v1.12.13

Upgrade dependency to matrix-js-sdk@41.2.0
[Backport staging] Fix soft crash of room list when trying to open a room (#32872 )
2026-03-24 11:26:49 +00:00 · 2026-03-24 11:23:51 +00:00 · 2026-03-20 15:44:40 +00:00 · 2026-03-17 11:43:46 +00:00 · 2026-03-17 11:41:10 +00:00 · 2026-03-17 08:57:37 +00:00
4893 changed files with 313568 additions and 237281 deletions
@@ -1,13 +0,0 @@
-src/vector/modernizr.js
-test/end-to-end-tests/node_modules/
-test/end-to-end-tests/element/
-test/end-to-end-tests/synapse/
-test/end-to-end-tests/lib/
-# Legacy skinning file that some people might still have
-src/component-index.js
-# Auto-generated file
-src/modules.ts
-src/modules.js
-# Test result files
-/playwright/test-results/
-/playwright/html-report/
@@ -1,369 +0,0 @@
-module.exports = {
-    plugins: ["matrix-org", "eslint-plugin-react-compiler"],
-    extends: ["plugin:matrix-org/babel", "plugin:matrix-org/react", "plugin:matrix-org/a11y"],
-    parserOptions: {
-        project: ["./tsconfig.json"],
-    },
-    env: {
-        browser: true,
-        node: true,
-    },
-    globals: {
-        LANGUAGES_FILE: "readonly",
-    },
-    rules: {
-        // Things we do that break the ideal style
-        "no-constant-condition": "off",
-        "prefer-promise-reject-errors": "off",
-        "no-async-promise-executor": "off",
-        "no-extra-boolean-cast": "off",
-
-        // Bind or arrow functions in props causes performance issues (but we
-        // currently use them in some places).
-        // It's disabled here, but we should using it sparingly.
-        "react/jsx-no-bind": "off",
-        "react/jsx-key": ["error"],
-
-        "no-restricted-properties": [
-            "error",
-            ...buildRestrictedPropertiesOptions(
-                ["window.innerHeight", "window.innerWidth", "window.visualViewport"],
-                "Use UIStore to access window dimensions instead.",
-            ),
-            ...buildRestrictedPropertiesOptions(
-                ["React.forwardRef", "*.forwardRef", "forwardRef"],
-                "Use ref props instead.",
-            ),
-            ...buildRestrictedPropertiesOptions(
-                ["*.mxcUrlToHttp", "*.getHttpUriForMxc"],
-                "Use Media helper instead to centralise access for customisation.",
-            ),
-            ...buildRestrictedPropertiesOptions(["window.setImmediate"], "Use setTimeout instead."),
-        ],
-        "no-restricted-globals": [
-            "error",
-            {
-                name: "setImmediate",
-                message: "Use setTimeout instead.",
-            },
-            {
-                name: "Buffer",
-                message: "Buffer is not available in the web.",
-            },
-        ],
-
-        "import/no-duplicates": ["error"],
-        // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
-        // Ban compound-design-tokens raw svg imports in favour of their React component counterparts
-        "no-restricted-imports": [
-            "error",
-            {
-                paths: [
-                    {
-                        name: "react",
-                        importNames: ["forwardRef"],
-                        message: "Use ref props instead.",
-                    },
-                    {
-                        name: "@testing-library/react",
-                        message: "Please use jest-matrix-react instead",
-                    },
-                    {
-                        name: "matrix-js-sdk",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/src",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/src/",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "matrix-js-sdk/src/index",
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        name: "emojibase-regex",
-                        message:
-                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
-                    },
-                ],
-                patterns: [
-                    {
-                        group: [
-                            "matrix-js-sdk/src/**",
-                            "!matrix-js-sdk/src/matrix",
-                            "!matrix-js-sdk/src/crypto-api",
-                            "!matrix-js-sdk/src/types",
-                            "!matrix-js-sdk/src/testing",
-                            "!matrix-js-sdk/src/utils/**",
-                            "matrix-js-sdk/src/utils/internal/**",
-                            "matrix-js-sdk/lib",
-                            "matrix-js-sdk/lib/",
-                            "matrix-js-sdk/lib/**",
-                            // XXX: Temporarily allow these as they are not available via the main export
-                            "!matrix-js-sdk/src/logger",
-                            "!matrix-js-sdk/src/errors",
-                            "!matrix-js-sdk/src/utils",
-                            "!matrix-js-sdk/src/version-support",
-                            "!matrix-js-sdk/src/randomstring",
-                            "!matrix-js-sdk/src/sliding-sync",
-                            "!matrix-js-sdk/src/browser-index",
-                            "!matrix-js-sdk/src/feature",
-                            "!matrix-js-sdk/src/NamespacedValue",
-                            "!matrix-js-sdk/src/ReEmitter",
-                            "!matrix-js-sdk/src/event-mapper",
-                            "!matrix-js-sdk/src/interactive-auth",
-                            "!matrix-js-sdk/src/secret-storage",
-                            "!matrix-js-sdk/src/room-hierarchy",
-                            "!matrix-js-sdk/src/rendezvous",
-                            "!matrix-js-sdk/src/indexeddb-worker",
-                            "!matrix-js-sdk/src/pushprocessor",
-                            "!matrix-js-sdk/src/extensible_events_v1",
-                            "!matrix-js-sdk/src/extensible_events_v1/PollStartEvent",
-                            "!matrix-js-sdk/src/extensible_events_v1/PollResponseEvent",
-                            "!matrix-js-sdk/src/extensible_events_v1/PollEndEvent",
-                            "!matrix-js-sdk/src/extensible_events_v1/InvalidEventError",
-                            "!matrix-js-sdk/src/oidc",
-                            "!matrix-js-sdk/src/oidc/discovery",
-                            "!matrix-js-sdk/src/oidc/authorize",
-                            "!matrix-js-sdk/src/oidc/validate",
-                            "!matrix-js-sdk/src/oidc/error",
-                            "!matrix-js-sdk/src/oidc/register",
-                            "!matrix-js-sdk/src/webrtc",
-                            "!matrix-js-sdk/src/webrtc/call",
-                            "!matrix-js-sdk/src/webrtc/callFeed",
-                            "!matrix-js-sdk/src/webrtc/mediaHandler",
-                            "!matrix-js-sdk/src/webrtc/callEventTypes",
-                            "!matrix-js-sdk/src/webrtc/callEventHandler",
-                            "!matrix-js-sdk/src/webrtc/groupCallEventHandler",
-                            "!matrix-js-sdk/src/models",
-                            "!matrix-js-sdk/src/models/read-receipt",
-                            "!matrix-js-sdk/src/models/relations-container",
-                            "!matrix-js-sdk/src/models/related-relations",
-                            "!matrix-js-sdk/src/matrixrtc",
-                        ],
-                        message: "Please use matrix-js-sdk/src/matrix instead",
-                    },
-                    {
-                        group: ["emojibase-regex/emoji*"],
-                        message:
-                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
-                    },
-                    {
-                        group: ["@vector-im/compound-design-tokens/icons/*"],
-                        message: "Please use @vector-im/compound-design-tokens/assets/web/icons/* instead",
-                    },
-                ],
-            },
-        ],
-
-        // There are too many a11y violations to fix at once
-        // Turn violated rules off until they are fixed
-        "jsx-a11y/aria-activedescendant-has-tabindex": "off",
-        "jsx-a11y/click-events-have-key-events": "off",
-        "jsx-a11y/interactive-supports-focus": "off",
-        "jsx-a11y/media-has-caption": "off",
-        "jsx-a11y/mouse-events-have-key-events": "off",
-        "jsx-a11y/no-autofocus": "off",
-        "jsx-a11y/no-noninteractive-element-interactions": "off",
-        "jsx-a11y/no-noninteractive-element-to-interactive-role": "off",
-        "jsx-a11y/no-noninteractive-tabindex": "off",
-        "jsx-a11y/no-static-element-interactions": "off",
-        "jsx-a11y/role-supports-aria-props": "off",
-
-        "matrix-org/require-copyright-header": "error",
-
-        "react-compiler/react-compiler": "error",
-    },
-    overrides: [
-        {
-            files: ["src/**/*.{ts,tsx}", "test/**/*.{ts,tsx}", "playwright/**/*.ts"],
-            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
-            rules: {
-                "@typescript-eslint/explicit-function-return-type": [
-                    "error",
-                    {
-                        allowExpressions: true,
-                    },
-                ],
-
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "no-extra-boolean-cast": "off",
-
-                // Remove Babel things manually due to override limitations
-                "@babel/no-invalid-this": ["off"],
-
-                // We're okay being explicit at the moment
-                "@typescript-eslint/no-empty-interface": "off",
-                // We disable this while we're transitioning
-                "@typescript-eslint/no-explicit-any": "off",
-                // We'd rather not do this but we do
-                "@typescript-eslint/ban-ts-comment": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-                "@typescript-eslint/no-empty-object-type": [
-                    "error",
-                    {
-                        // We do this sometimes to brand interfaces
-                        allowInterfaces: "with-single-extends",
-                    },
-                ],
-            },
-        },
-        // temporary override for offending icon require files
-        {
-            files: [
-                "src/SdkConfig.ts",
-                "src/components/structures/FileDropTarget.tsx",
-                "src/components/structures/RoomStatusBar.tsx",
-                "src/components/structures/UserMenu.tsx",
-                "src/components/views/avatars/WidgetAvatar.tsx",
-                "src/components/views/dialogs/AddExistingToSpaceDialog.tsx",
-                "src/components/views/dialogs/ForwardDialog.tsx",
-                "src/components/views/dialogs/InviteDialog.tsx",
-                "src/components/views/dialogs/ModalWidgetDialog.tsx",
-                "src/components/views/dialogs/UploadConfirmDialog.tsx",
-                "src/components/views/dialogs/security/SetupEncryptionDialog.tsx",
-                "src/components/views/elements/AddressTile.tsx",
-                "src/components/views/elements/AppWarning.tsx",
-                "src/components/views/elements/SSOButtons.tsx",
-                "src/components/views/messages/MAudioBody.tsx",
-                "src/components/views/messages/MImageBody.tsx",
-                "src/components/views/messages/MFileBody.tsx",
-                "src/components/views/messages/MStickerBody.tsx",
-                "src/components/views/messages/MVideoBody.tsx",
-                "src/components/views/messages/MVoiceMessageBody.tsx",
-                "src/components/views/right_panel/EncryptionPanel.tsx",
-                "src/components/views/rooms/EntityTile.tsx",
-                "src/components/views/rooms/LinkPreviewGroup.tsx",
-                "src/components/views/rooms/MemberList.tsx",
-                "src/components/views/rooms/MessageComposer.tsx",
-                "src/components/views/rooms/ReplyPreview.tsx",
-                "src/components/views/settings/tabs/room/SecurityRoomSettingsTab.tsx",
-                "src/components/views/settings/tabs/user/GeneralUserSettingsTab.tsx",
-            ],
-            rules: {
-                "@typescript-eslint/no-var-requires": "off",
-            },
-        },
-        {
-            files: ["test/**/*.{ts,tsx}", "playwright/**/*.ts"],
-            extends: ["plugin:matrix-org/jest"],
-            rules: {
-                // We don't need super strict typing in test utilities
-                "@typescript-eslint/explicit-function-return-type": "off",
-                "@typescript-eslint/explicit-member-accessibility": "off",
-                "@typescript-eslint/no-empty-object-type": "off",
-
-                // Jest/Playwright specific
-
-                // Disabled tests are a reality for now but as soon as all of the xits are
-                // eliminated, we should enforce this.
-                "jest/no-disabled-tests": "off",
-                // Also treat "oldBackendOnly" as a test function.
-                // Used in some crypto tests.
-                "jest/no-standalone-expect": [
-                    "error",
-                    {
-                        additionalTestBlockFunctions: ["beforeAll", "beforeEach", "oldBackendOnly"],
-                    },
-                ],
-
-                // These are fine in tests
-                "no-restricted-globals": "off",
-                "react-compiler/react-compiler": "off",
-            },
-        },
-        {
-            files: ["playwright/**/*.ts"],
-            parserOptions: {
-                project: ["./playwright/tsconfig.json"],
-            },
-            rules: {
-                "react-hooks/rules-of-hooks": ["off"],
-                "@typescript-eslint/no-floating-promises": ["error"],
-            },
-        },
-        {
-            files: ["module_system/**/*.{ts,tsx}"],
-            parserOptions: {
-                project: ["./tsconfig.module_system.json"],
-            },
-            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
-            // NOTE: These rules are frozen and new rules should not be added here.
-            // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
-            rules: {
-                // Things we do that break the ideal style
-                "prefer-promise-reject-errors": "off",
-                "quotes": "off",
-
-                // We disable this while we're transitioning
-                "@typescript-eslint/no-explicit-any": "off",
-                // We're okay with assertion errors when we ask for them
-                "@typescript-eslint/no-non-null-assertion": "off",
-
-                // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
-                "no-restricted-imports": [
-                    "error",
-                    {
-                        paths: [
-                            {
-                                name: "matrix-js-sdk",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/src",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/src/",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                            {
-                                name: "matrix-js-sdk/src/index",
-                                message: "Please use matrix-js-sdk/src/matrix instead",
-                            },
-                        ],
-                        patterns: [
-                            {
-                                group: ["matrix-js-sdk/lib", "matrix-js-sdk/lib/", "matrix-js-sdk/lib/**"],
-                                message: "Please use matrix-js-sdk/src/* instead",
-                            },
-                        ],
-                    },
-                ],
-            },
-        },
-    ],
-    settings: {
-        react: {
-            version: "detect",
-        },
-    },
-};
-
-function buildRestrictedPropertiesOptions(properties, message) {
-    return properties.map((prop) => {
-        let [object, property] = prop.split(".");
-        if (object === "*") {
-            object = undefined;
-        }
-        return {
-            object,
-            property,
-            message,
-        };
-    });
-}
@@ -1,32 +1,36 @@
 *                         @element-hq/element-web-reviewers
 /.github/workflows/**     @element-hq/element-web-team
-/package.json             @element-hq/element-web-team
-/yarn.lock                @element-hq/element-web-team
+package.json              @element-hq/element-web-team
+/pnpm-lock.yaml           @element-hq/element-web-team

-/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
-/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
-/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
-/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
-/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
-/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
-/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
-/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
-/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
-/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
-/src/components/views/dialogs/devtools/Crypto.tsx                       @element-hq/element-crypto-web-reviewers
-/playwright/e2e/crypto/                                                 @element-hq/element-crypto-web-reviewers
-/playwright/e2e/settings/encryption-user-tab/                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
+/apps/web/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
+/apps/web/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
+/apps/web/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
+/apps/web/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
+/apps/web/src/components/views/dialogs/devtools/Crypto.tsx                       @element-hq/element-crypto-web-reviewers
+/apps/web/playwright/e2e/crypto/                                                 @element-hq/element-crypto-web-reviewers
+/apps/web/playwright/e2e/settings/encryption-user-tab/                           @element-hq/element-crypto-web-reviewers
+/packages/shared-components/src/crypto/                                          @element-hq/element-crypto-web-reviewers


-/src/models/Call.ts                       @element-hq/element-call-reviewers
-/src/call-types.ts                        @element-hq/element-call-reviewers
-/src/components/views/voip                @element-hq/element-call-reviewers
-/playwright/e2e/voip/element-call.spec.ts @element-hq/element-call-reviewers
+/apps/web/src/models/Call.ts                             @element-hq/element-call-reviewers
+/apps/web/src/call-types.ts                              @element-hq/element-call-reviewers
+/apps/web/src/components/views/voip                      @element-hq/element-call-reviewers
+/apps/web/playwright/e2e/voip/element-call.spec.ts       @element-hq/element-call-reviewers

 # Ignore translations as those will be updated by GHA for Localazy download
-/src/i18n/strings
-/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers
-# Ignore the synapse & mas plugins as this is updated by GHA for docker image updating
-/playwright/testcontainers/synapse.ts
-/playwright/testcontainers/mas.ts
+/apps/web/src/i18n/strings
+/packages/shared-components/src/i18n/strings
+/apps/web/src/i18n/strings/en_EN.json                    @element-hq/element-web-reviewers
+/packages/shared-components/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers
+
+# Ignore the synapse & mas plugins as this is updated by GHA for docker image updating
+/apps/web/playwright/testcontainers/synapse.ts
+/apps/web/playwright/testcontainers/mas.ts

@@ -1,6 +1,6 @@
 name: Bug report for the Element desktop app (not in a browser)
 description: File a bug report if you are using the desktop Element application.
-labels: [T-Defect]
+labels: [T-Defect, A-Electron]
 body:
    - type: markdown
      attributes:
@@ -3,3 +3,6 @@ contact_links:
    - name: Questions & support
      url: https://matrix.to/#/#element-web:matrix.org
      about: Please ask and answer questions here.
+    - name: Bug report for the Element flatpak app
+      url: https://github.com/flathub/im.riot.Riot/issues
+      about: Please file bugs with the Flatpak application on the respective repository.
@@ -2,7 +2,7 @@

 ## Checklist

- [ ] I have read through [review guidelines](../docs/review.md) and [CONTRIBUTING.md](../CONTRIBUTING.md).
+- [ ] I have read through [review guidelines](https://github.com/element-hq/element-web/blob/develop/docs/review.md) and [CONTRIBUTING.md](https://github.com/element-hq/element-web/blob/develop/CONTRIBUTING.md).
 - [ ] Tests written for new code (and old code if feasible).
 - [ ] New or updated `public`/`exported` symbols have accurate [TSDoc](https://tsdoc.org/) documentation.
 - [ ] Linter and other CI checks pass.
@@ -173,6 +173,12 @@
  color: "bfd4f2"
 - name: "A-Welcome-Page"
  color: "bfd4f2"
+- name: "A-Install"
+  color: "72A447"
+- name: "A-Seshat"
+  color: "8262BE"
+- name: "A-Update"
+  color: "17BE67"
 - name: "backport staging"
  description: "Label to automatically backport PR to staging branch"
  color: "B60205"
@@ -279,3 +285,26 @@
 - name: "Z-Flaky-Test-Disabled"
  description: "The flaking test has been disabled"
  color: "ededed"
+- name: "Z-Skip-Coverage"
+  description: "Skip SonarQube coverage for this PR"
+  color: "ededed"
+- name: "Z-Arch"
+  color: "D601BE"
+- name: "Z-ARM"
+  color: "5DEC5B"
+- name: "Z-Flatpak"
+  color: "0CA856"
+- name: "Z-Linux"
+  color: "7B4A9C"
+- name: "Z-macOS"
+  color: "500605"
+- name: "Z-Official"
+  color: "1D2B20"
+- name: "Z-Snap"
+  color: "29CD95"
+- name: "Z-Suse"
+  color: "79D07B"
+- name: "Z-Wayland"
+  color: "94C519"
+- name: "Z-Windows"
+  color: "0632DE"
@@ -1,4 +1,15 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": ["github>matrix-org/renovate-config-element-web"]
+    "extends": ["github>matrix-org/renovate-config-element-web"],
+    "postUpdateOptions": ["pnpmDedupe"],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "datasourceTemplate": "docker",
+            "versioningTemplate": "loose",
+            "description": "Update testcontainers docker digests",
+            "managerFilePatterns": ["**/testcontainers/*.ts"],
+            "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""]
+        }
+    ]
 }
@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types:
            - closed
            - labeled
@@ -12,6 +12,7 @@ concurrency:
 env:
    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {} # No permissions required
 jobs:
    build:
@@ -42,32 +43,34 @@ jobs:
            run:
                shell: bash
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  # Disable cache on Windows as it is slower than not caching
                  # https://github.com/actions/setup-node/issues/975
-                  cache: ${{ runner.os != 'Windows' && 'yarn' || '' }}
+                  cache: ${{ runner.os != 'Windows' && 'pnpm' || '' }}
                  node-version: "lts/*"

-            # Workaround for yarn install timeouts, especially on Windows
-            - run: yarn config set network-timeout 300000
-
            - name: Fetch layered build
              run: ./scripts/layered.sh

            - name: Copy config
+              working-directory: apps/web
              run: cp element.io/develop/config.json config.json

            - name: Build
+              working-directory: apps/web
              env:
                  CI_PACKAGE: true
-              run: VERSION=$(scripts/get-version-from-git.sh) yarn build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build

            - name: Upload Artifact
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp-${{ matrix.image }}
-                  path: webapp
+                  path: apps/web/webapp
                  retention-days: 1
@@ -14,14 +14,18 @@ jobs:
            R2_URL: ${{ vars.CF_R2_S3_API }}
            VERSION: ${{ github.ref_name }}
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Download package
+              working-directory: apps/web
              run: |
                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz"
                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz.asc"

            - name: Check GPG signature
+              working-directory: apps/web
              run: |
                  wget "https://packages.element.io/element-release-key.gpg"
                  gpg --import element-release-key.gpg
@@ -31,6 +35,7 @@ jobs:
                  FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}

            - name: Prepare
+              working-directory: apps/web
              run: |
                  mkdir -p debian/tmp/DEBIAN
                  find debian -maxdepth 1 -type f -exec cp "{}" debian/tmp/DEBIAN/ \;
@@ -41,6 +46,7 @@ jobs:
                  ln -s /etc/element-web/config.json debian/tmp/usr/share/element-web/config.json

            - name: Write changelog
+              working-directory: apps/web
              run: |
                  VERSION=$(cat package.json | jq -r .version)
                  TIME=$(date -d "$PUBLISHED_AT" -R)
@@ -57,22 +63,23 @@ jobs:
                  PUBLISHED_AT: ${{ github.event.release.published_at }}

            - name: Build deb package
+              working-directory: apps/web
              run: |
                  VERSION=$(cat package.json | jq -r .version)
                  dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
                  dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb

-            - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: element-web.deb
-                  path: element-web.deb
+                  path: apps/web/element-web.deb
                  retention-days: 14

            - name: Publish to packages.element.io
              if: github.event.release.prerelease == false
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
              with:
-                  file: element-web.deb
+                  file: apps/web/element-web.deb
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  bucket-api: ${{ vars.CF_R2_S3_API }}
                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -9,6 +9,8 @@ on:
 concurrency:
    group: ${{ github.repository_owner }}-${{ github.workflow }}-${{ github.ref_name }}
    cancel-in-progress: true
+env:
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {}
 jobs:
    build:
@@ -26,17 +28,21 @@ jobs:
            R2_URL: ${{ vars.CF_R2_S3_API }}
            R2_PUBLIC_URL: "https://element-web-develop.element.io"
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Dependencies
              run: "./scripts/layered.sh"

