v1.12.13

Upgrade dependency to matrix-js-sdk@41.2.0
[Backport staging] Fix soft crash of room list when trying to open a room (#32872 )
2026-03-24 11:26:49 +00:00 · 2026-03-24 11:23:51 +00:00 · 2026-03-20 15:44:40 +00:00 · 2026-03-17 11:43:46 +00:00 · 2026-03-17 11:41:10 +00:00 · 2026-03-17 08:57:37 +00:00
4165 changed files with 79753 additions and 42299 deletions
@@ -1,36 +1,36 @@
 *                         @element-hq/element-web-reviewers
 /.github/workflows/**     @element-hq/element-web-team
-/package.json             @element-hq/element-web-team
-/yarn.lock                @element-hq/element-web-team
+package.json              @element-hq/element-web-team
+/pnpm-lock.yaml           @element-hq/element-web-team

-/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
-/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
-/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
-/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
-/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
-/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
-/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
-/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
-/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
-/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
-/src/components/views/dialogs/devtools/Crypto.tsx                       @element-hq/element-crypto-web-reviewers
-/playwright/e2e/crypto/                                                 @element-hq/element-crypto-web-reviewers
-/playwright/e2e/settings/encryption-user-tab/                           @element-hq/element-crypto-web-reviewers
-/packages/shared-components/src/crypto/                                 @element-hq/element-crypto-web-reviewers
+/apps/web/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
+/apps/web/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
+/apps/web/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
+/apps/web/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
+/apps/web/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/dialogs/devtools/Crypto.tsx                       @element-hq/element-crypto-web-reviewers
+/apps/web/playwright/e2e/crypto/                                                 @element-hq/element-crypto-web-reviewers
+/apps/web/playwright/e2e/settings/encryption-user-tab/                           @element-hq/element-crypto-web-reviewers
+/packages/shared-components/src/crypto/                                          @element-hq/element-crypto-web-reviewers


-/src/models/Call.ts                       @element-hq/element-call-reviewers
-/src/call-types.ts                        @element-hq/element-call-reviewers
-/src/components/views/voip                @element-hq/element-call-reviewers
-/playwright/e2e/voip/element-call.spec.ts @element-hq/element-call-reviewers
+/apps/web/src/models/Call.ts                             @element-hq/element-call-reviewers
+/apps/web/src/call-types.ts                              @element-hq/element-call-reviewers
+/apps/web/src/components/views/voip                      @element-hq/element-call-reviewers
+/apps/web/playwright/e2e/voip/element-call.spec.ts       @element-hq/element-call-reviewers

 # Ignore translations as those will be updated by GHA for Localazy download
-/src/i18n/strings
+/apps/web/src/i18n/strings
 /packages/shared-components/src/i18n/strings
-/src/i18n/strings/en_EN.json                             @element-hq/element-web-reviewers
+/apps/web/src/i18n/strings/en_EN.json                    @element-hq/element-web-reviewers
 /packages/shared-components/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers

 # Ignore the synapse & mas plugins as this is updated by GHA for docker image updating
-/playwright/testcontainers/synapse.ts
-/playwright/testcontainers/mas.ts
+/apps/web/playwright/testcontainers/synapse.ts
+/apps/web/playwright/testcontainers/mas.ts

@@ -1,6 +1,6 @@
 name: Bug report for the Element desktop app (not in a browser)
 description: File a bug report if you are using the desktop Element application.
-labels: [T-Defect]
+labels: [T-Defect, A-Electron]
 body:
    - type: markdown
      attributes:
@@ -3,3 +3,6 @@ contact_links:
    - name: Questions & support
      url: https://matrix.to/#/#element-web:matrix.org
      about: Please ask and answer questions here.
+    - name: Bug report for the Element flatpak app
+      url: https://github.com/flathub/im.riot.Riot/issues
+      about: Please file bugs with the Flatpak application on the respective repository.
@@ -173,6 +173,12 @@
  color: "bfd4f2"
 - name: "A-Welcome-Page"
  color: "bfd4f2"
+- name: "A-Install"
+  color: "72A447"
+- name: "A-Seshat"
+  color: "8262BE"
+- name: "A-Update"
+  color: "17BE67"
 - name: "backport staging"
  description: "Label to automatically backport PR to staging branch"
  color: "B60205"
@@ -282,3 +288,23 @@
 - name: "Z-Skip-Coverage"
  description: "Skip SonarQube coverage for this PR"
  color: "ededed"
+- name: "Z-Arch"
+  color: "D601BE"
+- name: "Z-ARM"
+  color: "5DEC5B"
+- name: "Z-Flatpak"
+  color: "0CA856"
+- name: "Z-Linux"
+  color: "7B4A9C"
+- name: "Z-macOS"
+  color: "500605"
+- name: "Z-Official"
+  color: "1D2B20"
+- name: "Z-Snap"
+  color: "29CD95"
+- name: "Z-Suse"
+  color: "79D07B"
+- name: "Z-Wayland"
+  color: "94C519"
+- name: "Z-Windows"
+  color: "0632DE"
@@ -1,4 +1,15 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": ["github>matrix-org/renovate-config-element-web"]
+    "extends": ["github>matrix-org/renovate-config-element-web"],
+    "postUpdateOptions": ["pnpmDedupe"],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "datasourceTemplate": "docker",
+            "versioningTemplate": "loose",
+            "description": "Update testcontainers docker digests",
+            "managerFilePatterns": ["**/testcontainers/*.ts"],
+            "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""]
+        }
+    ]
 }
@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types:
            - closed
            - labeled
@@ -12,6 +12,7 @@ concurrency:
 env:
    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {} # No permissions required
 jobs:
    build:
@@ -42,32 +43,34 @@ jobs:
            run:
                shell: bash
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  # Disable cache on Windows as it is slower than not caching
                  # https://github.com/actions/setup-node/issues/975
-                  cache: ${{ runner.os != 'Windows' && 'yarn' || '' }}
+                  cache: ${{ runner.os != 'Windows' && 'pnpm' || '' }}
                  node-version: "lts/*"

-            # Workaround for yarn install timeouts, especially on Windows
-            - run: yarn config set network-timeout 300000
-
            - name: Fetch layered build
              run: ./scripts/layered.sh

            - name: Copy config
+              working-directory: apps/web
              run: cp element.io/develop/config.json config.json

            - name: Build
+              working-directory: apps/web
              env:
                  CI_PACKAGE: true
-              run: VERSION=$(scripts/get-version-from-git.sh) yarn build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build

            - name: Upload Artifact
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp-${{ matrix.image }}
-                  path: webapp
+                  path: apps/web/webapp
                  retention-days: 1
@@ -14,14 +14,18 @@ jobs:
            R2_URL: ${{ vars.CF_R2_S3_API }}
            VERSION: ${{ github.ref_name }}
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Download package
+              working-directory: apps/web
              run: |
                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz"
                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz.asc"

            - name: Check GPG signature
+              working-directory: apps/web
              run: |
                  wget "https://packages.element.io/element-release-key.gpg"
                  gpg --import element-release-key.gpg
@@ -31,6 +35,7 @@ jobs:
                  FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}

            - name: Prepare
+              working-directory: apps/web
              run: |
                  mkdir -p debian/tmp/DEBIAN
                  find debian -maxdepth 1 -type f -exec cp "{}" debian/tmp/DEBIAN/ \;
@@ -41,6 +46,7 @@ jobs:
                  ln -s /etc/element-web/config.json debian/tmp/usr/share/element-web/config.json

            - name: Write changelog
+              working-directory: apps/web
              run: |
                  VERSION=$(cat package.json | jq -r .version)
                  TIME=$(date -d "$PUBLISHED_AT" -R)
@@ -57,22 +63,23 @@ jobs:
                  PUBLISHED_AT: ${{ github.event.release.published_at }}

            - name: Build deb package
+              working-directory: apps/web
              run: |
                  VERSION=$(cat package.json | jq -r .version)
                  dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
                  dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: element-web.deb
-                  path: element-web.deb
+                  path: apps/web/element-web.deb
                  retention-days: 14

            - name: Publish to packages.element.io
              if: github.event.release.prerelease == false
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
              with:
-                  file: element-web.deb
+                  file: apps/web/element-web.deb
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  bucket-api: ${{ vars.CF_R2_S3_API }}
                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -9,6 +9,8 @@ on:
 concurrency:
    group: ${{ github.repository_owner }}-${{ github.workflow }}-${{ github.ref_name }}
    cancel-in-progress: true
+env:
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {}
 jobs:
    build:
@@ -26,17 +28,21 @@ jobs:
            R2_URL: ${{ vars.CF_R2_S3_API }}
            R2_PUBLIC_URL: "https://element-web-develop.element.io"
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Dependencies
              run: "./scripts/layered.sh"

            - name: Build, Package & Upload sourcemaps
+              working-directory: apps/web
              run: "./scripts/ci_package.sh"
              env:
                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
@@ -52,20 +58,21 @@ jobs:
                  CSP_EXTRA_SOURCE: ${{ env.R2_PUBLIC_URL }}

            - run: mv dist/element-*.tar.gz dist/develop.tar.gz
+              working-directory: apps/web

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
-                  path: dist/develop.tar.gz
+                  path: apps/web/dist/develop.tar.gz
                  retention-days: 1

            - name: Extract webapp
              run: |
                  mkdir _deploy
-                  tar xf dist/develop.tar.gz -C _deploy --strip-components=1
+                  tar xf apps/web/dist/develop.tar.gz -C _deploy --strip-components=1

            - name: Copy config
-              run: cp element.io/develop/config.json _deploy/config.json
+              run: cp apps/web/element.io/develop/config.json _deploy/config.json

            - name: Populate 404.html
              run: echo "404 Not Found" > _deploy/404.html
@@ -112,7 +119,7 @@ jobs:
            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
            - name: Deploy to R2
              run: |
-                  aws s3 cp dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
+                  aws s3 cp apps/web/dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
                  aws s3 cp _deploy/ s3://$R2_BUCKET/ --recursive --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
              env:
                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -129,4 +136,6 @@ jobs:
                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}

            - run: |
-                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
+                  echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
+              env:
+                  STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
@@ -0,0 +1,79 @@
+name: CD # Continuous Delivery
+on:
+    push:
+        branches: [develop]
+concurrency: ${{ github.workflow }}-${{ github.ref_name }}
+
+permissions: {}
+env:
+    NX_DEFAULT_OUTPUT_STYLE: static
+
+jobs:
+    docker:
+        name: Docker Bake
+        runs-on: ubuntu-24.04
+        permissions:
+            id-token: write # needed for signing the images with GitHub OIDC Token
+            packages: write # needed for publishing packages to GHCR
+            # Needed for nx-set-shas
+            contents: read
+            actions: read
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
+                  fetch-depth: 0
+                  # reduce the size of the checkout with tree filtering,
+                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
+                  filter: tree:0
+                  persist-credentials: false
+
+            - name: Prepare nx
+              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
+              with:
+                  main-branch-name: develop
+
+            - name: Install Cosign
+              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
+            - name: Set up Docker Buildx
+              id: builder
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  node-version-file: package.json
+                  cache: "pnpm"
+
+            - name: Install Deps
+              run: "pnpm install --frozen-lockfile"
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - run: pnpm nx affected -t docker:build
+              env:
+                  INPUT_PUSH: true
+                  INPUT_LOAD: false
+                  INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}
+
+            - name: Sign the images with GitHub OIDC token
+              env:
+                  PATTERN: "^ghcr.io/element-hq/element-web*"
+              run: |
+                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
+                    # Check if digest is valid (not <none>)
+                    if [[ "$TARGET" != *"@<none>"* ]]; then
+                      echo "Signing $TARGET..."
+                      cosign sign --yes "$TARGET"
+                    fi
+                  done
@@ -34,7 +34,9 @@ jobs:
        env:
            SITE: ${{ inputs.site || 'staging.element.io' }}
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Load GPG key
              run: |
@@ -70,7 +72,7 @@ jobs:
              run: cp -vnpr _current_version/bundles/* _deploy/bundles/

            - name: Copy config
-              run: cp element.io/app/config.json _deploy/config.json
+              run: cp apps/web/element.io/app/config.json _deploy/config.json

            - name: Populate 404.html
              run: echo "404 Not Found" > _deploy/404.html
@@ -20,9 +20,10 @@ jobs:
        env:
            TEST_TAG: vectorim/element-web:test
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  fetch-depth: 0 # needed for docker-package to be able to calculate the version
+                  persist-credentials: false

            - name: Install Cosign
              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
@@ -38,9 +39,10 @@ jobs:

            - name: Build and load
              id: test-build
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
              with:
                  context: .
+                  file: apps/web/Dockerfile
                  load: true

            - name: Test the image
@@ -95,14 +97,14 @@ jobs:
                      latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}

            - name: Login to Docker Hub
-              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
              if: github.event_name != 'pull_request'
              with:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Login to GitHub Container Registry
-              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
              if: github.event_name != 'pull_request'
              with:
                  registry: ghcr.io
@@ -138,7 +140,7 @@ jobs:
                      services/web-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;

