Merge remote-tracking branch 'origin/develop' into feature/no-member-events-flood

Author: bxdxnn

.github/CODEOWNERS

@@ -21,9 +21,15 @@
 
 
 /apps/web/src/models/Call.ts                             @element-hq/element-call-reviewers
+/apps/web/test/unit-tests/models/Call-test.ts            @element-hq/element-call-reviewers
+/apps/web/src/stores/CallStore.ts                        @element-hq/element-call-reviewers
+/apps/web/test/unit-tests/stores/CallStore-test.ts       @element-hq/element-call-reviewers
 /apps/web/src/call-types.ts                              @element-hq/element-call-reviewers
 /apps/web/src/components/views/voip                      @element-hq/element-call-reviewers
-/apps/web/playwright/e2e/voip/element-call.spec.ts       @element-hq/element-call-reviewers
+/apps/web/res/css/views/voip                             @element-hq/element-call-reviewers
+/apps/web/playwright/e2e/voip                            @element-hq/element-call-reviewers
+/apps/web/playwright/snapshots/voip                      @element-hq/element-call-reviewers
+/apps/web/test/test-utils/call.ts                        @element-hq/element-call-reviewers
 
 # Ignore translations as those will be updated by GHA for Localazy download
 /apps/web/src/i18n/strings

.github/actions/download-verify-element-tarball/action.yml

@@ -11,7 +11,7 @@ runs:
     using: composite
     steps:
         - name: Download release tarball
-          uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1
+          uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1
           with:
               tag: ${{ inputs.tag }}
               fileName: element-*.tar.gz*

.github/labels.yml

@@ -91,9 +91,6 @@
 - name: "A-Modules"
   description: "Module system related"
   color: "bfd4f2"
-- name: "A-New-Search-Experience"
-  description: "The new search dialog available in Labs"
-  color: "bfd4f2"
 - name: "A-Packaging"
   description: "Packaging, signing, releasing"
   color: "bfd4f2"

.github/renovate.json

@@ -2,25 +2,43 @@
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
     "extends": ["github>matrix-org/renovate-config-element-web"],
     "postUpdateOptions": ["pnpmDedupe"],
+    "stopUpdatingLabel": "X-Blocked",
     "packageRules": [
         {
+            "description": "Group all testcontainers docker digests",
             "groupName": "testcontainers docker digests",
             "groupSlug": "testcontainers-docker",
             "matchDepTypes": ["testcontainers-docker"],
             "matchPackageNames": ["*"]
+        },
+        {
+            "description": "Separate updates to overrides from other groups",
+            "matchManagers": ["npm"],
+            "matchFileNames": ["pnpm-workspace.yaml"],
+            "matchDepTypes": ["pnpm-workspace.overrides"],
+            "groupSlug": null
+        },
+        {
+            "description": "Disable any major updates to overrides as this almost always is wrong",
+            "matchUpdateTypes": ["major"],
+            "matchManagers": ["npm"],
+            "matchFileNames": ["pnpm-workspace.yaml"],
+            "matchDepTypes": ["pnpm-workspace.overrides"],
+            "enabled": false
         }
     ],
     "customManagers": [
         {
+            "description": "Update testcontainers docker digests",
             "customType": "regex",
             "datasourceTemplate": "docker",
             "versioningTemplate": "loose",
-            "description": "Update testcontainers docker digests",
             "managerFilePatterns": ["**/testcontainers/*.ts"],
             "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""],
             "depTypeTemplate": "testcontainers-docker"
         },
         {
+            "description": "Update element-desktop hakDependencies",
             "customType": "jsonata",
             "managerFilePatterns": ["/(^|/)package\\.json$/"],
             "fileFormat": "json",

.github/workflows/build-and-test.yaml

@@ -63,8 +63,8 @@ jobs:
                   repository: element-hq/element-web
                   persist-credentials: false
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   cache: "pnpm"
                   node-version: "lts/*"
@@ -145,8 +145,8 @@ jobs:
                   name: webapp
                   path: apps/web/webapp
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   cache: "pnpm"
                   cache-dependency-path: pnpm-lock.yaml
@@ -206,6 +206,8 @@ jobs:
         needs: prepare_ed
         name: "Desktop Windows"
         uses: ./.github/workflows/build_desktop_windows.yaml
+        # Skip Windows builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
+        if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
         strategy:
             matrix:
                 arch: [x64, ia32, arm64]
@@ -223,10 +225,13 @@ jobs:
                 arch: [amd64, arm64]
                 runAllTests:
                     - ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests') }}
-                # We ship static sqlcipher builds, so delegate testing the system builds to the merge queue
                 exclude:
+                    # We ship static sqlcipher builds, so delegate testing the system builds to the merge queue
                     - runAllTests: false
                       sqlcipher: system
+                    # Additionally skip arm64 system builds on PRs, as the amd64 test is enough for a smoke test and includes the screenshot tests
+                    - runAllTests: false
+                      arch: arm64
         with:
             sqlcipher: ${{ matrix.sqlcipher }}
             arch: ${{ matrix.arch }}
@@ -236,6 +241,9 @@ jobs:
         needs: prepare_ed
         name: "Desktop macOS"
         uses: ./.github/workflows/build_desktop_macos.yaml
+        # Skip macOS builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
+        # and we have a very low limit of concurrent macos runners (5) across the Github org.
+        if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
         with:
             blob_report: true
 
