "<rootDir>/../../node_modules/react-dom",
+        "^matrix-js-sdk$": "<rootDir>/../../node_modules/matrix-js-sdk/src",
+        "^matrix-react-sdk$": "<rootDir>/src",
+        "decoderWorker\\.min\\.js": "<rootDir>/__mocks__/empty.js",
+        "decoderWorker\\.min\\.wasm": "<rootDir>/__mocks__/empty.js",
+        "waveWorker\\.min\\.js": "<rootDir>/__mocks__/empty.js",
+        "context-filter-polyfill": "<rootDir>/__mocks__/empty.js",
+        "workers/(.+)Factory": "<rootDir>/__mocks__/workerFactoryMock.js",
+        "^!!raw-loader!.*": "jest-raw-loader",
+        "recorderWorkletFactory": "<rootDir>/__mocks__/empty.js",
+        "counterpart": "<rootDir>/../../node_modules/counterpart",
+        "@vector-im/compound-web": "<rootDir>/../../node_modules/@vector-im/compound-web",
+    },
+    transformIgnorePatterns: [
+        "/node_modules/(?!(mime|matrix-js-sdk|uuid|p-retry|is-network-error|react-merge-refs|is-ip|ip-regex|super-regex|function-timeout|time-span|convert-hrtime|clone-regexp|is-regexp|matrix-web-i18n|await-lock|@element-hq/web-shared-components|react-virtuoso|lodash)).+$",
+    ],
+    collectCoverageFrom: [
+        "<rootDir>/src/**/*.{js,ts,tsx}",
+        "<rootDir>/packages/**/*.{js,ts,tsx}",
+        // getSessionLock is piped into a different JS context via stringification, and the coverage functionality is
+        // not available in that contest. So, turn off coverage instrumentation for it.
+        "!<rootDir>/src/utils/SessionLock.ts",
+        // Coverage chokes on type definition files
+        "!<rootDir>/src/**/*.d.ts",
+    ],
+    coverageReporters: ["text-summary", "lcov"],
+    prettierPath: null,
+    moduleDirectories: ["node_modules", "test/test-utils"],
+};
+
+// if we're running under GHA, enable relevant reporters
+if (env["GITHUB_ACTIONS"] !== undefined) {
+    config.reporters ??= [];
+    config.reporters.push(["github-actions", { silent: false }]);
+    config.reporters.push("summary");
+    config.reporters.push("@casualbot/jest-sonar-reporter");
+
+    // if we're running against the develop branch, also enable the slow test reporter
+    if (env["GITHUB_REF"] == "refs/heads/develop") {
+        config.reporters.push("<rootDir>/test/slowReporter.cjs");
+    }
+}
+
+export default config;
@@ -6,7 +6,7 @@ Please see LICENSE files in the repository root for full details.
 */

 import * as YAML from "yaml";
-import * as fs from "fs";
+import * as fs from "node:fs";

 export type BuildConfig = {
    // Dev note: make everything here optional for user safety. Invalid
@@ -5,11 +5,11 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */

-import * as fs from "fs";
-import * as childProcess from "child_process";
+import * as fs from "node:fs";
+import * as childProcess from "node:child_process";
 import * as semver from "semver";

-import { type BuildConfig } from "./BuildConfig";
+import { type BuildConfig } from "./BuildConfig.ts";

 // This expects to be run from ./scripts/install.ts

@@ -38,7 +38,7 @@ export function installer(config: BuildConfig): void {
    let exitCode = 0;

    // We cheat a bit and store the current package.json and lockfile so we can safely
-    // run `yarn add` without creating extra committed files for people. We restore
+    // run `pnpm add` without creating extra committed files for people. We restore
    // these files by simply overwriting them when we're done.
    const packageDeps = readCurrentPackageDetails();

@@ -47,7 +47,7 @@ export function installer(config: BuildConfig): void {
    const currentOptDeps = getOptionalDepNames(packageDeps.packageJson);

    try {
-        // Install the modules with yarn
+        // Install the modules with pnpm
        const yarnAddRef = config.modules.join(" ");
        callYarnAdd(yarnAddRef); // install them all at once

