Merge branch 'master' into develop

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/SSLcom-sandbox.crt

@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgIIaI6ivggL++4wDQYJKoZIhvcNAQELBQAwgZAxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
+CgwPU1NMIENvcnBvcmF0aW9uMUUwQwYDVQQDDDxTU0wuY29tIEVWIFJvb3QgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyIC0gRGV2ZWxvcG1lbnQwHhcNMTgw
+MTE2MTIxNjM2WhcNNDMwMTE1MTIxNjM2WjCBkDELMAkGA1UEBhMCVVMxDjAMBgNV
+BAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9y
+YXRpb24xRTBDBgNVBAMMPFNTTC5jb20gRVYgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1
+dGhvcml0eSBSU0EgUjIgLSBEZXZlbG9wbWVudDCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAK/qcD65JCkueKp0+KXG2kAw8euDHuraLR3lJoUFz4ilGK1M
+t+RjSuY6dHQw8ku7TnW9ejWoSFjCBSDx7tP/fzOwOxmBW6+F1NDuV/IaUtn3G2lk
+CZglVk9z3n1HuWDN10xNiLoo5nzeIlvNAoDbXDGhI4Y6Z0qouAIS607JpJMWHOqZ
+OUiiOuM11gI5Kz9GtVttXCjRmwlkU8WiJVIUuVedQAQt2FChrzNQewGFFi0uIau/
+wFRclx6hd4JRIImC6VMJd9lcitWsqMcM94pD3fX2ozNgWX+MVlmcDYFSN9Sv8tG4
+yCj4ONS8HZGzbxeyQXJhEJSi2FnBi0j6MD/d4DNFj0hCg9wz3fgVLDGCO0pNMO0Y
+oXdrzfoj1/zEv0Ibgh7zKG2JHkPfapn3ExFI5d6xi66u5tPVI8cvLxqrgybRPs7Z
+y1dQA7ew3LyTPAHoGtbTMvewtx1TkTtRxxhRRm0l58owqSVbSYrixFtosNobCERo
+uiknaQqoY1ZDsdKsaqFoZDbntNRYhN3Ea4OPWVqDUU5ZPz9MTIRAi3MIq854yyQo
+BjX9nv+kYa+Esr19pxUW0z7BWFhbXsMVpt0QMVyhwgzXvEreaZHFwHHaGb9d5x5P
+VBDhsigMmtzBk9NlbCsy+uGXWHgZA/DVefueEq0sv38VoU30uYa5Tj0FLm09AgMB
+AAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUI9PCucv3G9fRoTDu
+ZQ4Hw6g4PkIwHQYDVR0OBBYEFCPTwrnL9xvX0aEw7mUOB8OoOD5CMA4GA1UdDwEB
+/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAk43CCrC0Zbvi7YUsSePKi+KzvyQ9
+mjKa5NBU/A5/sLeZS3R+wqCX7l5euYVDsUuNgNVD/QL9jNIonuHBrvKaxkmqxE1r
+IcDEaUdjy2lQ0uqD7UDoS3ctrjGkPpUahrTdr3gaKcQBtUhn9v4Y2OBm6J1hDVwI
+CIKcxIzRv6AUpApOtk+++m5tzDU48t8+GzrVl1hkspSYcumA+zuHllbPDL1ADdo5
+kK/bBQtZrGqzPqKzeqaB1A5Wm0Igwf++7nyzdKNdjxtv907D9vg8EB4Swavuv/Ne
+5/jbpI32pz0NIzzSl5ARAHuFhILsO/cEAlloDoTHzibHqFDIeU9/59HMUsJYMOtD
+Ii0/LmQ6dBE4TeukCCLJwtkFYZ2eBgDjF/LHBB+z/UBs4milRgwx+Pe5UDUEjtGe
+G/XMVnTSKZTy9jMaXJD5EmfP+Cfh8EEgFgjg4AmLUbEo9gXzPxyXSLgd8JGSsjg8
+EV/Ri4Mmmt4XUwlSVvEOezxxDGd17gwbottCIC+rqPHonHkGmKpLMH80Bk0uOOCs
+ui1oVwSifMyIcudgCcOfRLUf/f2j2NW7N7E7Vw/Zqfn+pqp/EG0KCqOM2vfJAc0s
+u3rSrOJZGtB6txgtmTjoadxApWf4U/FCi3uArt6gS5MJqZjuiRNXs/K3SlSAqLGl
+5UiG52ew+VdBHzE=
+-----END CERTIFICATE-----

.github/workflows/build_and_deploy.yaml

@@ -62,7 +62,7 @@ jobs:
         name: Windows ${{ matrix.arch }}
         strategy:
             matrix:
-                arch: [ia32, x64]
+                arch: [ia32, x64, arm64]
         uses: ./.github/workflows/build_windows.yaml
         secrets: inherit
         with:
@@ -92,7 +92,6 @@ jobs:
         uses: ./.github/workflows/build_linux.yaml
         with:
             arch: ${{ matrix.arch }}
-            config: ${{ needs.prepare.outputs.config }}
             sqlcipher: ${{ matrix.sqlcipher }}
             version: ${{ needs.prepare.outputs.nightly-version }}
 
@@ -112,6 +111,8 @@ jobs:
 
             - name: Prepare artifacts for deployment
               run: |
+                  set -x
+
                   # Windows
                   for arch in x64 ia32 arm64
                   do
@@ -145,6 +146,8 @@ jobs:
             - name: "[Nightly] Strip version from installer file"
               if: needs.prepare.outputs.nightly-version != ''
               run: |
+                  set -x
+
                   # Windows
                   for arch in x64 ia32 arm64
                   do
@@ -161,6 +164,8 @@ jobs:
             - name: "[Release] Prepare release latest symlink"
               if: needs.prepare.outputs.nightly-version == ''
               run: |
+                  set -x
+
                   # Windows
                   for arch in x64 ia32 arm64
                   do
@@ -197,18 +202,12 @@ jobs:
                   name: packages.element.io
                   path: packages.element.io
 
-            # Workaround for https://www.cloudflarestatus.com/incidents/t5nrjmpxc1cj
-            - uses: unfor19/install-aws-cli-action@e8b481e524a99f37fbd39fdc1dcb3341ab091367 # v1
-              if: needs.prepare.outputs.deploy == 'true'
-              with:
-                  version: 2.22.35
-                  verbose: false
-                  arch: amd64
-
+            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
             - name: Deploy artifacts
               if: needs.prepare.outputs.deploy == 'true'
               run: |
-                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto
+                  set -x
+                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto --checksum-algorithm CRC32
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
                   AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
@@ -227,6 +226,8 @@ jobs:
               id: deb
               if: needs.linux.result == 'success'
               run: |
+                  set -x
+
                   for arch in amd64 arm64
                   do
                       echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
@@ -286,6 +287,8 @@ jobs:
 
             - name: Copy files to S3
               run: |
+                  set -x
+
                   PREFIX="${VERSION%.*}"
                   for file in win-*/*.msi; do
                       filename=$(basename "$file")

.github/workflows/build_and_test.yaml

@@ -22,7 +22,7 @@ jobs:
         uses: ./.github/workflows/build_windows.yaml
         strategy:
             matrix:
-                arch: [x64, ia32]
+                arch: [x64, ia32, arm64]
         with:
             arch: ${{ matrix.arch }}
 
@@ -35,7 +35,6 @@ jobs:
                 sqlcipher: [system, static]
                 arch: [amd64, arm64]
         with:
-            config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
             sqlcipher: ${{ matrix.sqlcipher }}
             arch: ${{ matrix.arch }}
 
@@ -50,6 +49,7 @@ jobs:
             - linux
             - windows
         strategy:
+            fail-fast: false
             matrix:
                 include:
                     - name: macOS Universal
@@ -97,7 +97,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: package.json
+                  node-version-file: .node-version
                   cache: "yarn"
 
             - name: Install Deps
@@ -121,12 +121,6 @@ jobs:
                   # We need sudo on Linux as it is installed in /opt/
                   RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
 
-            - name: Workaround macOS GHA permission issues
-              if: runner.os == 'macOS'
-              run: |
-                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
-                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/opt/off/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
-
             - name: Run tests
               uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
               timeout-minutes: 5

.github/workflows/build_linux.yaml

@@ -8,10 +8,6 @@ on:
                 type: string
                 required: true
                 description: "The architecture to build for, one of 'amd64' | 'arm64'"
-            config:
-                type: string
-                required: true
-                description: "The config directory to use"
             version:
                 type: string
                 required: false
@@ -25,16 +21,12 @@ env:
     MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
 permissions: {} # No permissions required
 jobs:
-    # We build the hak files on native infrastructure as matrix-seshat fails to cross-compile properly
-    # https://github.com/matrix-org/seshat/issues/135
-    hak:
+    build:
+        # We build on native infrastructure as matrix-seshat fails to cross-compile properly
+        # https://github.com/matrix-org/seshat/issues/135
         runs-on: ${{ inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
         env:
             HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
-        outputs:
-            cache-key: ${{ steps.cache-key.outputs.key }}
-            arch: ${{ steps.config.outputs.arch }}
-            build-args: ${{ steps.config.outputs.build-args }}
         steps:
             - name: Resolve docker image tag for push
               if: github.event_name == 'push'
@@ -70,47 +62,39 @@ jobs:
               with:
                   name: webapp
 
-            - name: Calculate cache key
-              id: cache-key
-              run: |
-                  echo "key=$CACHE_KEY" >> $GITHUB_OUTPUT
-              env:
-                  CACHE_KEY: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
-
             - name: Cache .hak
               id: cache
               uses: actions/cache@v4
               with:
-                  key: ${{ steps.cache-key.outputs.key }}
+                  key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
                   path: |
                       ./.hak
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: package.json
+                  node-version-file: .node-version
                   cache: "yarn"
               env:
                   # Workaround for https://github.com/actions/setup-node/issues/317
                   FORCE_COLOR: 0
 