            - name: Build, Package & Upload sourcemaps
+              working-directory: apps/web
              run: "./scripts/ci_package.sh"
              env:
                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
@@ -52,20 +58,21 @@ jobs:
                  CSP_EXTRA_SOURCE: ${{ env.R2_PUBLIC_URL }}

            - run: mv dist/element-*.tar.gz dist/develop.tar.gz
+              working-directory: apps/web

-            - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
-                  path: dist/develop.tar.gz
+                  path: apps/web/dist/develop.tar.gz
                  retention-days: 1

            - name: Extract webapp
              run: |
                  mkdir _deploy
-                  tar xf dist/develop.tar.gz -C _deploy --strip-components=1
+                  tar xf apps/web/dist/develop.tar.gz -C _deploy --strip-components=1

            - name: Copy config
-              run: cp element.io/develop/config.json _deploy/config.json
+              run: cp apps/web/element.io/develop/config.json _deploy/config.json

            - name: Populate 404.html
              run: echo "404 Not Found" > _deploy/404.html
@@ -104,7 +111,7 @@ jobs:
                  running-workflow-name: "Build & Deploy develop.element.io"
                  repo-token: ${{ secrets.GITHUB_TOKEN }}
                  wait-interval: 10
-                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages).)*$
+                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages|Upload).)*$

            # We keep the latest develop.tar.gz on R2 instead of relying on the github artifact uploaded earlier
            # as the expires after 24h and requires auth to download.
@@ -112,7 +119,7 @@ jobs:
            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
            - name: Deploy to R2
              run: |
-                  aws s3 cp dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
+                  aws s3 cp apps/web/dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
                  aws s3 cp _deploy/ s3://$R2_BUCKET/ --recursive --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
              env:
                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -129,4 +136,6 @@ jobs:
                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}

            - run: |
-                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
+                  echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
+              env:
+                  STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
@@ -0,0 +1,79 @@
+name: CD # Continuous Delivery
+on:
+    push:
+        branches: [develop]
+concurrency: ${{ github.workflow }}-${{ github.ref_name }}
+
+permissions: {}
+env:
+    NX_DEFAULT_OUTPUT_STYLE: static
+
+jobs:
+    docker:
+        name: Docker Bake
+        runs-on: ubuntu-24.04
+        permissions:
+            id-token: write # needed for signing the images with GitHub OIDC Token
+            packages: write # needed for publishing packages to GHCR
+            # Needed for nx-set-shas
+            contents: read
+            actions: read
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
+                  fetch-depth: 0
+                  # reduce the size of the checkout with tree filtering,
+                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
+                  filter: tree:0
+                  persist-credentials: false
+
+            - name: Prepare nx
+              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
+              with:
+                  main-branch-name: develop
+
+            - name: Install Cosign
+              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
+            - name: Set up Docker Buildx
+              id: builder
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  node-version-file: package.json
+                  cache: "pnpm"
+
+            - name: Install Deps
+              run: "pnpm install --frozen-lockfile"
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - run: pnpm nx affected -t docker:build
+              env:
+                  INPUT_PUSH: true
+                  INPUT_LOAD: false
+                  INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}
+
+            - name: Sign the images with GitHub OIDC token
+              env:
+                  PATTERN: "^ghcr.io/element-hq/element-web*"
+              run: |
+                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
+                    # Check if digest is valid (not <none>)
+                    if [[ "$TARGET" != *"@<none>"* ]]; then
+                      echo "Signing $TARGET..."
+                      cosign sign --yes "$TARGET"
+                    fi
+                  done
@@ -34,7 +34,9 @@ jobs:
        env:
            SITE: ${{ inputs.site || 'staging.element.io' }}
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Load GPG key
              run: |
@@ -70,7 +72,7 @@ jobs:
              run: cp -vnpr _current_version/bundles/* _deploy/bundles/

            - name: Copy config
-              run: cp element.io/app/config.json _deploy/config.json
+              run: cp apps/web/element.io/app/config.json _deploy/config.json

            - name: Populate 404.html
              run: echo "404 Not Found" > _deploy/404.html
@@ -20,42 +20,29 @@ jobs:
        env:
            TEST_TAG: vectorim/element-web:test
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  fetch-depth: 0 # needed for docker-package to be able to calculate the version
+                  persist-credentials: false

            - name: Install Cosign
              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
              if: github.event_name != 'pull_request'

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
              with:
                  install: true

-            - name: Login to Docker Hub
-              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
-              if: github.event_name != 'pull_request'
-              with:
-                  username: ${{ secrets.DOCKERHUB_USERNAME }}
-                  password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-            - name: Login to GitHub Container Registry
-              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
-              if: github.event_name != 'pull_request'
-              with:
-                  registry: ghcr.io
-                  username: ${{ github.repository_owner }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
            - name: Build and load
              id: test-build
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
              with:
                  context: .
+                  file: apps/web/Dockerfile
                  load: true

            - name: Test the image
@@ -96,24 +83,77 @@ jobs:

            - name: Docker meta
              id: meta
-              uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
+              uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
              if: github.event_name != 'pull_request'
              with:
                  images: |
                      vectorim/element-web
                      ghcr.io/element-hq/element-web
+                      oci-push.vpn.infra.element.io/element-web
                  tags: |
                      type=ref,event=branch
                      type=ref,event=tag
                  flavor: |
                      latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}

+            - name: Login to Docker Hub
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Connect to Tailscale
+              uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4
+              if: github.event_name != 'pull_request'
+              with:
+                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+                  audience: ${{ secrets.TS_AUDIENCE }}
+                  tags: tag:github-actions
+
+            - name: Compute vault jwt role name
+              id: vault-jwt-role
+              if: github.event_name != 'pull_request'
+              run: |
+                  echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"
+
+            - name: Get team registry token
+              id: import-secrets
+              uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  url: https://vault.infra.ci.i.element.dev
+                  role: ${{ steps.vault-jwt-role.outputs.role_name }}
+                  path: service-management/github-actions
+                  jwtGithubAudience: https://vault.infra.ci.i.element.dev
+                  method: jwt
+                  secrets: |
+                      services/web-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
+                      services/web-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;
+
+            - name: Login to oci.element.io Registry
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  registry: oci-push.vpn.infra.element.io
+                  username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
+                  password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}
+
            - name: Build and push
              id: build-and-push
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
              if: github.event_name != 'pull_request'
              with:
                  context: .
+                  file: apps/web/Dockerfile
                  push: true
                  platforms: linux/amd64,linux/arm64
                  tags: ${{ steps.meta.outputs.tags }}
@@ -139,16 +179,3 @@ jobs:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}
                  repository: vectorim/element-web
-
-            - name: Repository Dispatch
-              uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4
-              if: github.event_name != 'pull_request'
-              with:
-                  repository: element-hq/element-web-pro
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  event-type: image-built
-                  # Stable way to determine the :version
-                  client-payload: |-
-                      {
-                          "base-ref": "${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}"
-                      }
@@ -17,39 +17,45 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - name: Fetch element-desktop
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-desktop
                  path: element-desktop
+                  persist-credentials: false

            - name: Fetch element-web
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  path: element-web
+                  persist-credentials: false

            - name: Fetch matrix-js-sdk
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: matrix-org/matrix-js-sdk
                  path: matrix-js-sdk
+                  persist-credentials: false

-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
              with:
-                  cache: "yarn"
-                  cache-dependency-path: element-web/yarn.lock
+                  package_json_file: element-web/package.json
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  cache-dependency-path: element-web/pnpm-lock.yaml
                  node-version: "lts/*"

            - name: Generate automations docs
              working-directory: element-web
              run: |
-                  yarn install --frozen-lockfile
-                  yarn ts-node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
+                  pnpm install --frozen-lockfile
+                  pnpm node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
                  echo "-   [Automations](automations.md)" >> docs/SUMMARY.md

            - name: Setup mdBook
              uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2
              with:
-                  mdbook-version: "0.4.10"
+                  mdbook-version: "0.5.1"

            - name: Install mdbook extensions
              run: cargo install mdbook-combiner mdbook-mermaid
@@ -2,7 +2,9 @@
 # taking the artifact and uploading it to Netlify for easier viewing
 name: Upload End to End Test report to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["End to End Tests"]
        types:
            - completed
@@ -25,7 +27,7 @@ jobs:
            actions: read
        steps:
            - name: Download HTML report
-              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -37,6 +37,7 @@ env:
    PR_NUMBER: ${{ github.event.pull_request.number }}
    # Use 6 runners in the default case, but 4 when running on a schedule where we run all 5 projects (20 runners total)
    NUM_RUNNERS: ${{ github.event_name == 'schedule' && 4 || 6 }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

@@ -50,13 +51,15 @@ jobs:
            runners-matrix: ${{ steps.runner-vars.outputs.matrix }}
        steps:
            - name: Checkout code
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
+                  persist-credentials: false

-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Fetch layered build
@@ -66,18 +69,20 @@ jobs:
              run: scripts/layered.sh

            - name: Copy config
+              working-directory: apps/web
              run: cp element.io/develop/config.json config.json

            - name: Build
              env:
                  CI_PACKAGE: true
-              run: VERSION=$(scripts/get-version-from-git.sh) yarn build
+              working-directory: apps/web
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build

            - name: Upload Artifact
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: webapp
-                  path: webapp
+                  path: apps/web/webapp
                  retention-days: 1

            - name: Calculate runner variables
@@ -122,32 +127,33 @@ jobs:
                    - runAllTests: false
                      project: Pinecone
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

            - name: 📥 Download artifact
-              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  name: webapp
-                  path: webapp
+                  path: apps/web/webapp

-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
-                  cache-dependency-path: yarn.lock
+                  cache: "pnpm"
+                  cache-dependency-path: pnpm-lock.yaml
                  node-version: "lts/*"

            - name: Install dependencies
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Get installed Playwright version
              id: playwright
-              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -155,34 +161,39 @@ jobs:

            - name: Install Playwright browsers
              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: yarn playwright install --with-deps --no-shell
+              working-directory: apps/web
+              run: pnpm playwright install --with-deps --no-shell

            - name: Install system dependencies for WebKit
              # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
              if: matrix.project == 'WebKit' && steps.playwright-cache.outputs.cache-hit == 'true'
-              run: yarn playwright install-deps webkit
+              working-directory: apps/web
+              run: pnpm playwright install-deps webkit

            # We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
            - name: Run Playwright tests
+              working-directory: apps/web
              run: |
-                  yarn playwright test \
-                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                  pnpm playwright test \
+                      --shard "$SHARD" \
                      --project="${{ matrix.project }}" \
                      ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+              env:
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build.outputs.num-runners) }}

            - name: Upload blob report to GitHub Actions Artifacts
              if: always()
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: all-blob-reports-${{ matrix.project }}-${{ matrix.runner }}
-                  path: blob-report
+                  path: apps/web/blob-report
                  retention-days: 1

    downstream-modules:
        name: Downstream Playwright tests [element-modules]
        needs: build
        if: inputs.skip != true && github.event_name == 'merge_group'
-        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
        with:
            webapp-artifact: webapp

@@ -194,33 +205,36 @@ jobs:
        if: always()
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.skip != true
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+              if: inputs.skip != true
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              if: inputs.skip != true
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install dependencies
              if: inputs.skip != true
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Download blob reports from GitHub Actions Artifacts
              if: inputs.skip != true
-              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  pattern: all-blob-reports-*
-                  path: all-blob-reports
+                  path: apps/web/all-blob-reports
                  merge-multiple: true

            - name: Merge into HTML Report
              if: inputs.skip != true
-              run: yarn playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
+              working-directory: apps/web
+              run: pnpm playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
              env:
                  # Only pass creds to the flaky-reporter on main branch runs
                  GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
@@ -228,11 +242,12 @@ jobs:
            # Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
            - name: Upload HTML report
              if: always() && inputs.skip != true
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: html-report
-                  path: playwright-report
+                  path: apps/web/playwright-report
                  retention-days: 14
+                  if-no-files-found: error

            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1
@@ -7,6 +7,8 @@ permissions:
    pull-requests: write # needed to auto-approve PRs
 jobs:
    download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
+        with:
+            packageManager: pnpm
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -1,12 +1,14 @@
 name: Localazy Upload
 on:
+    workflow_dispatch: {}
    push:
        branches: [develop]
        paths:
-            - "src/i18n/strings/en_EN.json"
+            - "apps/web/src/i18n/strings/en_EN.json"
+            - "packages/shared-components/src/i18n/strings/en_EN.json"
 permissions: {} # No permissions needed
 jobs:
    upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        secrets:
            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
@@ -2,7 +2,9 @@
 # and uploading it to netlify
 name: Upload Preview Build to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Build"]
        types:
            - completed
@@ -28,7 +30,7 @@ jobs:
                      Exercise caution. Use test accounts.

            - name: 📥 Download artifact
-              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -1,92 +0,0 @@
-name: Pending reviews automation
-on:
-    # The bot exceeded its API rate limit. Disabling for now (adding workflow dispatch so the workflow file stays valid & we can test to see if it starts working again)
-    workflow_dispatch: {}
-    # We run it on a schedule instead of on pull_request_* events to not create confusing messaging in the PR
-    #schedule:
-    #    - cron: "*/10 * * * *"
-concurrency: ${{ github.workflow }}
-permissions: {} # We use ELEMENT_BOT_TOKEN instead
-jobs:
-    bot:
-        name: Pending reviews bot
-        runs-on: ubuntu-24.04
-        environment: Matrix
-        env:
-            URL: "https://github.com/pulls?q=is%3Apr+is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+review-requested%3A%40me+sort%3Aupdated-desc+"
-            RELEASE_BLOCKERS_URL: "https://github.com/pulls?q=is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+sort%3Aupdated-desc+label%3AX-Release-Blocker+"
-        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
-              env:
-                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
-                  ROOM_ID: ${{ secrets.ROOM_ID }}
-                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
-              with:
-                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
-                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  script: |
-                      const { HS_URL, ROOM_ID, TOKEN, URL, RELEASE_BLOCKERS_URL } = process.env;
-
-                      async function updateCounter(counter, link, severity, title, value, clearOnZero) {
-                          const apiUrl = `${HS_URL}/_matrix/client/v3/rooms/${ROOM_ID}/state/re.jki.counter/${counter}`;
-                          const headers = {
-                              "Content-Type": "application/json",
-                              "Authorization": `Bearer ${TOKEN}`,
-                          };
-                          const res = await fetch(apiUrl, {
-                              method: "GET",
-                              headers,
-                          });
-
-                          const data = await res.json();
-
-                          if (data.value === issueCount) {
-                              console.log("Pending review count already correct");
-                              return;
-                          }
-
-                          let body = {};
-                          if (issueCount || !clearOnZero) {
-                              body = JSON.stringify({
-                                  link,
-                                  severity,
-                                  title,
-                                  value,
-                              });
-                          }
-
-                          await fetch(apiUrl, {
-                              method: "PUT",
-                              body,
-                              headers,
-                          });
-                      }
-
-                      const repos = [
-                          "element-hq/element-desktop",
-                          "element-hq/element-web",
-                          "matrix-org/matrix-js-sdk",
-                      ];
-                      const teams = [
-                          "matrix-org/element-web-team",
-                          "matrix-org/element-web-reviewers",
-                          "element-hq/element-web-team",
-                          "element-hq/element-web-reviewers",
-                      ];
-
-                      let issueCount = 0;
-                      for (const team of teams) {
-                          const org = team.split("/", 2)[0];
-                          const reposInOrg = repos.filter(repo => repo.startsWith(org + "/"));
-                          const { data } = await github.rest.search.issuesAndPullRequests({
-                              q: `is:pr is:open review:required ${reposInOrg.map(r => `repo:${r}`).join(" ")} team-review-requested:${team}`,
-                          });
-                          issueCount += data.total_count;
-                      }
-                      await updateCounter("gh_reviews", URL, "warning", "Pending reviews", issueCount);
-
-                      const { data } = await github.rest.search.issuesAndPullRequests({
-                          q: `is:open ${repos.map(repo => `repo:${repo}`).join(" ")} label:X-Release-Blocker`,
-                      });
-                      const blockerCount = data.total_count;
-                      await updateCounter("release_blockers", RELEASE_BLOCKERS_URL, "alert", "Release Blockers", blockerCount, true);
@@ -1,57 +0,0 @@
-name: Update Playwright docker images
-on:
-    workflow_dispatch: {}
-    schedule:
-        - cron: "0 6 * * *" # Every day at 6am UTC
-permissions: {}
-jobs:
-    update:
-        runs-on: ubuntu-24.04
-        permissions:
-            pull-requests: write
-        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - name: Update synapse image
-              run: |
-                  docker pull "$IMAGE"
-                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
-                  DIGEST=${INSPECT#*@}
-                  sed -i "s/const TAG.*/const TAG = \"develop@$DIGEST\";/" playwright/testcontainers/synapse.ts
-              env:
-                  IMAGE: ghcr.io/element-hq/synapse:develop
-
-            - name: Update MAS image
-              run: |
-                  docker pull "$IMAGE"
-                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
-                  DIGEST=${INSPECT#*@}
-                  sed -i "s/const TAG.*/const TAG = \"main@$DIGEST\";/" playwright/testcontainers/mas.ts
-              env:
-                  IMAGE: ghcr.io/element-hq/matrix-authentication-service:main
-
-            - name: Create Pull Request
-              id: cpr
-              uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
-              with:
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  branch: actions/playwright-image-updates
-                  delete-branch: true
-                  title: Playwright Docker image updates
-                  labels: |
-                      T-Task
-
-            - name: Enable automerge
-              run: gh pr merge --merge --auto "$PR_NUMBER"
-              if: steps.cpr.outputs.pull-request-operation == 'created'
-              env:
-                  GH_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-
-            - name: Enable autoapprove
-              run: |
-                  gh pr review --approve "$PR_NUMBER"
-              if: steps.cpr.outputs.pull-request-operation == 'created'
-              env:
-                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types: [opened, edited, labeled, unlabeled, synchronize]
    merge_group:
        types: [checks_requested]
 permissions: {}
 jobs:
    action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            pull-requests: write
        secrets:
@@ -9,4 +9,4 @@ jobs:
    draft:
        permissions:
            contents: write
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
@@ -7,9 +7,10 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # We use ELEMENT_BOT_TOKEN instead
 jobs:
    merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
+            dir: apps/web
            dependencies: |
                matrix-js-sdk
@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
    release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            contents: write
            issues: write
@@ -29,6 +29,7 @@ jobs:
            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
            asset-path: dist/*.tar.gz
            expected-asset-count: 3
+            dir: apps/web

    notify-downstream:
        name: Trigger release drafter downstream
@@ -27,7 +27,7 @@ jobs:
                    - matrix-org/matrix-js-sdk
                    - element-hq/element-web
                    - element-hq/element-desktop
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
@@ -41,7 +41,7 @@ jobs:
            REPOS: matrix-js-sdk element-web element-desktop
        steps:
            - name: Checkout Element Desktop
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-desktop
              with:
                  repository: element-hq/element-desktop
@@ -50,8 +50,9 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Element Web
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-web
              with:
                  repository: element-hq/element-web
@@ -60,8 +61,9 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Matrix JS SDK
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.matrix-js-sdk
              with:
                  repository: matrix-org/matrix-js-sdk
@@ -70,6 +72,7 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true

            - name: Prepare Git
              run: |
@@ -13,21 +13,25 @@ jobs:

        steps:
            - name: 🧮 Checkout code
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - name: 🔧 Set up node environment
-              uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: 🔧 Set up node environment
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
                  node-version-file: ".node-version"
                  registry-url: "https://registry.npmjs.org"
-              env:
-                  NODE_AUTH_TOKEN: ${{ secrets.ELEMENT_NPM_TOKEN }}

-            - name: 🛠️ Setup
-              # When running `install` it also calls the `prepare` step which generates
-              # a build
-              run: yarn --cwd packages/shared-components install --pure-lockfile
+            # Ensure npm 11.5.1 or later is installed
+            - name: Update npm
+              run: npm install -g npm@latest
+
+            # Need to setup element web too as it needs the translations
+            - name: 🛠️ Setup EW
+              run: pnpm install --frozen-lockfile

            - name: 🚀 Publish to npm
              working-directory: packages/shared-components
@@ -0,0 +1,38 @@
+name: Build shared component storybook
+on:
+    merge_group: {}
+    pull_request: {}
+    workflow_call: {}
+
+permissions: {}
+
+jobs:
+    doc:
+        name: Build storybook
+        runs-on: ubuntu-latest
+        steps:
+            - name: 🧮 Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: 🔧 Pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
+                  node-version-file: package.json
+
+            - name: 🔨 Install dependencies
+              working-directory: packages/shared-components
+              run: "pnpm install --frozen-lockfile"
+
+            - name: 📖 Build Storybook
+              working-directory: packages/shared-components
+              run: pnpm build:storybook
+
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: shared-components-storybook
+                  path: packages/shared-components/storybook-static
+                  retention-days: 1
@@ -0,0 +1,33 @@
+name: Publish shared component storybook
+on:
+    workflow_dispatch: {}
+    push:
+        branches:
+            - "develop"
+        paths:
+            - "packages/shared-components/**/*"
+
+permissions: {}
+
+jobs:
+    build:
+        name: Build storybook
+        uses: ./.github/workflows/shared-component-storybook-build.yml
+
+    publish:
+        name: Publish storybook
+        runs-on: ubuntu-latest
+        needs: build
+        environment: SharedComponents
+        steps:
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+              with:
+                  name: shared-components-storybook
+                  path: storybook-static
+
+            - name: 🚀 Deploy to Cloudflare Pages
+              uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
+              with:
+                  apiToken: ${{ secrets.CF_PAGES_TOKEN }}
+                  accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
+                  command: pages deploy storybook-static --project-name=shared-components-storybook
@@ -27,7 +27,7 @@ jobs:
              run: "sudo apt-get install -y tree"

            - name: Download Diffs
-              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -21,34 +21,28 @@ jobs:
            issues: read
            pull-requests: read
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
-                  cache: "yarn"
+                  cache: "pnpm"
                  node-version: "lts/*"

-            - name: Install element web dependencies
-              run: yarn install --frozen-lockfile
-
-            - name: Build Element Web resources
-              # Needed to prepare language files
-              run: "yarn build:res"
-
            - name: Install dependencies
              working-directory: packages/shared-components
-              run: yarn install --frozen-lockfile
+              run: pnpm install --frozen-lockfile

            - name: Get installed Playwright version
              working-directory: packages/shared-components
              id: playwright
-              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