@@ -108,20 +108,20 @@ type RawDependencies = {

 function readCurrentPackageDetails(): RawDependencies {
    return {
-        lockfile: fs.readFileSync("./yarn.lock", "utf-8"),
+        lockfile: fs.readFileSync("./pnpm-lock.yaml", "utf-8"),
        packageJson: fs.readFileSync("./package.json", "utf-8"),
    };
 }

 function writePackageDetails(deps: RawDependencies): void {
-    fs.writeFileSync("./yarn.lock", deps.lockfile, "utf-8");
+    fs.writeFileSync("./pnpm-lock.yaml", deps.lockfile, "utf-8");
    fs.writeFileSync("./package.json", deps.packageJson, "utf-8");
 }

 function callYarnAdd(dep: string): void {
    // Add the module to the optional dependencies section just in case something
    // goes wrong in restoring the original package details.
-    childProcess.execSync(`yarn add -O ${dep}`, {
+    childProcess.execSync(`pnpm add -O ${dep}`, {
        env: process.env,
        stdio: ["inherit", "inherit", "inherit"],
    });
@@ -170,7 +170,7 @@ function getTopLevelDependencyVersion(dep: string): string {

 function getModuleApiVersionFor(moduleName: string): string {
    // We'll just pretend that this isn't highly problematic...
-    // Yarn is fairly stable in putting modules in a flat hierarchy, at least.
+    // pnpm is fairly stable in putting modules in a flat hierarchy, at least.
    const pkgJsonStr = fs.readFileSync(`./node_modules/${moduleName}/package.json`, "utf-8");
    return findDepVersionInPackageJson(moduleApiDepName, pkgJsonStr);
 }
@@ -0,0 +1,12 @@
+/*
+Copyright 2022-2024 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { readBuildConfig } from "../BuildConfig.ts";
+import { installer } from "../installer.ts";
+
+const buildConf = readBuildConfig();
+installer(buildConf);
@@ -0,0 +1,251 @@
+{
+    "name": "element-web",
+    "version": "1.12.13",
+    "description": "Element: the future of secure communication",
+    "author": "New Vector Ltd.",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/element-hq/element-web"
+    },
+    "license": "SEE LICENSE IN README.md",
+    "type": "module",
+    "matrix_i18n_extra_translation_funcs": [
+        "UserFriendlyError"
+    ],
+    "scripts": {
+        "i18n": "matrix-gen-i18n src res && pnpm i18n:sort && pnpm i18n:lint",
+        "i18n:sort": "matrix-sort-i18n src/i18n/strings/en_EN.json",
+        "i18n:lint": "matrix-i18n-lint && prettier --log-level=silent --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && pnpm i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "rethemendex": "sh ./res/css/rethemendex.sh",
+        "build": "nx build",
+        "build-stats": "nx build --json=webpack-stats.json",
+        "vendor:modernizr": "modernizr -c .modernizr.json -d src/vector/modernizr.js && mv src/vector/modernizr.js src/vector/modernizr.cjs",
+        "vendor:jitsi": "curl -s https://meet.element.io/libs/external_api.min.js > ./res/jitsi_external_api.min.js",
+        "dist": "./scripts/package.sh",
+        "start": "nx start",
+        "lint": "pnpm lint:types && pnpm lint:js && pnpm lint:style",
+        "lint:js": "eslint --max-warnings 0 src test playwright module_system",
+        "lint:js-fix": "eslint --fix src test playwright module_system",
+        "lint:types": "nx lint:types",
+        "lint:style": "stylelint \"res/css/**/*.pcss\"",
+        "test": "nx test:unit",
+        "test:playwright": "playwright test",
+        "test:playwright:open": "pnpm test:playwright --ui",
+        "test:playwright:screenshots": "playwright-screenshots-experimental pnpm playwright test --update-snapshots --project=Chrome --grep @screenshot",
+        "coverage": "pnpm test --coverage",
+        "analyse:webpack-bundles": "webpack-bundle-analyzer webpack-stats.json webapp"
+    },
+    "dependencies": {
+        "@babel/runtime": "^7.12.5",
+        "@element-hq/element-web-module-api": "catalog:",
+        "@element-hq/web-shared-components": "workspace:*",
+        "@fontsource/fira-code": "^5",
+        "@fontsource/inter": "catalog:",
+        "@formatjs/intl-segmenter": "^12.0.0",
+        "@matrix-org/analytics-events": "^0.32.0",
+        "@matrix-org/emojibase-bindings": "^1.5.0",
