Merge tag 'v3.76.0' into sc

* Fixes for [CVE-2023-37259](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2023-37259) / [GHSA-c9vx-2g7w-rp65](GHSA-c9vx-2g7w-rp65)
* GYU: Update banner ([\matrix-org#11211](matrix-org#11211)). Fixes element-hq/element-web#25530. Contributed by @justjanne.
* Linkify mxc:// URLs as links to your media repo ([\matrix-org#11213](matrix-org#11213)). Fixes element-hq/element-web#6942.
* OIDC: Log in ([\matrix-org#11199](matrix-org#11199)). Fixes element-hq/element-web#25657. Contributed by @kerryarchibald.
* Handle all permitted url schemes in linkify ([\matrix-org#11215](matrix-org#11215)). Fixes element-hq/element-web#4457 and element-hq/element-web#8720.
* Autoapprove Element Call oidc requests ([\matrix-org#11209](matrix-org#11209)). Contributed by @toger5.
* Allow creating knock rooms ([\matrix-org#11182](matrix-org#11182)). Contributed by @charlynguyen.
* feat(faq): remove keyboard shortcuts button ([\matrix-org#9342](matrix-org#9342)). Fixes element-hq/element-web#22625. Contributed by @gefgu.
* Expose and pre-populate thread ID in devtools dialog ([\matrix-org#10953](matrix-org#10953)).
* Hide URL preview if it will be empty ([\matrix-org#9029](matrix-org#9029)).
* Change wording from avatar to profile picture ([\matrix-org#7015](matrix-org#7015)). Fixes element-hq/element-meta#1331. Contributed by @aaronraimist.
* Quick and dirty devtool to explore state history ([\matrix-org#11197](matrix-org#11197)).
* Consider more user inputs when calculating zxcvbn score ([\matrix-org#11180](matrix-org#11180)).
* GYU: Account Notification Settings ([\matrix-org#11008](matrix-org#11008)). Fixes element-hq/element-web#24567. Contributed by @justjanne.
* Compound Typography pass ([\matrix-org#11103](matrix-org#11103)). Fixes element-hq/element-web#25548.
* OIDC: navigate to authorization endpoint ([\matrix-org#11096](matrix-org#11096)). Fixes element-hq/element-web#25574. Contributed by @kerryarchibald.
* Fix missing metaspace notification badges ([\matrix-org#11269](matrix-org#11269)). Fixes element-hq/element-web#25679.
* Make checkboxes less rounded ([\matrix-org#11224](matrix-org#11224)). Contributed by @andybalaam.
* GYU: Fix issues with audible keywords without activated mentions ([\matrix-org#11218](matrix-org#11218)). Contributed by @justjanne.
* PosthogAnalytics unwatch settings on logout ([\matrix-org#11207](matrix-org#11207)). Fixes element-hq/element-web#25703.
* Avoid trying to set room account data for pinned events as guest ([\matrix-org#11216](matrix-org#11216)). Fixes element-hq/element-web#6300.
* GYU: Disable sound for DMs checkbox when DM notifications are disabled ([\matrix-org#11210](matrix-org#11210)). Contributed by @justjanne.
* force to allow calls without video and audio in embedded mode ([\matrix-org#11131](matrix-org#11131)). Contributed by @EnricoSchw.
* Fix room tile text clipping ([\matrix-org#11196](matrix-org#11196)). Fixes element-hq/element-web#25718.
* Handle newlines in user pills ([\matrix-org#11166](matrix-org#11166)). Fixes element-hq/element-web#10994.
* Limit width of user menu in space panel ([\matrix-org#11192](matrix-org#11192)). Fixes element-hq/element-web#22627.
* Add isLocation to ComposerEvent analytics events ([\matrix-org#11187](matrix-org#11187)). Contributed by @andybalaam.
* Fix: hide unsupported login elements ([\matrix-org#11185](matrix-org#11185)). Fixes element-hq/element-web#25711. Contributed by @kerryarchibald.
* Scope smaller font size to user info panel ([\matrix-org#11178](matrix-org#11178)). Fixes element-hq/element-web#25683.
* Apply i18n to strings in the html export ([\matrix-org#11176](matrix-org#11176)).
* Inhibit url previews on MXIDs containing slashes same as those without ([\matrix-org#11160](matrix-org#11160)).
* Make event info size consistent with state events ([\matrix-org#11181](matrix-org#11181)).
* Fix markdown content spacing ([\matrix-org#11177](matrix-org#11177)). Fixes element-hq/element-web#25685.
* Fix font-family definition for emojis ([\matrix-org#11170](matrix-org#11170)). Fixes element-hq/element-web#25686.
* Fix spurious error sending receipt in thread errors ([\matrix-org#11157](matrix-org#11157)).
* Consider the empty push rule actions array equiv to deprecated dont_notify ([\matrix-org#11155](matrix-org#11155)). Fixes element-hq/element-web#25674.
* Only trap escape key for cancel reply if there is a reply ([\matrix-org#11140](matrix-org#11140)). Fixes element-hq/element-web#25640.
* Update linkify to 4.1.1 ([\matrix-org#11132](matrix-org#11132)). Fixes element-hq/element-web#23806.