            - name: Login to oci.element.io Registry
-              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
              if: github.event_name != 'pull_request'
              with:
                  registry: oci-push.vpn.infra.element.io
@@ -147,10 +149,11 @@ jobs:

            - name: Build and push
              id: build-and-push
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
              if: github.event_name != 'pull_request'
              with:
                  context: .
+                  file: apps/web/Dockerfile
                  push: true
                  platforms: linux/amd64,linux/arm64
                  tags: ${{ steps.meta.outputs.tags }}
@@ -17,33 +17,39 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - name: Fetch element-desktop
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-desktop
                  path: element-desktop
+                  persist-credentials: false

            - name: Fetch element-web
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  path: element-web
+                  persist-credentials: false

            - name: Fetch matrix-js-sdk
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: matrix-org/matrix-js-sdk
                  path: matrix-js-sdk
+                  persist-credentials: false

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+              with:
+                  package_json_file: element-web/package.json
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
-                  cache-dependency-path: element-web/yarn.lock
+                  cache: "pnpm"
+                  cache-dependency-path: element-web/pnpm-lock.yaml
                  node-version: "lts/*"

            - name: Generate automations docs
              working-directory: element-web
              run: |
-                  yarn install --frozen-lockfile
-                  yarn node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
+                  pnpm install --frozen-lockfile
+                  pnpm node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
                  echo "-   [Automations](automations.md)" >> docs/SUMMARY.md

            - name: Setup mdBook
@@ -2,7 +2,9 @@
 # taking the artifact and uploading it to Netlify for easier viewing
 name: Upload End to End Test report to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["End to End Tests"]
        types:
            - completed
@@ -25,7 +27,7 @@ jobs:
            actions: read
        steps:
            - name: Download HTML report
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -37,6 +37,7 @@ env:
    PR_NUMBER: ${{ github.event.pull_request.number }}
    # Use 6 runners in the default case, but 4 when running on a schedule where we run all 5 projects (20 runners total)
    NUM_RUNNERS: ${{ github.event_name == 'schedule' && 4 || 6 }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

@@ -50,13 +51,15 @@ jobs:
            runners-matrix: ${{ steps.runner-vars.outputs.matrix }}
        steps:
            - name: Checkout code
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
+                  persist-credentials: false

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Fetch layered build
@@ -66,18 +69,20 @@ jobs:
              run: scripts/layered.sh

            - name: Copy config
+              working-directory: apps/web
              run: cp element.io/develop/config.json config.json

            - name: Build
              env:
                  CI_PACKAGE: true
-              run: VERSION=$(scripts/get-version-from-git.sh) yarn build
+              working-directory: apps/web
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build

            - name: Upload Artifact
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
-                  path: webapp
+                  path: apps/web/webapp
                  retention-days: 1

            - name: Calculate runner variables
@@ -122,32 +127,33 @@ jobs:
                    - runAllTests: false
                      project: Pinecone
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

            - name: 📥 Download artifact
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  name: webapp
-                  path: webapp
+                  path: apps/web/webapp

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
-                  cache-dependency-path: yarn.lock
+                  cache: "pnpm"
+                  cache-dependency-path: pnpm-lock.yaml
                  node-version: "lts/*"

            - name: Install dependencies
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Get installed Playwright version
              id: playwright
-              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -155,34 +161,39 @@ jobs:

            - name: Install Playwright browsers
              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: yarn playwright install --with-deps --no-shell
+              working-directory: apps/web
+              run: pnpm playwright install --with-deps --no-shell

            - name: Install system dependencies for WebKit
              # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
              if: matrix.project == 'WebKit' && steps.playwright-cache.outputs.cache-hit == 'true'
-              run: yarn playwright install-deps webkit
+              working-directory: apps/web
+              run: pnpm playwright install-deps webkit

            # We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
            - name: Run Playwright tests
+              working-directory: apps/web
              run: |
-                  yarn playwright test \
-                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                  pnpm playwright test \
+                      --shard "$SHARD" \
                      --project="${{ matrix.project }}" \
                      ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+              env:
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build.outputs.num-runners) }}

            - name: Upload blob report to GitHub Actions Artifacts
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: all-blob-reports-${{ matrix.project }}-${{ matrix.runner }}
-                  path: blob-report
+                  path: apps/web/blob-report
                  retention-days: 1

    downstream-modules:
        name: Downstream Playwright tests [element-modules]
        needs: build
        if: inputs.skip != true && github.event_name == 'merge_group'
-        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
        with:
            webapp-artifact: webapp

@@ -194,33 +205,36 @@ jobs:
        if: always()
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.skip != true
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+              if: inputs.skip != true
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              if: inputs.skip != true
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install dependencies
              if: inputs.skip != true
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Download blob reports from GitHub Actions Artifacts
              if: inputs.skip != true
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  pattern: all-blob-reports-*
-                  path: all-blob-reports
+                  path: apps/web/all-blob-reports
                  merge-multiple: true

            - name: Merge into HTML Report
              if: inputs.skip != true
-              run: yarn playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
+              working-directory: apps/web
+              run: pnpm playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
              env:
                  # Only pass creds to the flaky-reporter on main branch runs
                  GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
@@ -228,11 +242,12 @@ jobs:
            # Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
            - name: Upload HTML report
              if: always() && inputs.skip != true
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: html-report
-                  path: playwright-report
+                  path: apps/web/playwright-report
                  retention-days: 14
+                  if-no-files-found: error

            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1
@@ -7,6 +7,8 @@ permissions:
    pull-requests: write # needed to auto-approve PRs
 jobs:
    download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
+        with:
+            packageManager: pnpm
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -1,13 +1,14 @@
 name: Localazy Upload
 on:
+    workflow_dispatch: {}
    push:
        branches: [develop]
        paths:
-            - "src/i18n/strings/en_EN.json"
+            - "apps/web/src/i18n/strings/en_EN.json"
            - "packages/shared-components/src/i18n/strings/en_EN.json"
 permissions: {} # No permissions needed
 jobs:
    upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        secrets:
            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
@@ -2,7 +2,9 @@
 # and uploading it to netlify
 name: Upload Preview Build to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Build"]
        types:
            - completed
@@ -28,7 +30,7 @@ jobs:
                      Exercise caution. Use test accounts.

            - name: 📥 Download artifact
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -1,92 +0,0 @@
-name: Pending reviews automation
-on:
-    # The bot exceeded its API rate limit. Disabling for now (adding workflow dispatch so the workflow file stays valid & we can test to see if it starts working again)
-    workflow_dispatch: {}
-    # We run it on a schedule instead of on pull_request_* events to not create confusing messaging in the PR
-    #schedule:
-    #    - cron: "*/10 * * * *"
-concurrency: ${{ github.workflow }}
-permissions: {} # We use ELEMENT_BOT_TOKEN instead
-jobs:
-    bot:
-        name: Pending reviews bot
-        runs-on: ubuntu-24.04
-        environment: Matrix
-        env:
-            URL: "https://github.com/pulls?q=is%3Apr+is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+review-requested%3A%40me+sort%3Aupdated-desc+"
-            RELEASE_BLOCKERS_URL: "https://github.com/pulls?q=is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+sort%3Aupdated-desc+label%3AX-Release-Blocker+"
-        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
-              env:
-                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
-                  ROOM_ID: ${{ secrets.ROOM_ID }}
-                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
-              with:
-                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
-                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  script: |
-                      const { HS_URL, ROOM_ID, TOKEN, URL, RELEASE_BLOCKERS_URL } = process.env;
-
-                      async function updateCounter(counter, link, severity, title, value, clearOnZero) {
-                          const apiUrl = `${HS_URL}/_matrix/client/v3/rooms/${ROOM_ID}/state/re.jki.counter/${counter}`;
-                          const headers = {
-                              "Content-Type": "application/json",
-                              "Authorization": `Bearer ${TOKEN}`,
-                          };
-                          const res = await fetch(apiUrl, {
-                              method: "GET",
-                              headers,
-                          });
-
-                          const data = await res.json();
-
-                          if (data.value === issueCount) {
-                              console.log("Pending review count already correct");
-                              return;
-                          }
-
-                          let body = {};
-                          if (issueCount || !clearOnZero) {
-                              body = JSON.stringify({
-                                  link,
-                                  severity,
-                                  title,
-                                  value,
-                              });
-                          }
-
-                          await fetch(apiUrl, {
-                              method: "PUT",
-                              body,
-                              headers,
-                          });
-                      }
-
-                      const repos = [
-                          "element-hq/element-desktop",
-                          "element-hq/element-web",
-                          "matrix-org/matrix-js-sdk",
-                      ];
-                      const teams = [
-                          "matrix-org/element-web-team",
-                          "matrix-org/element-web-reviewers",
-                          "element-hq/element-web-team",
-                          "element-hq/element-web-reviewers",
-                      ];
-
-                      let issueCount = 0;
-                      for (const team of teams) {
-                          const org = team.split("/", 2)[0];
-                          const reposInOrg = repos.filter(repo => repo.startsWith(org + "/"));
-                          const { data } = await github.rest.search.issuesAndPullRequests({
-                              q: `is:pr is:open review:required ${reposInOrg.map(r => `repo:${r}`).join(" ")} team-review-requested:${team}`,
-                          });
-                          issueCount += data.total_count;
-                      }
-                      await updateCounter("gh_reviews", URL, "warning", "Pending reviews", issueCount);
-
-                      const { data } = await github.rest.search.issuesAndPullRequests({
-                          q: `is:open ${repos.map(repo => `repo:${repo}`).join(" ")} label:X-Release-Blocker`,
-                      });
-                      const blockerCount = data.total_count;
-                      await updateCounter("release_blockers", RELEASE_BLOCKERS_URL, "alert", "Release Blockers", blockerCount, true);
@@ -1,57 +0,0 @@
-name: Update Playwright docker images
-on:
-    workflow_dispatch: {}
-    schedule:
-        - cron: "0 6 * * *" # Every day at 6am UTC
-permissions: {}
-jobs:
-    update:
-        runs-on: ubuntu-24.04
-        permissions:
-            pull-requests: write
-        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - name: Update synapse image
-              run: |
-                  docker pull "$IMAGE"
-                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
-                  DIGEST=${INSPECT#*@}
-                  sed -i "s/const TAG.*/const TAG = \"develop@$DIGEST\";/" playwright/testcontainers/synapse.ts
-              env:
-                  IMAGE: ghcr.io/element-hq/synapse:develop
-
-            - name: Update MAS image
-              run: |
-                  docker pull "$IMAGE"
-                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
-                  DIGEST=${INSPECT#*@}
-                  sed -i "s/const TAG.*/const TAG = \"main@$DIGEST\";/" playwright/testcontainers/mas.ts
-              env:
-                  IMAGE: ghcr.io/element-hq/matrix-authentication-service:main
-
-            - name: Create Pull Request
-              id: cpr
-              uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8
-              with:
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  branch: actions/playwright-image-updates
-                  delete-branch: true
-                  title: Playwright Docker image updates
-                  labels: |
-                      T-Task
-
-            - name: Enable automerge
-              run: gh pr merge --merge --auto "$PR_NUMBER"
-              if: steps.cpr.outputs.pull-request-operation == 'created'
-              env:
-                  GH_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-
-            - name: Enable autoapprove
-              run: |
-                  gh pr review --approve "$PR_NUMBER"
-              if: steps.cpr.outputs.pull-request-operation == 'created'
-              env:
-                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types: [opened, edited, labeled, unlabeled, synchronize]
    merge_group:
        types: [checks_requested]
 permissions: {}
 jobs:
    action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            pull-requests: write
        secrets:
@@ -9,4 +9,4 @@ jobs:
    draft:
        permissions:
            contents: write
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
@@ -7,9 +7,10 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # We use ELEMENT_BOT_TOKEN instead
 jobs:
    merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
+            dir: apps/web
            dependencies: |
                matrix-js-sdk
@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
    release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            contents: write
            issues: write
@@ -29,6 +29,7 @@ jobs:
            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
            asset-path: dist/*.tar.gz
            expected-asset-count: 3
+            dir: apps/web

    notify-downstream:
        name: Trigger release drafter downstream
@@ -27,7 +27,7 @@ jobs:
                    - matrix-org/matrix-js-sdk
                    - element-hq/element-web
                    - element-hq/element-desktop
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
@@ -41,7 +41,7 @@ jobs:
            REPOS: matrix-js-sdk element-web element-desktop
        steps:
            - name: Checkout Element Desktop
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-desktop
              with:
                  repository: element-hq/element-desktop
@@ -50,8 +50,9 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Element Web
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-web
              with:
                  repository: element-hq/element-web
@@ -60,8 +61,9 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Matrix JS SDK
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.matrix-js-sdk
              with:
                  repository: matrix-org/matrix-js-sdk
@@ -70,6 +72,7 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true

            - name: Prepare Git
              run: |
@@ -13,12 +13,15 @@ jobs:

        steps:
            - name: 🧮 Checkout code
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - name: 🔧 Set up node environment
              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version-file: ".node-version"
                  registry-url: "https://registry.npmjs.org"

@@ -28,12 +31,7 @@ jobs:

            # Need to setup element web too as it needs the translations
            - name: 🛠️ Setup EW
-              run: yarn install --pure-lockfile
-
-            - name: 🛠️ Setup
-              # When running `install` it also calls the `prepare` step which generates
-              # a build
-              run: yarn --cwd packages/shared-components install --pure-lockfile
+              run: pnpm install --frozen-lockfile

            - name: 🚀 Publish to npm
              working-directory: packages/shared-components
@@ -0,0 +1,38 @@
+name: Build shared component storybook
+on:
+    merge_group: {}
+    pull_request: {}
+    workflow_call: {}
+
+permissions: {}
+
+jobs:
+    doc:
+        name: Build storybook
+        runs-on: ubuntu-latest
+        steps:
+            - name: 🧮 Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: 🔧 Pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  node-version-file: package.json
+
+            - name: 🔨 Install dependencies
+              working-directory: packages/shared-components
+              run: "pnpm install --frozen-lockfile"
+
+            - name: 📖 Build Storybook
+              working-directory: packages/shared-components
+              run: pnpm build:storybook
+
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: shared-components-storybook
+                  path: packages/shared-components/storybook-static
+                  retention-days: 1
@@ -0,0 +1,33 @@
+name: Publish shared component storybook
+on:
+    workflow_dispatch: {}
+    push:
+        branches:
+            - "develop"
+        paths:
+            - "packages/shared-components/**/*"
+
+permissions: {}
+
+jobs:
+    build:
+        name: Build storybook
+        uses: ./.github/workflows/shared-component-storybook-build.yml
+
+    publish:
+        name: Publish storybook
+        runs-on: ubuntu-latest
+        needs: build
+        environment: SharedComponents
+        steps:
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+              with:
+                  name: shared-components-storybook
+                  path: storybook-static
+
+            - name: 🚀 Deploy to Cloudflare Pages
+              uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
+              with:
+                  apiToken: ${{ secrets.CF_PAGES_TOKEN }}
+                  accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
+                  command: pages deploy storybook-static --project-name=shared-components-storybook
@@ -27,7 +27,7 @@ jobs:
              run: "sudo apt-get install -y tree"

            - name: Download Diffs
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -21,27 +21,28 @@ jobs:
            issues: read
            pull-requests: read
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install dependencies
              working-directory: packages/shared-components
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Get installed Playwright version
              working-directory: packages/shared-components
              id: playwright
-              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -50,11 +51,11 @@ jobs:
            - name: Install Playwright browsers
              working-directory: packages/shared-components
              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: "yarn playwright install --with-deps --only-shell"
+              run: "pnpm playwright install --with-deps --only-shell"

            - name: Run Visual tests
              working-directory: packages/shared-components
-              run: "yarn test:storybook --run"
+              run: "pnpm test:storybook --run"

            # Workaround for vis silently adding new baselines if they didn't exist
            # Can be removed once https://github.com/repobuddy/visual-testing/issues/516 is released
@@ -64,7 +65,7 @@ jobs:

            - name: Upload received images & diffs
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: received-images
                  path: packages/shared-components/__vis__/linux
@@ -12,7 +12,7 @@ jobs:
    sonarqube:
        name: 🩻 SonarQube
        if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
-        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            actions: read
            statuses: write
@@ -14,143 +14,115 @@ concurrency:
 env:
    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

 jobs:
-    ts_lint:
-        name: "Typescript Syntax Check"
+    lint:
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - name: Typescript Syntax Check
+                      install: layered
+                      command: "lint:types"
+                    - name: Prettier
+                      install: normal
+                      command: "lint:prettier"
+                    - name: ESLint
+                      install: normal
+                      command: "lint:js"
+                    - name: Style Lint
+                      install: normal
+                      command: "lint:style"
+                    - name: Workflow Lint
+                      install: normal
+                      command: "lint:workflows"
+                    - name: Analyse Dead Code
+                      install: normal
+                      command: "lint:knip"
+                    - name: Rethemendex Check
+                      command: "rethemendex"
+                      assert-diff: true
+        name: ${{ matrix.name }}
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              if: matrix.install != ''
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

-            - name: Install Dependencies
+            - name: Install Dependencies (layered)
+              if: matrix.install == 'layered'
              run: "./scripts/layered.sh"
+            - name: Install Dependencies (normal)
+              if: matrix.install == 'normal'
+              run: "pnpm install --frozen-lockfile"

-            - name: Typecheck
-              run: "yarn run lint:types"
+            - name: Run ${{ matrix.command }}
+              run: pnpm --if-present run "$CMD" && pnpm -r --if-present run "$CMD"
+              env:
+                  CMD: ${{ matrix.command }}

-            - name: Install Shared Component Dependencies
-              run: "yarn --cwd packages/shared-components install"
+            - name: Assert no changes
+              run: git diff --exit-code
+              if: matrix.assert-diff

-            - name: Typecheck Shared Components
-              run: "yarn --cwd packages/shared-components run lint:types"
+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-    i18n_lint_ew:
-        name: "i18n Check (Element Web)"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+
+    i18n:
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - name: Element Web
+                      path: "apps/web"
+                      allowed-hardcoded-keys: |
+                          console_dev_note
+                          labs|element_call_video_rooms
+                          labs|feature_disable_call_per_sender_encryption
+                          voip|element_call
+                          error|invalid_json
+                          error|misconfigured
+                          welcome_to_element
+                          devtools|settings|elementCallUrl
+                          labs|sliding_sync_description
+                          settings|voip|noise_suppression_description
+                          settings|voip|echo_cancellation_description
+                    - name: Shared Components
+                      path: "packages/shared-components"
+        name: "i18n Check (${{ matrix.name }})"
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@abf186831e2acb3e98fca13a0711a3fa1364d2b1
        permissions:
            pull-requests: read
        with:
            hardcoded-words: "Element"
-            allowed-hardcoded-keys: |
-                console_dev_note
-                labs|element_call_video_rooms
-                labs|feature_disable_call_per_sender_encryption
-                voip|element_call
-                error|invalid_json
-                error|misconfigured
-                welcome_to_element
-                devtools|settings|elementCallUrl
-                labs|sliding_sync_description
+            packageManager: pnpm
+            path: ${{ matrix.path }}
+            allowed-hardcoded-keys: ${{ matrix.allowed-hardcoded-keys }}

-    i18n_lint_shared_components:
-        name: "i18n Check (Shared Components)"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
-        permissions:
-            pull-requests: read
-        with:
-            path: "packages/shared-components"
-            hardcoded-words: "Element"
-
-    rethemendex_lint:
-        name: "Rethemendex Check"
+    # Dummy job to simplify branch protections
+    ci:
+        name: Static Analysis
+        needs: [lint, i18n]
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - run: ./res/css/rethemendex.sh
-
-            - run: git diff --exit-code
-
-    js_lint:
-        name: "ESLint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn run lint:js"
-
-            - name: Install Shared Component Deps
-              run: "yarn --cwd packages/shared-components install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn --cwd packages/shared-components run lint:js"
-
-    style_lint:
-        name: "Style Lint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install"
-
-            - name: Run Linter
-              run: "yarn run lint:style"
-
-    workflow_lint:
-        name: "Workflow Lint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn lint:workflows"
-
-    analyse_dead_code:
-        name: "Analyse Dead Code"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run linter
-              run: "yarn run lint:knip"
+            - run: echo "Ok"
@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead

 jobs:
    sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@dac99c67f08f8f2a079e885ffb682a2f39cd3960
        with:
            LABELS: |
                element-hq/element-meta
@@ -25,6 +25,7 @@ env:
    ENABLE_COVERAGE: ${{ github.event_name != 'merge_group' && inputs.disable_coverage != 'true' }}
    # fetchdep.sh needs to know our PR number
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {}

@@ -39,15 +40,17 @@ jobs:
                runner: [1, 2]
        steps:
            - name: Checkout code
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - name: Yarn cache
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: pnpm cache
              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  node-version: "lts/*"
-                  cache: "yarn"
+                  cache: "pnpm"

            - name: Install Deps
              run: "./scripts/layered.sh"
@@ -55,41 +58,47 @@ jobs:
                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}

            - name: Jest Cache
-              uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              with:
                  path: /tmp/jest_cache
-                  key: ${{ hashFiles('**/yarn.lock') }}
+                  key: ${{ hashFiles('**/pnpm-lock.yaml') }}

            - name: Get number of CPU cores
              id: cpu-cores
              uses: SimenB/github-actions-cpu-cores@97ba232459a8e02ff6121db9362b09661c875ab8 # v2

            - name: Run tests
+              working-directory: apps/web
              run: |
-                  yarn test \
-                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                  pnpm test \
+                      --coverage=$ENABLE_COVERAGE \
                      --ci \
-                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
-                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --max-workers $MAX_WORKERS \
+                      --shard "$SHARD" \
                      --cacheDirectory /tmp/jest_cache
              env:
                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true

                  # tell jest to use coloured output
                  FORCE_COLOR: true
+                  MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}

            - name: Move coverage files into place
              if: env.ENABLE_COVERAGE == 'true'
-              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+              working-directory: apps/web
+              run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
+              env:
+                  NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: coverage-${{ matrix.runner }}
                  path: |
-                      coverage
-                      !coverage/lcov-report
+                      apps/web/coverage
+                      !apps/web/coverage/lcov-report

    complete:
        name: jest-tests
@@ -104,7 +113,7 @@ jobs:

            - name: Skip SonarCloud in merge queue
              if: github.event_name == 'merge_group' || inputs.disable_coverage == 'true'
-              uses: guibranco/github-status-action-v2@5530c593759f489bba08272e96986ffc571c1ea1
+              uses: guibranco/github-status-action-v2@9bfa8773cdbdc6c185747fd43cd7faa9d7c32f09
              with:
                  authToken: ${{ secrets.GITHUB_TOKEN }}
                  state: success
@@ -118,35 +127,37 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - name: Checkout code
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - name: Yarn cache
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: pnpm cache
              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  node-version: "lts/*"
-                  cache: "yarn"
+                  cache: "pnpm"

            - name: Install Shared Component Deps
              working-directory: "packages/shared-components"
-              run: "yarn install"
+              run: "pnpm install"

            - name: Cache storybook & vitest
-              uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              with:
                  path: |
                      packages/shared-components/node_modules/.cache
                      packages/shared-components/node_modules/.vite/vitest
-                  key: ${{ hashFiles('packages/shared-components/yarn.lock') }}
+                  key: ${{ hashFiles('pnpm-lock.yaml') }}

            - name: Get installed Playwright version
              working-directory: packages/shared-components
              id: playwright
-              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -155,15 +166,15 @@ jobs:
            - name: Install Playwright browsers
              working-directory: packages/shared-components
              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: "yarn playwright install --with-deps --only-shell"
+              run: "pnpm playwright install --with-deps --only-shell"

            - name: Run tests
              working-directory: "packages/shared-components"
-              run: yarn test:unit --coverage=${{ env.ENABLE_COVERAGE }}
+              run: pnpm test:unit --coverage=$ENABLE_COVERAGE

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: coverage-sharedcomponents
                  path: |
@@ -12,7 +12,7 @@ jobs:
            issues: write
            pull-requests: write
        steps:
-            - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10
+            - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
              with:
                  operations-per-run: 100

@@ -9,21 +9,25 @@ jobs:
    update:
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
+              run: "pnpm install --frozen-lockfile"

            - name: Fetch Jitsi
-              run: "yarn update:jitsi"
+              working-directory: apps/web
+              run: "pnpm vendor:jitsi"

            - name: Create Pull Request
-              uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8
+              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  branch: actions/jitsi-update
@@ -3,29 +3,19 @@
 /dist
 /key.pem
 /lib
-/node_modules
-/webapp
+node_modules
 /.npmrc
 /*.log
 package-lock.json
 .DS_Store
-electron/dist
-electron/pub
 **/.idea
-/config.json
-/config.json.*
-/config.local*.json
-# Legacy skinning file that some people might still have
-/src/component-index.js
-/.tmp
 /webpack-stats.json
+/.tmp
 .vscode
 .vscode/
 .env
-/coverage
-# Auto-generated file
-/src/modules.js
-/build_config.yaml
+.env.*
+coverage
 /book
 /index.html
 # version file and tarball created by `npm pack` / `yarn pack`
@@ -41,3 +31,10 @@ storybook-static

 # TSC incremental compilation information
 *.tsbuildinfo
+
+/.link-config
+
+.nx/cache
+.nx/workspace-data
+
+.pnpm-store
@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname "$0")/_/husky.sh"
-
 npx lint-staged --concurrent false
@@ -1,7 +1,3 @@
 {
-    "*": "prettier --write",
-    "src/**/*.(ts|tsx)": ["eslint --fix"],
-    "scripts/**/*.(ts|tsx)": ["eslint --fix"],
-    "module_system/**/*.(ts|tsx)": ["eslint --fix"],
-    "*.pcss": ["stylelint --fix"]
+    "*": "prettier --write --ignore-unknown"
 }
@@ -1,30 +1,30 @@
 /build
 /dist
 /lib
-/node_modules
-/webapp
+node_modules
+/apps/web/webapp
 /*.log
-yarn.lock
+pnpm-lock.yaml
 electron/dist
 electron/pub
 **/.idea
 /.tmp
-/webpack-stats.json
+webpack-stats.json
 .vscode
 .vscode/
 .env
-/coverage
+coverage
 # Auto-generated file
-/src/modules.ts
-/src/modules.js
-/src/i18n/strings
-/build_config.yaml
+/apps/web/src/modules.ts
+/apps/web/src/modules.js
+src/i18n/strings
+/apps/web//build_config.yaml
 # Raises an error because it contains a template var breaking the script tag
-src/vector/index.html
-src/vector/modernizr.js
+/apps/web/src/vector/index.html
+/apps/web/src/vector/modernizr.cjs
 /docs/lib
 /book
-/debian/tmp
+debian/tmp
 /.npmrc
 package-lock.json