+        "@matrix-org/react-sdk-module-api": "^2.4.0",
+        "@sentry/browser": "^10.0.0",
+        "@types/png-chunks-extract": "^1.0.2",
+        "@vector-im/compound-design-tokens": "catalog:",
+        "@vector-im/compound-web": "catalog:",
+        "@vector-im/matrix-wysiwyg": "2.40.0",
+        "@zxcvbn-ts/core": "^3.0.4",
+        "@zxcvbn-ts/language-common": "^3.0.4",
+        "@zxcvbn-ts/language-en": "^3.0.2",
+        "await-lock": "^3.0.0",
+        "bloom-filters": "^3.0.3",
+        "blurhash": "^2.0.3",
+        "browserslist": "^4.23.2",
+        "classnames": "^2.2.6",
+        "commonmark": "^0.31.0",
+        "css-tree": "^3.0.0",
+        "diff-dom": "^5.0.0",
+        "diff-match-patch": "^1.0.5",
+        "domutils": "^3.2.2",
+        "emojibase-regex": "^17.0.0",
+        "escape-html": "^1.0.3",
+        "file-saver": "^2.0.5",
+        "filesize": "11.0.13",
+        "github-markdown-css": "^5.5.1",
+        "glob-to-regexp": "^0.4.1",
+        "highlight.js": "^11.3.1",
+        "html-entities": "^2.0.0",
+        "html-react-parser": "^5.2.2",
+        "is-ip": "^5.0.0",
+        "js-xxhash": "^5.0.0",
+        "jsrsasign": "^11.0.0",
+        "jszip": "^3.7.0",
+        "katex": "^0.16.0",
+        "lodash": "npm:lodash-es@^4.17.21",
+        "maplibre-gl": "^5.0.0",
+        "matrix-encrypt-attachment": "^1.0.3",
+        "matrix-js-sdk": "41.2.0",
+        "matrix-widget-api": "^1.16.1",
+        "memoize-one": "^6.0.0",
+        "mime": "^4.0.4",
+        "oidc-client-ts": "^3.0.1",
+        "opus-recorder": "^8.0.3",
+        "pako": "^2.0.3",
+        "png-chunks-extract": "^1.0.0",
+        "posthog-js": "1.356.1",
+        "qrcode": "1.5.4",
+        "re-resizable": "6.11.2",
+        "react": "catalog:",
+        "react-beautiful-dnd": "^13.1.0",
+        "react-blurhash": "^0.3.0",
+        "react-dom": "catalog:",
+        "react-focus-lock": "^2.5.1",
+        "react-string-replace": "^2.0.0",
+        "react-transition-group": "^4.4.1",
+        "rfc4648": "^1.4.0",
+        "sanitize-filename": "^1.6.3",
+        "sanitize-html": "2.17.1",
+        "tar-js": "^0.3.0",
+        "ua-parser-js": "1.0.40",
+        "uuid": "^13.0.0",
+        "what-input": "^5.2.10"
+    },
+    "devDependencies": {
+        "@babel/core": "^7.12.10",
+        "@babel/eslint-parser": "^7.12.10",
+        "@babel/eslint-plugin": "^7.12.10",
+        "@babel/plugin-proposal-decorators": "^7.25.9",
+        "@babel/plugin-proposal-export-default-from": "^7.12.1",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-transform-class-properties": "^7.12.1",
+        "@babel/plugin-transform-class-static-block": "^7.26.0",
+        "@babel/plugin-transform-logical-assignment-operators": "^7.20.7",
+        "@babel/plugin-transform-nullish-coalescing-operator": "^7.12.1",
+        "@babel/plugin-transform-numeric-separator": "^7.12.7",
+        "@babel/plugin-transform-object-rest-spread": "^7.12.1",
+        "@babel/plugin-transform-optional-chaining": "^7.12.7",
+        "@babel/plugin-transform-runtime": "^7.12.10",
+        "@babel/preset-env": "^7.12.11",
+        "@babel/preset-react": "^7.12.10",
+        "@babel/preset-typescript": "^7.12.7",
+        "@casualbot/jest-sonar-reporter": "2.5.0",
+        "@element-hq/element-call-embedded": "0.18.0",
+        "@element-hq/element-web-playwright-common": "catalog:",
+        "@element-hq/element-web-playwright-common-local": "workspace:*",
+        "@fetch-mock/jest": "^0.2.20",
+        "@jest/globals": "^30.2.0",
+        "@peculiar/webcrypto": "^1.4.3",
+        "@playwright/test": "catalog:",
+        "@principalstudio/html-webpack-inject-preload": "^1.2.7",
+        "@sentry/webpack-plugin": "^5.0.0",
+        "@stylistic/eslint-plugin": "^5.0.0",
+        "@svgr/webpack": "^8.0.0",
+        "@testing-library/dom": "^10.4.0",
+        "@testing-library/jest-dom": "^6.4.8",
+        "@testing-library/react": "^16.0.0",
+        "@testing-library/user-event": "^14.5.2",
+        "@types/commonmark": "^0.27.4",
+        "@types/content-type": "^1.1.9",
+        "@types/counterpart": "^0.18.1",