-            # Does not need branch matching as only analyses this layer
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
             - name: "Get modified files"
               id: changed_files
               if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request'
-              uses: tj-actions/changed-files@d6e91a2266cdb9d62096cebf1e8546899c6aa18f # v45
+              uses: tj-actions/changed-files@dcc7a0cba800f454d79fff4b993e8c3555bcc0a8 # v45
               with:
                   files: |
                       dockerbuild/**
 
             # This allows contributors to test changes to the dockerbuild image within a pull request
             - name: Build docker image
-              uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6
+              uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
               if: steps.changed_files.outputs.any_modified == 'true'
               with:
-                  context: dockerbuild
+                  file: dockerbuild/Dockerfile
                   load: true
                   platforms: linux/${{ inputs.arch }}
                   tags: ${{ env.HAK_DOCKER_IMAGE }}
@@ -124,7 +108,10 @@ jobs:
                     $HAK_DOCKER_IMAGE \
                     yarn build:native
 
-            - name: Check native libraries
+            - name: Fix permissions on .hak
+              run: sudo chown -R $USER:$USER .hak
+
+            - name: Check native libraries in hak dependencies
               run: |
                   shopt -s globstar
 
@@ -132,50 +119,25 @@ jobs:
                       ./scripts/glibc-check.sh $filename
                   done
 
-    build:
-        needs: hak
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@v4
-
-            - uses: actions/download-artifact@v4
-              with:
-                  name: webapp
-
-            - name: Load .hak
-              id: cache
-              uses: actions/cache/restore@v4
-              with:
-                  key: ${{ needs.hak.outputs.cache-key }}
-                  fail-on-cache-miss: true
-                  path: |
-                      ./.hak
-
-            - uses: actions/setup-node@v4
-              with:
-                  node-version-file: package.json
-                  cache: "yarn"
-              env:
-                  # Workaround for https://github.com/actions/setup-node/issues/317
-                  FORCE_COLOR: 0
-
-            # Does not need branch matching as only analyses this layer
-            - name: Install Deps
-              run: "yarn install --frozen-lockfile"
-
-            - name: "[Nightly] Resolve version"
-              if: inputs.version != ''
-              run: |
-                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
-
             - name: Generate debian files and arguments
               run: |
                   if [ -f changelog.Debian ]; then
                       echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
                   fi
 
+            # Workaround for https://github.com/electron-userland/electron-builder/issues/6116
+            - name: Install fpm
+              if: inputs.arch == 'arm64'
+              run: |
+                  sudo apt-get install ruby-dev build-essential
+                  sudo gem install fpm
+                  echo "USE_SYSTEM_FPM=true" >> $GITHUB_ENV
+
             - name: Build App
-              run: yarn build --publish never -l ${{ needs.hak.outputs.build-args }}
+              run: yarn build --publish never -l ${{ steps.config.outputs.build-args }}
+              env:
+                  # Only set for Nightly builds
+                  ED_NIGHTLY: ${{ inputs.version }}
 
             - name: Check native libraries
               run: |
@@ -203,7 +165,7 @@ jobs:
 
                   ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
               env:
-                  ARCH: ${{ needs.hak.outputs.arch }}
+                  ARCH: ${{ steps.config.outputs.arch }}
 
             # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
             - name: Upload Artifacts
@@ -214,3 +176,10 @@ jobs:
                       dist
                       !dist/*-unpacked/**
                   retention-days: 1
+
+            - name: Assert all required files are present
+              run: |
+                  test -f ./dist/element-desktop*$ARCH.deb
+                  test -f ./dist/element-desktop*.tar.gz
+              env:
+                  ARCH: ${{ inputs.arch }}

.github/workflows/build_macos.yaml

@@ -58,28 +58,23 @@ jobs:
             # M1 macos-14 comes without Python preinstalled
             - uses: actions/setup-python@v5
               with:
-                  python-version: "3.12"
+                  python-version: "3.13"
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: package.json
+                  node-version-file: .node-version
                   cache: "yarn"
 
-            # Does not need branch matching as only analyses this layer
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
+            # Python 3.12 drops distutils which keytar relies on
+            - name: Install setuptools
+              run: pip3 install setuptools
+
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
-              run: |
-                  # Python 3.12 drops distutils which keytar relies on
-                  pip3 install setuptools
-                  yarn build:native:universal
-
-            - name: "[Nightly] Resolve version"
-              if: inputs.version != ''
-              run: |
-                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
+              run: yarn build:native:universal
 
             # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
             - name: "[Signed] Build App"
@@ -92,6 +87,8 @@ jobs:
                   APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                   CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
                   CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
+                  # Only set for Nightly builds
+                  ED_NIGHTLY: ${{ inputs.version }}
 
             - name: Check app was signed & notarised successfully
               if: inputs.sign != ''
@@ -143,3 +140,8 @@ jobs:
                       dist
                       !dist/mac-universal/**
                   retention-days: 1
+
+            - name: Assert all required files are present
+              run: |
+                  test -f ./dist/Element*.dmg
+                  test -f ./dist/Element*-mac.zip

.github/workflows/build_prepare.yaml

@@ -34,12 +34,9 @@ on:
             packages-dir:
                 description: "The directory non-deb packages for this run should live in within packages.element.io"
                 value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
-            # These are just simple pass-throughs of the input to simplify reuse of complex inline conditions
-            config:
-                description: "The relative path to the config file for this run"
-                value: ${{ inputs.config }}
+            # This is just a simple pass-through of the input to simplify reuse of complex inline conditions
             deploy:
-                description: "The relative path to the config file for this run"
+                description: "Whether the build should be deployed to production"
                 value: ${{ inputs.deploy }}
 permissions: {}
 jobs:
@@ -56,7 +53,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: package.json
+                  node-version-file: .node-version
                   cache: "yarn"
 
             - name: Install Deps
@@ -93,8 +90,6 @@ jobs:
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
                   AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
-                  # Workaround for https://www.cloudflarestatus.com/incidents/t5nrjmpxc1cj
-                  AWS_REQUEST_CHECKSUM_CALCULATION: when_required
                   R2_BUCKET: ${{ vars.R2_BUCKET }}
                   R2_URL: ${{ vars.CF_R2_S3_API }}
 

.github/workflows/build_windows.yaml

@@ -3,6 +3,8 @@
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
 
 # Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
+# We always sign using eSignerCKA to ensure it keeps working, but aside from release & nightlies we use demo credentials
+# which do not yield trusted signatures.
 defaults:
     run:
         shell: powershell
@@ -54,7 +56,8 @@ jobs:
                         "ia32": {
                           "target": "i686-pc-windows-msvc",
                           "build-args": "--ia32",
-                          "arch": "x86"
+                          "arch": "x86",
+                          "extra_config": "{\"user_notice\": {\"title\": \"Your desktop support ends soon\",\"description\": \"Support for 32-bit Windows installations will end soon, this impacts you. Transition to the web or mobile app for continued access.\"}}"
                         }
                       }
 
@@ -72,11 +75,6 @@ jobs:
                   path: |
                       ./.hak
 
-            - name: Set up build tools
-              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
-              with:
-                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
-
             # ActiveTCL package on choco is from 2015,
             # this one is newer but includes more than we need
             - name: Choco install tclsh
@@ -102,13 +100,38 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: package.json
+                  node-version-file: .node-version
                   cache: "yarn"
 
-            # Does not need branch matching as only analyses this layer
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
+            - name: Insert config snippet
+              if: steps.config.outputs.extra_config != ''
+              shell: bash
+              run: |
+                  mkdir config-edit
+                  yarn asar extract webapp.asar config-edit
+                  cd config-edit
+                  mv config.json old-config.json
+                  echo '${{ steps.config.outputs.extra_config }}' | jq -s '.[0] * .[1]' old-config.json - > config.json
+                  rm old-config.json
+                  cd ..
+                  rm webapp.asar
+                  yarn asar pack config-edit/ webapp.asar
+
+            - name: Set up sqlcipher macros
+              if: steps.cache.outputs.cache-hit != 'true' && contains(inputs.arch, 'arm')
+              shell: pwsh
+              run: |
+                  echo "NCC=${{ github.workspace }}\scripts\cl.bat" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+            - name: Set up build tools
+              if: steps.cache.outputs.cache-hit != 'true'
+              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+              with:
+                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
+
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
               run: |
@@ -116,7 +139,6 @@ jobs:
                   yarn build:native --target ${{ steps.config.outputs.target }}
 
             - name: Install and configure eSigner CKA
-              if: inputs.sign
               run: |
                   Set-StrictMode -Version 'Latest'
 
@@ -134,8 +156,13 @@ jobs:
                   $LogConfig[0] = '<log4net threshold="OFF">'
                   $LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
 
-                  # Configure
-                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config -mode product -user "${{ secrets.ESIGNER_USER_NAME }}" -pass "${{ secrets.ESIGNER_USER_PASSWORD }}" -totp "${{ secrets.ESIGNER_USER_TOTP }}" -key "${{ env.MASTER_KEY_FILE }}" -r
+                  # Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
+                      -mode ${{ vars.ESIGNER_MODE || 'sandbox' }} `
+                      -user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
+                      -pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
+                      -totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
+                      -key "${{ env.MASTER_KEY_FILE }}" -r
                   ${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
                   ${{ env.INSTALL_DIR }}/eSignerCKATool.exe load
 
@@ -154,24 +181,25 @@ jobs:
                   INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
                   MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
 