Author: su-ex

.editorconfig

@@ -24,3 +24,6 @@ trim_trailing_whitespace = true
 
 [*.{yml,yaml}]
 indent_size = 4
+
+[*.tsx.snap]
+trim_trailing_whitespace = false

.github/workflows/static_analysis.yaml

@@ -43,46 +43,6 @@ jobs:
             - name: Typecheck (release mode)
               run: "yarn run lint:types"
 
-    tsc-strict:
-        name: Typescript Strict Error Checker
-        if: github.event_name == 'pull_request'
-        runs-on: ubuntu-latest
-        permissions:
-            pull-requests: read
-            checks: write
-        steps:
-            - uses: actions/checkout@v3
-              with:
-                  ref: ${{ github.event.pull_request.head.sha }}
-
-            - name: Install Deps
-              run: "scripts/ci/layered.sh"
-
-            - name: Get diff lines
-              id: diff
-              uses: Equip-Collaboration/diff-line-numbers@e752977e2cb4207d671bb9e4dad18c07c1b73d52 # v1.1.0
-              with:
-                  include: '["\\.tsx?$"]'
-
-            - name: Detecting files changed
-              id: files
-              uses: futuratrepadeira/changed-files@0239328a3a6268aad16af7c3e4efc78e32d6c0f0 # v4.0.1
-              with:
-                  repo-token: ${{ secrets.GITHUB_TOKEN }}
-                  pattern: '^.*\.tsx?$'
-
-            - uses: t3chguy/typescript-check-action@main
-              with:
-                  repo-token: ${{ secrets.GITHUB_TOKEN }}
-                  use-check: false
-                  check-fail-mode: added
-                  output-behaviour: annotate
-                  ts-extra-args: "--strict --noImplicitAny"
-                  files-changed: ${{ steps.files.outputs.files_updated }}
-                  files-added: ${{ steps.files.outputs.files_created }}
-                  files-deleted: ${{ steps.files.outputs.files_deleted }}
-                  line-numbers: ${{ steps.diff.outputs.lineNumbers }}
-
     i18n_lint:
         name: "i18n Check"
         uses: matrix-org/matrix-react-sdk/.github/workflows/i18n_check.yml@develop