+        "@types/css-tree": "^2.3.8",
+        "@types/diff-match-patch": "^1.0.32",
+        "@types/escape-html": "^1.0.1",
+        "@types/express": "^5.0.0",
+        "@types/file-saver": "^2.0.3",
+        "@types/glob-to-regexp": "^0.4.1",
+        "@types/jest": "30.0.0",
+        "@types/jitsi-meet": "^2.0.2",
+        "@types/jsrsasign": "^10.5.4",
+        "@types/lodash": "^4.14.168",
+        "@types/modernizr": "^3.5.3",
+        "@types/node": "22",
+        "@types/pako": "^2.0.0",
+        "@types/postcss-import": "^14.0.3",
+        "@types/qrcode": "^1.3.5",
+        "@types/react": "catalog:",
+        "@types/react-beautiful-dnd": "^13.0.0",
+        "@types/react-dom": "catalog:",
+        "@types/react-transition-group": "^4.4.0",
+        "@types/sanitize-html": "2.16.0",
+        "@types/sdp-transform": "^2.4.10",
+        "@types/semver": "^7.5.8",
+        "@types/tar-js": "^0.3.5",
+        "@types/ua-parser-js": "^0.7.36",
+        "@typescript-eslint/eslint-plugin": "^8.19.0",
+        "@typescript-eslint/parser": "^8.19.0",
+        "babel-jest": "^30.0.0",
+        "babel-loader": "^10.0.0",
+        "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
+        "blob-polyfill": "^9.0.0",
+        "copy-webpack-plugin": "^14.0.0",
+        "css-loader": "^7.0.0",
+        "css-minimizer-webpack-plugin": "^8.0.0",
+        "dotenv": "^17.0.0",
+        "eslint": "8.57.1",
+        "eslint-config-google": "^0.14.0",
+        "eslint-config-prettier": "^10.0.0",
+        "eslint-plugin-deprecate": "0.9.0",
+        "eslint-plugin-import": "^2.25.4",
+        "eslint-plugin-jest": "^29.0.0",
+        "eslint-plugin-jsx-a11y": "^6.5.1",
+        "eslint-plugin-matrix-org": "^3.0.0",
+        "eslint-plugin-react": "^7.28.0",
+        "eslint-plugin-react-compiler": "^19.0.0-beta-df7b47d-20241124",
+        "eslint-plugin-react-hooks": "^7.0.0",
+        "eslint-plugin-unicorn": "^56.0.0",
+        "express": "^5.0.0",
+        "fake-indexeddb": "^6.0.0",
+        "file-loader": "^6.0.0",
+        "html-webpack-plugin": "^5.5.3",
+        "identity-obj-proxy": "^3.0.0",
+        "jest": "^30.0.0",
+        "jest-canvas-mock": "^2.5.2",
+        "jest-environment-jsdom": "^30.2.0",
+        "jest-fixed-jsdom": "^0.0.11",
+        "jest-mock": "^30.0.0",
+        "jest-raw-loader": "^1.0.1",
+        "jsqr": "^1.4.0",
+        "matrix-web-i18n": "catalog:",
+        "mini-css-extract-plugin": "2.10.0",
+        "modernizr": "^3.12.0",
+        "playwright-core": "catalog:",
+        "postcss": "8.5.6",
+        "postcss-easings": "4.0.0",
+        "postcss-hexrgba": "2.1.0",
+        "postcss-import": "16.1.1",
+        "postcss-loader": "8.2.0",
+        "postcss-mixins": "12.0.0",
+        "postcss-nested": "7.0.2",
+        "postcss-preset-env": "11.1.1",
+        "postcss-scss": "4.0.9",
+        "postcss-simple-vars": "7.0.1",
+        "prettier": "3.8.1",
+        "process": "^0.11.10",
+        "raw-loader": "^4.0.2",
+        "semver": "^7.5.2",
+        "source-map-loader": "^5.0.0",
+        "stylelint": "^17.0.0",
+        "stylelint-config-standard": "^40.0.0",
+        "stylelint-scss": "^7.0.0",
+        "stylelint-value-no-unknown-custom-properties": "^6.0.1",
+        "terser-webpack-plugin": "^5.3.9",
+        "testcontainers": "^11.0.0",
+        "typescript": "catalog:",
+        "util": "^0.12.5",
+        "web-streams-polyfill": "^4.0.0",
+        "webpack": "^5.89.0",
+        "webpack-bundle-analyzer": "^5.0.0",
+        "webpack-cli": "^6.0.0",
+        "webpack-dev-server": "^5.0.0",
+        "webpack-retry-chunk-load-plugin": "^3.1.1",
+        "webpack-version-file-plugin": "^0.5.0",
+        "yaml": "^2.3.3"
+    },
+    "@casualbot/jest-sonar-reporter": {
+        "outputDirectory": "coverage",
+        "outputName": "jest-sonar-report.xml",
+        "relativePaths": true
+    },
+    "engines": {
+        "node": ">=22.18"
+    },
+    "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017",
+    "private": true
+}
@@ -6,22 +6,34 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */

-import { defineConfig, devices } from "@playwright/test";
+import {
+    defineConfig,
+    devices,
+    type Project,
+    type PlaywrightTestOptions,
+    type PlaywrightWorkerOptions,
+} from "@playwright/test";

 import { type WorkerOptions } from "./playwright/services";

 const baseURL = process.env["BASE_URL"] ?? "http://localhost:8080";

-const chromeProject = {
+const chromeProject: Project<PlaywrightTestOptions, WorkerOptions & PlaywrightWorkerOptions>["use"] = {
    ...devices["Desktop Chrome"],
    channel: "chromium",
    permissions: ["clipboard-write", "clipboard-read", "microphone"],
    launchOptions: {
        args: ["--use-fake-ui-for-media-stream", "--use-fake-device-for-media-stream", "--mute-audio"],
    },
+    connectOptions: process.env.PW_TEST_CONNECT_WS_ENDPOINT
+        ? {
+              wsEndpoint: process.env.PW_TEST_CONNECT_WS_ENDPOINT,
+              exposeNetwork: "<loopback>",
+          }
+        : undefined,
 };

-export default defineConfig<WorkerOptions>({
+export default defineConfig<{}, WorkerOptions>({
    projects: [
        {
            name: "Chrome",
@@ -79,7 +91,7 @@ export default defineConfig<WorkerOptions>({
        trace: "on-first-retry",
    },
    webServer: {
-        command: process.env.CI ? "npx serve -p 8080 -L ./webapp" : "yarn start",
+        command: process.env.CI ? "npx serve -p 8080 -L ./webapp" : "pnpm start",
        url: `${baseURL}/config.json`,
        reuseExistingServer: true,
        timeout: (process.env.CI ? 30 : 120) * 1000,
@@ -91,6 +103,7 @@ export default defineConfig<WorkerOptions>({
    retries: process.env.CI ? 2 : 0,
    reporter: process.env.CI ? [["blob"], ["github"]] : [["html", { outputFolder: "playwright/html-report" }]],
    snapshotDir: "playwright/snapshots",
-    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    // When running the browser in docker, set the platform to `linux` as that is the platform where the browser is running
+    snapshotPathTemplate: `{snapshotDir}/{testFilePath}/{arg}-${process.env.PW_TEST_CONNECT_WS_ENDPOINT ? "linux" : "{platform}"}{ext}`,
    forbidOnly: !!process.env.CI,
 });
@@ -0,0 +1,6 @@
+/test-results/
+/html-report/
+/logs/
+# Only commit snapshots from Linux
+/snapshots/**/*.png
+!/snapshots/**/*-linux.png
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");`