-            - name: "[Nightly] Resolve version"
-              if: inputs.version != ''
-              shell: bash
-              run: |
-                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
-
-            # XXX: For whatever reason if we use `yarn build ...` it freezes, but splitting it into parts it is fine
-            - run: yarn run build:ts
-            - run: yarn run build:res
-
             - name: Build App
+              run: yarn build --publish never -w ${{ steps.config.outputs.build-args }}
+              env:
+                  # Only set for Nightly builds
+                  ED_NIGHTLY: ${{ inputs.version }}
+
+            - name: Trust eSigner sandbox cert
+              if: inputs.sign == ''
               run: |
-                  yarn electron-builder --publish never -w ${{ steps.config.outputs.build-args }}
+                  Set-StrictMode -Version 'Latest'
+                  Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root -FilePath .github/SSLcom-sandbox.crt
 
             - name: Check app was signed successfully
-              if: inputs.sign != ''
               run: |
-                  . "$env:SIGNTOOL_PATH" verify /pa (get-item ./dist/squirrel-windows*/*.exe)
+                  Set-StrictMode -Version 'Latest'
+                  Get-ChildItem `
+                      -Recurse dist `
+                      -Include *.exe, *.msi `
+                  | ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
 
             - name: Upload Artifacts
               uses: actions/upload-artifact@v4
@@ -180,3 +208,11 @@ jobs:
                   path: |
                       dist
                   retention-days: 1
+
+            - name: Assert all required files are present
+              run: |
+                  Test-Path './dist/win-*unpacked/Element*.exe'
+                  Test-Path './dist/squirrel-windows*/Element Setup*.exe'
+                  Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
+                  Test-Path './dist/squirrel-windows*/RELEASES'
+                  Test-Path './dist/Element*.msi'

.github/workflows/dockerbuild.yaml

@@ -22,17 +22,17 @@ jobs:
             - uses: actions/checkout@v4
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3
+              uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3
+              uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
               with:
                   install: true
 
             - name: Build test image
-              uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6
+              uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
               with:
-                  context: dockerbuild
+                  file: dockerbuild/Dockerfile
                   push: false
                   load: true
                   tags: element-desktop-dockerbuild
@@ -42,7 +42,7 @@ jobs:
               run: docker run -v $PWD:/project element-desktop-dockerbuild yarn install
 
             - name: Log in to the Container registry
-              uses: docker/login-action@327cd5a69de6c009b9ce71bce8395f28e651bf99
+              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
               if: github.event_name != 'pull_request'
               with:
                   registry: ${{ env.REGISTRY }}
@@ -52,7 +52,7 @@ jobs:
             - name: Extract metadata for Docker
               id: meta
               if: github.event_name != 'pull_request'
-              uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5
+              uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
               with:
                   images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
                   tags: |
@@ -61,9 +61,9 @@ jobs:
 
             - name: Build and push Docker image
               if: github.event_name != 'pull_request'
-              uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6
+              uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
               with:
-                  context: dockerbuild
+                  file: dockerbuild/Dockerfile
                   push: true
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release.yml

@@ -19,6 +19,7 @@ jobs:
             contents: write
             issues: write
             pull-requests: read
+            id-token: write
         secrets:
             ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
             GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

.github/workflows/triage-stale.yml

@@ -0,0 +1,22 @@
+name: Close stale PRs
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "30 1 * * *"
+permissions: {}
+jobs:
+    close:
+        runs-on: ubuntu-24.04
+        permissions:
+            actions: write
+            issues: write
+            pull-requests: write
+        steps:
+            - uses: actions/stale@v9
+              with:
+                  operations-per-run: 250
+                  days-before-issue-stale: -1
+                  days-before-issue-close: -1
+                  days-before-pr-stale: 180
+                  days-before-pr-close: 0
+                  close-pr-message: "This PR has been automatically closed because it has been stale for 180 days. If you wish to continue working on this PR, please ping a maintainer to reopen it."

.node-version

@@ -0,0 +1 @@
+v22.14.0

CHANGELOG.md

@@ -1,3 +1,114 @@
+Changes in [1.11.96](https://github.com/element-hq/element-desktop/releases/tag/v1.11.96) (2025-03-25)
+======================================================================================================
+## ✨ Features
+
+* RoomListViewModel: Track the index of the active room in the list ([#29519](https://github.com/element-hq/element-web/pull/29519)). Contributed by @MidhunSureshR.
+* New room list: add empty state ([#29512](https://github.com/element-hq/element-web/pull/29512)). Contributed by @florianduros.
+* Implement `MessagePreviewViewModel` ([#29514](https://github.com/element-hq/element-web/pull/29514)). Contributed by @MidhunSureshR.
+* RoomListViewModel: Add functionality to toggle message preview setting ([#29511](https://github.com/element-hq/element-web/pull/29511)). Contributed by @MidhunSureshR.
+* New room list: add more options menu on room list item ([#29445](https://github.com/element-hq/element-web/pull/29445)). Contributed by @florianduros.
+* RoomListViewModel: Provide a way to resort the room list and track the active sort method ([#29499](https://github.com/element-hq/element-web/pull/29499)). Contributed by @MidhunSureshR.
+* Change \*All rooms\* meta space name to \*All Chats\* ([#29498](https://github.com/element-hq/element-web/pull/29498)). Contributed by @florianduros.
+* Add setting to hide avatars of rooms you have been invited to. ([#29497](https://github.com/element-hq/element-web/pull/29497)). Contributed by @Half-Shot.
+* Room List Store: Save preferred sorting algorithm and use that on app launch ([#29493](https://github.com/element-hq/element-web/pull/29493)). Contributed by @MidhunSureshR.
+* Add key storage toggle to Encryption settings ([#29310](https://github.com/element-hq/element-web/pull/29310)). Contributed by @dbkr.
+* New room list: add primary filters ([#29481](https://github.com/element-hq/element-web/pull/29481)). Contributed by @florianduros.
+* Implement MSC4142: Remove unintentional intentional mentions in replies ([#28209](https://github.com/element-hq/element-web/pull/28209)). Contributed by @tulir.
+* White background for 'They do not match' button ([#29470](https://github.com/element-hq/element-web/pull/29470)). Contributed by @andybalaam.
+* RoomListViewModel: Support secondary filters in the view model ([#29465](https://github.com/element-hq/element-web/pull/29465)). Contributed by @MidhunSureshR.
+* RoomListViewModel: Support primary filters in the view model ([#29454](https://github.com/element-hq/element-web/pull/29454)). Contributed by @MidhunSureshR.
+* Room List Store: Implement secondary filters ([#29458](https://github.com/element-hq/element-web/pull/29458)). Contributed by @MidhunSureshR.
+* Room List Store: Implement rest of the primary filters ([#29444](https://github.com/element-hq/element-web/pull/29444)). Contributed by @MidhunSureshR.
+* Room List Store: Support filters by implementing just the favourite filter ([#29433](https://github.com/element-hq/element-web/pull/29433)). Contributed by @MidhunSureshR.
+* Move toggle switch for integration manager for a11y ([#29436](https://github.com/element-hq/element-web/pull/29436)). Contributed by @Half-Shot.
+* New room list: basic flat list ([#29368](https://github.com/element-hq/element-web/pull/29368)). Contributed by @florianduros.
+* Improve rageshake upload experience by providing useful error information ([#29378](https://github.com/element-hq/element-web/pull/29378)). Contributed by @Half-Shot.
+* Add more functionality to the room list vm ([#29402](https://github.com/element-hq/element-web/pull/29402)). Contributed by @MidhunSureshR.
+
+## 🐛 Bug Fixes
+
+* Fix `--no-update` command line flag ([#2210](https://github.com/element-hq/element-desktop/pull/2210)). Contributed by @t3chguy.
+* New room list: fix compose menu action in space  ([#29500](https://github.com/element-hq/element-web/pull/29500)). Contributed by @florianduros.
+* Change ToggleHiddenEventVisibility \& GoToHome KeyBindingActions ([#29374](https://github.com/element-hq/element-web/pull/29374)). Contributed by @gy-mate.
+* Fix Docker Healthcheck ([#29471](https://github.com/element-hq/element-web/pull/29471)). Contributed by @benbz.
+* Room List Store: Fetch rooms after space store is ready + attach store to window ([#29453](https://github.com/element-hq/element-web/pull/29453)). Contributed by @MidhunSureshR.
+* Room List Store: Fix bug where left rooms appear in room list ([#29452](https://github.com/element-hq/element-web/pull/29452)). Contributed by @MidhunSureshR.
+* Add space to the bottom of the room summary actions below leave room ([#29270](https://github.com/element-hq/element-web/pull/29270)). Contributed by @langleyd.
+* Show error screens in group calls ([#29254](https://github.com/element-hq/element-web/pull/29254)). Contributed by @robintown.
+* Prevent user from accidentally triggering multiple identity resets ([#29388](https://github.com/element-hq/element-web/pull/29388)). Contributed by @uhoreg.
+* Remove buggy tooltip on room intro \& homepage ([#29406](https://github.com/element-hq/element-web/pull/29406)). Contributed by @t3chguy.
+
+
+
+Changes in [1.11.95](https://github.com/element-hq/element-desktop/releases/tag/v1.11.95) (2025-03-11)
+======================================================================================================
+## ✨ Features
+
+* Switch to shiftkey/node-keytar as it has NAPI 10 updates ([#2172](https://github.com/element-hq/element-desktop/pull/2172)). Contributed by @t3chguy.
+* Add support for Windows arm64 ([#624](https://github.com/element-hq/element-desktop/pull/624)). Contributed by @t3chguy.
+* Room List Store: Filter rooms by active space ([#29399](https://github.com/element-hq/element-web/pull/29399)). Contributed by @MidhunSureshR.
+* Room List - Update the room list store on actions from the dispatcher ([#29397](https://github.com/element-hq/element-web/pull/29397)). Contributed by @MidhunSureshR.
+* Room List  - Implement a minimal view model ([#29357](https://github.com/element-hq/element-web/pull/29357)). Contributed by @MidhunSureshR.
+* New room list: add space menu in room header ([#29352](https://github.com/element-hq/element-web/pull/29352)). Contributed by @florianduros.
+* Room List - Store sorted rooms in skip list ([#29345](https://github.com/element-hq/element-web/pull/29345)). Contributed by @MidhunSureshR.
+* New room list: add dial to search section ([#29359](https://github.com/element-hq/element-web/pull/29359)). Contributed by @florianduros.
+* New room list: add compose menu for spaces in header ([#29347](https://github.com/element-hq/element-web/pull/29347)). Contributed by @florianduros.
+* Use EditInPlace control for Identity Server picker to improve a11y ([#29280](https://github.com/element-hq/element-web/pull/29280)). Contributed by @Half-Shot.
+* First step to add header to new room list ([#29320](https://github.com/element-hq/element-web/pull/29320)). Contributed by @florianduros.
+* Add Windows 64-bit arm link and remove 32-bit link on compatibility page ([#29312](https://github.com/element-hq/element-web/pull/29312)). Contributed by @t3chguy.
+* Honour the backup disable flag from Element X ([#29290](https://github.com/element-hq/element-web/pull/29290)). Contributed by @dbkr.
+
+## 🐛 Bug Fixes
+
+* Fix edited code block width ([#29394](https://github.com/element-hq/element-web/pull/29394)). Contributed by @florianduros.
+* new room list: keep space name in one line in header ([#29369](https://github.com/element-hq/element-web/pull/29369)). Contributed by @florianduros.
+* Dismiss "Key storage out of sync" toast when secrets received ([#29348](https://github.com/element-hq/element-web/pull/29348)). Contributed by @richvdh.
+* Minor CSS fixes for the new room list ([#29334](https://github.com/element-hq/element-web/pull/29334)). Contributed by @florianduros.
+* Add padding to room header icon ([#29271](https://github.com/element-hq/element-web/pull/29271)). Contributed by @langleyd.
+
+
+
+Changes in [1.11.94](https://github.com/element-hq/element-desktop/releases/tag/v1.11.94) (2025-02-27)
+======================================================================================================
+* No changes
+
+## 🐛 Bug Fixes
+
+* [Backport staging] fix: /tmp/element-web-config may already exist preventing the container from booting up ([#29377](https://github.com/element-hq/element-web/pull/29377)). Contributed by @RiotRobot.
+
+
+
+Changes in [1.11.93](https://github.com/element-hq/element-desktop/releases/tag/v1.11.93) (2025-02-25)
+======================================================================================================
+## ✨ Features
+
+* [backport] Dynamically load Element Web modules in Docker entrypoint ([#29358](https://github.com/element-hq/element-web/pull/29358)). Contributed by @t3chguy.
+* ChangeRecoveryKey: error handling ([#29262](https://github.com/element-hq/element-web/pull/29262)). Contributed by @richvdh.
+* Dehydration: enable dehydrated device on "Set up recovery" ([#29265](https://github.com/element-hq/element-web/pull/29265)). Contributed by @richvdh.
+* Render reason for invite rejection. ([#29257](https://github.com/element-hq/element-web/pull/29257)). Contributed by @Half-Shot.
+* New room list: add search section ([#29251](https://github.com/element-hq/element-web/pull/29251)). Contributed by @florianduros.
+* New room list: hide favourites and people meta spaces ([#29241](https://github.com/element-hq/element-web/pull/29241)). Contributed by @florianduros.
+* New Room List: Create new labs flag ([#29239](https://github.com/element-hq/element-web/pull/29239)). Contributed by @MidhunSureshR.
+* Stop URl preview from covering message box ([#29215](https://github.com/element-hq/element-web/pull/29215)). Contributed by @edent.
+* Rename "security key" into "recovery key" ([#29217](https://github.com/element-hq/element-web/pull/29217)). Contributed by @florianduros.
+* Add new verification section to user profile ([#29200](https://github.com/element-hq/element-web/pull/29200)). Contributed by @MidhunSureshR.
+* Initial support for runtime modules ([#29104](https://github.com/element-hq/element-web/pull/29104)). Contributed by @t3chguy.
+* Add `Forgot recovery key?` button to encryption tab ([#29202](https://github.com/element-hq/element-web/pull/29202)). Contributed by @florianduros.
+* Add KeyIcon to key storage out of sync toast ([#29201](https://github.com/element-hq/element-web/pull/29201)). Contributed by @florianduros.
+* Improve rendering of empty topics in the timeline  ([#29152](https://github.com/element-hq/element-web/pull/29152)). Contributed by @Half-Shot.
+
+## 🐛 Bug Fixes
+
+* Fix font scaling in member list ([#29285](https://github.com/element-hq/element-web/pull/29285)). Contributed by @florianduros.
+* Grow member list search field when resizing the right panel ([#29267](https://github.com/element-hq/element-web/pull/29267)). Contributed by @langleyd.
+* Don't reload roomview on offline connectivity check ([#29243](https://github.com/element-hq/element-web/pull/29243)). Contributed by @dbkr.
+* Respect user's 12/24 hour preference consistently ([#29237](https://github.com/element-hq/element-web/pull/29237)). Contributed by @t3chguy.
+* Restore the accessibility role on call views ([#29225](https://github.com/element-hq/element-web/pull/29225)). Contributed by @robintown.
+* Revert `GoToHome` keyboard shortcut to `Ctrl`–`Shift`–`H` on macOS ([#28577](https://github.com/element-hq/element-web/pull/28577)). Contributed by @gy-mate.
+* Encryption tab: display correct encryption panel when user cancels the reset identity flow ([#29216](https://github.com/element-hq/element-web/pull/29216)). Contributed by @florianduros.
+
+
+
 Changes in [1.11.92](https://github.com/element-hq/element-desktop/releases/tag/v1.11.92) (2025-02-11)
 ======================================================================================================
 ## ✨ Features