CHANGELOG.md

@@ -1,3 +1,50 @@
+Changes in [3.76.0](https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.76.0) (2023-07-18)
+=====================================================================================================
+
+## 🔒 Security
+ * Fixes for [CVE-2023-37259](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2023-37259) / [GHSA-c9vx-2g7w-rp65](https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65)
+
+## ✨ Features
+ * GYU: Update banner ([\#11211](https://github.com/matrix-org/matrix-react-sdk/pull/11211)). Fixes vector-im/element-web#25530. Contributed by @justjanne.
+ * Linkify mxc:// URLs as links to your media repo ([\#11213](https://github.com/matrix-org/matrix-react-sdk/pull/11213)). Fixes vector-im/element-web#6942.
+ * OIDC: Log in ([\#11199](https://github.com/matrix-org/matrix-react-sdk/pull/11199)). Fixes vector-im/element-web#25657. Contributed by @kerryarchibald.
+ * Handle all permitted url schemes in linkify ([\#11215](https://github.com/matrix-org/matrix-react-sdk/pull/11215)). Fixes vector-im/element-web#4457 and vector-im/element-web#8720.
+ * Autoapprove Element Call oidc requests ([\#11209](https://github.com/matrix-org/matrix-react-sdk/pull/11209)). Contributed by @toger5.
+ * Allow creating knock rooms ([\#11182](https://github.com/matrix-org/matrix-react-sdk/pull/11182)). Contributed by @charlynguyen.
+ * feat(faq): remove keyboard shortcuts button ([\#9342](https://github.com/matrix-org/matrix-react-sdk/pull/9342)). Fixes vector-im/element-web#22625. Contributed by @gefgu.
+ * Expose and pre-populate thread ID in devtools dialog ([\#10953](https://github.com/matrix-org/matrix-react-sdk/pull/10953)).
+ * Hide URL preview if it will be empty ([\#9029](https://github.com/matrix-org/matrix-react-sdk/pull/9029)).
+ * Change wording from avatar to profile picture ([\#7015](https://github.com/matrix-org/matrix-react-sdk/pull/7015)). Fixes vector-im/element-meta#1331. Contributed by @aaronraimist.
+ * Quick and dirty devtool to explore state history ([\#11197](https://github.com/matrix-org/matrix-react-sdk/pull/11197)).
+ * Consider more user inputs when calculating zxcvbn score ([\#11180](https://github.com/matrix-org/matrix-react-sdk/pull/11180)).
+ * GYU: Account Notification Settings ([\#11008](https://github.com/matrix-org/matrix-react-sdk/pull/11008)). Fixes vector-im/element-web#24567. Contributed by @justjanne.
+ * Compound Typography pass ([\#11103](https://github.com/matrix-org/matrix-react-sdk/pull/11103)). Fixes vector-im/element-web#25548.
+ * OIDC: navigate to authorization endpoint ([\#11096](https://github.com/matrix-org/matrix-react-sdk/pull/11096)). Fixes vector-im/element-web#25574. Contributed by @kerryarchibald.
+
+## 🐛 Bug Fixes
+ * Fix missing metaspace notification badges ([\#11269](https://github.com/matrix-org/matrix-react-sdk/pull/11269)). Fixes vector-im/element-web#25679.
+ * Make checkboxes less rounded ([\#11224](https://github.com/matrix-org/matrix-react-sdk/pull/11224)). Contributed by @andybalaam.
+ * GYU: Fix issues with audible keywords without activated mentions ([\#11218](https://github.com/matrix-org/matrix-react-sdk/pull/11218)). Contributed by @justjanne.
+ * PosthogAnalytics unwatch settings on logout ([\#11207](https://github.com/matrix-org/matrix-react-sdk/pull/11207)). Fixes vector-im/element-web#25703.
+ * Avoid trying to set room account data for pinned events as guest ([\#11216](https://github.com/matrix-org/matrix-react-sdk/pull/11216)). Fixes vector-im/element-web#6300.
+ * GYU: Disable sound for DMs checkbox when DM notifications are disabled ([\#11210](https://github.com/matrix-org/matrix-react-sdk/pull/11210)). Contributed by @justjanne.
+ * force to allow calls without video and audio in embedded mode ([\#11131](https://github.com/matrix-org/matrix-react-sdk/pull/11131)). Contributed by @EnricoSchw.
+ * Fix room tile text clipping ([\#11196](https://github.com/matrix-org/matrix-react-sdk/pull/11196)). Fixes vector-im/element-web#25718.
+ * Handle newlines in user pills ([\#11166](https://github.com/matrix-org/matrix-react-sdk/pull/11166)). Fixes vector-im/element-web#10994.
+ * Limit width of user menu in space panel ([\#11192](https://github.com/matrix-org/matrix-react-sdk/pull/11192)). Fixes vector-im/element-web#22627.
+ * Add isLocation to ComposerEvent analytics events ([\#11187](https://github.com/matrix-org/matrix-react-sdk/pull/11187)). Contributed by @andybalaam.
+ * Fix: hide unsupported login elements ([\#11185](https://github.com/matrix-org/matrix-react-sdk/pull/11185)). Fixes vector-im/element-web#25711. Contributed by @kerryarchibald.
+ * Scope smaller font size to user info panel ([\#11178](https://github.com/matrix-org/matrix-react-sdk/pull/11178)). Fixes vector-im/element-web#25683.
+ * Apply i18n to strings in the html export ([\#11176](https://github.com/matrix-org/matrix-react-sdk/pull/11176)).
+ * Inhibit url previews on MXIDs containing slashes same as those without ([\#11160](https://github.com/matrix-org/matrix-react-sdk/pull/11160)).
+ * Make event info size consistent with state events ([\#11181](https://github.com/matrix-org/matrix-react-sdk/pull/11181)).
+ * Fix markdown content spacing ([\#11177](https://github.com/matrix-org/matrix-react-sdk/pull/11177)). Fixes vector-im/element-web#25685.
+ * Fix font-family definition for emojis ([\#11170](https://github.com/matrix-org/matrix-react-sdk/pull/11170)). Fixes vector-im/element-web#25686.
+ * Fix spurious error sending receipt in thread errors ([\#11157](https://github.com/matrix-org/matrix-react-sdk/pull/11157)).
+ * Consider the empty push rule actions array equiv to deprecated dont_notify ([\#11155](https://github.com/matrix-org/matrix-react-sdk/pull/11155)). Fixes vector-im/element-web#25674.
+ * Only trap escape key for cancel reply if there is a reply ([\#11140](https://github.com/matrix-org/matrix-react-sdk/pull/11140)). Fixes vector-im/element-web#25640.
+ * Update linkify to 4.1.1 ([\#11132](https://github.com/matrix-org/matrix-react-sdk/pull/11132)). Fixes vector-im/element-web#23806.
+
 Changes in [3.75.0](https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.75.0) (2023-07-04)
 =====================================================================================================
 