@@ -33,14 +33,22 @@ package-lock.json
 /docs/changelogs

 # Legacy skinning file that some people might still have
-/src/component-index.js
+/apps/web/src/component-index.js

 # Downloaded and already minified
-res/jitsi_external_api.min.js
+/apps/web/res/jitsi_external_api.min.js

 # This file is also machine-generated
-/playwright/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
-/playwright/test-results/
-/playwright/html-report/
-/playwright/logs/
-/playwright/snapshots/
+/apps/web/playwright/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
+/apps/web/playwright/test-results/
+/apps/web/playwright/html-report/
+/apps/web/playwright/logs/
+/apps/web/playwright/snapshots/
+
+# Shared components generated files
+/packages/shared-components/dist/
+/packages/shared-components/src/i18n/i18nKeys.d.ts
+/packages/shared-components/typedoc/
+/packages/shared-components/storybook-static/
+
+/.nx/
@@ -1 +0,0 @@
-module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");
@@ -1,3 +1,91 @@
+Changes in [1.12.13](https://github.com/element-hq/element-web/releases/tag/v1.12.13) (2026-03-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove automatic rageshakes on UTD labs feature ([#32778](https://github.com/element-hq/element-web/pull/32778)). Contributed by @Half-Shot.
+* Remove automaticErrorReporting labs feature ([#32781](https://github.com/element-hq/element-web/pull/32781)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Upgrade Element Call for new picture-in-picture designs ([#32816](https://github.com/element-hq/element-web/pull/32816)). Contributed by @robintown.
+* Room list: add sections to shared components ([#32735](https://github.com/element-hq/element-web/pull/32735)). Contributed by @florianduros.
+* feat: Devtool for sticky events MSC4354 ([#32741](https://github.com/element-hq/element-web/pull/32741)). Contributed by @BillCarsonFr.
+* Port URL Preview components to MVVM ([#32525](https://github.com/element-hq/element-web/pull/32525)). Contributed by @Half-Shot.
+* Add support for Widget \& Room Header Buttons module APIs ([#32734](https://github.com/element-hq/element-web/pull/32734)). Contributed by @dbkr.
+* Port over linkifyJS to shared-components. ([#32731](https://github.com/element-hq/element-web/pull/32731)). Contributed by @Half-Shot.
+* Redesign widget pip and move into shared component ([#32654](https://github.com/element-hq/element-web/pull/32654)). Contributed by @toger5.
+* Implement customisations \& login component Module API 1.11.0 ([#32687](https://github.com/element-hq/element-web/pull/32687)). Contributed by @t3chguy.
+* Realign MessageActionBar to Figma designs ([#32722](https://github.com/element-hq/element-web/pull/32722)). Contributed by @t3chguy.
+* Implement new widget permissions module api ([#32565](https://github.com/element-hq/element-web/pull/32565)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix soft crash of room list when trying to open a room ([#32872](https://github.com/element-hq/element-web/pull/32872)). Contributed by @RiotRobot.
+* Fix "key storage out of sync" appearing when key storage is actually fine ([#32811](https://github.com/element-hq/element-web/pull/32811)). Contributed by @andybalaam.
+* Fix remove button styling in local address list of room settings ([#32798](https://github.com/element-hq/element-web/pull/32798)). Contributed by @florianduros.
+* Always check \& update the users timezone on their profile on startup ([#32764](https://github.com/element-hq/element-web/pull/32764)). Contributed by @Half-Shot.
+* Fix nx configuration to actually run type linter ([#32776](https://github.com/element-hq/element-web/pull/32776)). Contributed by @richvdh.
+* Fix expand space panel button not being shown on keyboard focus ([#32746](https://github.com/element-hq/element-web/pull/32746)). Contributed by @t3chguy.
+* Reset key storage if restoring from Recovery encounters the wrong decryption key ([#32668](https://github.com/element-hq/element-web/pull/32668)). Contributed by @andybalaam.
+
+
+Changes in [1.12.12](https://github.com/element-hq/element-web/releases/tag/v1.12.12) (2026-03-10)
+==================================================================================================
+## ✨ Features
+
+* Add stable support for MSC4380 invite blocking ([#31966](https://github.com/element-hq/element-web/pull/31966)). Contributed by @richvdh.
+* Hide the names of banned users behind a spoiler tag ([#32424](https://github.com/element-hq/element-web/pull/32424)). Contributed by @andybalaam.
+* Room list: remove bold effect on selected room ([#32593](https://github.com/element-hq/element-web/pull/32593)). Contributed by @florianduros.
+* Use Compound buttons in auth screens ([#32562](https://github.com/element-hq/element-web/pull/32562)). Contributed by @t3chguy.
+* Track room list sorting algorithm changes ([#32556](https://github.com/element-hq/element-web/pull/32556)). Contributed by @MidhunSureshR.
+* Update `sso_redirect_options` to work for Native OIDC ([#32537](https://github.com/element-hq/element-web/pull/32537)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Room list: avoid excessive re-renders on room list store update or filter change ([#32663](https://github.com/element-hq/element-web/pull/32663)). Contributed by @florianduros.
+* Room list: listen to call event to check number of participants ([#32677](https://github.com/element-hq/element-web/pull/32677)). Contributed by @florianduros.
+* Fix invite-specific join errors not being shown ([#32621](https://github.com/element-hq/element-web/pull/32621)). Contributed by @Half-Shot.
+* Prevent logging lots of "Browser unsupported" lines ([#32647](https://github.com/element-hq/element-web/pull/32647)). Contributed by @Half-Shot.
+* Update critical gradient for room status bar ([#32575](https://github.com/element-hq/element-web/pull/32575)). Contributed by @Half-Shot.
+* Room list: avoid header overflowing when too long ([#32645](https://github.com/element-hq/element-web/pull/32645)). Contributed by @florianduros.
+* Room list: center focus outline of room list item ([#32637](https://github.com/element-hq/element-web/pull/32637)). Contributed by @florianduros.
+* Fix misaligned cross in complete security dialog ([#32614](https://github.com/element-hq/element-web/pull/32614)). Contributed by @dbkr.
+* Room list: fix keyboard navigation ([#32585](https://github.com/element-hq/element-web/pull/32585)). Contributed by @florianduros.
+* Don't show empty privacy section ([#32582](https://github.com/element-hq/element-web/pull/32582)). Contributed by @dbkr.
+* Disable room list image dragging ([#32590](https://github.com/element-hq/element-web/pull/32590)). Contributed by @florianduros.
+* Update UserMenu theme toggle to use IconButton ([#32591](https://github.com/element-hq/element-web/pull/32591)). Contributed by @t3chguy.
+* Room list: make room list item scales with large font size ([#32523](https://github.com/element-hq/element-web/pull/32523)). Contributed by @florianduros.
+
+
+Changes in [1.12.11](https://github.com/element-hq/element-web/releases/tag/v1.12.11) (2026-02-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove UIFeature.BulkUnverifiedSessionsReminder setting ([#31943](https://github.com/element-hq/element-web/pull/31943)). Contributed by @andybalaam.
+* Remove unused function to auto-rageshake when key backup is not set up ([#31942](https://github.com/element-hq/element-web/pull/31942)). Contributed by @andybalaam.
+
+## ✨ Features
+
+* Room list: update the visuals in order to have better contrast ([#32421](https://github.com/element-hq/element-web/pull/32421)). Contributed by @florianduros.
+*  Set history visibility to "invited" for DMs and new non-public rooms when creating a room ([#31974](https://github.com/element-hq/element-web/pull/31974)). Contributed by @langleyd.
+* Remove server acl status/summaries from timeline  ([#32461](https://github.com/element-hq/element-web/pull/32461)). Contributed by @langleyd.
+* Update `globalBlacklistUnverifiedDevices` on setting change ([#31983](https://github.com/element-hq/element-web/pull/31983)). Contributed by @kaylendog.
+* Add badge for history visibiltity to room info panel ([#31927](https://github.com/element-hq/element-web/pull/31927)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* Default useOnlyCurrentProfiles to true ([#32524](https://github.com/element-hq/element-web/pull/32524)). Contributed by @dbkr.
+* Keep custom theme active after reload ([#32506](https://github.com/element-hq/element-web/pull/32506)). Contributed by @florianduros.
+* Update font format from 'ttf' to 'truetype' ([#32493](https://github.com/element-hq/element-web/pull/32493)). Contributed by @all-yall.
+* Fix videos on Firefox ([#32497](https://github.com/element-hq/element-web/pull/32497)). Contributed by @p1gp1g.
+* Use a dedicated FAQ/help entry for key storage. ([#32480](https://github.com/element-hq/element-web/pull/32480)). Contributed by @mxandreas.
+* Avoid showing two chat timelines side by side after a call ([#32484](https://github.com/element-hq/element-web/pull/32484)). Contributed by @robintown.
+* Update screenshot for reactive display name disambiguation ([#32431](https://github.com/element-hq/element-web/pull/32431)). Contributed by @aditya-cherukuru.
+* Fix Status Bar being unreadable when the user overrides the default OS light/dark theme. ([#32442](https://github.com/element-hq/element-web/pull/32442)). Contributed by @Half-Shot.
+* fix: Remove state\_key: null from Seshat search results ([#31524](https://github.com/element-hq/element-web/pull/31524)). Contributed by @shinaoka.
+* Fix user pill deserialisation ([#31947](https://github.com/element-hq/element-web/pull/31947)). Contributed by @t3chguy.
+
+
 Changes in [1.12.10](https://github.com/element-hq/element-web/releases/tag/v1.12.10) (2026-02-10)
 ==================================================================================================
 ## ✨ Features
@@ -46,6 +46,9 @@ As for your PR description, it should include these things:
 - Add comments to the diff for the reviewer that might help them to understand
  why the change is necessary or how they might better understand and review it.

+Please **_do not use force push_** in your PRs. Doing so means we can't see what
+has changed. We use squash merge to get a "clean" git history.
+
 ### Changelogs

 There's no need to manually add Changelog entries: we use information in the
@@ -9,7 +9,7 @@

 # Element

-Element (formerly known as Vector and Riot) is a Matrix web client built using the [Matrix
+Element (formerly known as Vector and Riot) is a Matrix web & desktop client built using the [Matrix
 JS SDK](https://github.com/matrix-org/matrix-js-sdk).

 # Supported Environments
@@ -42,8 +42,8 @@ Element has several tiers of support for different environments:
 The period of support for these tiers should last until the releases specified above, plus 1 app release cycle(2 weeks). In the case of Firefox ESR this is extended further to allow it land in Debian Stable.

 For accessing Element on an Android or iOS device, we currently recommend the
-native apps [element-android](https://github.com/element-hq/element-android)
-and [element-ios](https://github.com/element-hq/element-ios).
+native apps [element-x-android](https://github.com/element-hq/element-x-android)
+and [element-x-ios](https://github.com/element-hq/element-x-ios).

 # Getting Started

@@ -55,91 +55,16 @@ To host your own instance of Element see [Installing Element Web](docs/install.m

 To install Element as a desktop application, see [Running as a desktop app](#running-as-a-desktop-app) below.

-# Important Security Notes
+---

-## Separate domains
+# Monorepo

-We do not recommend running Element from the same domain name as your Matrix
-homeserver. The reason is the risk of XSS (cross-site-scripting)
-vulnerabilities that could occur if someone caused Element to load and render
-malicious user generated content from a Matrix API which then had trusted
-access to Element (or other apps) due to sharing the same domain.
+This repository is a monorepo hosting Element Web and other related projects in various subdirectories.
+You can read more about the structure [here](docs/monorepo.md).