dockerbuild/Dockerfile

@@ -2,7 +2,7 @@
 # with broader compatibility, down to Debian bullseye & Ubuntu focal.
 FROM rust:bullseye
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN curl --proto "=https" -L https://yarnpkg.com/latest.tar.gz | tar xvz && mv yarn-* /yarn && ln -s /yarn/bin/yarn /usr/bin/yarn
 RUN apt-get -qq update && apt-get -y -qq dist-upgrade && \
@@ -16,13 +16,12 @@ RUN apt-get -qq update && apt-get -y -qq dist-upgrade && \
   apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
 RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip
 
-ENV DEBUG_COLORS true
-ENV FORCE_COLOR true
+ENV DEBUG_COLORS=true
+ENV FORCE_COLOR=true
 
 WORKDIR /project
 
-ENV NODE_VERSION 20.18.2
 ARG TARGETOS
 ARG TARGETARCH
-COPY setup.sh /setup.sh
+COPY .node-version dockerbuild/setup.sh /
 RUN /setup.sh

dockerbuild/setup.sh

@@ -3,5 +3,6 @@
 set -x
 declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
 ARCH="${archMap["$TARGETARCH"]}"
-curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+NODE_VERSION=$(cat /.node-version)
+curl --proto "=https" -L "https://nodejs.org/dist/$NODE_VERSION/node-$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
   unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md

docs/windows-requirements.md

@@ -12,6 +12,13 @@ If you want to build native modules, make sure that the following tools are inst
 - [Strawberry Perl](https://strawberryperl.com/)
 - [Rustup](https://rustup.rs/)
 - [NASM](https://www.nasm.us/)
+
+You can install the above tools using [Chocolatey](https://chocolatey.org/install):
+
+```cmd
+choco install --no-progress -y git nodejs-lts yarn python StrawberryPerl rustup.install nasm magicsplat-tcl-tk
+```
+
 - [Build Tools for Visual Studio 2019](https://visualstudio.microsoft.com/downloads/#build-tools-for-visual-studio-2019) with the following configuration:
     - On the Workloads tab:
         - Desktop & Mobile -> C++ build tools

electron-builder.ts

@@ -174,6 +174,9 @@ const config: Omit<Writable<Configuration>, "electronFuses"> & {
             schemes: ["io.element.desktop", "element"],
         },
     ],
+    nativeRebuilder: "sequential",
+    nodeGypRebuild: false,
+    npmRebuild: true,
 };
 
 /**

hak/keytar/build.ts

@@ -1,26 +0,0 @@
-/*
-Copyright 2024 New Vector Ltd.
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-import path from "node:path";
-
-import type HakEnv from "../../scripts/hak/hakEnv.js";
-import type { DependencyInfo } from "../../scripts/hak/dep.js";
-
-export default async function buildKeytar(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    const env = hakEnv.makeGypEnv();
-
-    console.log("Running yarn with env", env);
-    await hakEnv.spawn(
-        path.join(moduleInfo.nodeModuleBinDir, "node-gyp"),
-        ["rebuild", "--arch", hakEnv.getTargetArch()],
-        {
-            cwd: moduleInfo.moduleBuildDir,
-            env,
-        },
-    );
-}

hak/keytar/check.ts

@@ -1,15 +0,0 @@
-/*
-Copyright 2024 New Vector Ltd.
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-import type HakEnv from "../../scripts/hak/hakEnv.js";
-import type { DependencyInfo } from "../../scripts/hak/dep.js";
-
-export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    // node-gyp uses python for reasons beyond comprehension
-    await hakEnv.checkTools([["python", "--version"]]);
-}

hak/keytar/hak.json

@@ -1,10 +0,0 @@
-{
-    "scripts": {
-        "check": "check.ts",
-        "build": "build.ts"
-    },
-    "copy": "build/Release/keytar.node",
-    "dependencies": {
-        "libsecret": "0.20.3"
-    }
-}

knip.ts

@@ -5,11 +5,7 @@ export default {
     project: ["**/*.{js,ts}"],
     ignoreDependencies: [
         // Brought in via hak scripts
-        "keytar",
         "matrix-seshat",
-        // Needed by `electron-builder`
-        "electron-builder-squirrel-windows",
-        "@types/yargs",
         // Required for `action-validator`
         "@action-validator/*",
         // Used for git pre-commit hooks