            - name: Cache playwright binaries
-              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              id: playwright-cache
              with:
                  path: ~/.cache/ms-playwright
@@ -57,20 +51,21 @@ jobs:
            - name: Install Playwright browsers
              working-directory: packages/shared-components
              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: "yarn playwright install --with-deps --only-shell"
-
-            - name: Build storybook dependencies
-              # When the first test is ran, it will fail because the dependencies are not yet built.
-              # This step is to ensure that the dependencies are built before running the tests.
-              run: "yarn --cwd packages/shared-components test:storybook:ci"
-              continue-on-error: true
+              run: "pnpm playwright install --with-deps --only-shell"

            - name: Run Visual tests
-              run: "yarn --cwd packages/shared-components test:storybook:ci"
+              working-directory: packages/shared-components
+              run: "pnpm test:storybook --run"
+
+            # Workaround for vis silently adding new baselines if they didn't exist
+            # Can be removed once https://github.com/repobuddy/visual-testing/issues/516 is released
+            - run: |
+                  git add -N .
+                  git diff --exit-code

            - name: Upload received images & diffs
              if: always()
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: received-images
-                  path: packages/shared-components/playwright/shared-component-received
+                  path: packages/shared-components/__vis__/linux
@@ -12,7 +12,7 @@ jobs:
    sonarqube:
        name: 🩻 SonarQube
        if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
-        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            actions: read
            statuses: write
@@ -14,142 +14,115 @@ concurrency:
 env:
    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

 jobs:
-    ts_lint:
-        name: "Typescript Syntax Check"
+    lint:
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - name: Typescript Syntax Check
+                      install: layered
+                      command: "lint:types"
+                    - name: Prettier
+                      install: normal
+                      command: "lint:prettier"
+                    - name: ESLint
+                      install: normal
+                      command: "lint:js"
+                    - name: Style Lint
+                      install: normal
+                      command: "lint:style"
+                    - name: Workflow Lint
+                      install: normal
+                      command: "lint:workflows"
+                    - name: Analyse Dead Code
+                      install: normal
+                      command: "lint:knip"
+                    - name: Rethemendex Check
+                      command: "rethemendex"
+                      assert-diff: true
+        name: ${{ matrix.name }}
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              if: matrix.install != ''
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

-            - name: Install Dependencies
+            - name: Install Dependencies (layered)
+              if: matrix.install == 'layered'
              run: "./scripts/layered.sh"
+            - name: Install Dependencies (normal)
+              if: matrix.install == 'normal'
+              run: "pnpm install --frozen-lockfile"

-            - name: Typecheck
-              run: "yarn run lint:types"
+            - name: Run ${{ matrix.command }}
+              run: pnpm --if-present run "$CMD" && pnpm -r --if-present run "$CMD"
+              env:
+                  CMD: ${{ matrix.command }}

-            - name: Build Element Web resources
-              # Needed to prepare language files for shared components
-              run: "yarn build:res"
+            - name: Assert no changes
+              run: git diff --exit-code
+              if: matrix.assert-diff

-            - name: Install Shared Component Dependencies
-              run: "yarn --cwd packages/shared-components install"
+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - name: Typecheck Shared Components
-              run: "yarn --cwd packages/shared-components run lint:types"
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0

-    i18n_lint:
-        name: "i18n Check"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+    i18n:
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - name: Element Web
+                      path: "apps/web"
+                      allowed-hardcoded-keys: |
+                          console_dev_note
+                          labs|element_call_video_rooms
+                          labs|feature_disable_call_per_sender_encryption
+                          voip|element_call
+                          error|invalid_json
+                          error|misconfigured
+                          welcome_to_element
+                          devtools|settings|elementCallUrl
+                          labs|sliding_sync_description
+                          settings|voip|noise_suppression_description
+                          settings|voip|echo_cancellation_description
+                    - name: Shared Components
+                      path: "packages/shared-components"
+        name: "i18n Check (${{ matrix.name }})"
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@abf186831e2acb3e98fca13a0711a3fa1364d2b1
        permissions:
            pull-requests: read
        with:
            hardcoded-words: "Element"
-            allowed-hardcoded-keys: |
-                console_dev_note
-                labs|element_call_video_rooms
-                labs|feature_disable_call_per_sender_encryption
-                voip|element_call
-                error|invalid_json
-                error|misconfigured
-                welcome_to_element
-                devtools|settings|elementCallUrl
-                labs|sliding_sync_description
+            packageManager: pnpm
+            path: ${{ matrix.path }}
+            allowed-hardcoded-keys: ${{ matrix.allowed-hardcoded-keys }}

-    rethemendex_lint:
-        name: "Rethemendex Check"
+    # Dummy job to simplify branch protections
+    ci:
+        name: Static Analysis
+        needs: [lint, i18n]
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - run: ./res/css/rethemendex.sh
-
-            - run: git diff --exit-code
-
-    js_lint:
-        name: "ESLint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn run lint:js"
-
-            - name: Build Element Web resources
-              # Needed to prepare language files for shared components
-              run: "yarn build:res"
-
-            - name: Install Shared Component Deps
-              run: "yarn --cwd packages/shared-components install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn --cwd packages/shared-components run lint:js"
-
-    style_lint:
-        name: "Style Lint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install"
-
-            - name: Run Linter
-              run: "yarn run lint:style"
-
-    workflow_lint:
-        name: "Workflow Lint"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run Linter
-              run: "yarn lint:workflows"
-
-    analyse_dead_code:
-        name: "Analyse Dead Code"
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
-              with:
-                  cache: "yarn"
-                  node-version: "lts/*"
-
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: Run linter
-              run: "yarn run lint:knip"
+            - run: echo "Ok"
@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead

 jobs:
    sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@dac99c67f08f8f2a079e885ffb682a2f39cd3960
        with:
            LABELS: |
                element-hq/element-meta
@@ -25,12 +25,13 @@ env:
    ENABLE_COVERAGE: ${{ github.event_name != 'merge_group' && inputs.disable_coverage != 'true' }}
    # fetchdep.sh needs to know our PR number
    PR_NUMBER: ${{ github.event.pull_request.number }}
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {}

 jobs:
-    jest:
-        name: Jest
+    jest_ew:
+        name: Jest (Element Web)
        runs-on: ubuntu-24.04
        strategy:
            fail-fast: false
@@ -39,15 +40,17 @@ jobs:
                runner: [1, 2]
        steps:
            - name: Checkout code
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - name: Yarn cache
-              uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
              with:
                  node-version: "lts/*"
-                  cache: "yarn"
+                  cache: "pnpm"

            - name: Install Deps
              run: "./scripts/layered.sh"
@@ -55,56 +58,62 @@ jobs:
                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}

            - name: Jest Cache
-              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
              with:
                  path: /tmp/jest_cache
-                  key: ${{ hashFiles('**/yarn.lock') }}
+                  key: ${{ hashFiles('**/pnpm-lock.yaml') }}

            - name: Get number of CPU cores
              id: cpu-cores
              uses: SimenB/github-actions-cpu-cores@97ba232459a8e02ff6121db9362b09661c875ab8 # v2

            - name: Run tests
+              working-directory: apps/web
              run: |
-                  yarn test \
-                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                  pnpm test \
+                      --coverage=$ENABLE_COVERAGE \
                      --ci \
-                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
-                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --max-workers $MAX_WORKERS \
+                      --shard "$SHARD" \
                      --cacheDirectory /tmp/jest_cache
              env:
                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true

                  # tell jest to use coloured output
                  FORCE_COLOR: true
+                  MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}

            - name: Move coverage files into place
              if: env.ENABLE_COVERAGE == 'true'
-              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+              working-directory: apps/web
+              run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
+              env:
+                  NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
              with:
                  name: coverage-${{ matrix.runner }}
                  path: |
-                      coverage
-                      !coverage/lcov-report
+                      apps/web/coverage
+                      !apps/web/coverage/lcov-report

    complete:
        name: jest-tests
-        needs: jest
+        needs: [jest_ew, vitest_sc]
        if: always()
        runs-on: ubuntu-24.04
        permissions:
            statuses: write
        steps:
-            - if: needs.jest.result != 'skipped' && needs.jest.result != 'success'
+            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1

            - name: Skip SonarCloud in merge queue
              if: github.event_name == 'merge_group' || inputs.disable_coverage == 'true'
-              uses: guibranco/github-status-action-v2@5530c593759f489bba08272e96986ffc571c1ea1
+              uses: guibranco/github-status-action-v2@9bfa8773cdbdc6c185747fd43cd7faa9d7c32f09
              with:
                  authToken: ${{ secrets.GITHUB_TOKEN }}
                  state: success
@@ -112,3 +121,62 @@ jobs:
                  context: SonarCloud Code Analysis
                  sha: ${{ github.sha }}
                  target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+    vitest_sc:
+        name: Vitest (Shared Components)
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - name: pnpm cache
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  node-version: "lts/*"
+                  cache: "pnpm"
+
+            - name: Install Shared Component Deps
+              working-directory: "packages/shared-components"
+              run: "pnpm install"
+
+            - name: Cache storybook & vitest
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              with:
+                  path: |
+                      packages/shared-components/node_modules/.cache
+                      packages/shared-components/node_modules/.vite/vitest
+                  key: ${{ hashFiles('pnpm-lock.yaml') }}
+
+            - name: Get installed Playwright version
+              working-directory: packages/shared-components
+              id: playwright
+              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
+
+            - name: Cache playwright binaries
+              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              id: playwright-cache
+              with:
+                  path: ~/.cache/ms-playwright
+                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}-onlyshell
+
+            - name: Install Playwright browsers
+              working-directory: packages/shared-components
+              if: steps.playwright-cache.outputs.cache-hit != 'true'
+              run: "pnpm playwright install --with-deps --only-shell"
+
+            - name: Run tests
+              working-directory: "packages/shared-components"
+              run: pnpm test:unit --coverage=$ENABLE_COVERAGE
+
+            - name: Upload Artifact
+              if: env.ENABLE_COVERAGE == 'true'
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: coverage-sharedcomponents
+                  path: |
+                      packages/shared-components/coverage
+                      !packages/shared-components/coverage/lcov-report
@@ -9,7 +9,7 @@ jobs:
        name: Move PRs asking for design review to the design board
        runs-on: ubuntu-24.04
        steps:
-            - uses: octokit/graphql-action@8ad880e4d437783ea2ab17010324de1075228110 # v2.3.2
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: find_team_members
              with:
                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
@@ -52,7 +52,7 @@ jobs:
                  fi
              env:
                  TEAM: "design"
-            - uses: octokit/graphql-action@8ad880e4d437783ea2ab17010324de1075228110 # v2.3.2
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: add_to_project
              if: steps.any_matching_reviewers.outputs.match == 'true'
              with:
@@ -76,7 +76,7 @@ jobs:
        name: Move PRs asking for design review to the design board
        runs-on: ubuntu-24.04
        steps:
-            - uses: octokit/graphql-action@8ad880e4d437783ea2ab17010324de1075228110 # v2.3.2
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: find_team_members
              with:
                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
@@ -119,7 +119,7 @@ jobs:
                  fi
              env:
                  TEAM: "product"
-            - uses: octokit/graphql-action@8ad880e4d437783ea2ab17010324de1075228110 # v2.3.2
+            - uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505 # v3.0.2
              id: add_to_project
              if: steps.any_matching_reviewers.outputs.match == 'true'
              with:
@@ -12,7 +12,7 @@ jobs:
            issues: write
            pull-requests: write
        steps:
-            - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10
+            - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
              with:
                  operations-per-run: 100

@@ -9,21 +9,25 @@ jobs:
    update:
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-
-            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  cache: "yarn"
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              with:
+                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
+              run: "pnpm install --frozen-lockfile"

            - name: Fetch Jitsi
-              run: "yarn update:jitsi"
+              working-directory: apps/web
+              run: "pnpm vendor:jitsi"

            - name: Create Pull Request
-              uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
+              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  branch: actions/jitsi-update
@@ -26,13 +26,13 @@ jobs:
              env:
                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
                  LOBBY_ROOM_ID: ${{ secrets.ROOM_ID }}
-                  PUBLIC_ROOM_ID: "!IemiTbwVankHTFiEoh:matrix.org"
-                  ANNOUNCEMENT_ROOM_ID: "!bijaLdadorKgNGtHdA:matrix.org"
+                  PUBLIC_DISCUSSION_ROOM_ID: "!xUW4PpAe1CmThA3r2wI8IrgwwsK006-zqWdJCljpd10"
+                  ANNOUNCEMENT_ROOM_ID: "!ars5ndgI6IIYZXECiJ-u8YljHNzShJn3nHdB-3rYI2M"
                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
                  RELEASE_STATUS: "Release status: ${{ inputs.expected_status }} expected ${{ inputs.expected_date }}"
              with:
                  script: |
-                      const { HS_URL, TOKEN, RELEASE_STATUS, LOBBY_ROOM_ID, PUBLIC_ROOM_ID, ANNOUNCEMENT_ROOM_ID } = process.env;
+                      const { HS_URL, TOKEN, RELEASE_STATUS, LOBBY_ROOM_ID, PUBLIC_DISCUSSION_ROOM_ID, ANNOUNCEMENT_ROOM_ID } = process.env;

                      const repo = context.repo;
                      const { data } = await github.rest.repos.getLatestRelease({
@@ -71,18 +71,23 @@ jobs:
                          const data = await res.json();
                          console.log(roomId, "got event", data);

+                          if (!regex.test(data.topic)) {
+                              core.setFailed("Topic format is incorrect for room " + roomId);
+                              return;
+                          }
+
                          const topic = data.topic.replace(regex, releaseTopic);
                          if (topic === data.topic) {
                              console.log(roomId, "nothing to do");
                              return;
                          }
                          if (data["org.matrix.msc3765.topic"]) {
-                              data["org.matrix.msc3765.topic"].forEach(d => {
+                              data["org.matrix.msc3765.topic"]?.["m.text"].forEach(d => {
                                  d.body = d.body.replace(regex, releaseTopic);
                              });
                          }
                          if (data["m.topic"]) {
-                              data["m.topic"].forEach(d => {
+                              data["m.topic"]?.["m.text"].forEach(d => {
                                  d.body = d.body.replace(regex, releaseTopic);
                              });
                          }
@@ -97,12 +102,18 @@ jobs:
                          });

                          if (res.ok) {
-                              console.log(roomId, "topic updated:", topic);
+                              const resJson = res.json();
+                              if (resJson.errcode) {
+                                  core.setFailed(`Error updating ${roomId}: ${resJson.error}`);
+                              } else {
+                                  console.log(roomId, "topic updated:", topic);
+                              }
                          } else {
-                              console.log(roomId, await res.text());
+                              const errText = await res.text();
+                              core.setFailed(`Error updating ${roomId}: ${errText}`);
                          }
                      }

                      await updateReleaseInTopic(LOBBY_ROOM_ID);
-                      await updateReleaseInTopic(PUBLIC_ROOM_ID);
+                      await updateReleaseInTopic(PUBLIC_DISCUSSION_ROOM_ID);
                      await updateReleaseInTopic(ANNOUNCEMENT_ROOM_ID);
@@ -3,36 +3,38 @@
 /dist
 /key.pem
 /lib
-/node_modules
-/webapp
+node_modules
 /.npmrc
 /*.log
 package-lock.json
 .DS_Store
-electron/dist
-electron/pub
 **/.idea
-/config.json
-/config.json.*
-/config.local*.json
-# Legacy skinning file that some people might still have
-/src/component-index.js
-/.tmp
 /webpack-stats.json
+/.tmp
 .vscode
 .vscode/
 .env
-/coverage
-# Auto-generated file
-/src/modules.js
-/build_config.yaml
+.env.*
+coverage
 /book
 /index.html
 # version file and tarball created by `npm pack` / `yarn pack`
 /git-revision.txt
+jest-sonar.xml

 *storybook.log
 storybook-static

 /packages/shared-components/node_modules
 /packages/shared-components/dist
+/packages/shared-components/src/i18nKeys.d.ts
+
+# TSC incremental compilation information
+*.tsbuildinfo
+
+/.link-config
+
+.nx/cache
+.nx/workspace-data
+
+.pnpm-store
@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname "$0")/_/husky.sh"
-
 npx lint-staged --concurrent false
@@ -1,7 +1,3 @@
 {
-    "*": "prettier --write",
-    "src/**/*.(ts|tsx)": ["eslint --fix"],
-    "scripts/**/*.(ts|tsx)": ["eslint --fix"],
-    "module_system/**/*.(ts|tsx)": ["eslint --fix"],
-    "*.pcss": ["stylelint --fix"]
+    "*": "prettier --write --ignore-unknown"
 }
@@ -1 +1 @@
-22
+24
@@ -1,31 +1,30 @@
 /build
 /dist
 /lib
-/node_modules
-/packages/
-/webapp
+node_modules
+/apps/web/webapp
 /*.log
-yarn.lock
+pnpm-lock.yaml
 electron/dist
 electron/pub
 **/.idea
 /.tmp
-/webpack-stats.json
+webpack-stats.json
 .vscode
 .vscode/
 .env
-/coverage
+coverage
 # Auto-generated file
-/src/modules.ts
-/src/modules.js
-/src/i18n/strings
-/build_config.yaml
+/apps/web/src/modules.ts
+/apps/web/src/modules.js
+src/i18n/strings
+/apps/web//build_config.yaml
 # Raises an error because it contains a template var breaking the script tag
-src/vector/index.html
-src/vector/modernizr.js
+/apps/web/src/vector/index.html
+/apps/web/src/vector/modernizr.cjs
 /docs/lib
 /book
-/debian/tmp
+debian/tmp
 /.npmrc
 package-lock.json