-We have put some coarse mitigations into place to try to protect against this
-situation, but it's still not good practice to do it in the first place. See
-<https://github.com/element-hq/element-web/issues/1977> for more details.
+# Element Web

-## Configuration best practices
-
-Unless you have special requirements, you will want to add the following to
-your web server configuration when hosting Element Web:
-
- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
-  framed and protect from [clickjacking][owasp-clickjacking].
- The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
-  header, as the modern replacement for `X-Frame-Options` (though both should be
-  included since not all browsers support it yet, see
-  [this][owasp-clickjacking-csp]).
- The `X-Content-Type-Options: nosniff` header, to [disable MIME
-  sniffing][mime-sniffing].
- The `X-XSS-Protection: 1; mode=block;` header, for basic XSS protection in
-  legacy browsers.
-
-[mime-sniffing]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing
-[owasp-clickjacking-csp]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#content-security-policy-frame-ancestors-examples
-[owasp-clickjacking]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
-
-If you are using nginx, this would look something like the following:
-
-```
-add_header X-Frame-Options SAMEORIGIN;
-add_header X-Content-Type-Options nosniff;
-add_header X-XSS-Protection "1; mode=block";
-add_header Content-Security-Policy "frame-ancestors 'self'";
-```
-
-For Apache, the configuration looks like:
-
-```
-Header set X-Frame-Options SAMEORIGIN
-Header set X-Content-Type-Options nosniff
-Header set X-XSS-Protection "1; mode=block"
-Header set Content-Security-Policy "frame-ancestors 'self'"
-```
-
-Note: In case you are already setting a `Content-Security-Policy` header
-elsewhere, you should modify it to include the `frame-ancestors` directive
-instead of adding that last line.
-
-# Building From Source
-
-Element is a modular webapp built with modern ES6 and uses a Node.js build system.
-Ensure you have the latest LTS version of Node.js installed.
-
-Using `yarn` instead of `npm` is recommended. Please see the Yarn [install
-guide](https://classic.yarnpkg.com/en/docs/install) if you do not have it already.
-
-1. Install or update `node.js` so that your `node` is at least the current recommended LTS.
-1. Install `yarn` if not present already.
-1. Clone the repo: `git clone https://github.com/element-hq/element-web.git`.
-1. Switch to the element-web directory: `cd element-web`.
-1. Install the prerequisites: `yarn install`.
-    - If you're using the `develop` branch, then it is recommended to set up a
-      proper development environment (see [Setting up a dev
-      environment](./developer_guide.md#setting-up-a-dev-environment) below). Alternatively, you
-      can use <https://develop.element.io> - the continuous integration release of
-      the develop branch.
-1. Configure the app by copying `config.sample.json` to `config.json` and
-   modifying it. See the [configuration docs](docs/config.md) for details.
-1. `yarn dist` to build a tarball to deploy. Untaring this file will give
-   a version-specific directory containing all the files that need to go on your
-   web server.
-
-Note that `yarn dist` is not supported on Windows, so Windows users can run `yarn build`,
-which will build all the necessary files into the `webapp` directory. The version of Element
-will not appear in Settings without using the dist script. You can then mount the
-`webapp` directory on your web server to actually serve up the app, which is
-entirely static content.
+To learn more about Element Web [click here](apps/web/README.md)

 # Running as a Desktop app

@@ -153,33 +78,6 @@ Many thanks to @aviraldg for the initial work on the Electron integration.

 The [configuration docs](docs/config.md#desktop-app-configuration) show how to override the desktop app's default settings if desired.

-# config.json
-
-Element supports a variety of settings to configure default servers, behaviour, themes, etc.
-See the [configuration docs](docs/config.md) for more details.
-
-# Labs Features
-
-Some features of Element may be enabled by flags in the `Labs` section of the settings.
-Some of these features are described in [labs.md](https://github.com/element-hq/element-web/blob/develop/docs/labs.md).
-
-# Caching requirements
-
-Element requires the following URLs not to be cached, when/if you are serving Element from your own webserver:
-
-```
-/config.*.json
-/i18n
-/home
-/sites
-/index.html
-```
-
-We also recommend that you force browsers to re-validate any cached copy of Element on page load by configuring your
-webserver to return `Cache-Control: no-cache` for `/`. This ensures the browser will fetch a new version of Element on
-the next page load after it's been deployed. Note that this is already configured for you in the nginx config of our
-Dockerfile.
-
 # Development

 Please read through the following:
@@ -194,17 +92,6 @@ To add a new translation, head to the [translating doc](docs/translating.md).

 For a developer guide, see the [translating dev doc](docs/translating-dev.md).

-# Extending Element Web with Modules
-
-Element Web supports a module system that allows you to extend or modify functionality at runtime. Modules are loaded dynamically and provide a safe, predictable API for customization.
-
-## What are modules?
-
-Modules are extensions that can add or modify Element Web's functionality. They are:
-
- Built using the [`@element-hq/element-web-module-api`](https://github.com/element-hq/element-modules/tree/main/packages/element-web-module-api)
- Loaded in EW via [config.json](docs/config.md#modules)
-
 # Triaging issues

 Issues are triaged by community members and the Web App Team, following the [triage process](https://github.com/element-hq/element-meta/wiki/Triage-process).
@@ -225,3 +112,6 @@ This software is multi licensed by New Vector Ltd (Element). It can be used eith

 (3) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
 Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
+
+Please contact [licensing@element.io](mailto:licensing@element.io) to purchase
+an Element commercial license for this software.
@@ -7,6 +7,7 @@ karma-reports/
 .idea/
 .tmp/
 config.json*
+.link-config
 # Exclude the playwright directory as much as we can as the snapshots are huge and we bind mount it in
 playwright/
 !playwright/docker-entrypoint.sh
@@ -1,4 +1,4 @@
-src/vector/modernizr.js
+src/vector/modernizr.cjs
 test/end-to-end-tests/node_modules/
 test/end-to-end-tests/element/
 test/end-to-end-tests/synapse/
@@ -11,3 +11,8 @@ src/modules.js
 # Test result files
 /playwright/test-results/
 /playwright/html-report/
+
+# Shared components generated files
+/packages/shared-components/dist/
+/packages/shared-components/src/i18n/i18nKeys.d.ts
+/packages/shared-components/typedoc/
@@ -196,9 +196,10 @@ module.exports = {
    },
    overrides: [
        {
-            files: ["src/**/*.{ts,tsx}", "test/**/*.{ts,tsx}", "playwright/**/*.ts"],
+            files: ["src/**/*.{ts,tsx}", "test/**/*.{ts,tsx}", "playwright/**/*.ts", "*.ts"],
            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
            rules: {
+                "@typescript-eslint/unbound-method": ["error", { ignoreStatic: true }],
                "@typescript-eslint/explicit-function-return-type": [
                    "error",
                    {
@@ -230,42 +231,6 @@ module.exports = {
                ],
            },
        },
-        // temporary override for offending icon require files
-        {
-            files: [
-                "src/SdkConfig.ts",
-                "src/components/structures/FileDropTarget.tsx",
-                "src/components/structures/RoomStatusBar.tsx",
-                "src/components/structures/UserMenu.tsx",
-                "src/components/views/avatars/WidgetAvatar.tsx",
-                "src/components/views/dialogs/AddExistingToSpaceDialog.tsx",
-                "src/components/views/dialogs/ForwardDialog.tsx",
-                "src/components/views/dialogs/InviteDialog.tsx",
-                "src/components/views/dialogs/ModalWidgetDialog.tsx",
-                "src/components/views/dialogs/UploadConfirmDialog.tsx",
-                "src/components/views/dialogs/security/SetupEncryptionDialog.tsx",
-                "src/components/views/elements/AddressTile.tsx",
-                "src/components/views/elements/AppWarning.tsx",
-                "src/components/views/elements/SSOButtons.tsx",
-                "src/components/views/messages/MAudioBody.tsx",
-                "src/components/views/messages/MImageBody.tsx",
-                "src/components/views/messages/MFileBody.tsx",
-                "src/components/views/messages/MStickerBody.tsx",
-                "src/components/views/messages/MVideoBody.tsx",
-                "src/components/views/messages/MVoiceMessageBody.tsx",
-                "src/components/views/right_panel/EncryptionPanel.tsx",
-                "src/components/views/rooms/EntityTile.tsx",
-                "src/components/views/rooms/LinkPreviewGroup.tsx",
-                "src/components/views/rooms/MemberList.tsx",
-                "src/components/views/rooms/MessageComposer.tsx",
-                "src/components/views/rooms/ReplyPreview.tsx",
-                "src/components/views/settings/tabs/room/SecurityRoomSettingsTab.tsx",
-                "src/components/views/settings/tabs/user/GeneralUserSettingsTab.tsx",
-            ],
-            rules: {
-                "@typescript-eslint/no-var-requires": "off",
-            },
-        },
        {
            files: ["test/**/*.{ts,tsx}", "playwright/**/*.ts"],
            extends: ["plugin:matrix-org/jest"],
@@ -274,6 +239,7 @@ module.exports = {
                "@typescript-eslint/explicit-function-return-type": "off",
                "@typescript-eslint/explicit-member-accessibility": "off",
                "@typescript-eslint/no-empty-object-type": "off",
+                "@typescript-eslint/unbound-method": "off",

                // Jest/Playwright specific

@@ -0,0 +1,9 @@
+/webapp
+/config.json
+/config.json.*
+/config.local*.json
+# Legacy skinning file that some people might still have
+/src/component-index.js
+# Auto-generated file
+/src/modules.js
+/build_config.yaml
@@ -0,0 +1,7 @@
+{
+    "*": "prettier --write --ignore-unknown",
+    "src/**/*.(ts|tsx)": ["eslint --fix"],
+    "scripts/**/*.(ts|tsx)": ["eslint --fix"],
+    "module_system/**/*.(ts|tsx)": ["eslint --fix"],
+    "*.pcss": ["stylelint --fix"]
+}
@@ -55,18 +55,16 @@ module.exports = {
                    { from: "res/css/views/rooms/_ReadReceiptGroup.pcss", type: "css" },
                    { from: "res/css/views/rooms/_EditMessageComposer.pcss", type: "css" },
                    { from: "res/css/views/right_panel/_BaseCard.pcss", type: "css" },
-                    { from: "res/css/views/messages/_MessageTimestamp.pcss", type: "css" },
-                    { from: "res/css/views/messages/_EventTileBubble.pcss", type: "css" },
                    { from: "res/css/views/messages/_MessageActionBar.pcss", type: "css" },
                    { from: "res/css/views/voip/LegacyCallView/_LegacyCallViewButtons.pcss", type: "css" },
                    { from: "res/css/views/elements/_ToggleSwitch.pcss", type: "css" },
                    { from: "res/css/views/settings/tabs/_SettingsTab.pcss", type: "css" },
                    { from: "res/css/structures/_RoomView.pcss", type: "css" },
                    // Compound vars
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-base.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-semantic.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-base-mq.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-semantic-mq.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-base.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-semantic.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-base-mq.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-semantic-mq.css",
                ],
            },
        ],
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-easings" {
+    export default function (): void;
+}
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-hexrgba" {
+    export default function (): void;
+}
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-mixins" {
+    export default function (): void;
+}
@@ -0,0 +1,19 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "webpack-version-file-plugin" {
+    interface Opts {
+        outputFile: string;
+        template?: string;
+        templateString?: string;
+        extras?: Record<string, string>;
+    }
+
+    export default class VersionFilePlugin {
+        public constructor(opts: Opts);
+    }
+}
@@ -1,7 +1,7 @@
-# syntax=docker.io/docker/dockerfile:1.20-labs@sha256:dbcde2ebc4abc8bb5c3c499b9c9a6876842bf5da243951cd2697f921a7aeb6a9
+# syntax=docker.io/docker/dockerfile:1.21-labs@sha256:2e681d22e86e738a057075f930b81b2ab8bc2a34cd16001484a7453cfa7a03fb

 # Builder
-FROM --platform=$BUILDPLATFORM node:24-bullseye@sha256:0cb1bd306f3bdb19174ea9dde765315532cb72074a549a1683fd7aacdde03a52 AS builder
+FROM --platform=$BUILDPLATFORM node:24-bullseye@sha256:d83f76ec9956d35fe14221022e8b5a87a5de6fcdb4edb1187eddeb7dc80cba71 AS builder

 # Support custom branch of the js-sdk. This also helps us build images of element-web develop.
 ARG USE_CUSTOM_SDKS=false
@@ -11,15 +11,16 @@ ARG JS_SDK_BRANCH="master"
 WORKDIR /src

 COPY --exclude=docker . /src
+RUN corepack enable
 RUN /src/scripts/docker-link-repos.sh
-RUN yarn --network-timeout=200000 install
+RUN pnpm install
 RUN /src/scripts/docker-package.sh

 # Copy the config now so that we don't create another layer in the app image
-RUN cp /src/config.sample.json /src/webapp/config.json
+RUN cp /src/apps/web/config.sample.json /src/apps/web/webapp/config.json

 # App
-FROM nginxinc/nginx-unprivileged:alpine-slim@sha256:a75b70e1479178becce46b2028076899e648665b88fd685472469b34316356ec
+FROM nginxinc/nginx-unprivileged:alpine-slim@sha256:800307aaf07c143f5d90aa9d4269cc1971dcfe5aee7cabd11579ac4c6bcf198f

 # Need root user to install packages & manipulate the usr directory
 USER root
@@ -27,12 +28,12 @@ USER root
 # Install jq and moreutils for sponge, both used by our entrypoints
 RUN apk add jq moreutils

-COPY --from=builder /src/webapp /app
+COPY --from=builder /src/apps/web/webapp /app