package.json

@@ -3,8 +3,8 @@
     "productName": "Element",
     "main": "lib/electron-main.js",
     "exports": "./lib/electron-main.js",
-    "version": "1.11.92",
-    "description": "A feature-rich client for Matrix.org",
+    "version": "1.11.96",
+    "description": "Element: the future of secure communication",
     "author": "Element",
     "homepage": "https://element.io",
     "repository": {
@@ -44,7 +44,7 @@
         "build": "yarn run build:ts && yarn run build:res && electron-builder",
         "build:ts": "tsc",
         "build:res": "tsx scripts/copy-res.ts",
-        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild dockerbuild",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild -f dockerbuild/Dockerfile .",
         "docker:build:native": "scripts/in-docker.sh yarn run hak",
         "docker:build": "scripts/in-docker.sh yarn run build",
         "docker:install": "scripts/in-docker.sh yarn install",
@@ -53,15 +53,17 @@
         "test": "playwright test",
         "test:open": "yarn test --ui",
         "test:screenshots:build": "docker build playwright -t element-desktop-playwright --platform linux/amd64",
-        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright"
+        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright",
+        "postinstall": "electron-builder install-app-deps"
     },
     "dependencies": {
-        "@sentry/electron": "^5.0.0",
+        "@sentry/electron": "^6.0.0",
+        "@standardnotes/electron-clear-data": "^1.0.5",
         "auto-launch": "^5.0.5",
         "counterpart": "^0.18.6",
-        "electron-clear-data": "^1.0.5",
         "electron-store": "^10.0.0",
         "electron-window-state": "^5.0.3",
+        "keytar-forked": "7.10.0",
         "minimist": "^1.2.6",
         "png-to-ico": "^2.1.1",
         "uuid": "^11.0.0"
@@ -72,24 +74,22 @@
         "@babel/core": "^7.18.10",
         "@babel/preset-env": "^7.18.10",
         "@babel/preset-typescript": "^7.18.6",
-        "@electron/asar": "3.2.18",
-        "@mapbox/node-pre-gyp": "^1.0.11",
-        "@playwright/test": "1.49.1",
-        "@stylistic/eslint-plugin": "^2.9.0",
+        "@electron/asar": "3.3.1",
+        "@playwright/test": "1.51.1",
+        "@stylistic/eslint-plugin": "^3.0.0",
         "@types/auto-launch": "^5.0.1",
         "@types/counterpart": "^0.18.1",
         "@types/minimist": "^1.2.1",
-        "@types/node": "18.19.71",
+        "@types/node": "18.19.80",
         "@types/pacote": "^11.1.1",
-        "@types/yargs": "^17.0.32",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
         "@typescript-eslint/parser": "^8.0.0",
-        "app-builder-lib": "^26.0.1",
+        "app-builder-lib": "26.0.11",
         "chokidar": "^4.0.0",
         "detect-libc": "^2.0.0",
-        "electron": "34.0.1",
-        "electron-builder": "^26.0.1",
-        "electron-builder-squirrel-windows": "^26.0.1",
+        "electron": "35.0.3",
+        "electron-builder": "26.0.11",
+        "electron-builder-squirrel-windows": "26.0.11",
         "electron-devtools-installer": "^4.0.0",
         "eslint": "^8.26.0",
         "eslint-config-google": "^0.14.0",
@@ -110,14 +110,13 @@
         "rimraf": "^6.0.0",
         "tar": "^7.0.0",
         "tsx": "^4.19.2",
-        "typescript": "5.7.3"
+        "typescript": "5.8.2"
     },
     "hakDependencies": {
-        "matrix-seshat": "^4.0.0",
-        "keytar": "^7.9.0"
+        "matrix-seshat": "^4.0.1"
     },
     "resolutions": {
-        "@types/node": "18.19.71",
+        "@types/node": "18.19.80",
         "config-file-ts": "0.2.8-rc1"
     }
 }

playwright/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/playwright:v1.49.1-jammy
+FROM mcr.microsoft.com/playwright:v1.51.1-jammy
 
 WORKDIR /work/element-desktop
 

playwright/e2e/launch/launch.spec.ts

@@ -55,4 +55,16 @@ test.describe("App launch", () => {
             }),
         ).resolves.not.toBeNull();
     });
+
+    test.describe("--no-update", () => {
+        test.use({
+            extraArgs: ["--no-update"],
+        });
+
+        // XXX: this test works fine locally but in CI the app start races with the test plumbing up the stdout/stderr pipes
+        // which means the logs are missed, disabling for now.
+        test.skip("should respect option", async ({ page, stdout }) => {
+            expect(stdout.data.toString()).toContain("Auto update disabled via command line flag");
+        });
+    });
 });

playwright/element-desktop-test.ts

@@ -11,12 +11,37 @@ import fs from "node:fs/promises";
 import path, { dirname } from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
+import { PassThrough } from "node:stream";
+
+/**
+ * A PassThrough stream that captures all data written to it.
+ */
+class CapturedPassThrough extends PassThrough {
+    private _chunks = [];
+
+    public constructor() {
+        super();
+        super.on("data", this.onData);
+    }
+
+    private onData = (chunk): void => {
+        this._chunks.push(chunk);
+    };
+
+    public get data(): Buffer {
+        return Buffer.concat(this._chunks);
+    }
+}
 
 interface Fixtures {
     app: ElectronApplication;
     tmpDir: string;
     extraEnv: Record<string, string>;
     extraArgs: string[];
+
+    // Utilities to capture stdout and stderr for tests to make assertions against
+    stdout: CapturedPassThrough;
+    stderr: CapturedPassThrough;
 }
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -24,6 +49,16 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 export const test = base.extend<Fixtures>({
     extraEnv: {},
     extraArgs: [],
+
+    // eslint-disable-next-line no-empty-pattern
+    stdout: async ({}, use) => {
+        await use(new CapturedPassThrough());
+    },
+    // eslint-disable-next-line no-empty-pattern
+    stderr: async ({}, use) => {
+        await use(new CapturedPassThrough());
+    },
+
     // eslint-disable-next-line no-empty-pattern
     tmpDir: async ({}, use) => {
         const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "element-desktop-tests-"));
@@ -31,7 +66,7 @@ export const test = base.extend<Fixtures>({
         await use(tmpDir);
         await fs.rm(tmpDir, { recursive: true });
     },
-    app: async ({ tmpDir, extraEnv, extraArgs }, use) => {
+    app: async ({ tmpDir, extraEnv, extraArgs, stdout, stderr }, use) => {
         const args = ["--profile-dir", tmpDir];
 
         const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
@@ -49,8 +84,8 @@ export const test = base.extend<Fixtures>({
             args: [...args, ...extraArgs],
         });
 
-        app.process().stdout.pipe(process.stdout);
-        app.process().stderr.pipe(process.stderr);
+        app.process().stdout.pipe(stdout).pipe(process.stdout);
+        app.process().stderr.pipe(stderr).pipe(process.stderr);
 
         await app.firstWindow();
 

scripts/@types/node-pre-gyp.d.ts

@@ -1,11 +0,0 @@
-/*
-Copyright 2022-2024 New Vector Ltd.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-declare module "@mapbox/node-pre-gyp/lib/util/versioning" {
-    // eslint-disable-next-line @typescript-eslint/naming-convention
-    export function get_runtime_abi(runtime: string, version: string): string;
-}

scripts/cl.bat

@@ -0,0 +1,7 @@
+REM Batch file to aid in cross-compiling sqlcipher for Windows ARM64
+REM Full path should be passed to Makefile.msc as NCC env var
+
+setlocal
+call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" %VSCMD_ARG_HOST_ARCH%
+cl.exe %*
+endlocal

scripts/hak/README.md

@@ -67,14 +67,14 @@ Hak is divided into lifecycle stages, in order:
 
 # hak.json
 
-The scripts section contains scripts used for lifecycle stages that need them (fetch, fetchDeps, build).
+The scripts section contains scripts used for lifecycle stages that need them (fetch, build).
 It also contains 'prune' and 'copy' which are globs of files to delete from the output module directory
 and copy over from the module build directory to the output module directory, respectively.
 
 # Shortcomings
 
 Hak doesn't know about dependencies between lifecycle stages, ie. it doesn't know that you need to
-'fetch' and 'fetchDeps' before you can 'build', etc. You get to run each individually, and remember
+'fetch' before you can 'build', etc. You get to run each individually, and remember
 the right order.
 