@@ -34,14 +33,22 @@ package-lock.json
 /docs/changelogs

 # Legacy skinning file that some people might still have
-/src/component-index.js
+/apps/web/src/component-index.js

 # Downloaded and already minified
-res/jitsi_external_api.min.js
+/apps/web/res/jitsi_external_api.min.js

 # This file is also machine-generated
-/playwright/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
-/playwright/test-results/
-/playwright/html-report/
-/playwright/logs/
-/playwright/snapshots/
+/apps/web/playwright/e2e/crypto/test_indexeddb_cryptostore_dump/dump.json
+/apps/web/playwright/test-results/
+/apps/web/playwright/html-report/
+/apps/web/playwright/logs/
+/apps/web/playwright/snapshots/
+
+# Shared components generated files
+/packages/shared-components/dist/
+/packages/shared-components/src/i18n/i18nKeys.d.ts
+/packages/shared-components/typedoc/
+/packages/shared-components/storybook-static/
+
+/.nx/
@@ -1 +0,0 @@
-module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");
@@ -1,82 +0,0 @@
-module.exports = {
-    extends: ["stylelint-config-standard"],
-    customSyntax: "postcss-scss",
-    plugins: ["stylelint-scss", "stylelint-value-no-unknown-custom-properties"],
-    rules: {
-        "comment-empty-line-before": null,
-        "declaration-empty-line-before": null,
-        "length-zero-no-unit": null,
-        "rule-empty-line-before": null,
-        "color-hex-length": null,
-        "at-rule-no-unknown": null,
-        "no-descending-specificity": null,
-        "scss/at-rule-no-unknown": [
-            true,
-            {
-                // https://github.com/vector-im/element-web/issues/10544
-                ignoreAtRules: ["define-mixin"],
-            },
-        ],
-        // Disable `&_kind`-style selectors while our unused CSS approach is "Find & Replace All"
-        // rather than a CI thing. Shorthand selectors are harder to detect when searching for a
-        // class name. This regex is trying to *allow* anything except `&words`, such as `&::before`,
-        // `&.mx_Class`, etc.
-        "selector-nested-pattern": "^((&[ :.\\[,])|([^&]))",
-        // Disable some defaults
-        "selector-class-pattern": null,
-        "custom-property-pattern": null,
-        "selector-id-pattern": null,
-        "keyframes-name-pattern": null,
-        "alpha-value-notation": null,
-        "color-function-notation": null,
-        "selector-not-notation": null,
-        "import-notation": null,
-        "value-keyword-case": null,
-        "declaration-block-no-redundant-longhand-properties": null,
-        "shorthand-property-no-redundant-values": null,
-        "property-no-vendor-prefix": null,
-        "selector-no-vendor-prefix": null,
-        "media-feature-name-no-vendor-prefix": null,
-        "number-max-precision": null,
-        "no-invalid-double-slash-comments": true,
-        "media-feature-range-notation": null,
-        "declaration-property-value-no-unknown": null,
-        "declaration-property-value-keyword-no-deprecated": null,
-        "csstools/value-no-unknown-custom-properties": [
-            true,
-            {
-                importFrom: [
-                    { from: "res/css/_common.pcss", type: "css" },
-                    { from: "res/themes/light/css/_light.pcss", type: "css" },
-                    // Right now our styles share vars all over the place, this is not ideal but acceptable for now
-                    { from: "res/css/views/rooms/_EventTile.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_IRCLayout.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_EventBubbleTile.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_ReadReceiptGroup.pcss", type: "css" },
-                    { from: "res/css/views/rooms/_EditMessageComposer.pcss", type: "css" },
-                    { from: "res/css/views/right_panel/_BaseCard.pcss", type: "css" },
-                    { from: "res/css/views/messages/_MessageTimestamp.pcss", type: "css" },
-                    { from: "res/css/views/messages/_EventTileBubble.pcss", type: "css" },
-                    { from: "res/css/views/messages/_MessageActionBar.pcss", type: "css" },
-                    { from: "res/css/views/voip/LegacyCallView/_LegacyCallViewButtons.pcss", type: "css" },
-                    { from: "res/css/views/elements/_ToggleSwitch.pcss", type: "css" },
-                    { from: "res/css/views/settings/tabs/_SettingsTab.pcss", type: "css" },
-                    { from: "res/css/structures/_RoomView.pcss", type: "css" },
-                    // Compound vars
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-base.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-semantic.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-base-mq.css",
-                    "node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-semantic-mq.css",
-                ],
-            },
-        ],
-        "property-no-deprecated": [
-            true,
-            {
-                ignoreProperties: ["-webkit-box-orient", "word-wrap"],
-            },
-        ],
-        "nesting-selector-no-missing-scoping-root": null,
-        "no-invalid-position-declaration": null,
-    },
-};
@@ -1,3 +1,322 @@
+Changes in [1.12.13](https://github.com/element-hq/element-web/releases/tag/v1.12.13) (2026-03-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove automatic rageshakes on UTD labs feature ([#32778](https://github.com/element-hq/element-web/pull/32778)). Contributed by @Half-Shot.
+* Remove automaticErrorReporting labs feature ([#32781](https://github.com/element-hq/element-web/pull/32781)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Upgrade Element Call for new picture-in-picture designs ([#32816](https://github.com/element-hq/element-web/pull/32816)). Contributed by @robintown.
+* Room list: add sections to shared components ([#32735](https://github.com/element-hq/element-web/pull/32735)). Contributed by @florianduros.
+* feat: Devtool for sticky events MSC4354 ([#32741](https://github.com/element-hq/element-web/pull/32741)). Contributed by @BillCarsonFr.
+* Port URL Preview components to MVVM ([#32525](https://github.com/element-hq/element-web/pull/32525)). Contributed by @Half-Shot.
+* Add support for Widget \& Room Header Buttons module APIs ([#32734](https://github.com/element-hq/element-web/pull/32734)). Contributed by @dbkr.
+* Port over linkifyJS to shared-components. ([#32731](https://github.com/element-hq/element-web/pull/32731)). Contributed by @Half-Shot.
+* Redesign widget pip and move into shared component ([#32654](https://github.com/element-hq/element-web/pull/32654)). Contributed by @toger5.
+* Implement customisations \& login component Module API 1.11.0 ([#32687](https://github.com/element-hq/element-web/pull/32687)). Contributed by @t3chguy.
+* Realign MessageActionBar to Figma designs ([#32722](https://github.com/element-hq/element-web/pull/32722)). Contributed by @t3chguy.
+* Implement new widget permissions module api ([#32565](https://github.com/element-hq/element-web/pull/32565)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix soft crash of room list when trying to open a room ([#32872](https://github.com/element-hq/element-web/pull/32872)). Contributed by @RiotRobot.
+* Fix "key storage out of sync" appearing when key storage is actually fine ([#32811](https://github.com/element-hq/element-web/pull/32811)). Contributed by @andybalaam.
+* Fix remove button styling in local address list of room settings ([#32798](https://github.com/element-hq/element-web/pull/32798)). Contributed by @florianduros.
+* Always check \& update the users timezone on their profile on startup ([#32764](https://github.com/element-hq/element-web/pull/32764)). Contributed by @Half-Shot.
+* Fix nx configuration to actually run type linter ([#32776](https://github.com/element-hq/element-web/pull/32776)). Contributed by @richvdh.
+* Fix expand space panel button not being shown on keyboard focus ([#32746](https://github.com/element-hq/element-web/pull/32746)). Contributed by @t3chguy.
+* Reset key storage if restoring from Recovery encounters the wrong decryption key ([#32668](https://github.com/element-hq/element-web/pull/32668)). Contributed by @andybalaam.
+
+
+Changes in [1.12.12](https://github.com/element-hq/element-web/releases/tag/v1.12.12) (2026-03-10)
+==================================================================================================
+## ✨ Features
+
+* Add stable support for MSC4380 invite blocking ([#31966](https://github.com/element-hq/element-web/pull/31966)). Contributed by @richvdh.
+* Hide the names of banned users behind a spoiler tag ([#32424](https://github.com/element-hq/element-web/pull/32424)). Contributed by @andybalaam.
+* Room list: remove bold effect on selected room ([#32593](https://github.com/element-hq/element-web/pull/32593)). Contributed by @florianduros.
+* Use Compound buttons in auth screens ([#32562](https://github.com/element-hq/element-web/pull/32562)). Contributed by @t3chguy.
+* Track room list sorting algorithm changes ([#32556](https://github.com/element-hq/element-web/pull/32556)). Contributed by @MidhunSureshR.
+* Update `sso_redirect_options` to work for Native OIDC ([#32537](https://github.com/element-hq/element-web/pull/32537)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Room list: avoid excessive re-renders on room list store update or filter change ([#32663](https://github.com/element-hq/element-web/pull/32663)). Contributed by @florianduros.
+* Room list: listen to call event to check number of participants ([#32677](https://github.com/element-hq/element-web/pull/32677)). Contributed by @florianduros.
+* Fix invite-specific join errors not being shown ([#32621](https://github.com/element-hq/element-web/pull/32621)). Contributed by @Half-Shot.
+* Prevent logging lots of "Browser unsupported" lines ([#32647](https://github.com/element-hq/element-web/pull/32647)). Contributed by @Half-Shot.
+* Update critical gradient for room status bar ([#32575](https://github.com/element-hq/element-web/pull/32575)). Contributed by @Half-Shot.
+* Room list: avoid header overflowing when too long ([#32645](https://github.com/element-hq/element-web/pull/32645)). Contributed by @florianduros.
+* Room list: center focus outline of room list item ([#32637](https://github.com/element-hq/element-web/pull/32637)). Contributed by @florianduros.
+* Fix misaligned cross in complete security dialog ([#32614](https://github.com/element-hq/element-web/pull/32614)). Contributed by @dbkr.
+* Room list: fix keyboard navigation ([#32585](https://github.com/element-hq/element-web/pull/32585)). Contributed by @florianduros.
+* Don't show empty privacy section ([#32582](https://github.com/element-hq/element-web/pull/32582)). Contributed by @dbkr.
+* Disable room list image dragging ([#32590](https://github.com/element-hq/element-web/pull/32590)). Contributed by @florianduros.
+* Update UserMenu theme toggle to use IconButton ([#32591](https://github.com/element-hq/element-web/pull/32591)). Contributed by @t3chguy.
+* Room list: make room list item scales with large font size ([#32523](https://github.com/element-hq/element-web/pull/32523)). Contributed by @florianduros.
+
+
+Changes in [1.12.11](https://github.com/element-hq/element-web/releases/tag/v1.12.11) (2026-02-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove UIFeature.BulkUnverifiedSessionsReminder setting ([#31943](https://github.com/element-hq/element-web/pull/31943)). Contributed by @andybalaam.
+* Remove unused function to auto-rageshake when key backup is not set up ([#31942](https://github.com/element-hq/element-web/pull/31942)). Contributed by @andybalaam.
+
+## ✨ Features
+
+* Room list: update the visuals in order to have better contrast ([#32421](https://github.com/element-hq/element-web/pull/32421)). Contributed by @florianduros.
+*  Set history visibility to "invited" for DMs and new non-public rooms when creating a room ([#31974](https://github.com/element-hq/element-web/pull/31974)). Contributed by @langleyd.
+* Remove server acl status/summaries from timeline  ([#32461](https://github.com/element-hq/element-web/pull/32461)). Contributed by @langleyd.
+* Update `globalBlacklistUnverifiedDevices` on setting change ([#31983](https://github.com/element-hq/element-web/pull/31983)). Contributed by @kaylendog.
+* Add badge for history visibiltity to room info panel ([#31927](https://github.com/element-hq/element-web/pull/31927)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* Default useOnlyCurrentProfiles to true ([#32524](https://github.com/element-hq/element-web/pull/32524)). Contributed by @dbkr.
+* Keep custom theme active after reload ([#32506](https://github.com/element-hq/element-web/pull/32506)). Contributed by @florianduros.
+* Update font format from 'ttf' to 'truetype' ([#32493](https://github.com/element-hq/element-web/pull/32493)). Contributed by @all-yall.
+* Fix videos on Firefox ([#32497](https://github.com/element-hq/element-web/pull/32497)). Contributed by @p1gp1g.
+* Use a dedicated FAQ/help entry for key storage. ([#32480](https://github.com/element-hq/element-web/pull/32480)). Contributed by @mxandreas.
+* Avoid showing two chat timelines side by side after a call ([#32484](https://github.com/element-hq/element-web/pull/32484)). Contributed by @robintown.
+* Update screenshot for reactive display name disambiguation ([#32431](https://github.com/element-hq/element-web/pull/32431)). Contributed by @aditya-cherukuru.
+* Fix Status Bar being unreadable when the user overrides the default OS light/dark theme. ([#32442](https://github.com/element-hq/element-web/pull/32442)). Contributed by @Half-Shot.
+* fix: Remove state\_key: null from Seshat search results ([#31524](https://github.com/element-hq/element-web/pull/31524)). Contributed by @shinaoka.
+* Fix user pill deserialisation ([#31947](https://github.com/element-hq/element-web/pull/31947)). Contributed by @t3chguy.
+
+
+Changes in [1.12.10](https://github.com/element-hq/element-web/releases/tag/v1.12.10) (2026-02-10)
+==================================================================================================
+## ✨ Features
+
+* Support additional\_creators in /upgraderoom (MSC4289) ([#31934](https://github.com/element-hq/element-web/pull/31934)). Contributed by @andybalaam.
+* Update room header icon for world\_readable rooms ([#31915](https://github.com/element-hq/element-web/pull/31915)). Contributed by @richvdh.
+* Show an icon in the room header for shared history ([#31879](https://github.com/element-hq/element-web/pull/31879)). Contributed by @richvdh.
+* Remove "history may be shared" banner. ([#31881](https://github.com/element-hq/element-web/pull/31881)). Contributed by @kaylendog.
+* Allow dismissing 'Key storage out of sync' temporarily ([#31455](https://github.com/element-hq/element-web/pull/31455)). Contributed by @andybalaam.
+* Add `resolutions` entry for `matrix-widget-api` to package.json ([#31851](https://github.com/element-hq/element-web/pull/31851)). Contributed by @toger5.
+* Improve visibility under contrast control mode ([#31847](https://github.com/element-hq/element-web/pull/31847)). Contributed by @t3chguy.
+* Unread Sorting - Add option for sorting in `OptionsMenuView` ([#31754](https://github.com/element-hq/element-web/pull/31754)). Contributed by @MidhunSureshR.
+* Unread sorting - Implement sorter and use it in the room list store ([#31723](https://github.com/element-hq/element-web/pull/31723)). Contributed by @MidhunSureshR.
+* Allow Element Call widgets to receive sticky events ([#31843](https://github.com/element-hq/element-web/pull/31843)). Contributed by @robintown.
+* Improve icon rendering accessibility ([#31791](https://github.com/element-hq/element-web/pull/31791)). Contributed by @t3chguy.
+* Add message preview toggle to room list header option ([#31821](https://github.com/element-hq/element-web/pull/31821)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix room list not being cleared ([#32438](https://github.com/element-hq/element-web/pull/32438)). Contributed by @RiotRobot.
+* Fix failure to update room info panel on joinrule change ([#31938](https://github.com/element-hq/element-web/pull/31938)). Contributed by @richvdh.
+* Throttle space notification state calculation ([#31922](https://github.com/element-hq/element-web/pull/31922)). Contributed by @dbkr.
+* Fix emoji verification responsive layout ([#31899](https://github.com/element-hq/element-web/pull/31899)). Contributed by @t3chguy.
+* Add patch for linkify to fix doctype handling ([#31900](https://github.com/element-hq/element-web/pull/31900)). Contributed by @dbkr.
+* Fix rooms with no messages appearing at the top of the room list ([#31798](https://github.com/element-hq/element-web/pull/31798)). Contributed by @MidhunSureshR.
+* Fix room list menu flashes when menu is closed ([#31868](https://github.com/element-hq/element-web/pull/31868)). Contributed by @florianduros.
+* Message preview toggle is inverted in room list header ([#31865](https://github.com/element-hq/element-web/pull/31865)). Contributed by @florianduros.
+* Fix duplicate toasts appearing for the same call if two events appear. ([#31693](https://github.com/element-hq/element-web/pull/31693)). Contributed by @Half-Shot.
+* Fix ability to send rageshake during session restore failure ([#31848](https://github.com/element-hq/element-web/pull/31848)). Contributed by @t3chguy.
+* Fix mis-alignment of `Threads` right panel title ([#31849](https://github.com/element-hq/element-web/pull/31849)). Contributed by @t3chguy.
+* Unset buttons does not include color inherit ([#31801](https://github.com/element-hq/element-web/pull/31801)). Contributed by @Philldomd.
+
+
+Changes in [1.12.9](https://github.com/element-hq/element-web/releases/tag/v1.12.9) (2026-01-27)
+================================================================================================
+## ✨ Features
+
+* Allow local log downloads when a rageshake URL is not configured. ([#31716](https://github.com/element-hq/element-web/pull/31716)). Contributed by @Half-Shot.
+* Improve icon rendering accessibility ([#31776](https://github.com/element-hq/element-web/pull/31776)). Contributed by @t3chguy.
+* Show "Bob shared this message" on messages shared via MSC4268 ([#31684](https://github.com/element-hq/element-web/pull/31684)). Contributed by @richvdh.
+* Update the way we render icons for accessibility ([#31731](https://github.com/element-hq/element-web/pull/31731)). Contributed by @t3chguy.
+* Switch from css masks to rendering svg ([#31681](https://github.com/element-hq/element-web/pull/31681)). Contributed by @t3chguy.
+* Support for stable MSC4191 account management action parameter ([#31701](https://github.com/element-hq/element-web/pull/31701)). Contributed by @hughns.
+* Support for stable m.oauth UIA stage from MSC4312 ([#31704](https://github.com/element-hq/element-web/pull/31704)). Contributed by @hughns.
+* Switch to Compound icons to replace old icons ([#31667](https://github.com/element-hq/element-web/pull/31667)). Contributed by @t3chguy.
+* Switch from svg masks to svg rendering in more places ([#31652](https://github.com/element-hq/element-web/pull/31652)). Contributed by @t3chguy.
+* Switch from svg masks to svg rendering in more places ([#31650](https://github.com/element-hq/element-web/pull/31650)). Contributed by @t3chguy.
+* Update notification icons using Compound icons ([#31671](https://github.com/element-hq/element-web/pull/31671)). Contributed by @t3chguy.
+* Memoise ListView context  ([#31668](https://github.com/element-hq/element-web/pull/31668)). Contributed by @t3chguy.
+* Switch emoji picker to use emoji for header icons ([#31645](https://github.com/element-hq/element-web/pull/31645)). Contributed by @t3chguy.
+* Replace icons with Compound alternatives ([#31642](https://github.com/element-hq/element-web/pull/31642)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Fix avatar decorations in thread activity centre not being atop avatar ([#31789](https://github.com/element-hq/element-web/pull/31789)). Contributed by @t3chguy.
+* Fix room settings roles tab getting confused if power level change fails ([#31768](https://github.com/element-hq/element-web/pull/31768)). Contributed by @t3chguy.
+* Custom themes now import highlights in css ([#31758](https://github.com/element-hq/element-web/pull/31758)). Contributed by @Philldomd.
+* Use correct translation for url preview settings ([#31740](https://github.com/element-hq/element-web/pull/31740)). Contributed by @florianduros.
+* Fix error shown if accepting a 3pid invite ([#31735](https://github.com/element-hq/element-web/pull/31735)). Contributed by @dbkr.
+* Ensure correct focus configuration for Element Call before allowing users to call. ([#31490](https://github.com/element-hq/element-web/pull/31490)). Contributed by @Half-Shot.
+* Fix emoji font in emoji picker header buttons ([#31679](https://github.com/element-hq/element-web/pull/31679)). Contributed by @t3chguy.
+* fix flaky test by waiting for chat panel before counting messages ([#31633](https://github.com/element-hq/element-web/pull/31633)). Contributed by @BillCarsonFr.
+
+
+Changes in [1.12.8](https://github.com/element-hq/element-web/releases/tag/v1.12.8) (2026-01-13)
+================================================================================================
+## 🦖 Deprecations
+
+* Remove `element_call.participant_limit` config and associated code. ([#31638](https://github.com/element-hq/element-web/pull/31638)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Switch to rendering svg icons rather than masking them ([#31557](https://github.com/element-hq/element-web/pull/31557)). Contributed by @t3chguy.
+* Update history visibility UX ([#31635](https://github.com/element-hq/element-web/pull/31635)). Contributed by @langleyd.
+* Show correct call icon for joining a call. ([#31489](https://github.com/element-hq/element-web/pull/31489)). Contributed by @Half-Shot.
+* Update StopGapWidgetDriver to support sticky events ([#31205](https://github.com/element-hq/element-web/pull/31205)). Contributed by @Half-Shot.
+* Remove release announcements for new sounds \& room list ([#31544](https://github.com/element-hq/element-web/pull/31544)). Contributed by @t3chguy.
+* Add button to restore from backup into /devtools ([#31581](https://github.com/element-hq/element-web/pull/31581)). Contributed by @mxandreas.
+* Switch to non-solid compound icons for room settings \& composer ([#31561](https://github.com/element-hq/element-web/pull/31561)). Contributed by @t3chguy.
+* Support encrypted state events MSC4362 ([#31513](https://github.com/element-hq/element-web/pull/31513)). Contributed by @andybalaam.
+* Update prop type \& documentation for HistoryVisibleBanner and VM. ([#31545](https://github.com/element-hq/element-web/pull/31545)). Contributed by @kaylendog.
+* Switch to Compound icons in more places ([#31560](https://github.com/element-hq/element-web/pull/31560)). Contributed by @t3chguy.
+* Switch to rendering svg icons rather than masking them ([#31550](https://github.com/element-hq/element-web/pull/31550)). Contributed by @t3chguy.
+* Make AccessibleButton contrast control compatible ([#31308](https://github.com/element-hq/element-web/pull/31308)). Contributed by @t3chguy.
+* Switch to compound-design-tokens for platform icons ([#31543](https://github.com/element-hq/element-web/pull/31543)). Contributed by @t3chguy.
+* Switch to rendering svg icons rather than masking them ([#31531](https://github.com/element-hq/element-web/pull/31531)). Contributed by @t3chguy.
+* Switch to rendering svg icons rather than css masking ([#31517](https://github.com/element-hq/element-web/pull/31517)). Contributed by @t3chguy.
+* Auto approve matrix rtc member event (`m.rtc.member`) (sticky events) ([#31452](https://github.com/element-hq/element-web/pull/31452)). Contributed by @toger5.
+* Size Autocomplete relative to the RoomView height rather than the viewport height ([#31425](https://github.com/element-hq/element-web/pull/31425)). Contributed by @langleyd.
+* Implement UI for history visibility acknowledgement. ([#31156](https://github.com/element-hq/element-web/pull/31156)). Contributed by @kaylendog.
+* Export disposing hook from package ([#31498](https://github.com/element-hq/element-web/pull/31498)). Contributed by @MidhunSureshR.
+* Change `header-panel-bg-hover` to use `var(--cpd-color-bg-action-secondary-hovered)` for better custom theming ([#31457](https://github.com/element-hq/element-web/pull/31457)). Contributed by @th0mcat.
+* Improve icon rendering in iconized context menu ([#31458](https://github.com/element-hq/element-web/pull/31458)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix space settings visibility tab crashing ([#31705](https://github.com/element-hq/element-web/pull/31705)). Contributed by @RiotRobot.
+* Fix expand/collapse reply preview not showing in some cases ([#31639](https://github.com/element-hq/element-web/pull/31639)). Contributed by @t3chguy.
+* Fix bundled font or custom font not applied after theme switch ([#31591](https://github.com/element-hq/element-web/pull/31591)). Contributed by @florianduros.
+* Add ol override CSS for markdown-body ([#31618](https://github.com/element-hq/element-web/pull/31618)). Contributed by @niamu.
+* Fix reaction left margin in timeline card ([#31625](https://github.com/element-hq/element-web/pull/31625)). Contributed by @t3chguy.
+* Open right panel timeline when jumping to event with maximised widget ([#31626](https://github.com/element-hq/element-web/pull/31626)). Contributed by @t3chguy.
+* Fix Compound Link elements not having an underline. ([#31583](https://github.com/element-hq/element-web/pull/31583)). Contributed by @Half-Shot.
+* Recalculate mentions metadata of forwarded messages based on message body ([#31193](https://github.com/element-hq/element-web/pull/31193)). Contributed by @twassman.
+* Fix Room Preview Card Layout ([#31611](https://github.com/element-hq/element-web/pull/31611)). Contributed by @germain-gg.
+* Fix: WidgetMessaging not properly closed causing side effects and bugs ([#31598](https://github.com/element-hq/element-web/pull/31598)). Contributed by @BillCarsonFr.
+* Handle cross-signing keys missing locally and/or from secret storage ([#31367](https://github.com/element-hq/element-web/pull/31367)). Contributed by @uhoreg.
+* fix: Allow wrapping in `Banner` component. ([#31532](https://github.com/element-hq/element-web/pull/31532)). Contributed by @kaylendog.
+* Update algorithm for history visible banner. ([#31577](https://github.com/element-hq/element-web/pull/31577)). Contributed by @kaylendog.
+* Fix styling issue when using EW modules ([#31533](https://github.com/element-hq/element-web/pull/31533)). Contributed by @florianduros.
+* Prevent history visible banner from displaying in threads. ([#31535](https://github.com/element-hq/element-web/pull/31535)). Contributed by @kaylendog.
+* Make the feedback icon be the right color in dark theme ([#31527](https://github.com/element-hq/element-web/pull/31527)). Contributed by @robintown.
+
+
+Changes in [1.12.7](https://github.com/element-hq/element-web/releases/tag/v1.12.7) (2025-12-16)
+================================================================================================
+## ✨ Features
+
+* Replace legacy icons with compound ([#31424](https://github.com/element-hq/element-web/pull/31424)). Contributed by @t3chguy.
+* Update polls UX to match EX Mobile and improve accessibility ([#31245](https://github.com/element-hq/element-web/pull/31245)). Contributed by @langleyd.
+* Add option to enable read receipt and marker when user interact with UI ([#31353](https://github.com/element-hq/element-web/pull/31353)). Contributed by @florianduros.
+* Introduce a hook to auto dispose view models ([#31178](https://github.com/element-hq/element-web/pull/31178)). Contributed by @MidhunSureshR.
+* Update settings toggles to use consistent design across app. ([#30169](https://github.com/element-hq/element-web/pull/30169)). Contributed by @Half-Shot.
+* Add ability to the room view to hide widgets ([#31400](https://github.com/element-hq/element-web/pull/31400)). Contributed by @langleyd.
+* call: Pass the echo cancellation and noise suppression settings to EC ([#31317](https://github.com/element-hq/element-web/pull/31317)). Contributed by @BillCarsonFr.
+* Tweak rendering of icons for a11y ([#31358](https://github.com/element-hq/element-web/pull/31358)). Contributed by @t3chguy.
+* Implement new `renderNotificationDecoration` from module API  ([#31389](https://github.com/element-hq/element-web/pull/31389)). Contributed by @MidhunSureshR.
+* Replace more icons with compound ([#31381](https://github.com/element-hq/element-web/pull/31381)). Contributed by @t3chguy.
+* Replace more icons with compound ([#31378](https://github.com/element-hq/element-web/pull/31378)). Contributed by @t3chguy.
+* `<Banner/>`: Hide `Dismiss` button if `onClose` handler is not provided. ([#31362](https://github.com/element-hq/element-web/pull/31362)). Contributed by @kaylendog.
+* Replace batch of legacy icons with compound design tokens ([#31360](https://github.com/element-hq/element-web/pull/31360)). Contributed by @t3chguy.
+* MSC4380: Invite blocking ([#31268](https://github.com/element-hq/element-web/pull/31268)). Contributed by @richvdh.
+* Tweak rendering of icons for accessibility ([#31346](https://github.com/element-hq/element-web/pull/31346)). Contributed by @t3chguy.
+* Implement a shared `Banner` component. ([#31266](https://github.com/element-hq/element-web/pull/31266)). Contributed by @kaylendog.
+* Allow the Login screen to use the dark theme ([#31293](https://github.com/element-hq/element-web/pull/31293)). Contributed by @richvdh.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Amend e2e normal icon from lock-solid to info ([#31559](https://github.com/element-hq/element-web/pull/31559)). Contributed by @t3chguy.
+* [Backport staging] Fix CSS specificity causing icon issues in e2e verification ([#31548](https://github.com/element-hq/element-web/pull/31548)). Contributed by @RiotRobot.
+* [Backport staging] Fix e2e icons in CompleteSecurity \& SetupEncryptionBody ([#31522](https://github.com/element-hq/element-web/pull/31522)). Contributed by @RiotRobot.
+* [Backport staging] Remove an extra paragraph in advanced room settings ([#31511](https://github.com/element-hq/element-web/pull/31511)). Contributed by @RiotRobot.
+* [Backport staging] Don't show the key storage out of sync toast when backup disabled ([#31507](https://github.com/element-hq/element-web/pull/31507)). Contributed by @RiotRobot.
+* Fix composer button visibility in contrast colour mode ([#31255](https://github.com/element-hq/element-web/pull/31255)). Contributed by @t3chguy.
+* Ensure correct room version is used and permissions are appropriately sert when creating rooms ([#31464](https://github.com/element-hq/element-web/pull/31464)). Contributed by @Half-Shot.
+* Fix e2e icon rendering ([#31454](https://github.com/element-hq/element-web/pull/31454)). Contributed by @t3chguy.
+* EventIndexer: ensure we add initial checkpoints when the db is first opened ([#31448](https://github.com/element-hq/element-web/pull/31448)). Contributed by @richvdh.
+* Fix `/join <alias>` command failing due to race condition ([#31433](https://github.com/element-hq/element-web/pull/31433)). Contributed by @MidhunSureshR.
+* MessageEventIndexDialog: distinguish indexed rooms ([#31436](https://github.com/element-hq/element-web/pull/31436)). Contributed by @richvdh.
+* Move `EditInPlace` out of `Form` (Fixes: reloading EW on EC url update) ([#31434](https://github.com/element-hq/element-web/pull/31434)). Contributed by @toger5.
+* Fixes issue where cursor would jump to the beginning of the input field after converting Japanese text and pressing Tab ([#31432](https://github.com/element-hq/element-web/pull/31432)). Contributed by @shinaoka.
+* Fix widgets getting stuck in loading states ([#31314](https://github.com/element-hq/element-web/pull/31314)). Contributed by @robintown.
+* Room list: fix room options remaining on room item after mouse leaving ([#31414](https://github.com/element-hq/element-web/pull/31414)). Contributed by @florianduros.
+* Make `RoomList.showMessagePreview` configurable by `config.json` ([#31419](https://github.com/element-hq/element-web/pull/31419)). Contributed by @florianduros.
+* Fix bug which caused app not to load correctly when `force_verification` is enabled ([#31265](https://github.com/element-hq/element-web/pull/31265)). Contributed by @richvdh.
+* Room list: display the menu option on the room list item when clicked/opened ([#31380](https://github.com/element-hq/element-web/pull/31380)). Contributed by @florianduros.
+* Fix handling of SVGs ([#31359](https://github.com/element-hq/element-web/pull/31359)). Contributed by @t3chguy.
+* Fix word wrapping in expanded left panel buttons ([#31377](https://github.com/element-hq/element-web/pull/31377)). Contributed by @t3chguy.
+* Fix aspect ratio on error view background ([#31361](https://github.com/element-hq/element-web/pull/31361)). Contributed by @t3chguy.
+* Fix failure to request persistent storage perms ([#31299](https://github.com/element-hq/element-web/pull/31299)). Contributed by @richvdh.
+* Fix calls sometimes not knowing that they're presented ([#31313](https://github.com/element-hq/element-web/pull/31313)). Contributed by @robintown.
+
+
+Changes in [1.12.6](https://github.com/element-hq/element-web/releases/tag/v1.12.6) (2025-12-03)
+================================================================================================
+This release fixes a bug where 1:1 calling was incorrectly not available if no Element Call focus was set.
+
+## 🐛 Bug Fixes
+
+* Add option to pick call options for voice calls. ([#31413](https://github.com/element-hq/element-web/pull/31413)).
+
+Changes in [1.12.5](https://github.com/element-hq/element-web/releases/tag/v1.12.5) (2025-12-02)
+================================================================================================
+## ✨ Features
+
+* Update Emojibase to v17 ([#31307](https://github.com/element-hq/element-web/pull/31307)). Contributed by @t3chguy.
+* Adds tooltip for compose menu ([#31122](https://github.com/element-hq/element-web/pull/31122)). Contributed by @byteplow.
+* Add option to hide pinned message banner in room view ([#31296](https://github.com/element-hq/element-web/pull/31296)). Contributed by @florianduros.
+* update twemoji to not monochromise emoji with BLACK in their name ([#31281](https://github.com/element-hq/element-web/pull/31281)). Contributed by @ara4n.
+* upgrade to twemoji 17.0.2 and fix #14695 ([#31267](https://github.com/element-hq/element-web/pull/31267)). Contributed by @ara4n.
+* Add options to hide right panel in room view ([#31252](https://github.com/element-hq/element-web/pull/31252)). Contributed by @florianduros.
+* Delayed event management: split endpoints, no auth  ([#31183](https://github.com/element-hq/element-web/pull/31183)). Contributed by @AndrewFerr.
+* Support using Element Call for voice calls in DMs ([#30817](https://github.com/element-hq/element-web/pull/30817)). Contributed by @Half-Shot.
+* Improve screen reader accessibility of auth pages ([#31236](https://github.com/element-hq/element-web/pull/31236)). Contributed by @t3chguy.
+* Add posthog tracking for key backup toasts ([#31195](https://github.com/element-hq/element-web/pull/31195)). Contributed by @Half-Shot.
+
+## 🐛 Bug Fixes
+
+* Return to using Fira Code as the default monospace font ([#31302](https://github.com/element-hq/element-web/pull/31302)). Contributed by @ara4n.
+* Fix case of home screen being displayed erroneously  ([#31301](https://github.com/element-hq/element-web/pull/31301)). Contributed by @langleyd.
+* Fix message edition and reply when multiple rooms at displayed the same moment ([#31280](https://github.com/element-hq/element-web/pull/31280)). Contributed by @florianduros.
+* Key storage out of sync: reset key backup when needed ([#31279](https://github.com/element-hq/element-web/pull/31279)). Contributed by @uhoreg.
+* Fix invalid events crashing entire room rather than just their tile ([#31256](https://github.com/element-hq/element-web/pull/31256)). Contributed by @t3chguy.
+* Fix expand button of space panel getting cut off at the edges ([#31259](https://github.com/element-hq/element-web/pull/31259)). Contributed by @MidhunSureshR.
+* Fix pill buttons in dialogs ([#31246](https://github.com/element-hq/element-web/pull/31246)). Contributed by @dbkr.
+* Fix blank sections at the top and bottom of the member list when scrolling ([#31198](https://github.com/element-hq/element-web/pull/31198)). Contributed by @langleyd.
+* Fix emoji category selection with keyboard ([#31162](https://github.com/element-hq/element-web/pull/31162)). Contributed by @langleyd.
+
+
+Changes in [1.12.4](https://github.com/element-hq/element-web/releases/tag/v1.12.4) (2025-11-18)
+================================================================================================
+## ✨ Features
+
+* Apply aria-hidden to emoji in SAS verification ([#31204](https://github.com/element-hq/element-web/pull/31204)). Contributed by @t3chguy.
+* Add options to hide header and composer of room view for the module api ([#31095](https://github.com/element-hq/element-web/pull/31095)). Contributed by @florianduros.
+* Experimental Module API Additions ([#30863](https://github.com/element-hq/element-web/pull/30863)). Contributed by @dbkr.
+* Change polls to use fieldset/legend markup ([#31160](https://github.com/element-hq/element-web/pull/31160)). Contributed by @langleyd.
+* Use compound Button styles for Jitsi button ([#31159](https://github.com/element-hq/element-web/pull/31159)). Contributed by @Half-Shot.
+* Add FocusLock to emoji picker ([#31146](https://github.com/element-hq/element-web/pull/31146)). Contributed by @langleyd.
+* Move room name, avatar, and topic to IOpts. ([#30981](https://github.com/element-hq/element-web/pull/30981)). Contributed by @kaylendog.
+* Add a devtool for looking at users and their devices ([#30983](https://github.com/element-hq/element-web/pull/30983)). Contributed by @uhoreg.
+
+## 🐛 Bug Fixes
+
+* Fix room list handling of membership changes ([#31197](https://github.com/element-hq/element-web/pull/31197)). Contributed by @t3chguy.
+* Fix room list unable to be resized when displayed after a module ([#31186](https://github.com/element-hq/element-web/pull/31186)). Contributed by @florianduros.
+* Inhibit keyboard highlights in dialogs when effector is not in focus ([#31181](https://github.com/element-hq/element-web/pull/31181)). Contributed by @t3chguy.
+* Strip mentions from forwarded messages ([#30884](https://github.com/element-hq/element-web/pull/30884)). Contributed by @twassman.
+* Don't allow pin or edit of messages with a send status ([#31158](https://github.com/element-hq/element-web/pull/31158)). Contributed by @langleyd.
+* Hide room header buttons if the room hasn't been created yet. ([#31092](https://github.com/element-hq/element-web/pull/31092)). Contributed by @Half-Shot.
+* Fix screen readers not indicating the emoji picker search field is focused. ([#31128](https://github.com/element-hq/element-web/pull/31128)). Contributed by @langleyd.
+* Fix emoji picker highlight missing when not active element ([#31148](https://github.com/element-hq/element-web/pull/31148)). Contributed by @t3chguy.
+* Add relevant aria attribute for selected emoji in the emoji picker ([#31125](https://github.com/element-hq/element-web/pull/31125)). Contributed by @t3chguy.
+* Fix tooltips within context menu portals being unreliable ([#31129](https://github.com/element-hq/element-web/pull/31129)). Contributed by @t3chguy.
+* Avoid excessive re-render of room list and member list ([#31131](https://github.com/element-hq/element-web/pull/31131)). Contributed by @florianduros.
+* Make emoji picker height responsive. ([#31130](https://github.com/element-hq/element-web/pull/31130)). Contributed by @langleyd.
+* Emoji Picker: Focused emoji does not move with the arrow keys ([#30893](https://github.com/element-hq/element-web/pull/30893)). Contributed by @langleyd.
+* Fix audio player seek bar position  ([#31127](https://github.com/element-hq/element-web/pull/31127)). Contributed by @florianduros.
+* Add aria label to emoji picker search ([#31126](https://github.com/element-hq/element-web/pull/31126)). Contributed by @langleyd.
+
+
 Changes in [1.12.3](https://github.com/element-hq/element-web/releases/tag/v1.12.3) (2025-11-04)
 ================================================================================================
 ## 🦖 Deprecations
@@ -46,6 +46,9 @@ As for your PR description, it should include these things:
 - Add comments to the diff for the reviewer that might help them to understand
  why the change is necessary or how they might better understand and review it.