 # Override default nginx config. Templates in `/etc/nginx/templates` are passed
 # through `envsubst` by the nginx docker image entry point.
-COPY /docker/nginx-templates/* /etc/nginx/templates/
-COPY /docker/docker-entrypoint.d/* /docker-entrypoint.d/
+COPY /apps/web/docker/nginx-templates/* /etc/nginx/templates/
+COPY /apps/web/docker/docker-entrypoint.d/* /docker-entrypoint.d/

 RUN rm -rf /usr/share/nginx/html \
  && ln -s /app /usr/share/nginx/html
@@ -0,0 +1,123 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import webpack from "webpack";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import _ from "lodash";
+import { type Translations } from "matrix-web-i18n";
+
+interface Options {
+    // Path to the strings for the application, will be used to deduce what languages are supported
+    stringsPath: string;
+    // Additional paths to strings which will be merged into the application's own strings for supported languages
+    additionalStringsPaths?: string[];
+}
+
+async function exists(path: string): Promise<boolean> {
+    try {
+        await fs.access(path);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+export class I18nWebpackPlugin {
+    private readonly options: Options;
+
+    public constructor(options: Options) {
+        this.options = options;
+    }
+
+    public apply(compiler: webpack.Compiler): void {
+        const { RawSource } = compiler.webpack.sources;
+
+        compiler.hooks.thisCompilation.tap("I18nWebpackPlugin", (compilation) => {
+            compilation.hooks.processAssets.tapPromise(
+                {
+                    name: "I18nWebpackPlugin",
+                    stage: webpack.Compilation.PROCESS_ASSETS_STAGE_ADDITIONS,
+                },
+                async () => {
+                    const paths = [this.options.stringsPath, ...(this.options.additionalStringsPaths ?? [])].map((p) =>
+                        path.resolve(compiler.context, p),
+                    );
+
+                    const logger = compilation.getLogger("I18nWebpackPlugin");
+
+                    for (const p of paths) {
+                        compilation.contextDependencies.add(p);
+
+                        if (!(await exists(p))) {
+                            compilation.errors.push(
+                                new webpack.WebpackError(`I18nWebpackPlugin: strings path not found: ${p}`),
+                            );
+                            return;
+                        }
+                    }
+
+                    const primaryPath = paths[0];
+                    const includeLangs = [...new Set([...(await fs.readdir(primaryPath))])]
+                        .filter((fn) => fn.endsWith(".json"))
+                        .map((f) => f.slice(0, -5));
+
+                    const langFileMap: Record<string, string> = {};
+
+                    for (const lang of includeLangs) {
+                        let translations: Translations = {};
+                        for (const p of paths) {
+                            const f = path.join(p, lang + ".json");
+
+                            if (await exists(f)) {
+                                try {
+                                    const content = await fs.readFile(f, "utf-8");
+                                    translations = _.merge(translations, JSON.parse(content));
+                                    compilation.fileDependencies.add(f);
+                                } catch (e) {
+                                    compilation.errors.push(
+                                        new webpack.WebpackError(
+                                            `I18nWebpackPlugin: Failed to read or parse ${f}: ${e}`,
+                                        ),
+                                    );
+                                }
+                            }
+                        }
+
+                        const json = JSON.stringify(translations, null, 4);
+                        const jsonBuffer = Buffer.from(json);
+                        const digest = compiler.webpack.util
+                            .createHash("xxhash64")
+                            .update(jsonBuffer)
+                            .digest("hex")
+                            .slice(0, 7);
+                        const filename = `${lang}.${digest}.json`;
+
+                        compilation.emitAsset(`i18n/${filename}`, new RawSource(jsonBuffer));
+                        langFileMap[lang] = filename;
+                        logger.debug(`Generated language file: ${filename}`);
+                    }
+
+                    // Generate languages.json
+                    const languages: Record<string, string> = {};
+                    includeLangs.forEach((lang) => {
+                        const normalizedLanguage = lang.toLowerCase().replace("_", "-");
+                        const languageParts = normalizedLanguage.split("-");
+                        if (languageParts.length == 2 && languageParts[0] == languageParts[1]) {
+                            languages[languageParts[0]] = langFileMap[lang];
+                        } else {
+                            languages[normalizedLanguage] = langFileMap[lang];
+                        }
+                    });
+
+                    compilation.emitAsset("i18n/languages.json", new RawSource(JSON.stringify(languages, null, 4)));
+                    logger.info("Generated languages.json and language files");
+                },
+            );
+        });
+    }
+}
@@ -0,0 +1,131 @@
+# Important Security Notes
+
+## Separate domains
+
+We do not recommend running Element from the same domain name as your Matrix
+homeserver. The reason is the risk of XSS (cross-site-scripting)
+vulnerabilities that could occur if someone caused Element to load and render
+malicious user generated content from a Matrix API which then had trusted
+access to Element (or other apps) due to sharing the same domain.
+
+We have put some coarse mitigations into place to try to protect against this
+situation, but it's still not good practice to do it in the first place. See
+<https://github.com/element-hq/element-web/issues/1977> for more details.
+
+## Configuration best practices
+
+Unless you have special requirements, you will want to add the following to
+your web server configuration when hosting Element Web:
+
+- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
+  framed and protect from [clickjacking][owasp-clickjacking].
+- The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
+  header, as the modern replacement for `X-Frame-Options` (though both should be
+  included since not all browsers support it yet, see
+  [this][owasp-clickjacking-csp]).
+- The `X-Content-Type-Options: nosniff` header, to [disable MIME
+  sniffing][mime-sniffing].
+- The `X-XSS-Protection: 1; mode=block;` header, for basic XSS protection in
+  legacy browsers.
+
+[mime-sniffing]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing
+[owasp-clickjacking-csp]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#content-security-policy-frame-ancestors-examples
+[owasp-clickjacking]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
+
+If you are using nginx, this would look something like the following:
+
+```
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header Content-Security-Policy "frame-ancestors 'self'";
+```
+
+For Apache, the configuration looks like:
+
+```
+Header set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Content-Security-Policy "frame-ancestors 'self'"
+```
+
+Note: In case you are already setting a `Content-Security-Policy` header
+elsewhere, you should modify it to include the `frame-ancestors` directive
+instead of adding that last line.
+
+# Building From Source
+
+Element is a modular webapp built with modern ES6 and uses a Node.js build system.
+Ensure you have the latest LTS version of Node.js installed.
+
+Using `pnpm` instead of `npm` is recommended. Please see the pnpm [install
+guide](https://pnpm.io/installation#using-corepack) if you do not have it already.
+
+1. Install or update `node.js` so that your `node` is at least the current recommended LTS.
+1. Install `pnpm` if not present already.
+1. Clone the repo: `git clone https://github.com/element-hq/element-web.git`.
+1. Switch to the element-web directory: `cd element-web/apps/web`.
+1. Install the prerequisites: `pnpm install`.
+    - If you're using the `develop` branch, then it is recommended to set up a
+      proper development environment (see [Setting up a dev
+      environment](../../developer_guide.md#setting-up-a-dev-environment) below). Alternatively, you
+      can use <https://develop.element.io> - the continuous integration release of
+      the develop branch.
+1. Configure the app by copying `config.sample.json` to `config.json` and
+   modifying it. See the [configuration docs](../../docs/config.md) for details.
+1. `pnpm dist` to build a tarball to deploy. Untaring this file will give
+   a version-specific directory containing all the files that need to go on your
+   web server.
+
+Note that `pnpm dist` is not supported on Windows, so Windows users can run `pnpm build`,
+which will build all the necessary files into the `webapp` directory. The version of Element
+will not appear in Settings without using the dist script. You can then mount the
+`webapp` directory on your web server to actually serve up the app, which is
+entirely static content.
+
+# config.json
+
+Element supports a variety of settings to configure default servers, behaviour, themes, etc.
+See the [configuration docs](../../docs/config.md) for more details.
+
+# Labs Features
+
+Some features of Element may be enabled by flags in the `Labs` section of the settings.
+Some of these features are described in [labs.md](https://github.com/element-hq/element-web/blob/develop/docs/labs.md).
+
+# Caching requirements
+
+Element requires the following URLs not to be cached, when/if you are serving Element from your own webserver:
+
+```
+/config.*.json
+/i18n
+/home
+/sites
+/index.html
+```
+
+We also recommend that you force browsers to re-validate any cached copy of Element on page load by configuring your
+webserver to return `Cache-Control: no-cache` for `/`. This ensures the browser will fetch a new version of Element on
+the next page load after it's been deployed. Note that this is already configured for you in the nginx config of our
+Dockerfile.
+
+# Development
+
+Please read through the following:
+
+1. [Developer guide](../../developer_guide.md)
+2. [Code style](../../code_style.md)
+3. [Contribution guide](../../CONTRIBUTING.md)
+
+# Extending Element Web with Modules
+
+Element Web supports a module system that allows you to extend or modify functionality at runtime. Modules are loaded dynamically and provide a safe, predictable API for customization.
+
+## What are modules?
+
+Modules are extensions that can add or modify Element Web's functionality. They are:
+
+- Built using the [`@element-hq/element-web-module-api`](https://github.com/element-hq/element-modules/tree/main/packages/element-web-module-api)
+- Loaded in EW via [config.json](../../docs/config.md#modules)
@@ -16,7 +16,7 @@
 # The modules to install. See ./docs/modules.md for more information on
 # what modules are.
 #
-# The values of this are provided to `yarn add` for inclusion.
+# The values of this are provided to `pnpm add` for inclusion.
 modules:
    # An example of pulling a module from NPM
    - "@vector-im/element-web-ilag-module@^0.0.1"
@@ -18,7 +18,6 @@
        "https://scalar-staging.vector.im/api"
    ],
    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
-    "uisi_autorageshake_app": "element-auto-uisi",
    "show_labs_settings": false,
    "room_directory": {
        "servers": ["matrix.org", "gitter.im"]
@@ -18,7 +18,6 @@
        "https://scalar-staging.vector.im/api"
    ],
    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
-    "uisi_autorageshake_app": "element-auto-uisi",
    "show_labs_settings": true,
    "room_directory": {
        "servers": ["matrix.org", "gitter.im"]
@@ -17,6 +17,9 @@ const config: Config = {
        // This is needed to be able to load dual CJS/ESM WASM packages e.g. rust crypto & matrix-wywiwyg
        customExportConditions: ["browser", "node"],
    },
+    transform: {
+        "\\.[jt]sx?$": "babel-jest",
+    },
    testMatch: ["<rootDir>/test/**/*-test.[tj]s?(x)"],
    globalSetup: "<rootDir>/test/globalSetup.ts",
    setupFiles: ["jest-canvas-mock", "web-streams-polyfill/polyfill"],
@@ -28,9 +31,9 @@ const config: Config = {
        "\\.(gif|png|ttf|woff2)$": "<rootDir>/__mocks__/imageMock.js",
        "\\.svg$": "<rootDir>/__mocks__/svg.js",
        "\\$webapp/i18n/languages.json": "<rootDir>/__mocks__/languages.json",
-        "^react$": "<rootDir>/node_modules/react",
-        "^react-dom$": "<rootDir>/node_modules/react-dom",
-        "^matrix-js-sdk$": "<rootDir>/node_modules/matrix-js-sdk/src",
+        "^react$": "<rootDir>/../../node_modules/react",
+        "^react-dom$": "<rootDir>/../../node_modules/react-dom",
+        "^matrix-js-sdk$": "<rootDir>/../../node_modules/matrix-js-sdk/src",
        "^matrix-react-sdk$": "<rootDir>/src",
        "decoderWorker\\.min\\.js": "<rootDir>/__mocks__/empty.js",
        "decoderWorker\\.min\\.wasm": "<rootDir>/__mocks__/empty.js",
@@ -39,11 +42,11 @@ const config: Config = {
        "workers/(.+)Factory": "<rootDir>/__mocks__/workerFactoryMock.js",
        "^!!raw-loader!.*": "jest-raw-loader",
        "recorderWorkletFactory": "<rootDir>/__mocks__/empty.js",
-        "counterpart": "<rootDir>/node_modules/counterpart",
-        "@vector-im/compound-web": "<rootDir>/node_modules/@vector-im/compound-web",
+        "counterpart": "<rootDir>/../../node_modules/counterpart",
+        "@vector-im/compound-web": "<rootDir>/../../node_modules/@vector-im/compound-web",
    },
    transformIgnorePatterns: [
-        "/node_modules/(?!(mime|matrix-js-sdk|uuid|p-retry|is-network-error|react-merge-refs|is-ip|ip-regex|super-regex|function-timeout|time-span|convert-hrtime|clone-regexp|is-regexp|matrix-web-i18n|await-lock|@element-hq/web-shared-components|react-virtuoso)).+$",
+        "/node_modules/(?!(mime|matrix-js-sdk|uuid|p-retry|is-network-error|react-merge-refs|is-ip|ip-regex|super-regex|function-timeout|time-span|convert-hrtime|clone-regexp|is-regexp|matrix-web-i18n|await-lock|@element-hq/web-shared-components|react-virtuoso|lodash)).+$",
    ],
    collectCoverageFrom: [
        "<rootDir>/src/**/*.{js,ts,tsx}",
@@ -55,20 +58,21 @@ const config: Config = {
        "!<rootDir>/src/**/*.d.ts",
    ],
    coverageReporters: ["text-summary", "lcov"],
-    testResultsProcessor: "@casualbot/jest-sonar-reporter",
    prettierPath: null,
    moduleDirectories: ["node_modules", "test/test-utils"],
 };