 There is also a _lot_ of duplication in the command execution: we should abstract away

scripts/hak/check.ts

@@ -10,7 +10,5 @@ import type { DependencyInfo } from "./dep.js";
 import type HakEnv from "./hakEnv.js";
 
 export default async function check(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    if (moduleInfo.scripts.check) {
-        await moduleInfo.scripts.check(hakEnv, moduleInfo);
-    }
+    await moduleInfo.scripts.check?.(hakEnv, moduleInfo);
 }

scripts/hak/copy.ts

@@ -9,7 +9,6 @@ Please see LICENSE files in the repository root for full details.
 import path from "node:path";
 import fsProm from "node:fs/promises";
 import childProcess from "node:child_process";
-import { rimraf } from "rimraf";
 import { glob } from "glob";
 import { mkdirp } from "mkdirp";
 
@@ -17,20 +16,6 @@ import type HakEnv from "./hakEnv.js";
 import type { DependencyInfo } from "./dep.js";
 
 export default async function copy(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    if (moduleInfo.cfg.prune) {
-        console.log("Removing " + moduleInfo.cfg.prune + " from " + moduleInfo.moduleOutDir);
-        // rimraf doesn't have a 'cwd' option: it always uses process.cwd()
-        // (and if you set glob.cwd it just breaks because it can't find the files)
-        const oldCwd = process.cwd();
-        try {
-            await mkdirp(moduleInfo.moduleOutDir);
-            process.chdir(moduleInfo.moduleOutDir);
-            await rimraf(moduleInfo.cfg.prune);
-        } finally {
-            process.chdir(oldCwd);
-        }
-    }
-
     if (moduleInfo.cfg.copy) {
         // If there are multiple moduleBuildDirs, singular moduleBuildDir
         // is the same as moduleBuildDirs[0], so we're just listing the contents

scripts/hak/fetchDeps.ts

@@ -1,19 +0,0 @@
-/*
-Copyright 2024 New Vector Ltd.
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-import { mkdirp } from "mkdirp";
-
-import type { DependencyInfo } from "./dep.js";
-import type HakEnv from "./hakEnv.js";
-
-export default async function fetchDeps(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    await mkdirp(moduleInfo.moduleDotHakDir);
-    if (moduleInfo.scripts.fetchDeps) {
-        await moduleInfo.scripts.fetchDeps(hakEnv, moduleInfo);
-    }
-}

scripts/hak/hakEnv.ts

@@ -8,31 +8,24 @@ Please see LICENSE files in the repository root for full details.
 
 import path from "node:path";
 import os from "node:os";
-import nodePreGypVersioning from "@mapbox/node-pre-gyp/lib/util/versioning";
 import { getElectronVersionFromInstalled } from "app-builder-lib/out/electron/electronVersion.js";
-import childProcess, { SpawnOptions } from "node:child_process";
+import childProcess, { type SpawnOptions } from "node:child_process";
 
-import { Arch, Target, TARGETS, getHost, isHostId, TargetId } from "./target.js";
-
-async function getRuntime(projectRoot: string): Promise<string> {
-    const electronVersion = await getElectronVersionFromInstalled(projectRoot);
-    return electronVersion ? "electron" : "node-webkit";
-}
+import { type Arch, type Target, TARGETS, getHost, isHostId, type TargetId } from "./target.js";
 
 async function getRuntimeVersion(projectRoot: string): Promise<string> {
     const electronVersion = await getElectronVersionFromInstalled(projectRoot);
-    if (electronVersion) {
-        return electronVersion;
-    } else {
-        return process.version.substr(1);
+    if (!electronVersion) {
+        throw new Error("Can't determine Electron version");
     }
+    return electronVersion;
 }
 
 export type Tool = [cmd: string, ...args: string[]];
 
 export default class HakEnv {
     public readonly target: Target;
-    public runtime?: string;
+    public runtime: string = "electron";
     public runtimeVersion?: string;
     public dotHakDir: string;
 
@@ -50,19 +43,9 @@ export default class HakEnv {
     }
 
     public async init(): Promise<void> {
-        this.runtime = await getRuntime(this.projectRoot);
         this.runtimeVersion = await getRuntimeVersion(this.projectRoot);
     }
 
-    public getRuntimeAbi(): string {
-        return nodePreGypVersioning.get_runtime_abi(this.runtime!, this.runtimeVersion!);
-    }
-
-    // {node_abi}-{platform}-{arch}
-    public getNodeTriple(): string {
-        return this.getRuntimeAbi() + "-" + this.target.platform + "-" + this.target.arch;
-    }
-
     public getTargetId(): TargetId {
         return this.target.id;
     }

scripts/hak/index.ts

@@ -15,13 +15,11 @@ import type { DependencyInfo } from "./dep.js";
 import { loadJsonFile } from "../../src/utils.js";
 import packageJson from "../../package.json";
 
-const GENERALCOMMANDS = ["target"];
-
 // These can only be run on specific modules
 const MODULECOMMANDS = ["check", "fetch", "link", "build", "copy", "clean"];
 
 // Shortcuts for multiple commands at once (useful for building universal binaries
-// because you can run the fetch/fetchDeps/build for each arch and then copy/link once)
+// because you can run the fetch/build for each arch and then copy/link once)
 const METACOMMANDS: Record<string, string[]> = {
     fetchandbuild: ["check", "fetch", "build"],
     copyandlink: ["copy", "link"],
@@ -120,13 +118,6 @@ async function main(): Promise<void> {
     if (modules.length === 0) modules = Object.keys(deps);
 
     for (const cmd of cmds) {
-        if (GENERALCOMMANDS.includes(cmd)) {
-            if (cmd === "target") {
-                console.log(hakEnv.getNodeTriple());
-            }
-            return;
-        }
-
         if (!MODULECOMMANDS.includes(cmd)) {
             console.error("Unknown command: " + cmd);
             console.log("Commands I know about:");

scripts/hak/link.ts

@@ -10,8 +10,8 @@ import path from "node:path";
 import os from "node:os";
 import fsProm from "node:fs/promises";
 
-import HakEnv from "./hakEnv.js";
-import { DependencyInfo } from "./dep.js";
+import type HakEnv from "./hakEnv.js";
+import { type DependencyInfo } from "./dep.js";
 
 export default async function link(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
     const yarnrc = path.join(hakEnv.projectRoot, ".yarnrc");

src/@types/global.d.ts

@@ -5,11 +5,11 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */
 
-import { BrowserWindow } from "electron";
-import Store from "electron-store";
-import AutoLaunch from "auto-launch";
+import { type BrowserWindow } from "electron";
 
-import { AppLocalization } from "../language-helper.js";
+import type Store from "electron-store";
+import type AutoLaunch from "auto-launch";
+import { type AppLocalization } from "../language-helper.js";
 
 // global type extensions need to use var for whatever reason
 /* eslint-disable no-var */

src/@types/keytar.d.ts

@@ -1,54 +0,0 @@
-// Based on https://github.com/atom/node-keytar/blob/master/keytar.d.ts because keytar is a hak-dependency and not a normal one
-// Definitions by: Milan Burda <https://github.com/miniak>, Brendan Forster <https://github.com/shiftkey>, Hari Juturu <https://github.com/juturu>
-// Adapted from DefinitelyTyped: https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/keytar/index.d.ts
-
-declare module "keytar" {
-    /**
-     * Get the stored password for the service and account.
-     *
-     * @param service The string service name.
-     * @param account The string account name.
-     *
-     * @returns A promise for the password string.
-     */
-    export function getPassword(service: string, account: string): Promise<string | null>;
-
-    /**
-     * Add the password for the service and account to the keychain.
-     *
-     * @param service The string service name.
-     * @param account The string account name.
-     * @param password The string password.
-     *
-     * @returns A promise for the set password completion.
-     */
-    export function setPassword(service: string, account: string, password: string): Promise<void>;
-
-    /**
-     * Delete the stored password for the service and account.
-     *
-     * @param service The string service name.
-     * @param account The string account name.
-     *
-     * @returns A promise for the deletion status. True on success.
-     */
-    export function deletePassword(service: string, account: string): Promise<boolean>;
-
-    /**
-     * Find a password for the service in the keychain.
-     *
-     * @param service The string service name.
-     *
-     * @returns A promise for the password string.
-     */
-    export function findPassword(service: string): Promise<string | null>;
-
-    /**
-     * Find all accounts and passwords for `service` in the keychain.
-     *
-     * @param service The string service name.
-     *
-     * @returns A promise for the array of found credentials.
-     */
-    export function findCredentials(service: string): Promise<Array<{ account: string; password: string }>>;
-}

src/electron-main.ts

@@ -10,7 +10,7 @@ Please see LICENSE files in the repository root for full details.
 
 // Squirrel on windows starts the app with various flags as hooks to tell us when we've been installed/uninstalled etc.
 import "./squirrelhooks.js";
-import { app, BrowserWindow, Menu, autoUpdater, protocol, dialog, Input, Event, session } from "electron";
+import { app, BrowserWindow, Menu, autoUpdater, protocol, dialog, type Input, type Event, session } from "electron";
 // eslint-disable-next-line n/file-extension-in-import
 import * as Sentry from "@sentry/electron/main";
 import AutoLaunch from "auto-launch";
@@ -22,7 +22,6 @@ import { URL, fileURLToPath } from "node:url";
 import minimist from "minimist";
 
 import "./ipc.js";
-import "./keytar.js";
 import "./seshat.js";
 import "./settings.js";
 import * as tray from "./tray.js";
@@ -437,8 +436,9 @@ app.on("ready", async () => {
         });
     });
 
-    if (argv["no-update"]) {
-        console.log('Auto update disabled via command line flag "--no-update"');
+    // Minimist parses `--no-`-prefixed arguments as booleans with value `false` rather than verbatim.
+    if (argv["update"] === false) {
+        console.log("Auto update disabled via command line flag");
     } else if (global.vectorConfig["update_base_url"]) {
         console.log(`Starting auto update with base URL: ${global.vectorConfig["update_base_url"]}`);
         void updater.start(global.vectorConfig["update_base_url"]);

src/i18n/strings/cy.json

@@ -0,0 +1,63 @@
+{
+    "action": {
+        "cancel": "Diddymu",
+        "close": "Cau",
+        "close_brand": "Cau %(brand)s",
+        "copy": "Copïo",
+        "cut": "Torri",
+        "delete": "Dileu",
+        "edit": "Golygu",
+        "minimise": "Lleihau",
+        "paste": "Gludo",
+        "paste_match_style": "Arddull Gludo a Chyfateb",
+        "quit": "Gadael",
+        "redo": "Ail-wneud",
+        "select_all": "Dewis y Cyfan",
+        "show_hide": "Dangos/Cuddio",
+        "undo": "Dadwneud",
+        "zoom_in": "Chwyddo i Mewn",
+        "zoom_out": "Chwyddo Allan"
+    },
+    "common": {
+        "about": "Ynghylch",
+        "brand_help": "Cymorth %(brand)s",
+        "help": "Cymorth",
+        "preferences": "Dewisiadau"
+    },
+    "confirm_quit": "Ydych chi'n siŵr eich bod am roi'r gorau iddi?",
+    "edit_menu": {
+        "speech": "Lleferydd",
+        "speech_start_speaking": "Cychwyn Llefaru",
+        "speech_stop_speaking": "Peidio Llefaru"
+    },
+    "file_menu": {
+        "label": "Ffeil"
+    },
+    "menu": {
+        "hide": "Cuddio",
+        "hide_others": "Cuddio'r Gweddill",
+        "services": "Gwasanaethau",
+        "unhide": "Datguddio"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "Ychwanegu at y geiriadur",
+        "copy_email": "Copïo cyfeiriad e-bost",
+        "copy_image": "Copïo delwedd",
+        "copy_image_url": "Copïo cyfeiriad delwedd",
+        "copy_link_url": "Copïo cyfeiriad y ddolen",
+        "save_image_as": "Cadw delwedd fel...",
+        "save_image_as_error_description": "Methodd cadw'r ddelwedd",
+        "save_image_as_error_title": "Methodd cadw'r ddelwedd"
+    },
+    "view_menu": {
+        "actual_size": "Maint Gwirioneddol",
+        "toggle_developer_tools": "Toglo Offer Datblygwyr",
+        "toggle_full_screen": "Toglo Sgrin Lawn",
+        "view": "Golwg"
+    },
+    "window_menu": {
+        "bring_all_to_front": "Popeth i'r Blaen",
+        "label": "Ffenestr",
+        "zoom": "Chwyddo"
+    }
+}