+Please **_do not use force push_** in your PRs. Doing so means we can't see what
+has changed. We use squash merge to get a "clean" git history.
+
 ### Changelogs

 There's no need to manually add Changelog entries: we use information in the
@@ -184,6 +187,16 @@ Please ensure your changes match the cosmetic style of the existing project,
 and **_never_** mix cosmetic and functional changes in the same commit, as it
 makes it horribly hard to review otherwise.

+## Shared Components
+
+When creating new UI components, consider whether they should be added to the shared components package (`packages/shared-components`) rather than directly in the main `src/` directory. Components should be placed in shared components if they:
+
+- Are reusable across different parts of the application
+- Could potentially be used by other Element projects (Element Desktop, Aurora, Element modules...)
+- Follow established patterns and don't have tight coupling to specific application logic
+
+For more details, see the [shared components README](./packages/shared-components/README.md).
+
 ## Attribution

 Everyone who contributes anything to Matrix is welcome to be listed in the
@@ -1,46 +0,0 @@
-# syntax=docker.io/docker/dockerfile:1.19-labs@sha256:dce1c693ef318bca08c964ba3122ae6248e45a1b96d65c4563c8dc6fe80349a2
-
-# Builder
-FROM --platform=$BUILDPLATFORM node:22-bullseye@sha256:cd951bb228ddf85882951d4bf4acefc5314eb2eb66eee002256f4bb17c2293e3 AS builder
-
-# Support custom branch of the js-sdk. This also helps us build images of element-web develop.
-ARG USE_CUSTOM_SDKS=false
-ARG JS_SDK_REPO="https://github.com/matrix-org/matrix-js-sdk.git"
-ARG JS_SDK_BRANCH="master"
-
-WORKDIR /src
-
-COPY --exclude=docker . /src
-RUN /src/scripts/docker-link-repos.sh
-RUN yarn --network-timeout=200000 install
-RUN /src/scripts/docker-package.sh
-
-# Copy the config now so that we don't create another layer in the app image
-RUN cp /src/config.sample.json /src/webapp/config.json
-
-# App
-FROM nginxinc/nginx-unprivileged:alpine-slim@sha256:304079937327a6490d5c89df47c8951d76f05b346d4c6e3b10cba2e266cd4904
-
-# Need root user to install packages & manipulate the usr directory
-USER root
-
-# Install jq and moreutils for sponge, both used by our entrypoints
-RUN apk add jq moreutils
-
-COPY --from=builder /src/webapp /app
-
-# Override default nginx config. Templates in `/etc/nginx/templates` are passed
-# through `envsubst` by the nginx docker image entry point.
-COPY /docker/nginx-templates/* /etc/nginx/templates/
-COPY /docker/docker-entrypoint.d/* /docker-entrypoint.d/
-
-RUN rm -rf /usr/share/nginx/html \
-  && ln -s /app /usr/share/nginx/html
-
-# Run as nginx user by default
-USER nginx
-
-# HTTP listen port
-ENV ELEMENT_WEB_PORT=80
-
-HEALTHCHECK --start-period=5s CMD wget -q --spider http://localhost:$ELEMENT_WEB_PORT/config.json
@@ -9,7 +9,7 @@

 # Element

-Element (formerly known as Vector and Riot) is a Matrix web client built using the [Matrix
+Element (formerly known as Vector and Riot) is a Matrix web & desktop client built using the [Matrix
 JS SDK](https://github.com/matrix-org/matrix-js-sdk).

 # Supported Environments
@@ -42,8 +42,8 @@ Element has several tiers of support for different environments:
 The period of support for these tiers should last until the releases specified above, plus 1 app release cycle(2 weeks). In the case of Firefox ESR this is extended further to allow it land in Debian Stable.

 For accessing Element on an Android or iOS device, we currently recommend the
-native apps [element-android](https://github.com/element-hq/element-android)
-and [element-ios](https://github.com/element-hq/element-ios).
+native apps [element-x-android](https://github.com/element-hq/element-x-android)
+and [element-x-ios](https://github.com/element-hq/element-x-ios).

 # Getting Started

@@ -55,91 +55,16 @@ To host your own instance of Element see [Installing Element Web](docs/install.m

 To install Element as a desktop application, see [Running as a desktop app](#running-as-a-desktop-app) below.

-# Important Security Notes
+---

-## Separate domains
+# Monorepo

-We do not recommend running Element from the same domain name as your Matrix
-homeserver. The reason is the risk of XSS (cross-site-scripting)
-vulnerabilities that could occur if someone caused Element to load and render
-malicious user generated content from a Matrix API which then had trusted
-access to Element (or other apps) due to sharing the same domain.
+This repository is a monorepo hosting Element Web and other related projects in various subdirectories.
+You can read more about the structure [here](docs/monorepo.md).

-We have put some coarse mitigations into place to try to protect against this
-situation, but it's still not good practice to do it in the first place. See
-<https://github.com/element-hq/element-web/issues/1977> for more details.
+# Element Web

-## Configuration best practices
-
-Unless you have special requirements, you will want to add the following to
-your web server configuration when hosting Element Web:
-
- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
-  framed and protect from [clickjacking][owasp-clickjacking].
- The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
-  header, as the modern replacement for `X-Frame-Options` (though both should be
-  included since not all browsers support it yet, see
-  [this][owasp-clickjacking-csp]).
- The `X-Content-Type-Options: nosniff` header, to [disable MIME
-  sniffing][mime-sniffing].
- The `X-XSS-Protection: 1; mode=block;` header, for basic XSS protection in
-  legacy browsers.
-
-[mime-sniffing]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing
-[owasp-clickjacking-csp]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#content-security-policy-frame-ancestors-examples
-[owasp-clickjacking]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
-
-If you are using nginx, this would look something like the following:
-
-```
-add_header X-Frame-Options SAMEORIGIN;
-add_header X-Content-Type-Options nosniff;
-add_header X-XSS-Protection "1; mode=block";
-add_header Content-Security-Policy "frame-ancestors 'self'";
-```
-
-For Apache, the configuration looks like:
-
-```
-Header set X-Frame-Options SAMEORIGIN
-Header set X-Content-Type-Options nosniff
-Header set X-XSS-Protection "1; mode=block"
-Header set Content-Security-Policy "frame-ancestors 'self'"
-```
-
-Note: In case you are already setting a `Content-Security-Policy` header
-elsewhere, you should modify it to include the `frame-ancestors` directive
-instead of adding that last line.
-
-# Building From Source
-
-Element is a modular webapp built with modern ES6 and uses a Node.js build system.
-Ensure you have the latest LTS version of Node.js installed.
-
-Using `yarn` instead of `npm` is recommended. Please see the Yarn [install
-guide](https://classic.yarnpkg.com/en/docs/install) if you do not have it already.
-
-1. Install or update `node.js` so that your `node` is at least the current recommended LTS.
-1. Install `yarn` if not present already.
-1. Clone the repo: `git clone https://github.com/element-hq/element-web.git`.
-1. Switch to the element-web directory: `cd element-web`.
-1. Install the prerequisites: `yarn install`.
-    - If you're using the `develop` branch, then it is recommended to set up a
-      proper development environment (see [Setting up a dev
-      environment](./developer_guide.md#setting-up-a-dev-environment) below). Alternatively, you
-      can use <https://develop.element.io> - the continuous integration release of
-      the develop branch.
-1. Configure the app by copying `config.sample.json` to `config.json` and
-   modifying it. See the [configuration docs](docs/config.md) for details.
-1. `yarn dist` to build a tarball to deploy. Untaring this file will give
-   a version-specific directory containing all the files that need to go on your
-   web server.
-
-Note that `yarn dist` is not supported on Windows, so Windows users can run `yarn build`,
-which will build all the necessary files into the `webapp` directory. The version of Element
-will not appear in Settings without using the dist script. You can then mount the
-`webapp` directory on your web server to actually serve up the app, which is
-entirely static content.
+To learn more about Element Web [click here](apps/web/README.md)

 # Running as a Desktop app

@@ -153,33 +78,6 @@ Many thanks to @aviraldg for the initial work on the Electron integration.

 The [configuration docs](docs/config.md#desktop-app-configuration) show how to override the desktop app's default settings if desired.