-// if we're running under GHA, enable the GHA reporter
+// if we're running under GHA, enable relevant reporters
 if (env["GITHUB_ACTIONS"] !== undefined) {
-    const reporters: Config["reporters"] = [["github-actions", { silent: false }], "summary"];
+    config.reporters ??= [];
+    config.reporters.push(["github-actions", { silent: false }]);
+    config.reporters.push("summary");
+    config.reporters.push("@casualbot/jest-sonar-reporter");

    // if we're running against the develop branch, also enable the slow test reporter
    if (env["GITHUB_REF"] == "refs/heads/develop") {
-        reporters.push("<rootDir>/test/slowReporter.cjs");
+        config.reporters.push("<rootDir>/test/slowReporter.cjs");
    }
-    config.reporters = reporters;
 }

 export default config;
@@ -38,7 +38,7 @@ export function installer(config: BuildConfig): void {
    let exitCode = 0;

    // We cheat a bit and store the current package.json and lockfile so we can safely
-    // run `yarn add` without creating extra committed files for people. We restore
+    // run `pnpm add` without creating extra committed files for people. We restore
    // these files by simply overwriting them when we're done.
    const packageDeps = readCurrentPackageDetails();

@@ -47,7 +47,7 @@ export function installer(config: BuildConfig): void {
    const currentOptDeps = getOptionalDepNames(packageDeps.packageJson);

    try {
-        // Install the modules with yarn
+        // Install the modules with pnpm
        const yarnAddRef = config.modules.join(" ");
        callYarnAdd(yarnAddRef); // install them all at once

@@ -108,20 +108,20 @@ type RawDependencies = {

 function readCurrentPackageDetails(): RawDependencies {
    return {
-        lockfile: fs.readFileSync("./yarn.lock", "utf-8"),
+        lockfile: fs.readFileSync("./pnpm-lock.yaml", "utf-8"),
        packageJson: fs.readFileSync("./package.json", "utf-8"),
    };
 }

 function writePackageDetails(deps: RawDependencies): void {
-    fs.writeFileSync("./yarn.lock", deps.lockfile, "utf-8");
+    fs.writeFileSync("./pnpm-lock.yaml", deps.lockfile, "utf-8");
    fs.writeFileSync("./package.json", deps.packageJson, "utf-8");
 }

 function callYarnAdd(dep: string): void {
    // Add the module to the optional dependencies section just in case something
    // goes wrong in restoring the original package details.
-    childProcess.execSync(`yarn add -O ${dep}`, {
+    childProcess.execSync(`pnpm add -O ${dep}`, {
        env: process.env,
        stdio: ["inherit", "inherit", "inherit"],
    });
@@ -170,7 +170,7 @@ function getTopLevelDependencyVersion(dep: string): string {

 function getModuleApiVersionFor(moduleName: string): string {
    // We'll just pretend that this isn't highly problematic...
-    // Yarn is fairly stable in putting modules in a flat hierarchy, at least.
+    // pnpm is fairly stable in putting modules in a flat hierarchy, at least.
    const pkgJsonStr = fs.readFileSync(`./node_modules/${moduleName}/package.json`, "utf-8");
    return findDepVersionInPackageJson(moduleApiDepName, pkgJsonStr);
 }
@@ -0,0 +1,251 @@
+{
+    "name": "element-web",
+    "version": "1.12.13",
+    "description": "Element: the future of secure communication",
+    "author": "New Vector Ltd.",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/element-hq/element-web"
+    },
+    "license": "SEE LICENSE IN README.md",
+    "type": "module",
+    "matrix_i18n_extra_translation_funcs": [
+        "UserFriendlyError"
+    ],
+    "scripts": {
+        "i18n": "matrix-gen-i18n src res && pnpm i18n:sort && pnpm i18n:lint",
+        "i18n:sort": "matrix-sort-i18n src/i18n/strings/en_EN.json",
+        "i18n:lint": "matrix-i18n-lint && prettier --log-level=silent --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && pnpm i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "rethemendex": "sh ./res/css/rethemendex.sh",
+        "build": "nx build",
+        "build-stats": "nx build --json=webpack-stats.json",
+        "vendor:modernizr": "modernizr -c .modernizr.json -d src/vector/modernizr.js && mv src/vector/modernizr.js src/vector/modernizr.cjs",
+        "vendor:jitsi": "curl -s https://meet.element.io/libs/external_api.min.js > ./res/jitsi_external_api.min.js",
+        "dist": "./scripts/package.sh",
+        "start": "nx start",
+        "lint": "pnpm lint:types && pnpm lint:js && pnpm lint:style",
+        "lint:js": "eslint --max-warnings 0 src test playwright module_system",
+        "lint:js-fix": "eslint --fix src test playwright module_system",
+        "lint:types": "nx lint:types",
+        "lint:style": "stylelint \"res/css/**/*.pcss\"",
+        "test": "nx test:unit",
+        "test:playwright": "playwright test",
+        "test:playwright:open": "pnpm test:playwright --ui",
+        "test:playwright:screenshots": "playwright-screenshots-experimental pnpm playwright test --update-snapshots --project=Chrome --grep @screenshot",
+        "coverage": "pnpm test --coverage",
+        "analyse:webpack-bundles": "webpack-bundle-analyzer webpack-stats.json webapp"
+    },
+    "dependencies": {
+        "@babel/runtime": "^7.12.5",
+        "@element-hq/element-web-module-api": "catalog:",
+        "@element-hq/web-shared-components": "workspace:*",
+        "@fontsource/fira-code": "^5",
+        "@fontsource/inter": "catalog:",
+        "@formatjs/intl-segmenter": "^12.0.0",
+        "@matrix-org/analytics-events": "^0.32.0",
+        "@matrix-org/emojibase-bindings": "^1.5.0",
+        "@matrix-org/react-sdk-module-api": "^2.4.0",
+        "@sentry/browser": "^10.0.0",
+        "@types/png-chunks-extract": "^1.0.2",
+        "@vector-im/compound-design-tokens": "catalog:",
+        "@vector-im/compound-web": "catalog:",
+        "@vector-im/matrix-wysiwyg": "2.40.0",
+        "@zxcvbn-ts/core": "^3.0.4",
+        "@zxcvbn-ts/language-common": "^3.0.4",
+        "@zxcvbn-ts/language-en": "^3.0.2",
+        "await-lock": "^3.0.0",
+        "bloom-filters": "^3.0.3",
+        "blurhash": "^2.0.3",
+        "browserslist": "^4.23.2",
+        "classnames": "^2.2.6",
+        "commonmark": "^0.31.0",
+        "css-tree": "^3.0.0",
+        "diff-dom": "^5.0.0",
+        "diff-match-patch": "^1.0.5",
+        "domutils": "^3.2.2",
+        "emojibase-regex": "^17.0.0",
+        "escape-html": "^1.0.3",
+        "file-saver": "^2.0.5",
+        "filesize": "11.0.13",
+        "github-markdown-css": "^5.5.1",
+        "glob-to-regexp": "^0.4.1",
+        "highlight.js": "^11.3.1",
+        "html-entities": "^2.0.0",
+        "html-react-parser": "^5.2.2",
+        "is-ip": "^5.0.0",
+        "js-xxhash": "^5.0.0",
+        "jsrsasign": "^11.0.0",
+        "jszip": "^3.7.0",
+        "katex": "^0.16.0",
+        "lodash": "npm:lodash-es@^4.17.21",
+        "maplibre-gl": "^5.0.0",
+        "matrix-encrypt-attachment": "^1.0.3",
+        "matrix-js-sdk": "41.2.0",
+        "matrix-widget-api": "^1.16.1",
+        "memoize-one": "^6.0.0",
+        "mime": "^4.0.4",
+        "oidc-client-ts": "^3.0.1",
+        "opus-recorder": "^8.0.3",
+        "pako": "^2.0.3",
+        "png-chunks-extract": "^1.0.0",
+        "posthog-js": "1.356.1",
+        "qrcode": "1.5.4",
+        "re-resizable": "6.11.2",
+        "react": "catalog:",
+        "react-beautiful-dnd": "^13.1.0",
+        "react-blurhash": "^0.3.0",
+        "react-dom": "catalog:",
+        "react-focus-lock": "^2.5.1",
+        "react-string-replace": "^2.0.0",
+        "react-transition-group": "^4.4.1",
+        "rfc4648": "^1.4.0",
+        "sanitize-filename": "^1.6.3",
+        "sanitize-html": "2.17.1",
+        "tar-js": "^0.3.0",
+        "ua-parser-js": "1.0.40",
+        "uuid": "^13.0.0",
+        "what-input": "^5.2.10"
+    },
+    "devDependencies": {
+        "@babel/core": "^7.12.10",
+        "@babel/eslint-parser": "^7.12.10",
+        "@babel/eslint-plugin": "^7.12.10",
+        "@babel/plugin-proposal-decorators": "^7.25.9",
+        "@babel/plugin-proposal-export-default-from": "^7.12.1",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-transform-class-properties": "^7.12.1",
+        "@babel/plugin-transform-class-static-block": "^7.26.0",
+        "@babel/plugin-transform-logical-assignment-operators": "^7.20.7",
+        "@babel/plugin-transform-nullish-coalescing-operator": "^7.12.1",
+        "@babel/plugin-transform-numeric-separator": "^7.12.7",
+        "@babel/plugin-transform-object-rest-spread": "^7.12.1",
+        "@babel/plugin-transform-optional-chaining": "^7.12.7",
+        "@babel/plugin-transform-runtime": "^7.12.10",
+        "@babel/preset-env": "^7.12.11",
+        "@babel/preset-react": "^7.12.10",
+        "@babel/preset-typescript": "^7.12.7",
+        "@casualbot/jest-sonar-reporter": "2.5.0",
+        "@element-hq/element-call-embedded": "0.18.0",
+        "@element-hq/element-web-playwright-common": "catalog:",
+        "@element-hq/element-web-playwright-common-local": "workspace:*",
+        "@fetch-mock/jest": "^0.2.20",
+        "@jest/globals": "^30.2.0",
+        "@peculiar/webcrypto": "^1.4.3",
+        "@playwright/test": "catalog:",
+        "@principalstudio/html-webpack-inject-preload": "^1.2.7",
+        "@sentry/webpack-plugin": "^5.0.0",
+        "@stylistic/eslint-plugin": "^5.0.0",
+        "@svgr/webpack": "^8.0.0",
+        "@testing-library/dom": "^10.4.0",
+        "@testing-library/jest-dom": "^6.4.8",
+        "@testing-library/react": "^16.0.0",
+        "@testing-library/user-event": "^14.5.2",
+        "@types/commonmark": "^0.27.4",
+        "@types/content-type": "^1.1.9",
+        "@types/counterpart": "^0.18.1",
+        "@types/css-tree": "^2.3.8",
+        "@types/diff-match-patch": "^1.0.32",
+        "@types/escape-html": "^1.0.1",
+        "@types/express": "^5.0.0",
+        "@types/file-saver": "^2.0.3",
+        "@types/glob-to-regexp": "^0.4.1",
+        "@types/jest": "30.0.0",
+        "@types/jitsi-meet": "^2.0.2",
+        "@types/jsrsasign": "^10.5.4",
+        "@types/lodash": "^4.14.168",
+        "@types/modernizr": "^3.5.3",
+        "@types/node": "22",
+        "@types/pako": "^2.0.0",
+        "@types/postcss-import": "^14.0.3",
+        "@types/qrcode": "^1.3.5",
+        "@types/react": "catalog:",
+        "@types/react-beautiful-dnd": "^13.0.0",
+        "@types/react-dom": "catalog:",
+        "@types/react-transition-group": "^4.4.0",
+        "@types/sanitize-html": "2.16.0",
+        "@types/sdp-transform": "^2.4.10",
+        "@types/semver": "^7.5.8",
+        "@types/tar-js": "^0.3.5",
+        "@types/ua-parser-js": "^0.7.36",
+        "@typescript-eslint/eslint-plugin": "^8.19.0",
+        "@typescript-eslint/parser": "^8.19.0",
+        "babel-jest": "^30.0.0",
+        "babel-loader": "^10.0.0",
+        "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
+        "blob-polyfill": "^9.0.0",
+        "copy-webpack-plugin": "^14.0.0",
+        "css-loader": "^7.0.0",
+        "css-minimizer-webpack-plugin": "^8.0.0",
+        "dotenv": "^17.0.0",
+        "eslint": "8.57.1",
+        "eslint-config-google": "^0.14.0",
+        "eslint-config-prettier": "^10.0.0",
+        "eslint-plugin-deprecate": "0.9.0",
+        "eslint-plugin-import": "^2.25.4",
+        "eslint-plugin-jest": "^29.0.0",
+        "eslint-plugin-jsx-a11y": "^6.5.1",
+        "eslint-plugin-matrix-org": "^3.0.0",
+        "eslint-plugin-react": "^7.28.0",
+        "eslint-plugin-react-compiler": "^19.0.0-beta-df7b47d-20241124",
+        "eslint-plugin-react-hooks": "^7.0.0",
+        "eslint-plugin-unicorn": "^56.0.0",
+        "express": "^5.0.0",
+        "fake-indexeddb": "^6.0.0",
+        "file-loader": "^6.0.0",
+        "html-webpack-plugin": "^5.5.3",
+        "identity-obj-proxy": "^3.0.0",
+        "jest": "^30.0.0",
+        "jest-canvas-mock": "^2.5.2",
+        "jest-environment-jsdom": "^30.2.0",
+        "jest-fixed-jsdom": "^0.0.11",
+        "jest-mock": "^30.0.0",
+        "jest-raw-loader": "^1.0.1",
+        "jsqr": "^1.4.0",
+        "matrix-web-i18n": "catalog:",
+        "mini-css-extract-plugin": "2.10.0",
+        "modernizr": "^3.12.0",
+        "playwright-core": "catalog:",
+        "postcss": "8.5.6",
+        "postcss-easings": "4.0.0",
+        "postcss-hexrgba": "2.1.0",
+        "postcss-import": "16.1.1",
+        "postcss-loader": "8.2.0",
+        "postcss-mixins": "12.0.0",
+        "postcss-nested": "7.0.2",
+        "postcss-preset-env": "11.1.1",
+        "postcss-scss": "4.0.9",
+        "postcss-simple-vars": "7.0.1",
+        "prettier": "3.8.1",
+        "process": "^0.11.10",
+        "raw-loader": "^4.0.2",
+        "semver": "^7.5.2",
+        "source-map-loader": "^5.0.0",
+        "stylelint": "^17.0.0",
+        "stylelint-config-standard": "^40.0.0",
+        "stylelint-scss": "^7.0.0",
+        "stylelint-value-no-unknown-custom-properties": "^6.0.1",
+        "terser-webpack-plugin": "^5.3.9",
+        "testcontainers": "^11.0.0",
+        "typescript": "catalog:",
+        "util": "^0.12.5",
+        "web-streams-polyfill": "^4.0.0",
+        "webpack": "^5.89.0",
+        "webpack-bundle-analyzer": "^5.0.0",
+        "webpack-cli": "^6.0.0",
+        "webpack-dev-server": "^5.0.0",
+        "webpack-retry-chunk-load-plugin": "^3.1.1",
+        "webpack-version-file-plugin": "^0.5.0",
+        "yaml": "^2.3.3"
+    },
+    "@casualbot/jest-sonar-reporter": {
+        "outputDirectory": "coverage",
+        "outputName": "jest-sonar-report.xml",
+        "relativePaths": true
+    },
+    "engines": {
+        "node": ">=22.18"
+    },
+    "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017",
+    "private": true
+}
@@ -6,22 +6,34 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */

-import { defineConfig, devices } from "@playwright/test";
+import {
+    defineConfig,
+    devices,
+    type Project,
+    type PlaywrightTestOptions,
+    type PlaywrightWorkerOptions,
+} from "@playwright/test";

 import { type WorkerOptions } from "./playwright/services";

 const baseURL = process.env["BASE_URL"] ?? "http://localhost:8080";

-const chromeProject = {
+const chromeProject: Project<PlaywrightTestOptions, WorkerOptions & PlaywrightWorkerOptions>["use"] = {
    ...devices["Desktop Chrome"],
    channel: "chromium",
    permissions: ["clipboard-write", "clipboard-read", "microphone"],
    launchOptions: {
        args: ["--use-fake-ui-for-media-stream", "--use-fake-device-for-media-stream", "--mute-audio"],
    },
+    connectOptions: process.env.PW_TEST_CONNECT_WS_ENDPOINT
+        ? {
+              wsEndpoint: process.env.PW_TEST_CONNECT_WS_ENDPOINT,
+              exposeNetwork: "<loopback>",
+          }
+        : undefined,
 };

-export default defineConfig<WorkerOptions>({
+export default defineConfig<{}, WorkerOptions>({
    projects: [
        {
            name: "Chrome",
@@ -79,7 +91,7 @@ export default defineConfig<WorkerOptions>({
        trace: "on-first-retry",
    },
    webServer: {
-        command: process.env.CI ? "npx serve -p 8080 -L ./webapp" : "yarn start",
+        command: process.env.CI ? "npx serve -p 8080 -L ./webapp" : "pnpm start",
        url: `${baseURL}/config.json`,
        reuseExistingServer: true,
        timeout: (process.env.CI ? 30 : 120) * 1000,
@@ -91,6 +103,7 @@ export default defineConfig<WorkerOptions>({
    retries: process.env.CI ? 2 : 0,
    reporter: process.env.CI ? [["blob"], ["github"]] : [["html", { outputFolder: "playwright/html-report" }]],
    snapshotDir: "playwright/snapshots",
-    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    // When running the browser in docker, set the platform to `linux` as that is the platform where the browser is running
+    snapshotPathTemplate: `{snapshotDir}/{testFilePath}/{arg}-${process.env.PW_TEST_CONNECT_WS_ENDPOINT ? "linux" : "{platform}"}{ext}`,
    forbidOnly: !!process.env.CI,
 });
@@ -4,5 +4,3 @@
 # Only commit snapshots from Linux
 /snapshots/**/*.png
 !/snapshots/**/*-linux.png
-# This file is machine-generated
-/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
@@ -30,6 +30,7 @@ test("Shows the last known page on reload", async ({ pageWithCredentials: page }
    const app = new ElementAppPage(page);
    await app.client.createRoom({ name: "Test Room" });
    await app.viewRoomByName("Test Room");
+    await expect(page).toHaveURL(/\/#\/room\//);

    // Navigate away
    await page.goto("about:blank");
@@ -23,6 +23,7 @@ const clickButtonReply = async (tile: Locator) => {
 };

 test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
+    test.slow();
    test.use({
        displayName: "Hanako",
    });
@@ -100,35 +101,39 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
                .mx_MessageActionBar {
                    display: none !important;
                }
+                /* Stabilize play button appearance in CI (disabled due to decoding) */
+                button[aria-label="Play"] {
+                    opacity: 1 !important;
+                }
+                button[aria-label="Play"] svg,
+                button[aria-label="Play"] path {
+                    fill: magenta !important;
+                    stroke: magenta !important;
+                }
            `,
            mask: [page.getByTestId("audio-player-seek")],
+            clip: undefined,
        };

        // Take a snapshot of mx_EventTile_last on IRC layout
-        await expect(page.locator(".mx_EventTile_last")).toMatchScreenshot(
-            `${detail.replaceAll(" ", "-")}-irc-layout.png`,
-            screenshotOptions,
-        );
+        screenshotOptions.clip = await page.locator(".mx_EventTile_last").boundingBox();
+        await expect(page).toMatchScreenshot(`${detail.replaceAll(" ", "-")}-irc-layout.png`, screenshotOptions);

        // Take a snapshot on modern/group layout
        await app.settings.setValue("layout", null, SettingLevel.DEVICE, Layout.Group);
        const groupTile = page.locator(".mx_EventTile_last[data-layout='group']");
        await groupTile.locator(".mx_MessageTimestamp").click();
        await checkPlayerVisibility(groupTile);
-        await expect(page.locator(".mx_EventTile_last")).toMatchScreenshot(
-            `${detail.replaceAll(" ", "-")}-group-layout.png`,
-            screenshotOptions,
-        );
+        screenshotOptions.clip = await page.locator(".mx_EventTile_last").boundingBox();
+        await expect(page).toMatchScreenshot(`${detail.replaceAll(" ", "-")}-group-layout.png`, screenshotOptions);

        // Take a snapshot on bubble layout
        await app.settings.setValue("layout", null, SettingLevel.DEVICE, Layout.Bubble);
        const bubbleTile = page.locator(".mx_EventTile_last[data-layout='bubble']");
        await bubbleTile.locator(".mx_MessageTimestamp").click();
        await checkPlayerVisibility(bubbleTile);
-        await expect(page.locator(".mx_EventTile_last")).toMatchScreenshot(
-            `${detail.replaceAll(" ", "-")}-bubble-layout.png`,
-            screenshotOptions,
-        );
+        screenshotOptions.clip = await page.locator(".mx_EventTile_last").boundingBox();
+        await expect(page).toMatchScreenshot(`${detail.replaceAll(" ", "-")}-bubble-layout.png`, screenshotOptions);
    };

    test.beforeEach(async ({ page, app, user }) => {
@@ -240,9 +245,9 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
            await expect(tile.getByRole("region", { name: "Audio player" })).toBeVisible();

            // Assert that replied audio file is rendered as file button inside ReplyChain
-            const button = tile.locator(".mx_ReplyChain_wrapper .mx_MFileBody_info[role='button']");
+            const button = tile.locator(".mx_ReplyChain_wrapper .mx_MFileBody [role='button']");
            // Assert that the file button has file name
-            await expect(button.locator(".mx_MFileBody_info_filename")).toBeVisible();
+            await expect(button.locator("span")).toBeVisible();

            await takeSnapshots(page, app, "Selected EventTile of audio player with a reply");
        },
@@ -302,9 +307,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {

            // Assert that the file button contains the name of the file sent at first
            await expect(
-                replyChain
-                    .locator(".mx_MFileBody_info[role='button']")
-                    .locator(".mx_MFileBody_info_filename", { hasText: "upload-first.ogg" }),
+                replyChain.locator(".mx_MFileBody [role='button']").locator("span", { hasText: "upload-first.ogg" }),
            ).toBeVisible();

            // Take snapshots
@@ -352,9 +355,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {

        const composer = thread.locator(".mx_MessageComposer--compact");
        // Assert that the reply preview contains audio ReplyTile the file info button
-        await expect(
-            composer.locator(".mx_ReplyPreview .mx_ReplyTile .mx_MFileBody_info[role='button']"),
-        ).toBeVisible();
+        await expect(composer.locator(".mx_ReplyPreview .mx_ReplyTile .mx_MFileBody [role='button']")).toBeVisible();

        // Select :smile: emoji and send it
        await composer.getByTestId("basicmessagecomposer").fill(":smile:");
@@ -362,6 +363,6 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
        await composer.getByTestId("basicmessagecomposer").press("Enter");

        // Assert that the file name is rendered on the file button
-        await expect(threadTile.locator(".mx_ReplyTile .mx_MFileBody_info[role='button']")).toBeVisible();
+        await expect(threadTile.locator(".mx_ReplyTile .mx_MFileBody [role='button']")).toBeVisible();
    });
 });
@@ -80,7 +80,15 @@ test.describe("Composer", () => {
            test.use({ viewport: { width: 1280, height: 720 } });
            test("render emoji picker", { tag: "@screenshot" }, async ({ page, app }) => {
                await app.getComposer(false).getByRole("button", { name: "Emoji" }).click();
-                await expect(page.getByTestId("mx_EmojiPicker")).toMatchScreenshot("emoji-picker.png");
+                // Mask the background of the screenshot to avoid failing the test just because some
+                // other component have changed its rendering.
+                await expect(page.getByTestId("mx_EmojiPicker")).toMatchScreenshot("emoji-picker.png", {
+                    css: `
+                        .mx_ContextualMenu_background {
+                            background-color: magenta !important;
+                        }
+                    `,
+                });
            });
        });

@@ -88,7 +96,15 @@ test.describe("Composer", () => {
            test.use({ viewport: { width: 1280, height: 360 } });
            test("render emoji picker", { tag: "@screenshot" }, async ({ page, app }) => {
                await app.getComposer(false).getByRole("button", { name: "Emoji" }).click();
-                await expect(page.getByTestId("mx_EmojiPicker")).toMatchScreenshot("emoji-picker-small.png");
+                // Mask the background of the screenshot to avoid failing the test just because some
+                // other component have changed its rendering.
+                await expect(page.getByTestId("mx_EmojiPicker")).toMatchScreenshot("emoji-picker-small.png", {
+                    css: `
+                        .mx_ContextualMenu_background {
+                            background-color: magenta !important;
+                        }
+                    `,
+                });
            });
        });

@@ -7,7 +7,7 @@ Please see LICENSE files in the repository root for full details.
 */

 import { test, expect } from "../../element-web-test";
-import { logIntoElement } from "./utils";
+import { createBot, logIntoElement } from "./utils";
 import { isDendrite } from "../../plugins/homeserver/dendrite";

 test.describe("Complete security", () => {
@@ -16,6 +16,17 @@ test.describe("Complete security", () => {
        displayName: "Jeff",
    });

+    test(
+        "Complete Security dialog appears correctly",
+        { tag: "@screenshot" },
+        async ({ page, credentials, homeserver }) => {
+            await createBot(page, homeserver, credentials, true);
+            await logIntoElement(page, credentials);
+            await expect(page.getByRole("heading", { name: "Confirm your identity" })).toBeVisible();
+            await expect(page.getByRole("main")).toMatchScreenshot("complete-security.png");
+        },
+    );
+
    test("should go straight to the welcome screen if we have no signed device", async ({
        page,
        homeserver,
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");`