src/i18n/strings/hu.json

@@ -2,7 +2,7 @@
     "action": {
         "cancel": "Mégse",
         "close": "Bezárás",
-        "close_brand": "%(brand)s bezárása",
+        "close_brand": "Az %(brand)s bezárása",
         "copy": "Másolás",
         "cut": "Kivágás",
         "delete": "Törlés",
@@ -56,7 +56,7 @@
         "view": "Megtekintés"
     },
     "window_menu": {
-        "bring_all_to_front": "Mindent előtérbe hoz",
+        "bring_all_to_front": "Minden előtérbe hozása",
         "label": "Ablak",
         "zoom": "Nagyítás"
     }

src/i18n/strings/ka.json

@@ -0,0 +1,63 @@
+{
+    "action": {
+        "cancel": "გაუქმება",
+        "close": "დახურვა",
+        "close_brand": "დახურვა %(brand)s",
+        "copy": "კოპირება",
+        "cut": "მოჭრა",
+        "delete": "წაშალეთ",
+        "edit": "რედაქტირება",
+        "minimise": "შეამცირეთ",
+        "paste": "პასტა",
+        "paste_match_style": "ჩასვით და მატჩის სტილი",
+        "quit": "თავი დაანებე",
+        "redo": "რედო",
+        "select_all": "აირჩიეთ ყველა",
+        "show_hide": "ჩვენება/დამალვა",
+        "undo": "გაუქმება",
+        "zoom_in": "გაზარდოთ",
+        "zoom_out": "გაფართოება"
+    },
+    "common": {
+        "about": "შესახებ",
+        "brand_help": "%(brand)sდახმარება",
+        "help": "დახმარება",
+        "preferences": "პრეფერენციები"
+    },
+    "confirm_quit": "დარწმუნებული ხართ, რომ გსურთ დატოვება?",
+    "edit_menu": {
+        "speech": "გამოსვლა",
+        "speech_start_speaking": "დაიწყეთ საუბარი",
+        "speech_stop_speaking": "შეწყვიტე ლაპარ"
+    },
+    "file_menu": {
+        "label": "ფაილი"
+    },
+    "menu": {
+        "hide": "დამალვა",
+        "hide_others": "სხვების დამალვა",
+        "services": "მომსახურება",
+        "unhide": "გამოხატე"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "ლექსიკონში დამატება",
+        "copy_email": "ელ. ფოსტის მისამართის",
+        "copy_image": "სურათის დაკოპირება",
+        "copy_image_url": "გამოსახულების მისამართის კოპირ",
+        "copy_link_url": "ბმულის მისამართის კოპირება",
+        "save_image_as": "შეინახეთ სურათი როგორც...",
+        "save_image_as_error_description": "სურათის შენახვა ვერ შეძლო",
+        "save_image_as_error_title": "სურათის შენახვა ვერ შეძლ"
+    },
+    "view_menu": {
+        "actual_size": "რეალური ზომა",
+        "toggle_developer_tools": "დეველოპერის ინსტრუმენტების",
+        "toggle_full_screen": "სრული ეკრანის გადართვა",
+        "view": "ნახვა"
+    },
+    "window_menu": {
+        "bring_all_to_front": "ყველაფერი წინ წამოიყვანეთ",
+        "label": "ფანჯარა",
+        "zoom": "გაზუსტება"
+    }
+}

src/i18n/strings/lv.json

@@ -0,0 +1,63 @@
+{
+    "action": {
+        "cancel": "Atcelt",
+        "close": "Aizvērt",
+        "close_brand": "Aizvērt %(brand)s",
+        "copy": "Kopēt",
+        "cut": "Izgriezt",
+        "delete": "Dzēst",
+        "edit": "Labot",
+        "minimise": "Samazināt",
+        "paste": "Ielīmēt",
+        "paste_match_style": "Ielīmēt un pielāgot stilu",
+        "quit": "Iziet",
+        "redo": "Atatsaukt",
+        "select_all": "Atzīmēt visu",
+        "show_hide": "Parādīt/paslēpt",
+        "undo": "Atsaukt",
+        "zoom_in": "Tuvināt",
+        "zoom_out": "Tālināt"
+    },
+    "common": {
+        "about": "Par",
+        "brand_help": "%(brand)s palīdzība",
+        "help": "Palīdzība",
+        "preferences": "Iestatījumi"
+    },
+    "confirm_quit": "Vai tiešām iziet?",
+    "edit_menu": {
+        "speech": "Runa",
+        "speech_start_speaking": "Uzsākt runāšanu",
+        "speech_stop_speaking": "Pārtraukt runāšanu"
+    },
+    "file_menu": {
+        "label": "Datne"
+    },
+    "menu": {
+        "hide": "Paslēpt",
+        "hide_others": "Paslēpt citus",
+        "services": "Pakalpojumi",
+        "unhide": "Rādīt"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "Pievienot vārdnīcai",
+        "copy_email": "Ievietot e-pasta adresi starpliktuvē",
+        "copy_image": "Ievietot attēlu starpliktuvē",
+        "copy_image_url": "Ievietot attēla adresi starpliktuvē",
+        "copy_link_url": "Ievietot saites adresi starpliktuvē",
+        "save_image_as": "Saglabāt attēlu kā...",
+        "save_image_as_error_description": "Attēlu neizdevās saglabāt",
+        "save_image_as_error_title": "Neizdevās saglabāt attēlu"
+    },
+    "view_menu": {
+        "actual_size": "Īstais izmērs",
+        "toggle_developer_tools": "Pārslēgt izstrādātāja rīkus",
+        "toggle_full_screen": "Pārslēgt pilnekrānu",
+        "view": "Skats"
+    },
+    "window_menu": {
+        "bring_all_to_front": "Iznest visu priekšplānā",
+        "label": "Logs",
+        "zoom": "Tālummaiņa"
+    }
+}

src/i18n/strings/mg_MG.json

@@ -0,0 +1,63 @@
+{
+    "action": {
+        "cancel": "Hanafoana",
+        "close": "Akatona",
+        "close_brand": "Anakatona%(brand)s",
+        "copy": "Dika Mitovy",
+        "cut": "Tapaina",
+        "delete": "Fafaina",
+        "edit": "Anova",
+        "minimise": "Manamaivana",
+        "paste": "Koba",
+        "paste_match_style": "Mametaka sy Mampifanandrify ny fomba",
+        "quit": "Mialà",
+        "redo": "Averina atao",
+        "select_all": "Isafidy ny rehetra",
+        "show_hide": "Aneho/Anafina",
+        "undo": "Ravao",
+        "zoom_in": "Angedao",
+        "zoom_out": "Hahelezo"
+    },
+    "common": {
+        "about": "Mombamomba",
+        "brand_help": "%(marques)Fanampiana",
+        "help": "Fanampiana",
+        "preferences": "Safidy manokana"
+    },
+    "confirm_quit": "Azo Antoka ve fa tena hiala ianao",
+    "edit_menu": {
+        "speech": "Fitenenana",
+        "speech_start_speaking": "Atomboy ny resaka/Manomboha fitenenena",
+        "speech_stop_speaking": "Atsaharo ny fitenenana"
+    },
+    "file_menu": {
+        "label": "Manapetraka/apetrao"
+    },
+    "menu": {
+        "hide": "Afeno",
+        "hide_others": "Afeno ny hafa",
+        "services": "Tolotra",
+        "unhide": "Asehoy"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "Ampio ao amin'ny rakibolana",
+        "copy_email": "Adikao ny adiresy imailaka",
+        "copy_image": "Andika ny sary",
+        "copy_image_url": "Adikao ny adiresin'ny sary",
+        "copy_link_url": "Adikao ny adiresy rohy",
+        "save_image_as": "Hitahiry ny sary ho",
+        "save_image_as_error_description": "Tsy voatahiry ilay sary",
+        "save_image_as_error_title": "Tsy nahahomby ny fitahirizana an'ilay sary"
+    },
+    "view_menu": {
+        "actual_size": "Habe Ankehitriny",
+        "toggle_developer_tools": "Amadika fitaovana fampandrosoana",
+        "toggle_full_screen": "Hamadika amin'ny efijery feno",
+        "view": "Hijery"
+    },
+    "window_menu": {
+        "bring_all_to_front": "Ataovy aloha ny zava-drehetra",
+        "label": "Varavarankely",
+        "zoom": "Anakaiky fahitana"
+    }
+}