-# config.json
-
-Element supports a variety of settings to configure default servers, behaviour, themes, etc.
-See the [configuration docs](docs/config.md) for more details.
-
-# Labs Features
-
-Some features of Element may be enabled by flags in the `Labs` section of the settings.
-Some of these features are described in [labs.md](https://github.com/element-hq/element-web/blob/develop/docs/labs.md).
-
-# Caching requirements
-
-Element requires the following URLs not to be cached, when/if you are serving Element from your own webserver:
-
-```
-/config.*.json
-/i18n
-/home
-/sites
-/index.html
-```
-
-We also recommend that you force browsers to re-validate any cached copy of Element on page load by configuring your
-webserver to return `Cache-Control: no-cache` for `/`. This ensures the browser will fetch a new version of Element on
-the next page load after it's been deployed. Note that this is already configured for you in the nginx config of our
-Dockerfile.
-
 # Development

 Please read through the following:
@@ -214,3 +112,6 @@ This software is multi licensed by New Vector Ltd (Element). It can be used eith

 (3) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
 Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
+
+Please contact [licensing@element.io](mailto:licensing@element.io) to purchase
+an Element commercial license for this software.
@@ -7,6 +7,7 @@ karma-reports/
 .idea/
 .tmp/
 config.json*
+.link-config
 # Exclude the playwright directory as much as we can as the snapshots are huge and we bind mount it in
 playwright/
 !playwright/docker-entrypoint.sh
@@ -0,0 +1,18 @@
+src/vector/modernizr.cjs
+test/end-to-end-tests/node_modules/
+test/end-to-end-tests/element/
+test/end-to-end-tests/synapse/
+test/end-to-end-tests/lib/
+# Legacy skinning file that some people might still have
+src/component-index.js
+# Auto-generated file
+src/modules.ts
+src/modules.js
+# Test result files
+/playwright/test-results/
+/playwright/html-report/
+
+# Shared components generated files
+/packages/shared-components/dist/
+/packages/shared-components/src/i18n/i18nKeys.d.ts
+/packages/shared-components/typedoc/
@@ -0,0 +1,347 @@
+/*
+Copyright 2025 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+module.exports = {
+    plugins: ["matrix-org", "eslint-plugin-react-compiler"],
+    extends: ["plugin:matrix-org/babel", "plugin:matrix-org/react", "plugin:matrix-org/a11y"],
+    parserOptions: {
+        project: ["./tsconfig.json"],
+        tsconfigRootDir: __dirname,
+    },
+    env: {
+        browser: true,
+        node: true,
+    },
+    globals: {
+        LANGUAGES_FILE: "readonly",
+    },
+    rules: {
+        // Things we do that break the ideal style
+        "no-constant-condition": "off",
+        "prefer-promise-reject-errors": "off",
+        "no-async-promise-executor": "off",
+        "no-extra-boolean-cast": "off",
+
+        // Bind or arrow functions in props causes performance issues (but we
+        // currently use them in some places).
+        // It's disabled here, but we should using it sparingly.
+        "react/jsx-no-bind": "off",
+        "react/jsx-key": ["error"],
+
+        "no-restricted-properties": [
+            "error",
+            ...buildRestrictedPropertiesOptions(
+                ["window.innerHeight", "window.innerWidth", "window.visualViewport"],
+                "Use UIStore to access window dimensions instead.",
+            ),
+            ...buildRestrictedPropertiesOptions(
+                ["React.forwardRef", "*.forwardRef", "forwardRef"],
+                "Use ref props instead.",
+            ),
+            ...buildRestrictedPropertiesOptions(
+                ["*.mxcUrlToHttp", "*.getHttpUriForMxc"],
+                "Use Media helper instead to centralise access for customisation.",
+            ),
+            ...buildRestrictedPropertiesOptions(["window.setImmediate"], "Use setTimeout instead."),
+        ],
+        "no-restricted-globals": [
+            "error",
+            {
+                name: "setImmediate",
+                message: "Use setTimeout instead.",
+            },
+            {
+                name: "Buffer",
+                message: "Buffer is not available in the web.",
+            },
+        ],
+
+        "import/no-duplicates": ["error"],
+        // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
+        // Ban compound-design-tokens raw svg imports in favour of their React component counterparts
+        "no-restricted-imports": [
+            "error",
+            {
+                paths: [
+                    {
+                        name: "react",
+                        importNames: ["forwardRef"],
+                        message: "Use ref props instead.",
+                    },
+                    {
+                        name: "@testing-library/react",
+                        message: "Please use jest-matrix-react instead",
+                    },
+                    {
+                        name: "matrix-js-sdk",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/src",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/src/",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "matrix-js-sdk/src/index",
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        name: "emojibase-regex",
+                        message:
+                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
+                    },
+                ],
+                patterns: [
+                    {
+                        group: [
+                            "matrix-js-sdk/src/**",
+                            "!matrix-js-sdk/src/matrix",
+                            "!matrix-js-sdk/src/crypto-api",
+                            "!matrix-js-sdk/src/types",
+                            "!matrix-js-sdk/src/testing",
+                            "!matrix-js-sdk/src/utils/**",
+                            "matrix-js-sdk/src/utils/internal/**",
+                            "matrix-js-sdk/lib",
+                            "matrix-js-sdk/lib/",
+                            "matrix-js-sdk/lib/**",
+                            // XXX: Temporarily allow these as they are not available via the main export
+                            "!matrix-js-sdk/src/logger",
+                            "!matrix-js-sdk/src/errors",
+                            "!matrix-js-sdk/src/utils",
+                            "!matrix-js-sdk/src/version-support",
+                            "!matrix-js-sdk/src/randomstring",
+                            "!matrix-js-sdk/src/sliding-sync",
+                            "!matrix-js-sdk/src/browser-index",
+                            "!matrix-js-sdk/src/feature",
+                            "!matrix-js-sdk/src/NamespacedValue",
+                            "!matrix-js-sdk/src/ReEmitter",
+                            "!matrix-js-sdk/src/event-mapper",
+                            "!matrix-js-sdk/src/interactive-auth",
+                            "!matrix-js-sdk/src/secret-storage",
+                            "!matrix-js-sdk/src/room-hierarchy",
+                            "!matrix-js-sdk/src/rendezvous",
+                            "!matrix-js-sdk/src/indexeddb-worker",
+                            "!matrix-js-sdk/src/pushprocessor",
+                            "!matrix-js-sdk/src/extensible_events_v1",
+                            "!matrix-js-sdk/src/extensible_events_v1/PollStartEvent",
+                            "!matrix-js-sdk/src/extensible_events_v1/PollResponseEvent",
+                            "!matrix-js-sdk/src/extensible_events_v1/PollEndEvent",
+                            "!matrix-js-sdk/src/extensible_events_v1/InvalidEventError",
+                            "!matrix-js-sdk/src/oidc",
+                            "!matrix-js-sdk/src/oidc/discovery",
+                            "!matrix-js-sdk/src/oidc/authorize",
+                            "!matrix-js-sdk/src/oidc/validate",
+                            "!matrix-js-sdk/src/oidc/error",
+                            "!matrix-js-sdk/src/oidc/register",
+                            "!matrix-js-sdk/src/webrtc",
+                            "!matrix-js-sdk/src/webrtc/call",
+                            "!matrix-js-sdk/src/webrtc/callFeed",
+                            "!matrix-js-sdk/src/webrtc/mediaHandler",
+                            "!matrix-js-sdk/src/webrtc/callEventTypes",
+                            "!matrix-js-sdk/src/webrtc/callEventHandler",
+                            "!matrix-js-sdk/src/webrtc/groupCallEventHandler",
+                            "!matrix-js-sdk/src/models",
+                            "!matrix-js-sdk/src/models/read-receipt",
+                            "!matrix-js-sdk/src/models/relations-container",
+                            "!matrix-js-sdk/src/models/related-relations",
+                            "!matrix-js-sdk/src/matrixrtc",
+                        ],
+                        message: "Please use matrix-js-sdk/src/matrix instead",
+                    },
+                    {
+                        group: ["emojibase-regex/emoji*"],
+                        message:
+                            "This regex doesn't actually test for emoji. See the docs at https://emojibase.dev/docs/regex/ and prefer our own EMOJI_REGEX from HtmlUtils.",
+                    },
+                    {
+                        group: ["@vector-im/compound-design-tokens/icons/*"],
+                        message: "Please use @vector-im/compound-design-tokens/assets/web/icons/* instead",
+                    },
+                    {
+                        group: ["**/packages/shared-components/**", "../packages/shared-components/**"],
+                        message: "Please use @element-hq/web-shared-components",
+                    },
+                ],
+            },
+        ],
+
+        // There are too many a11y violations to fix at once
+        // Turn violated rules off until they are fixed
+        "jsx-a11y/aria-activedescendant-has-tabindex": "off",
+        "jsx-a11y/click-events-have-key-events": "off",
+        "jsx-a11y/interactive-supports-focus": "off",
+        "jsx-a11y/media-has-caption": "off",
+        "jsx-a11y/mouse-events-have-key-events": "off",
+        "jsx-a11y/no-autofocus": "off",
+        "jsx-a11y/no-noninteractive-element-interactions": "off",
+        "jsx-a11y/no-noninteractive-element-to-interactive-role": "off",
+        "jsx-a11y/no-noninteractive-tabindex": "off",
+        "jsx-a11y/no-static-element-interactions": "off",
+        "jsx-a11y/role-supports-aria-props": "off",
+
+        "matrix-org/require-copyright-header": "error",
+
+        "react-compiler/react-compiler": "error",
+    },
+    overrides: [
+        {
+            files: ["src/**/*.{ts,tsx}", "test/**/*.{ts,tsx}", "playwright/**/*.ts", "*.ts"],
+            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
+            rules: {
+                "@typescript-eslint/unbound-method": ["error", { ignoreStatic: true }],
+                "@typescript-eslint/explicit-function-return-type": [
+                    "error",
+                    {
+                        allowExpressions: true,
+                    },
+                ],
+
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "no-extra-boolean-cast": "off",
+
+                // Remove Babel things manually due to override limitations
+                "@babel/no-invalid-this": ["off"],
+
+                // We're okay being explicit at the moment
+                "@typescript-eslint/no-empty-interface": "off",
+                // We disable this while we're transitioning
+                "@typescript-eslint/no-explicit-any": "off",
+                // We'd rather not do this but we do
+                "@typescript-eslint/ban-ts-comment": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+                "@typescript-eslint/no-empty-object-type": [
+                    "error",
+                    {
+                        // We do this sometimes to brand interfaces
+                        allowInterfaces: "with-single-extends",
+                    },
+                ],
+            },
+        },
+        {
+            files: ["test/**/*.{ts,tsx}", "playwright/**/*.ts"],
+            extends: ["plugin:matrix-org/jest"],
+            rules: {
+                // We don't need super strict typing in test utilities
+                "@typescript-eslint/explicit-function-return-type": "off",
+                "@typescript-eslint/explicit-member-accessibility": "off",
+                "@typescript-eslint/no-empty-object-type": "off",
+                "@typescript-eslint/unbound-method": "off",
+
+                // Jest/Playwright specific
+
+                // Disabled tests are a reality for now but as soon as all of the xits are
+                // eliminated, we should enforce this.
+                "jest/no-disabled-tests": "off",
+                // Also treat "oldBackendOnly" as a test function.
+                // Used in some crypto tests.
+                "jest/no-standalone-expect": [
+                    "error",
+                    {
+                        additionalTestBlockFunctions: ["beforeAll", "beforeEach", "oldBackendOnly"],
+                    },
+                ],
+
+                // These are fine in tests
+                "no-restricted-globals": "off",
+                "react-compiler/react-compiler": "off",
+            },
+        },
+        {
+            files: ["playwright/**/*.ts"],
+            parserOptions: {
+                project: ["./playwright/tsconfig.json"],
+            },
+            rules: {
+                "react-hooks/rules-of-hooks": ["off"],
+                "@typescript-eslint/no-floating-promises": ["error"],
+            },
+        },
+        {
+            files: ["module_system/**/*.{ts,tsx}"],
+            parserOptions: {
+                project: ["./tsconfig.module_system.json"],
+            },
+            extends: ["plugin:matrix-org/typescript", "plugin:matrix-org/react"],
+            // NOTE: These rules are frozen and new rules should not be added here.
+            // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                // We disable this while we're transitioning
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+
+                // Ban matrix-js-sdk/src imports in favour of matrix-js-sdk/src/matrix imports to prevent unleashing hell.
+                "no-restricted-imports": [
+                    "error",
+                    {
+                        paths: [
+                            {
+                                name: "matrix-js-sdk",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/src",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/src/",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                            {
+                                name: "matrix-js-sdk/src/index",
+                                message: "Please use matrix-js-sdk/src/matrix instead",
+                            },
+                        ],
+                        patterns: [
+                            {
+                                group: ["matrix-js-sdk/lib", "matrix-js-sdk/lib/", "matrix-js-sdk/lib/**"],
+                                message: "Please use matrix-js-sdk/src/* instead",
+                            },
+                        ],
+                    },
+                ],
+            },
+        },
+    ],
+    settings: {
+        react: {
+            version: "detect",
+        },
+    },
+};
+
+function buildRestrictedPropertiesOptions(properties, message) {
+    return properties.map((prop) => {
+        let [object, property] = prop.split(".");
+        if (object === "*") {
+            object = undefined;
+        }
+        return {
+            object,
+            property,
+            message,
+        };
+    });
+}
@@ -0,0 +1,9 @@
+/webapp
+/config.json
+/config.json.*
+/config.local*.json
+# Legacy skinning file that some people might still have
+/src/component-index.js
+# Auto-generated file
+/src/modules.js
+/build_config.yaml
@@ -0,0 +1,7 @@
+{
+    "*": "prettier --write --ignore-unknown",
+    "src/**/*.(ts|tsx)": ["eslint --fix"],
+    "scripts/**/*.(ts|tsx)": ["eslint --fix"],
+    "module_system/**/*.(ts|tsx)": ["eslint --fix"],
+    "*.pcss": ["stylelint --fix"]
+}
@@ -0,0 +1,80 @@
+module.exports = {
+    extends: ["stylelint-config-standard"],
+    customSyntax: "postcss-scss",
+    plugins: ["stylelint-scss", "stylelint-value-no-unknown-custom-properties"],
+    rules: {
+        "comment-empty-line-before": null,
+        "declaration-empty-line-before": null,
+        "length-zero-no-unit": null,
+        "rule-empty-line-before": null,
+        "color-hex-length": null,
+        "at-rule-no-unknown": null,
+        "no-descending-specificity": null,
+        "scss/at-rule-no-unknown": [
+            true,
+            {
+                // https://github.com/vector-im/element-web/issues/10544
+                ignoreAtRules: ["define-mixin"],
+            },
+        ],
+        // Disable `&_kind`-style selectors while our unused CSS approach is "Find & Replace All"
+        // rather than a CI thing. Shorthand selectors are harder to detect when searching for a
+        // class name. This regex is trying to *allow* anything except `&words`, such as `&::before`,
+        // `&.mx_Class`, etc.
+        "selector-nested-pattern": "^((&[ :.\\[,])|([^&]))",
+        // Disable some defaults
+        "selector-class-pattern": null,
+        "custom-property-pattern": null,
+        "selector-id-pattern": null,
+        "keyframes-name-pattern": null,
+        "alpha-value-notation": null,
+        "color-function-notation": null,
+        "selector-not-notation": null,
+        "import-notation": null,
+        "value-keyword-case": null,
+        "declaration-block-no-redundant-longhand-properties": null,
+        "shorthand-property-no-redundant-values": null,
+        "property-no-vendor-prefix": null,
+        "selector-no-vendor-prefix": null,
+        "media-feature-name-no-vendor-prefix": null,
+        "number-max-precision": null,
+        "no-invalid-double-slash-comments": true,
+        "media-feature-range-notation": null,
+        "declaration-property-value-no-unknown": null,
+        "declaration-property-value-keyword-no-deprecated": null,
+        "csstools/value-no-unknown-custom-properties": [
+            true,
+            {
+                importFrom: [
+                    { from: "res/css/_common.pcss", type: "css" },
+                    { from: "res/themes/light/css/_light.pcss", type: "css" },
+                    // Right now our styles share vars all over the place, this is not ideal but acceptable for now
+                    { from: "res/css/views/rooms/_EventTile.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_IRCLayout.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_EventBubbleTile.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_ReadReceiptGroup.pcss", type: "css" },
+                    { from: "res/css/views/rooms/_EditMessageComposer.pcss", type: "css" },
+                    { from: "res/css/views/right_panel/_BaseCard.pcss", type: "css" },
+                    { from: "res/css/views/messages/_MessageActionBar.pcss", type: "css" },
+                    { from: "res/css/views/voip/LegacyCallView/_LegacyCallViewButtons.pcss", type: "css" },
+                    { from: "res/css/views/elements/_ToggleSwitch.pcss", type: "css" },
+                    { from: "res/css/views/settings/tabs/_SettingsTab.pcss", type: "css" },
+                    { from: "res/css/structures/_RoomView.pcss", type: "css" },
+                    // Compound vars
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-base.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-common-semantic.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-base-mq.css",
+                    "../../node_modules/@vector-im/compound-design-tokens/assets/web/css/cpd-theme-light-semantic-mq.css",
+                ],
+            },
+        ],
+        "property-no-deprecated": [
+            true,
+            {
+                ignoreProperties: ["-webkit-box-orient", "word-wrap"],
+            },
+        ],
+        "nesting-selector-no-missing-scoping-root": null,
+        "no-invalid-position-declaration": null,
+    },
+};
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-easings" {
+    export default function (): void;
+}
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-hexrgba" {
+    export default function (): void;
+}
@@ -0,0 +1,10 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "postcss-mixins" {
+    export default function (): void;
+}
@@ -0,0 +1,19 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+declare module "webpack-version-file-plugin" {
+    interface Opts {
+        outputFile: string;
+        template?: string;
+        templateString?: string;
+        extras?: Record<string, string>;
+    }
+
+    export default class VersionFilePlugin {
+        public constructor(opts: Opts);
+    }
+}
@@ -0,0 +1,47 @@
+# syntax=docker.io/docker/dockerfile:1.21-labs@sha256:2e681d22e86e738a057075f930b81b2ab8bc2a34cd16001484a7453cfa7a03fb
+
+# Builder
+FROM --platform=$BUILDPLATFORM node:24-bullseye@sha256:d83f76ec9956d35fe14221022e8b5a87a5de6fcdb4edb1187eddeb7dc80cba71 AS builder
+
+# Support custom branch of the js-sdk. This also helps us build images of element-web develop.
+ARG USE_CUSTOM_SDKS=false
+ARG JS_SDK_REPO="https://github.com/matrix-org/matrix-js-sdk.git"
+ARG JS_SDK_BRANCH="master"
+
+WORKDIR /src
+
+COPY --exclude=docker . /src
+RUN corepack enable
+RUN /src/scripts/docker-link-repos.sh
+RUN pnpm install
+RUN /src/scripts/docker-package.sh
+
+# Copy the config now so that we don't create another layer in the app image
+RUN cp /src/apps/web/config.sample.json /src/apps/web/webapp/config.json
+
+# App
+FROM nginxinc/nginx-unprivileged:alpine-slim@sha256:800307aaf07c143f5d90aa9d4269cc1971dcfe5aee7cabd11579ac4c6bcf198f
+
+# Need root user to install packages & manipulate the usr directory
+USER root
+
+# Install jq and moreutils for sponge, both used by our entrypoints
+RUN apk add jq moreutils
+
+COPY --from=builder /src/apps/web/webapp /app
+
+# Override default nginx config. Templates in `/etc/nginx/templates` are passed
+# through `envsubst` by the nginx docker image entry point.
+COPY /apps/web/docker/nginx-templates/* /etc/nginx/templates/
+COPY /apps/web/docker/docker-entrypoint.d/* /docker-entrypoint.d/
+
+RUN rm -rf /usr/share/nginx/html \
+  && ln -s /app /usr/share/nginx/html
+
+# Run as nginx user by default
+USER nginx
+
+# HTTP listen port
+ENV ELEMENT_WEB_PORT=80
+
+HEALTHCHECK --start-period=5s CMD wget -q --spider http://localhost:$ELEMENT_WEB_PORT/config.json
@@ -0,0 +1,123 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import webpack from "webpack";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import _ from "lodash";
+import { type Translations } from "matrix-web-i18n";
+
+interface Options {
+    // Path to the strings for the application, will be used to deduce what languages are supported
+    stringsPath: string;
+    // Additional paths to strings which will be merged into the application's own strings for supported languages
+    additionalStringsPaths?: string[];
+}
+
+async function exists(path: string): Promise<boolean> {
+    try {
+        await fs.access(path);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+export class I18nWebpackPlugin {
+    private readonly options: Options;
+
+    public constructor(options: Options) {
+        this.options = options;
+    }
+
+    public apply(compiler: webpack.Compiler): void {
+        const { RawSource } = compiler.webpack.sources;
+
+        compiler.hooks.thisCompilation.tap("I18nWebpackPlugin", (compilation) => {
+            compilation.hooks.processAssets.tapPromise(
+                {
+                    name: "I18nWebpackPlugin",
+                    stage: webpack.Compilation.PROCESS_ASSETS_STAGE_ADDITIONS,
+                },
+                async () => {
+                    const paths = [this.options.stringsPath, ...(this.options.additionalStringsPaths ?? [])].map((p) =>
+                        path.resolve(compiler.context, p),
+                    );
+
+                    const logger = compilation.getLogger("I18nWebpackPlugin");
+
+                    for (const p of paths) {
+                        compilation.contextDependencies.add(p);
+
+                        if (!(await exists(p))) {
+                            compilation.errors.push(
+                                new webpack.WebpackError(`I18nWebpackPlugin: strings path not found: ${p}`),
+                            );
+                            return;
+                        }
+                    }
+
+                    const primaryPath = paths[0];
+                    const includeLangs = [...new Set([...(await fs.readdir(primaryPath))])]
+                        .filter((fn) => fn.endsWith(".json"))
+                        .map((f) => f.slice(0, -5));
+
+                    const langFileMap: Record<string, string> = {};
+
+                    for (const lang of includeLangs) {
+                        let translations: Translations = {};
+                        for (const p of paths) {
+                            const f = path.join(p, lang + ".json");
+
+                            if (await exists(f)) {
+                                try {
+                                    const content = await fs.readFile(f, "utf-8");
+                                    translations = _.merge(translations, JSON.parse(content));
+                                    compilation.fileDependencies.add(f);
+                                } catch (e) {
+                                    compilation.errors.push(
+                                        new webpack.WebpackError(
+                                            `I18nWebpackPlugin: Failed to read or parse ${f}: ${e}`,
+                                        ),
+                                    );
+                                }
+                            }
+                        }
+
+                        const json = JSON.stringify(translations, null, 4);
+                        const jsonBuffer = Buffer.from(json);
+                        const digest = compiler.webpack.util
+                            .createHash("xxhash64")
+                            .update(jsonBuffer)
+                            .digest("hex")
+                            .slice(0, 7);
+                        const filename = `${lang}.${digest}.json`;
+
+                        compilation.emitAsset(`i18n/${filename}`, new RawSource(jsonBuffer));
+                        langFileMap[lang] = filename;
+                        logger.debug(`Generated language file: ${filename}`);
+                    }
+
+                    // Generate languages.json
+                    const languages: Record<string, string> = {};
+                    includeLangs.forEach((lang) => {
+                        const normalizedLanguage = lang.toLowerCase().replace("_", "-");
+                        const languageParts = normalizedLanguage.split("-");
+                        if (languageParts.length == 2 && languageParts[0] == languageParts[1]) {
+                            languages[languageParts[0]] = langFileMap[lang];
+                        } else {
+                            languages[normalizedLanguage] = langFileMap[lang];
+                        }
+                    });
+
+                    compilation.emitAsset("i18n/languages.json", new RawSource(JSON.stringify(languages, null, 4)));
+                    logger.info("Generated languages.json and language files");
+                },
+            );
+        });
+    }
+}
@@ -0,0 +1,131 @@
+# Important Security Notes
+
+## Separate domains
+
+We do not recommend running Element from the same domain name as your Matrix
+homeserver. The reason is the risk of XSS (cross-site-scripting)
+vulnerabilities that could occur if someone caused Element to load and render
+malicious user generated content from a Matrix API which then had trusted
+access to Element (or other apps) due to sharing the same domain.
+
+We have put some coarse mitigations into place to try to protect against this
+situation, but it's still not good practice to do it in the first place. See
+<https://github.com/element-hq/element-web/issues/1977> for more details.
+
+## Configuration best practices
+
+Unless you have special requirements, you will want to add the following to
+your web server configuration when hosting Element Web:
+
+- The `X-Frame-Options: SAMEORIGIN` header, to prevent Element Web from being
+  framed and protect from [clickjacking][owasp-clickjacking].
+- The `frame-ancestors 'self'` directive to your `Content-Security-Policy`
+  header, as the modern replacement for `X-Frame-Options` (though both should be
+  included since not all browsers support it yet, see
+  [this][owasp-clickjacking-csp]).
+- The `X-Content-Type-Options: nosniff` header, to [disable MIME
+  sniffing][mime-sniffing].
+- The `X-XSS-Protection: 1; mode=block;` header, for basic XSS protection in
+  legacy browsers.
+
+[mime-sniffing]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing
+[owasp-clickjacking-csp]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#content-security-policy-frame-ancestors-examples
+[owasp-clickjacking]: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
+
+If you are using nginx, this would look something like the following:
+
+```
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header Content-Security-Policy "frame-ancestors 'self'";
+```
+
+For Apache, the configuration looks like:
+
+```
+Header set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Content-Security-Policy "frame-ancestors 'self'"
+```
+
+Note: In case you are already setting a `Content-Security-Policy` header
+elsewhere, you should modify it to include the `frame-ancestors` directive
+instead of adding that last line.
+
+# Building From Source
+
+Element is a modular webapp built with modern ES6 and uses a Node.js build system.
+Ensure you have the latest LTS version of Node.js installed.
+
+Using `pnpm` instead of `npm` is recommended. Please see the pnpm [install
+guide](https://pnpm.io/installation#using-corepack) if you do not have it already.
+
+1. Install or update `node.js` so that your `node` is at least the current recommended LTS.
+1. Install `pnpm` if not present already.
+1. Clone the repo: `git clone https://github.com/element-hq/element-web.git`.
+1. Switch to the element-web directory: `cd element-web/apps/web`.
+1. Install the prerequisites: `pnpm install`.
+    - If you're using the `develop` branch, then it is recommended to set up a
+      proper development environment (see [Setting up a dev
+      environment](../../developer_guide.md#setting-up-a-dev-environment) below). Alternatively, you
+      can use <https://develop.element.io> - the continuous integration release of
+      the develop branch.
+1. Configure the app by copying `config.sample.json` to `config.json` and
+   modifying it. See the [configuration docs](../../docs/config.md) for details.
+1. `pnpm dist` to build a tarball to deploy. Untaring this file will give
+   a version-specific directory containing all the files that need to go on your
+   web server.
+
+Note that `pnpm dist` is not supported on Windows, so Windows users can run `pnpm build`,
+which will build all the necessary files into the `webapp` directory. The version of Element
+will not appear in Settings without using the dist script. You can then mount the
+`webapp` directory on your web server to actually serve up the app, which is
+entirely static content.
+
+# config.json
+
+Element supports a variety of settings to configure default servers, behaviour, themes, etc.
+See the [configuration docs](../../docs/config.md) for more details.
+
+# Labs Features
+
+Some features of Element may be enabled by flags in the `Labs` section of the settings.
+Some of these features are described in [labs.md](https://github.com/element-hq/element-web/blob/develop/docs/labs.md).
+
+# Caching requirements
+
+Element requires the following URLs not to be cached, when/if you are serving Element from your own webserver:
+
+```
+/config.*.json
+/i18n
+/home
+/sites
+/index.html
+```
+
+We also recommend that you force browsers to re-validate any cached copy of Element on page load by configuring your
+webserver to return `Cache-Control: no-cache` for `/`. This ensures the browser will fetch a new version of Element on
+the next page load after it's been deployed. Note that this is already configured for you in the nginx config of our
+Dockerfile.
+
+# Development
+
+Please read through the following:
+
+1. [Developer guide](../../developer_guide.md)
+2. [Code style](../../code_style.md)
+3. [Contribution guide](../../CONTRIBUTING.md)
+
+# Extending Element Web with Modules
+
+Element Web supports a module system that allows you to extend or modify functionality at runtime. Modules are loaded dynamically and provide a safe, predictable API for customization.
+
+## What are modules?
+
+Modules are extensions that can add or modify Element Web's functionality. They are:
+
+- Built using the [`@element-hq/element-web-module-api`](https://github.com/element-hq/element-modules/tree/main/packages/element-web-module-api)
+- Loaded in EW via [config.json](../../docs/config.md#modules)
@@ -16,7 +16,7 @@
 # The modules to install. See ./docs/modules.md for more information on
 # what modules are.
 #
-# The values of this are provided to `yarn add` for inclusion.
+# The values of this are provided to `pnpm add` for inclusion.
 modules:
    # An example of pulling a module from NPM
    - "@vector-im/element-web-ilag-module@^0.0.1"
@@ -43,7 +43,6 @@
    },
    "element_call": {
        "url": "https://call.element.io",
-        "participant_limit": 8,
        "brand": "Element Call"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
@@ -0,0 +1,56 @@
+{
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "show_labs_settings": false,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 60
+    },
+    "features": {
+        "feature_video_rooms": true,
+        "feature_group_calls": true,
+        "feature_element_call_video_rooms": true
+    },
+    "element_call": {
+        "url": "https://call.element.io"
+    }
+}
@@ -0,0 +1,62 @@
+{
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "show_labs_settings": true,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "sentry": {
+        "dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6",
+        "environment": "develop"
+    },
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "features": {
+        "threadsActivityCentre": true,
+        "feature_video_rooms": true,
+        "feature_group_calls": true,
+        "feature_element_call_video_rooms": true
+    },
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 100,
+        "Registration.mobileRegistrationHelper": true
+    },
+    "element_call": {
+        "url": "https://call.element.dev"
+    },
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+}
@@ -0,0 +1,78 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { env } from "process";
+
+import type { Config } from "jest";
+
+const config: Config = {
+    testEnvironment: "jest-fixed-jsdom",
+    testEnvironmentOptions: {
+        url: "http://localhost/",
+        // This is needed to be able to load dual CJS/ESM WASM packages e.g. rust crypto & matrix-wywiwyg
+        customExportConditions: ["browser", "node"],
+    },
+    transform: {
+        "\\.[jt]sx?$": "babel-jest",
+    },
+    testMatch: ["<rootDir>/test/**/*-test.[tj]s?(x)"],
+    globalSetup: "<rootDir>/test/globalSetup.ts",
+    setupFiles: ["jest-canvas-mock", "web-streams-polyfill/polyfill"],
+    setupFilesAfterEnv: ["<rootDir>/test/setupTests.ts"],
+    moduleNameMapper: {
+        // Support CSS module
+        "\\.(module.css)$": "identity-obj-proxy",
+        "\\.(css|scss|pcss)$": "<rootDir>/__mocks__/cssMock.js",
+        "\\.(gif|png|ttf|woff2)$": "<rootDir>/__mocks__/imageMock.js",
+        "\\.svg$": "<rootDir>/__mocks__/svg.js",
+        "\\$webapp/i18n/languages.json": "<rootDir>/__mocks__/languages.json",
+        "^react$": "<rootDir>/../../node_modules/react",
+        "^react-dom$": "<rootDir>/../../node_modules/react-dom",
+        "^matrix-js-sdk$": "<rootDir>/../../node_modules/matrix-js-sdk/src",
+        "^matrix-react-sdk$": "<rootDir>/src",
+        "decoderWorker\\.min\\.js": "<rootDir>/__mocks__/empty.js",
+        "decoderWorker\\.min\\.wasm": "<rootDir>/__mocks__/empty.js",
+        "waveWorker\\.min\\.js": "<rootDir>/__mocks__/empty.js",
+        "context-filter-polyfill": "<rootDir>/__mocks__/empty.js",
+        "workers/(.+)Factory": "<rootDir>/__mocks__/workerFactoryMock.js",
+        "^!!raw-loader!.*": "jest-raw-loader",
+        "recorderWorkletFactory": "<rootDir>/__mocks__/empty.js",
+        "counterpart": "<rootDir>/../../node_modules/counterpart",
+        "@vector-im/compound-web": "<rootDir>/../../node_modules/@vector-im/compound-web",
+    },
+    transformIgnorePatterns: [
+        "/node_modules/(?!(mime|matrix-js-sdk|uuid|p-retry|is-network-error|react-merge-refs|is-ip|ip-regex|super-regex|function-timeout|time-span|convert-hrtime|clone-regexp|is-regexp|matrix-web-i18n|await-lock|@element-hq/web-shared-components|react-virtuoso|lodash)).+$",
+    ],
+    collectCoverageFrom: [
+        "<rootDir>/src/**/*.{js,ts,tsx}",
+        "<rootDir>/packages/**/*.{js,ts,tsx}",
+        // getSessionLock is piped into a different JS context via stringification, and the coverage functionality is
+        // not available in that contest. So, turn off coverage instrumentation for it.
+        "!<rootDir>/src/utils/SessionLock.ts",
+        // Coverage chokes on type definition files
+        "!<rootDir>/src/**/*.d.ts",
+    ],
+    coverageReporters: ["text-summary", "lcov"],
+    prettierPath: null,
+    moduleDirectories: ["node_modules", "test/test-utils"],
+};
+
+// if we're running under GHA, enable relevant reporters
+if (env["GITHUB_ACTIONS"] !== undefined) {
+    config.reporters ??= [];
+    config.reporters.push(["github-actions", { silent: false }]);
+    config.reporters.push("summary");
+    config.reporters.push("@casualbot/jest-sonar-reporter");
+
+    // if we're running against the develop branch, also enable the slow test reporter
+    if (env["GITHUB_REF"] == "refs/heads/develop") {
+        config.reporters.push("<rootDir>/test/slowReporter.cjs");
+    }
+}
+
+export default config;
@@ -6,7 +6,7 @@ Please see LICENSE files in the repository root for full details.
 */