@@ -258,9 +266,9 @@ jobs:
                   persist-credentials: false
                   repository: element-hq/element-web
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
               if: needs.build_ew.outputs.skip == 'false'
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               if: needs.build_ew.outputs.skip == 'false'
               with:
                   cache: "pnpm"

.github/workflows/build.yml

@@ -47,8 +47,8 @@ jobs:
               with:
                   persist-credentials: false
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   # Disable cache on Windows as it is slower than not caching
                   # https://github.com/actions/setup-node/issues/975

.github/workflows/build_desktop_and_deploy.yaml

@@ -289,7 +289,7 @@ jobs:
             id-token: write # This is required for requesting the JWT
         steps:
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
+              uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
               with:
                   role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
                   role-session-name: githubaction-run-${{ github.run_id }}

.github/workflows/build_desktop_linux.yaml

@@ -110,8 +110,8 @@ jobs:
                   path: |
                       apps/desktop/.hak
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   node-version-file: apps/desktop/.node-version
                   cache: "pnpm"
@@ -126,14 +126,14 @@ jobs:
             - name: "Get modified files"
               id: changed_files
               if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-web'
-              uses: tj-actions/changed-files@823fcebdb31bb35fdf2229d9f769b400309430d0 # v46
+              uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47
               with:
                   files: |
                       apps/desktop/dockerbuild/**
 
             # This allows contributors to test changes to the dockerbuild image within a pull request
             - name: Build docker image
-              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+              uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
               if: steps.changed_files.outputs.any_modified == 'true'
               with:
                   file: apps/desktop/dockerbuild/Dockerfile
@@ -154,10 +154,12 @@ jobs:
 
             - name: Fix permissions
               run: |
+                  shopt -s globstar
+
                   # For .hak
                   sudo chown -R $USER:$USER apps/desktop/.hak
-                  # For node_modules pnpm strict security
-                  sudo chmod +x node_modules/7zip-bin/linux/*/7za
+                  # For node_modules
+                  sudo chown -R $USER:$USER **/node_modules
 
             - name: Check native libraries in hak dependencies
               working-directory: apps/desktop

.github/workflows/build_desktop_macos.yaml

@@ -70,7 +70,7 @@ permissions: {} # No permissions required
 jobs:
     build:
         name: Build macOS Universal
-        runs-on: macos-15 # M1
+        runs-on: macos-26 # M1
         environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
         steps:
             - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
@@ -113,8 +113,8 @@ jobs:
             # https://github.com/electron-userland/electron-builder/issues/9511#issuecomment-3774092888
             - run: sudo pip3 install pyobjc-framework-Quartz
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   node-version-file: apps/desktop/.node-version
                   cache: "pnpm"

.github/workflows/build_desktop_prepare.yaml

@@ -58,8 +58,8 @@ jobs:
                   persist-credentials: false
                   repository: element-hq/element-web
 
-            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
-            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   node-version-file: apps/desktop/.node-version
                   cache: "pnpm"
@@ -143,7 +143,7 @@ jobs:
             - name: "[Release] Fetch release"
               id: release
               if: ${{ !inputs.nightly && inputs.version != 'develop' }}
-              uses: cardinalby/git-get-release-action@5172c3a026600b1d459b117738c605fabc9e4e44 # 1.2.5
+              uses: cardinalby/git-get-release-action@2ab178299eecb253f820dcf2cce11f62be1178f7 # 1.2.6
               env:
                   GITHUB_TOKEN: ${{ github.token }}
               with:
@@ -170,7 +170,7 @@ jobs:
               run: |
                   set -e
 
-                  BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
+                  BUNDLE_HASH=$(pnpm exec asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
                   WEBAPP_VERSION=$(./scripts/get-version.ts)
                   WEB_VERSION=${WEBAPP_VERSION:0:12}
                   JS_VERSION=${WEBAPP_VERSION:16:12}