src/i18n/strings/nb_NO.json

@@ -0,0 +1,63 @@
+{
+    "action": {
+        "cancel": "Avbryt",
+        "close": "Lukk",
+        "close_brand": "Avslutt %(brand)s",
+        "copy": "Kopier",
+        "cut": "Klipp",
+        "delete": "Slett",
+        "edit": "Rediger",
+        "minimise": "Minimere",
+        "paste": "Lim inn",
+        "paste_match_style": "Lim inn og match stil",
+        "quit": "Avslutt",
+        "redo": "Gjør om",
+        "select_all": "Velg alle",
+        "show_hide": "Vis/Skjul",
+        "undo": "Angre",
+        "zoom_in": "Zoom inn",
+        "zoom_out": "Zoom ut"
+    },
+    "common": {
+        "about": "Om",
+        "brand_help": "%(brand)s Hjelp",
+        "help": "Hjelp",
+        "preferences": "Brukervalg"
+    },
+    "confirm_quit": "Er du sikker på at du vil slutte?",
+    "edit_menu": {
+        "speech": "Tale",
+        "speech_start_speaking": "Begynn å snakke",
+        "speech_stop_speaking": "Slutt å snakke"
+    },
+    "file_menu": {
+        "label": "Fil"
+    },
+    "menu": {
+        "hide": "Skjul",
+        "hide_others": "Skjul andre",
+        "services": "Tjenester",
+        "unhide": "Slutt å skjule"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "Legg til i ordbok",
+        "copy_email": "Kopier e-postadressen",
+        "copy_image": "Kopier bildet",
+        "copy_image_url": "Kopier bildeadresse",
+        "copy_link_url": "Kopier link adresse",
+        "save_image_as": "Lagre bildet som...",
+        "save_image_as_error_description": "Bildet kunne ikke lagres",
+        "save_image_as_error_title": "Kunne ikke lagre bildet"
+    },
+    "view_menu": {
+        "actual_size": "Faktisk størrelse",
+        "toggle_developer_tools": "Veksle Utvikleralternativer",
+        "toggle_full_screen": "Veksle Fullskjerm",
+        "view": "Vis"
+    },
+    "window_menu": {
+        "bring_all_to_front": "Flytt Alt Frem",
+        "label": "Vindu",
+        "zoom": "Forstørr"
+    }
+}

src/i18n/strings/pt_BR.json

@@ -20,6 +20,7 @@
     },
     "common": {
         "about": "Sobre",
+        "brand_help": "%(brand)s Ajuda",
         "help": "Ajuda",
         "preferences": "Preferências"
     },
@@ -56,6 +57,7 @@
     },
     "window_menu": {
         "bring_all_to_front": "Trazer Todas Para Frente",
-        "label": "Janela"
+        "label": "Janela",
+        "zoom": "Zoom"
     }
 }

src/i18n/strings/tr.json

@@ -0,0 +1,63 @@
+{
+    "action": {
+        "cancel": "İptal",
+        "close": "Kapat",
+        "close_brand": "Kapat %(brand)s",
+        "copy": "Kopyala",
+        "cut": "Kes",
+        "delete": "Sil",
+        "edit": "Düzenle",
+        "minimise": "Küçült",
+        "paste": "Yapıştır",
+        "paste_match_style": "Stili Yapıştır ve Eşleştir",
+        "quit": "Çık",
+        "redo": "Yeniden yap",
+        "select_all": "Tümünü seç",
+        "show_hide": "Göster/Gizle",
+        "undo": "Geri al",
+        "zoom_in": "Yakınlaştır",
+        "zoom_out": "Uzaklaştır"
+    },
+    "common": {
+        "about": "Hakkında",
+        "brand_help": "%(brand)s Yardım",
+        "help": "Yardım",
+        "preferences": "Tercihler"
+    },
+    "confirm_quit": "Çıkmak istediğinizden emin misiniz?",
+    "edit_menu": {
+        "speech": "Konuşma",
+        "speech_start_speaking": "Konuşmaya başla",
+        "speech_stop_speaking": "Konuşmayı durdur"
+    },
+    "file_menu": {
+        "label": "Dosya"
+    },
+    "menu": {
+        "hide": "Gizle",
+        "hide_others": "Diğerlerini gizle",
+        "services": "Hizmetler",
+        "unhide": "Göster"
+    },
+    "right_click_menu": {
+        "add_to_dictionary": "Sözlüğe ekle",
+        "copy_email": "E-posta adresini kopyala",
+        "copy_image": "Resmi kopyala",
+        "copy_image_url": "Görsel adresini kopyala",
+        "copy_link_url": "Bağlantılı adresi kopyala",
+        "save_image_as": "Resmi farklı kaydet...",
+        "save_image_as_error_description": "Görüntü kaydedilemedi",
+        "save_image_as_error_title": "Resim kaydedilemedi"
+    },
+    "view_menu": {
+        "actual_size": "Gerçek boyut",
+        "toggle_developer_tools": "Geliştirici araçları",
+        "toggle_full_screen": "Tam ekran",
+        "view": "Görüntüle"
+    },
+    "window_menu": {
+        "bring_all_to_front": "Hepsini öne getir",
+        "label": "Pencere",
+        "zoom": "Yaklaştır"
+    }
+}

src/ipc.ts

@@ -6,13 +6,13 @@ Please see LICENSE files in the repository root for full details.
 */
 
 import { app, autoUpdater, desktopCapturer, ipcMain, powerSaveBlocker, TouchBar, nativeImage } from "electron";
-import { relaunchApp } from "electron-clear-data";
+import { relaunchApp } from "@standardnotes/electron-clear-data";
+import keytar from "keytar-forked";
 
 import IpcMainEvent = Electron.IpcMainEvent;
 import { recordSSOSession } from "./protocol.js";
 import { randomArray } from "./utils.js";
 import { Settings } from "./settings.js";
-import { keytar } from "./keytar.js";
 import { getDisplayMediaCallback, setDisplayMediaCallback } from "./displayMediaCallback.js";
 
 ipcMain.on("setBadgeCount", function (_ev: IpcMainEvent, count: number): void {
@@ -141,11 +141,11 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
 
         case "getPickleKey":
             try {
-                ret = await keytar?.getPassword("element.io", `${args[0]}|${args[1]}`);
+                ret = await keytar.getPassword("element.io", `${args[0]}|${args[1]}`);
                 // migrate from riot.im (remove once we think there will no longer be
                 // logins from the time of riot.im)
                 if (ret === null) {
-                    ret = await keytar?.getPassword("riot.im", `${args[0]}|${args[1]}`);
+                    ret = await keytar.getPassword("riot.im", `${args[0]}|${args[1]}`);
                 }
             } catch {
                 // if an error is thrown (e.g. keytar can't connect to the keychain),
@@ -161,17 +161,18 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
                 // rather than sending them a pickle key we did not store on their behalf.
                 await keytar!.setPassword("element.io", `${args[0]}|${args[1]}`, pickleKey);
                 ret = pickleKey;
-            } catch {
+            } catch (e) {
+                console.error("Failed to create pickle key", e);
                 ret = null;
             }
             break;
 
         case "destroyPickleKey":
             try {
-                await keytar?.deletePassword("element.io", `${args[0]}|${args[1]}`);
+                await keytar.deletePassword("element.io", `${args[0]}|${args[1]}`);
                 // migrate from riot.im (remove once we think there will no longer be
                 // logins from the time of riot.im)
-                await keytar?.deletePassword("riot.im", `${args[0]}|${args[1]}`);
+                await keytar.deletePassword("riot.im", `${args[0]}|${args[1]}`);
             } catch {}
             break;
         case "getDesktopCapturerSources":

src/keytar.ts

@@ -1,21 +0,0 @@
-/*
-Copyright 2022-2024 New Vector Ltd.
-
-SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
-Please see LICENSE files in the repository root for full details.
-*/
-
-import type * as Keytar from "keytar"; // Hak dependency type
-
-let keytar: typeof Keytar | undefined;
-try {
-    ({ default: keytar } = await import("keytar"));
-} catch (e) {
-    if ((<NodeJS.ErrnoException>e).code === "MODULE_NOT_FOUND") {
-        console.log("Keytar isn't installed; secure key storage is disabled.");
-    } else {
-        console.warn("Keytar unexpected error:", e);
-    }
-}
-
-export { keytar };

src/language-helper.ts

@@ -6,7 +6,7 @@ Please see LICENSE files in the repository root for full details.
 */
 
 import counterpart from "counterpart";
-import { TranslationKey as TKey } from "matrix-web-i18n";
+import { type TranslationKey as TKey } from "matrix-web-i18n";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 

src/seshat.ts

@@ -8,6 +8,7 @@ Please see LICENSE files in the repository root for full details.
 import { app, ipcMain } from "electron";
 import { promises as afs } from "node:fs";
 import path from "node:path";
+import keytar from "keytar-forked";
 
 import type {
     Seshat as SeshatType,
@@ -16,7 +17,6 @@ import type {
 } from "matrix-seshat"; // Hak dependency type
 import IpcMainEvent = Electron.IpcMainEvent;
 import { randomArray } from "./utils.js";
-import { keytar } from "./keytar.js";
 
 let seshatSupported = false;
 let Seshat: typeof SeshatType;

src/vectormenu.ts

@@ -6,7 +6,7 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */
 
-import { app, shell, Menu, MenuItem, MenuItemConstructorOptions } from "electron";
+import { app, shell, Menu, type MenuItem, type MenuItemConstructorOptions } from "electron";
 
 import { _t } from "./language-helper.js";
 

src/webcontents-handler.ts

@@ -13,13 +13,13 @@ import {
     shell,
     dialog,
     ipcMain,
-    NativeImage,
-    WebContents,
-    ContextMenuParams,
-    DownloadItem,
-    MenuItemConstructorOptions,
-    IpcMainEvent,
-    Event,
+    type NativeImage,
+    type WebContents,
+    type ContextMenuParams,
+    type DownloadItem,
+    type MenuItemConstructorOptions,
+    type IpcMainEvent,
+    type Event,
 } from "electron";
 import url from "node:url";
 import fs from "node:fs";