 import * as YAML from "yaml";
-import * as fs from "fs";
+import * as fs from "node:fs";

 export type BuildConfig = {
    // Dev note: make everything here optional for user safety. Invalid
@@ -5,11 +5,11 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */

-import * as fs from "fs";
-import * as childProcess from "child_process";
+import * as fs from "node:fs";
+import * as childProcess from "node:child_process";
 import * as semver from "semver";

-import { type BuildConfig } from "./BuildConfig";
+import { type BuildConfig } from "./BuildConfig.ts";

 // This expects to be run from ./scripts/install.ts

@@ -38,7 +38,7 @@ export function installer(config: BuildConfig): void {
    let exitCode = 0;

    // We cheat a bit and store the current package.json and lockfile so we can safely
-    // run `yarn add` without creating extra committed files for people. We restore
+    // run `pnpm add` without creating extra committed files for people. We restore
    // these files by simply overwriting them when we're done.
    const packageDeps = readCurrentPackageDetails();

@@ -47,7 +47,7 @@ export function installer(config: BuildConfig): void {
    const currentOptDeps = getOptionalDepNames(packageDeps.packageJson);

    try {
-        // Install the modules with yarn
+        // Install the modules with pnpm
        const yarnAddRef = config.modules.join(" ");
        callYarnAdd(yarnAddRef); // install them all at once

@@ -108,20 +108,20 @@ type RawDependencies = {

 function readCurrentPackageDetails(): RawDependencies {
    return {
-        lockfile: fs.readFileSync("./yarn.lock", "utf-8"),
+        lockfile: fs.readFileSync("./pnpm-lock.yaml", "utf-8"),
        packageJson: fs.readFileSync("./package.json", "utf-8"),
    };
 }

 function writePackageDetails(deps: RawDependencies): void {
-    fs.writeFileSync("./yarn.lock", deps.lockfile, "utf-8");
+    fs.writeFileSync("./pnpm-lock.yaml", deps.lockfile, "utf-8");
    fs.writeFileSync("./package.json", deps.packageJson, "utf-8");
 }

 function callYarnAdd(dep: string): void {
    // Add the module to the optional dependencies section just in case something
    // goes wrong in restoring the original package details.
-    childProcess.execSync(`yarn add -O ${dep}`, {
+    childProcess.execSync(`pnpm add -O ${dep}`, {
        env: process.env,
        stdio: ["inherit", "inherit", "inherit"],
    });
@@ -170,7 +170,7 @@ function getTopLevelDependencyVersion(dep: string): string {

 function getModuleApiVersionFor(moduleName: string): string {
    // We'll just pretend that this isn't highly problematic...
-    // Yarn is fairly stable in putting modules in a flat hierarchy, at least.
+    // pnpm is fairly stable in putting modules in a flat hierarchy, at least.
    const pkgJsonStr = fs.readFileSync(`./node_modules/${moduleName}/package.json`, "utf-8");
    return findDepVersionInPackageJson(moduleApiDepName, pkgJsonStr);
 }
@@ -0,0 +1,12 @@
+/*
+Copyright 2022-2024 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { readBuildConfig } from "../BuildConfig.ts";
+import { installer } from "../installer.ts";
+
+const buildConf = readBuildConfig();
+installer(buildConf);
@@ -0,0 +1,251 @@
+{
+    "name": "element-web",
+    "version": "1.12.13",
+    "description": "Element: the future of secure communication",
+    "author": "New Vector Ltd.",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/element-hq/element-web"
+    },
+    "license": "SEE LICENSE IN README.md",
+    "type": "module",
+    "matrix_i18n_extra_translation_funcs": [
+        "UserFriendlyError"
+    ],
+    "scripts": {
+        "i18n": "matrix-gen-i18n src res && pnpm i18n:sort && pnpm i18n:lint",
+        "i18n:sort": "matrix-sort-i18n src/i18n/strings/en_EN.json",
+        "i18n:lint": "matrix-i18n-lint && prettier --log-level=silent --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && pnpm i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "rethemendex": "sh ./res/css/rethemendex.sh",
+        "build": "nx build",
+        "build-stats": "nx build --json=webpack-stats.json",
+        "vendor:modernizr": "modernizr -c .modernizr.json -d src/vector/modernizr.js && mv src/vector/modernizr.js src/vector/modernizr.cjs",
+        "vendor:jitsi": "curl -s https://meet.element.io/libs/external_api.min.js > ./res/jitsi_external_api.min.js",
+        "dist": "./scripts/package.sh",
+        "start": "nx start",
+        "lint": "pnpm lint:types && pnpm lint:js && pnpm lint:style",
+        "lint:js": "eslint --max-warnings 0 src test playwright module_system",
+        "lint:js-fix": "eslint --fix src test playwright module_system",
+        "lint:types": "nx lint:types",
+        "lint:style": "stylelint \"res/css/**/*.pcss\"",
+        "test": "nx test:unit",
+        "test:playwright": "playwright test",
+        "test:playwright:open": "pnpm test:playwright --ui",
+        "test:playwright:screenshots": "playwright-screenshots-experimental pnpm playwright test --update-snapshots --project=Chrome --grep @screenshot",
+        "coverage": "pnpm test --coverage",
+        "analyse:webpack-bundles": "webpack-bundle-analyzer webpack-stats.json webapp"
+    },
+    "dependencies": {
+        "@babel/runtime": "^7.12.5",
+        "@element-hq/element-web-module-api": "catalog:",
+        "@element-hq/web-shared-components": "workspace:*",
+        "@fontsource/fira-code": "^5",
+        "@fontsource/inter": "catalog:",
+        "@formatjs/intl-segmenter": "^12.0.0",
+        "@matrix-org/analytics-events": "^0.32.0",
+        "@matrix-org/emojibase-bindings": "^1.5.0",
+        "@matrix-org/react-sdk-module-api": "^2.4.0",
+        "@sentry/browser": "^10.0.0",
+        "@types/png-chunks-extract": "^1.0.2",
+        "@vector-im/compound-design-tokens": "catalog:",
+        "@vector-im/compound-web": "catalog:",
+        "@vector-im/matrix-wysiwyg": "2.40.0",
+        "@zxcvbn-ts/core": "^3.0.4",
+        "@zxcvbn-ts/language-common": "^3.0.4",
+        "@zxcvbn-ts/language-en": "^3.0.2",
+        "await-lock": "^3.0.0",
+        "bloom-filters": "^3.0.3",
+        "blurhash": "^2.0.3",
+        "browserslist": "^4.23.2",
+        "classnames": "^2.2.6",
+        "commonmark": "^0.31.0",
+        "css-tree": "^3.0.0",
+        "diff-dom": "^5.0.0",
+        "diff-match-patch": "^1.0.5",
+        "domutils": "^3.2.2",
+        "emojibase-regex": "^17.0.0",
+        "escape-html": "^1.0.3",
+        "file-saver": "^2.0.5",
+        "filesize": "11.0.13",
+        "github-markdown-css": "^5.5.1",
+        "glob-to-regexp": "^0.4.1",
+        "highlight.js": "^11.3.1",
+        "html-entities": "^2.0.0",
+        "html-react-parser": "^5.2.2",
+        "is-ip": "^5.0.0",
+        "js-xxhash": "^5.0.0",
+        "jsrsasign": "^11.0.0",
+        "jszip": "^3.7.0",
+        "katex": "^0.16.0",
+        "lodash": "npm:lodash-es@^4.17.21",
+        "maplibre-gl": "^5.0.0",
+        "matrix-encrypt-attachment": "^1.0.3",
+        "matrix-js-sdk": "41.2.0",
+        "matrix-widget-api": "^1.16.1",
+        "memoize-one": "^6.0.0",
+        "mime": "^4.0.4",
+        "oidc-client-ts": "^3.0.1",
+        "opus-recorder": "^8.0.3",
+        "pako": "^2.0.3",
+        "png-chunks-extract": "^1.0.0",
+        "posthog-js": "1.356.1",
+        "qrcode": "1.5.4",
+        "re-resizable": "6.11.2",
+        "react": "catalog:",
+        "react-beautiful-dnd": "^13.1.0",
+        "react-blurhash": "^0.3.0",
+        "react-dom": "catalog:",
+        "react-focus-lock": "^2.5.1",
+        "react-string-replace": "^2.0.0",
+        "react-transition-group": "^4.4.1",
+        "rfc4648": "^1.4.0",
+        "sanitize-filename": "^1.6.3",
+        "sanitize-html": "2.17.1",
+        "tar-js": "^0.3.0",
+        "ua-parser-js": "1.0.40",
+        "uuid": "^13.0.0",
+        "what-input": "^5.2.10"
+    },
+    "devDependencies": {
+        "@babel/core": "^7.12.10",
+        "@babel/eslint-parser": "^7.12.10",
+        "@babel/eslint-plugin": "^7.12.10",
+        "@babel/plugin-proposal-decorators": "^7.25.9",
+        "@babel/plugin-proposal-export-default-from": "^7.12.1",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-transform-class-properties": "^7.12.1",
+        "@babel/plugin-transform-class-static-block": "^7.26.0",
+        "@babel/plugin-transform-logical-assignment-operators": "^7.20.7",
+        "@babel/plugin-transform-nullish-coalescing-operator": "^7.12.1",
+        "@babel/plugin-transform-numeric-separator": "^7.12.7",
+        "@babel/plugin-transform-object-rest-spread": "^7.12.1",
+        "@babel/plugin-transform-optional-chaining": "^7.12.7",
+        "@babel/plugin-transform-runtime": "^7.12.10",
+        "@babel/preset-env": "^7.12.11",
+        "@babel/preset-react": "^7.12.10",
+        "@babel/preset-typescript": "^7.12.7",
+        "@casualbot/jest-sonar-reporter": "2.5.0",
+        "@element-hq/element-call-embedded": "0.18.0",
+        "@element-hq/element-web-playwright-common": "catalog:",
+        "@element-hq/element-web-playwright-common-local": "workspace:*",
+        "@fetch-mock/jest": "^0.2.20",
+        "@jest/globals": "^30.2.0",
+        "@peculiar/webcrypto": "^1.4.3",
+        "@playwright/test": "catalog:",
+        "@principalstudio/html-webpack-inject-preload": "^1.2.7",
+        "@sentry/webpack-plugin": "^5.0.0",
+        "@stylistic/eslint-plugin": "^5.0.0",
+        "@svgr/webpack": "^8.0.0",
+        "@testing-library/dom": "^10.4.0",
+        "@testing-library/jest-dom": "^6.4.8",
+        "@testing-library/react": "^16.0.0",
+        "@testing-library/user-event": "^14.5.2",
+        "@types/commonmark": "^0.27.4",
+        "@types/content-type": "^1.1.9",
+        "@types/counterpart": "^0.18.1",
+        "@types/css-tree": "^2.3.8",
+        "@types/diff-match-patch": "^1.0.32",
+        "@types/escape-html": "^1.0.1",
+        "@types/express": "^5.0.0",
+        "@types/file-saver": "^2.0.3",
+        "@types/glob-to-regexp": "^0.4.1",
+        "@types/jest": "30.0.0",
+        "@types/jitsi-meet": "^2.0.2",
+        "@types/jsrsasign": "^10.5.4",
+        "@types/lodash": "^4.14.168",
+        "@types/modernizr": "^3.5.3",
+        "@types/node": "22",
+        "@types/pako": "^2.0.0",
+        "@types/postcss-import": "^14.0.3",
+        "@types/qrcode": "^1.3.5",
+        "@types/react": "catalog:",
+        "@types/react-beautiful-dnd": "^13.0.0",
+        "@types/react-dom": "catalog:",
+        "@types/react-transition-group": "^4.4.0",
+        "@types/sanitize-html": "2.16.0",
+        "@types/sdp-transform": "^2.4.10",
+        "@types/semver": "^7.5.8",
+        "@types/tar-js": "^0.3.5",
+        "@types/ua-parser-js": "^0.7.36",
+        "@typescript-eslint/eslint-plugin": "^8.19.0",
+        "@typescript-eslint/parser": "^8.19.0",
+        "babel-jest": "^30.0.0",
+        "babel-loader": "^10.0.0",
+        "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
+        "blob-polyfill": "^9.0.0",
+        "copy-webpack-plugin": "^14.0.0",
+        "css-loader": "^7.0.0",
+        "css-minimizer-webpack-plugin": "^8.0.0",
+        "dotenv": "^17.0.0",
+        "eslint": "8.57.1",
+        "eslint-config-google": "^0.14.0",
+        "eslint-config-prettier": "^10.0.0",
+        "eslint-plugin-deprecate": "0.9.0",
+        "eslint-plugin-import": "^2.25.4",
+        "eslint-plugin-jest": "^29.0.0",
+        "eslint-plugin-jsx-a11y": "^6.5.1",
+        "eslint-plugin-matrix-org": "^3.0.0",
+        "eslint-plugin-react": "^7.28.0",
+        "eslint-plugin-react-compiler": "^19.0.0-beta-df7b47d-20241124",
+        "eslint-plugin-react-hooks": "^7.0.0",
+        "eslint-plugin-unicorn": "^56.0.0",
+        "express": "^5.0.0",
+        "fake-indexeddb": "^6.0.0",
+        "file-loader": "^6.0.0",
+        "html-webpack-plugin": "^5.5.3",
+        "identity-obj-proxy": "^3.0.0",
+        "jest": "^30.0.0",
+        "jest-canvas-mock": "^2.5.2",
+        "jest-environment-jsdom": "^30.2.0",
+        "jest-fixed-jsdom": "^0.0.11",
+        "jest-mock": "^30.0.0",
+        "jest-raw-loader": "^1.0.1",
+        "jsqr": "^1.4.0",
+        "matrix-web-i18n": "catalog:",
+        "mini-css-extract-plugin": "2.10.0",
+        "modernizr": "^3.12.0",
+        "playwright-core": "catalog:",
+        "postcss": "8.5.6",
+        "postcss-easings": "4.0.0",
+        "postcss-hexrgba": "2.1.0",
+        "postcss-import": "16.1.1",
+        "postcss-loader": "8.2.0",
+        "postcss-mixins": "12.0.0",
+        "postcss-nested": "7.0.2",
+        "postcss-preset-env": "11.1.1",
+        "postcss-scss": "4.0.9",
+        "postcss-simple-vars": "7.0.1",
+        "prettier": "3.8.1",
+        "process": "^0.11.10",
+        "raw-loader": "^4.0.2",
+        "semver": "^7.5.2",
+        "source-map-loader": "^5.0.0",
+        "stylelint": "^17.0.0",
+        "stylelint-config-standard": "^40.0.0",
+        "stylelint-scss": "^7.0.0",
+        "stylelint-value-no-unknown-custom-properties": "^6.0.1",
+        "terser-webpack-plugin": "^5.3.9",
+        "testcontainers": "^11.0.0",
+        "typescript": "catalog:",
+        "util": "^0.12.5",
+        "web-streams-polyfill": "^4.0.0",
+        "webpack": "^5.89.0",
+        "webpack-bundle-analyzer": "^5.0.0",
+        "webpack-cli": "^6.0.0",
+        "webpack-dev-server": "^5.0.0",
+        "webpack-retry-chunk-load-plugin": "^3.1.1",
+        "webpack-version-file-plugin": "^0.5.0",
+        "yaml": "^2.3.3"
+    },
+    "@casualbot/jest-sonar-reporter": {
+        "outputDirectory": "coverage",
+        "outputName": "jest-sonar-report.xml",
+        "relativePaths": true
+    },
+    "engines": {
+        "node": ">=22.18"
+    },
+    "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017",
+    "private": true
+}
@@ -6,22 +6,34 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */

-import { defineConfig, devices } from "@playwright/test";
+import {
+    defineConfig,
+    devices,
+    type Project,
+    type PlaywrightTestOptions,
+    type PlaywrightWorkerOptions,
+} from "@playwright/test";

 import { type WorkerOptions } from "./playwright/services";

 const baseURL = process.env["BASE_URL"] ?? "http://localhost:8080";

-const chromeProject = {
+const chromeProject: Project<PlaywrightTestOptions, WorkerOptions & PlaywrightWorkerOptions>["use"] = {
    ...devices["Desktop Chrome"],
    channel: "chromium",
    permissions: ["clipboard-write", "clipboard-read", "microphone"],
    launchOptions: {
        args: ["--use-fake-ui-for-media-stream", "--use-fake-device-for-media-stream", "--mute-audio"],
    },
+    connectOptions: process.env.PW_TEST_CONNECT_WS_ENDPOINT
+        ? {
+              wsEndpoint: process.env.PW_TEST_CONNECT_WS_ENDPOINT,
+              exposeNetwork: "<loopback>",
+          }
+        : undefined,
 };

-export default defineConfig<WorkerOptions>({
+export default defineConfig<{}, WorkerOptions>({
    projects: [
        {
            name: "Chrome",
@@ -79,7 +91,7 @@ export default defineConfig<WorkerOptions>({
        trace: "on-first-retry",
    },
    webServer: {
-        command: process.env.CI ? "npx serve -p 8080 -L ./webapp" : "yarn start",
+        command: process.env.CI ? "npx serve -p 8080 -L ./webapp" : "pnpm start",
        url: `${baseURL}/config.json`,
        reuseExistingServer: true,
        timeout: (process.env.CI ? 30 : 120) * 1000,
@@ -91,6 +103,7 @@ export default defineConfig<WorkerOptions>({
    retries: process.env.CI ? 2 : 0,
    reporter: process.env.CI ? [["blob"], ["github"]] : [["html", { outputFolder: "playwright/html-report" }]],
    snapshotDir: "playwright/snapshots",
-    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    // When running the browser in docker, set the platform to `linux` as that is the platform where the browser is running
+    snapshotPathTemplate: `{snapshotDir}/{testFilePath}/{arg}-${process.env.PW_TEST_CONNECT_WS_ENDPOINT ? "linux" : "{platform}"}{ext}`,
    forbidOnly: !!process.env.CI,
 });
@@ -0,0 +1,6 @@
+/test-results/
+/html-report/
+/logs/
+# Only commit snapshots from Linux
+/snapshots/**/*.png
+!/snapshots/**/*-linux.png
@@ -29,7 +29,7 @@ test.describe("Landmark navigation tests", () => {

        // Pressing Control+F6 again will focus room search
        await page.keyboard.press("ControlOrMeta+F6");
-        await expect(page.locator(".mx_RoomListSearch_search")).toBeFocused();
+        await expect(page.locator("#room-list-search-button")).toBeFocused();

        // Pressing Control+F6 again will focus the message composer
        await page.keyboard.press("ControlOrMeta+F6");
@@ -44,7 +44,7 @@ test.describe("Landmark navigation tests", () => {
        await expect(page.locator(".mx_HomePage")).toBeFocused();

        await page.keyboard.press("ControlOrMeta+Shift+F6");
-        await expect(page.locator(".mx_RoomListSearch_search")).toBeFocused();
+        await expect(page.locator("#room-list-search-button")).toBeFocused();

        await page.keyboard.press("ControlOrMeta+Shift+F6");
        await expect(page.locator(".mx_SpaceButton_active")).toBeFocused();
@@ -75,7 +75,7 @@ test.describe("Landmark navigation tests", () => {

        // Pressing Control+F6 again will focus room search
        await page.keyboard.press("ControlOrMeta+F6");
-        await expect(page.locator(".mx_RoomListSearch_search")).toBeFocused();
+        await expect(page.locator("#room-list-search-button")).toBeFocused();

        // Pressing Control+F6 again will focus the room tile in the room list
        await page.keyboard.press("ControlOrMeta+F6");
@@ -97,7 +97,7 @@ test.describe("Landmark navigation tests", () => {
        await expect(page.locator(".mx_RoomListItemView_selected")).toBeFocused();

        await page.keyboard.press("ControlOrMeta+Shift+F6");
-        await expect(page.locator(".mx_RoomListSearch_search")).toBeFocused();
+        await expect(page.locator("#room-list-search-button")).toBeFocused();

        await page.keyboard.press("ControlOrMeta+Shift+F6");
        await expect(page.locator(".mx_SpaceButton_active")).toBeFocused();
@@ -131,7 +131,7 @@ test.describe("Landmark navigation tests", () => {

        // Pressing Control+F6 again will focus room search
        await page.keyboard.press("ControlOrMeta+F6");
-        await expect(page.locator(".mx_RoomListSearch_search")).toBeFocused();
+        await expect(page.locator("#room-list-search-button")).toBeFocused();

        // Pressing Control+F6 again will focus the room tile in the room list
        await page.keyboard.press("ControlOrMeta+F6");
@@ -153,7 +153,7 @@ test.describe("Landmark navigation tests", () => {
        await expect(page.locator(".mx_RoomListItemView")).toBeFocused();

        await page.keyboard.press("ControlOrMeta+Shift+F6");
-        await expect(page.locator(".mx_RoomListSearch_search")).toBeFocused();
+        await expect(page.locator("#room-list-search-button")).toBeFocused();

        await page.keyboard.press("ControlOrMeta+Shift+F6");
        await expect(page.locator(".mx_SpaceButton_active")).toBeFocused();
@@ -30,6 +30,7 @@ test("Shows the last known page on reload", async ({ pageWithCredentials: page }
    const app = new ElementAppPage(page);
    await app.client.createRoom({ name: "Test Room" });
    await app.viewRoomByName("Test Room");
+    await expect(page).toHaveURL(/\/#\/room\//);

    // Navigate away
    await page.goto("about:blank");
@@ -23,6 +23,7 @@ const clickButtonReply = async (tile: Locator) => {
 };

 test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
+    test.slow();
    test.use({
        displayName: "Hanako",
    });
@@ -36,7 +37,9 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {

        // Wait until the file is sent
        await expect(page.locator(".mx_RoomView_statusArea_expanded")).not.toBeVisible();
-        await expect(page.locator(".mx_EventTile.mx_EventTile_last .mx_EventTile_receiptSent")).toBeVisible();
+        await expect(page.locator(".mx_EventTile.mx_EventTile_last").getByRole("status")).toHaveAccessibleName(
+            "Your message was sent",
+        );
        // wait for the tile to finish loading
        await expect(
            page
@@ -49,7 +52,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
    /**
     * Take snapshots of mx_EventTile_last on each layout, outputting log for reference/debugging.
     * @param detail The snapshot name. Used for outputting logs too.
-     * @param monospace This changes the font used to render the UI from a default one to Inconsolata. Set to false by default.
+     * @param monospace This changes the font used to render the UI from a default one to Fira Code. Set to false by default.
     */
    const takeSnapshots = async (page: Page, app: ElementAppPage, detail: string, monospace = false) => {
        // Check that the audio player is rendered and its button becomes visible
@@ -65,7 +68,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {

            if (monospace) {
                // Assert that the monospace timer is visible
-                await expect(locator.locator("[role='timer']")).toHaveCSS("font-family", "Inconsolata");
+                await expect(locator.locator("[role='timer']")).toHaveCSS("font-family", '"Fira Code"');
            }
        };

@@ -73,7 +76,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
            // Enable system font and monospace setting
            await app.settings.setValue("useBundledEmojiFont", null, SettingLevel.DEVICE, false);
            await app.settings.setValue("useSystemFont", null, SettingLevel.DEVICE, true);
-            await app.settings.setValue("systemFont", null, SettingLevel.DEVICE, "Inconsolata");
+            await app.settings.setValue("systemFont", null, SettingLevel.DEVICE, "Fira Code");
        }

        // Check the status of the seek bar
@@ -98,35 +101,39 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
                .mx_MessageActionBar {
                    display: none !important;
                }
+                /* Stabilize play button appearance in CI (disabled due to decoding) */
+                button[aria-label="Play"] {
+                    opacity: 1 !important;
+                }
+                button[aria-label="Play"] svg,
+                button[aria-label="Play"] path {
+                    fill: magenta !important;
+                    stroke: magenta !important;
+                }
            `,
            mask: [page.getByTestId("audio-player-seek")],
+            clip: undefined,
        };

        // Take a snapshot of mx_EventTile_last on IRC layout
-        await expect(page.locator(".mx_EventTile_last")).toMatchScreenshot(
-            `${detail.replaceAll(" ", "-")}-irc-layout.png`,
-            screenshotOptions,
-        );
+        screenshotOptions.clip = await page.locator(".mx_EventTile_last").boundingBox();
+        await expect(page).toMatchScreenshot(`${detail.replaceAll(" ", "-")}-irc-layout.png`, screenshotOptions);

        // Take a snapshot on modern/group layout
        await app.settings.setValue("layout", null, SettingLevel.DEVICE, Layout.Group);
        const groupTile = page.locator(".mx_EventTile_last[data-layout='group']");
        await groupTile.locator(".mx_MessageTimestamp").click();
        await checkPlayerVisibility(groupTile);
-        await expect(page.locator(".mx_EventTile_last")).toMatchScreenshot(
-            `${detail.replaceAll(" ", "-")}-group-layout.png`,
-            screenshotOptions,
-        );
+        screenshotOptions.clip = await page.locator(".mx_EventTile_last").boundingBox();
+        await expect(page).toMatchScreenshot(`${detail.replaceAll(" ", "-")}-group-layout.png`, screenshotOptions);

        // Take a snapshot on bubble layout
        await app.settings.setValue("layout", null, SettingLevel.DEVICE, Layout.Bubble);
        const bubbleTile = page.locator(".mx_EventTile_last[data-layout='bubble']");
        await bubbleTile.locator(".mx_MessageTimestamp").click();
        await checkPlayerVisibility(bubbleTile);
-        await expect(page.locator(".mx_EventTile_last")).toMatchScreenshot(
-            `${detail.replaceAll(" ", "-")}-bubble-layout.png`,
-            screenshotOptions,
-        );
+        screenshotOptions.clip = await page.locator(".mx_EventTile_last").boundingBox();
+        await expect(page).toMatchScreenshot(`${detail.replaceAll(" ", "-")}-bubble-layout.png`, screenshotOptions);
    };

    test.beforeEach(async ({ page, app, user }) => {
@@ -238,9 +245,9 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
            await expect(tile.getByRole("region", { name: "Audio player" })).toBeVisible();

            // Assert that replied audio file is rendered as file button inside ReplyChain
-            const button = tile.locator(".mx_ReplyChain_wrapper .mx_MFileBody_info[role='button']");
+            const button = tile.locator(".mx_ReplyChain_wrapper .mx_MFileBody [role='button']");
            // Assert that the file button has file name
-            await expect(button.locator(".mx_MFileBody_info_filename")).toBeVisible();
+            await expect(button.locator("span")).toBeVisible();

            await takeSnapshots(page, app, "Selected EventTile of audio player with a reply");
        },
@@ -300,9 +307,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {

            // Assert that the file button contains the name of the file sent at first
            await expect(
-                replyChain
-                    .locator(".mx_MFileBody_info[role='button']")
-                    .locator(".mx_MFileBody_info_filename", { hasText: "upload-first.ogg" }),
+                replyChain.locator(".mx_MFileBody [role='button']").locator("span", { hasText: "upload-first.ogg" }),
            ).toBeVisible();

            // Take snapshots
@@ -350,9 +355,7 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {

        const composer = thread.locator(".mx_MessageComposer--compact");
        // Assert that the reply preview contains audio ReplyTile the file info button
-        await expect(
-            composer.locator(".mx_ReplyPreview .mx_ReplyTile_audio .mx_MFileBody_info[role='button']"),
-        ).toBeVisible();
+        await expect(composer.locator(".mx_ReplyPreview .mx_ReplyTile .mx_MFileBody [role='button']")).toBeVisible();

        // Select :smile: emoji and send it
        await composer.getByTestId("basicmessagecomposer").fill(":smile:");
@@ -360,6 +363,6 @@ test.describe("Audio player", { tag: ["@no-firefox", "@no-webkit"] }, () => {
        await composer.getByTestId("basicmessagecomposer").press("Enter");

        // Assert that the file name is rendered on the file button
-        await expect(threadTile.locator(".mx_ReplyTile_audio .mx_MFileBody_info[role='button']")).toBeVisible();
+        await expect(threadTile.locator(".mx_ReplyTile .mx_MFileBody [role='button']")).toBeVisible();
    });
 });
@@ -0,0 +1,202 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2022, 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { test, expect } from "../../element-web-test";
+import { SettingLevel } from "../../../src/settings/SettingLevel";
+
+const CtrlOrMeta = process.platform === "darwin" ? "Meta" : "Control";
+
+test.describe("Composer", () => {
+    test.use({
+        displayName: "Janet",
+        botCreateOpts: {
+            displayName: "Bob",
+        },
+    });
+
+    test.use({
+        room: async ({ app, user }, use) => {
+            const roomId = await app.client.createRoom({ name: "Composing Room" });
+            await app.viewRoomByName("Composing Room");
+            await use({ roomId });
+        },
+    });
+
+    test.beforeEach(async ({ room }) => {}); // trigger room fixture
+
+    test.describe("CIDER", () => {
+        test("sends a message when you click send or press Enter", async ({ page }) => {
+            const composer = page.getByRole("textbox", { name: "Send an unencrypted message…" });
+
+            // Type a message
+            await composer.pressSequentially("my message 0");
+            // It has not been sent yet
+            await expect(page.locator(".mx_EventTile_body", { hasText: "my message 0" })).not.toBeVisible();
+
+            // Click send
+            await page.getByRole("button", { name: "Send message" }).click();
+            // It has been sent
+            await expect(
+                page.locator(".mx_EventTile_last .mx_EventTile_body", { hasText: "my message 0" }),
+            ).toBeVisible();
+
+            // Type another and press Enter afterward
+            await composer.pressSequentially("my message 1");
+            await composer.press("Enter");
+            // It was sent
+            await expect(
+                page.locator(".mx_EventTile_last .mx_EventTile_body", { hasText: "my message 1" }),
+            ).toBeVisible();
+        });
+
+        test("can write formatted text", async ({ page }) => {
+            const composer = page.getByRole("textbox", { name: "Send an unencrypted message…" });
+
+            await composer.pressSequentially("my bold");
+            await composer.press(`${CtrlOrMeta}+KeyB`);
+            await composer.pressSequentially(" message");
+            await page.getByRole("button", { name: "Send message" }).click();
+            // Note: both "bold" and "message" are bold, which is probably surprising
+            await expect(page.locator(".mx_EventTile_body strong", { hasText: "bold message" })).toBeVisible();
+        });
+
+        test("should allow user to input emoji via graphical picker", async ({ page, app }) => {
+            await app.getComposer(false).getByRole("button", { name: "Emoji" }).click();
+
+            await page.getByTestId("mx_EmojiPicker").locator(".mx_EmojiPicker_item", { hasText: "😇" }).click();
+
+            await page.locator(".mx_ContextualMenu_background").click(); // Close emoji picker
+            await page.getByRole("textbox", { name: "Send an unencrypted message…" }).press("Enter"); // Send message
+
+            await expect(page.locator(".mx_EventTile_body", { hasText: "😇" })).toBeVisible();
+        });
+
+        test.describe("render emoji picker with larger viewport height", async () => {
+            test.use({ viewport: { width: 1280, height: 720 } });
+            test("render emoji picker", { tag: "@screenshot" }, async ({ page, app }) => {
+                await app.getComposer(false).getByRole("button", { name: "Emoji" }).click();
+                // Mask the background of the screenshot to avoid failing the test just because some
+                // other component have changed its rendering.
+                await expect(page.getByTestId("mx_EmojiPicker")).toMatchScreenshot("emoji-picker.png", {
+                    css: `
+                        .mx_ContextualMenu_background {
+                            background-color: magenta !important;
+                        }
+                    `,
+                });
+            });
+        });
+
+        test.describe("render emoji picker with small viewport height", async () => {
+            test.use({ viewport: { width: 1280, height: 360 } });
+            test("render emoji picker", { tag: "@screenshot" }, async ({ page, app }) => {
+                await app.getComposer(false).getByRole("button", { name: "Emoji" }).click();
+                // Mask the background of the screenshot to avoid failing the test just because some
+                // other component have changed its rendering.
+                await expect(page.getByTestId("mx_EmojiPicker")).toMatchScreenshot("emoji-picker-small.png", {
+                    css: `
+                        .mx_ContextualMenu_background {
+                            background-color: magenta !important;
+                        }
+                    `,
+                });
+            });
+        });
+
+        test("should have focus lock in emoji picker", async ({ page, app }) => {
+            const emojiButton = app.getComposer(false).getByRole("button", { name: "Emoji" });
+
+            // Open emoji picker by clicking the button
+            await emojiButton.click();
+
+            // Wait for emoji picker to be visible
+            const emojiPicker = page.getByTestId("mx_EmojiPicker");
+            await expect(emojiPicker).toBeVisible();
+
+            // Get initial focused element (should be search input)
+            const searchInput = emojiPicker.getByRole("textbox", { name: "Search" });
+            await expect(searchInput).toBeFocused();
+
+            // Try to tab multiple times - focus should stay within emoji picker
+            await page.keyboard.press("Tab");
+            await page.keyboard.press("Tab");
+            await page.keyboard.press("Tab");
+            await page.keyboard.press("Tab");
+            await page.keyboard.press("Tab");
+
+            // Verify we're still within the emoji picker (not back to composer)
+            const focusedElement = await page.evaluate(() => document.activeElement?.closest(".mx_EmojiPicker"));
+            expect(focusedElement).not.toBeNull();
+
+            // Close with Escape key
+            await page.keyboard.press("Escape");
+
+            // Verify emoji picker is closed
+            await expect(emojiPicker).not.toBeVisible();
+
+            // Verify focus returns to emoji button
+            await expect(emojiButton).toBeFocused();
+        });
+
+        test.describe("when Control+Enter is required to send", () => {
+            test.beforeEach(async ({ app }) => {
+                await app.settings.setValue("MessageComposerInput.ctrlEnterToSend", null, SettingLevel.ACCOUNT, true);
+            });
+
+            test("only sends when you press Control+Enter", async ({ page }) => {
+                const composer = page.getByRole("textbox", { name: "Send an unencrypted message…" });
+                // Type a message and press Enter
+                await composer.pressSequentially("my message 3");
+                await composer.press("Enter");
+                // It has not been sent yet
+                await expect(page.locator(".mx_EventTile_body", { hasText: "my message 3" })).not.toBeVisible();
+
+                // Press Control+Enter
+                await composer.press(`${CtrlOrMeta}+Enter`);
+                // It was sent
+                await expect(
+                    page.locator(".mx_EventTile_last .mx_EventTile_body", { hasText: "my message 3" }),
+                ).toBeVisible();
+            });
+        });
+
+        test("can send mention", { tag: "@screenshot" }, async ({ page, bot, app }) => {
+            // Set up a private room so we have another user to mention
+            await app.client.createRoom({
+                is_direct: true,
+                invite: [bot.credentials.userId],
+            });
+            await app.viewRoomByName("Bob");
+
+            const composer = page.getByRole("textbox", { name: "Send an unencrypted message…" });
+            await composer.pressSequentially("@bob");
+
+            // Note that we include the user ID here as the room tile is also an 'option' role
+            // with text 'Bob'
+            await page.getByRole("option", { name: `Bob ${bot.credentials.userId}` }).click();
+            await expect(composer.getByText("Bob")).toBeVisible();
+            await expect(composer).toMatchScreenshot("mention.png");
+            await composer.press("Enter");
+            await expect(page.locator(".mx_EventTile_body", { hasText: "Bob" })).toBeVisible();
+        });
+
+        test("renders emoji autocomplete", { tag: "@screenshot" }, async ({ page }) => {
+            const composer = page.getByRole("textbox", { name: "Send an unencrypted message…" });
+
+            // Type ":+1" to trigger emoji autocomplete
+            await composer.pressSequentially(":+1");
+
+            // Wait for autocomplete to appear
+            const autocomplete = page.locator("#mx_Autocomplete");
+            await expect(autocomplete).toBeVisible();
+
+            // Take a screenshot of the autocomplete
+            await expect(autocomplete).toMatchScreenshot("emoji-autocomplete.png");
+        });
+    });
+});
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");`