cypress/e2e/crypto/crypto.spec.ts

@@ -116,9 +116,9 @@ const verify = function (this: CryptoTestContext) {
         // this requires creating a DM, so can take a while. Give it a longer timeout.
         cy.findByRole("button", { name: "Verify by emoji", timeout: 30000 }).click();
 
-        cy.wrap(bobsVerificationRequestPromise).then((request: VerificationRequest) => {
+        cy.wrap(bobsVerificationRequestPromise).then(async (request: VerificationRequest) => {
             // the bot user races with the Element user to hit the "verify by emoji" button
-            const verifier = request.beginKeyVerification("m.sas.v1");
+            const verifier = await request.startVerification("m.sas.v1");
             doTwoWaySasVerification(verifier);
         });
         cy.findByRole("button", { name: "They match" }).click();

cypress/e2e/crypto/utils.ts

@@ -28,13 +28,11 @@ export type EmojiMapping = [emoji: string, name: string];
 export function waitForVerificationRequest(cli: MatrixClient): Promise<VerificationRequest> {
     return new Promise<VerificationRequest>((resolve) => {
         const onVerificationRequestEvent = async (request: VerificationRequest) => {
-            // @ts-ignore CryptoEvent is not exported to window.matrixcs; using the string value here
-            cli.off("crypto.verification.request", onVerificationRequestEvent);
             await request.accept();
             resolve(request);
         };
-        // @ts-ignore
-        cli.on("crypto.verification.request", onVerificationRequestEvent);
+        // @ts-ignore CryptoEvent is not exported to window.matrixcs; using the string value here
+        cli.once("crypto.verificationRequestReceived", onVerificationRequestEvent);
     });
 }
 
@@ -59,7 +57,6 @@ export function handleSasVerification(verifier: Verifier): Promise<EmojiMapping[
 
         // @ts-ignore as above, avoiding reference to VerifierEvent
         verifier.on("show_sas", onShowSas);
-        verifier.verify();
     });
 }
 
@@ -134,7 +131,10 @@ export function doTwoWaySasVerification(verifier: Verifier): void {
     cy.wrap(emojiPromise).then((emojis: EmojiMapping[]) => {
         cy.get(".mx_VerificationShowSas_emojiSas_block").then((emojiBlocks) => {
             emojis.forEach((emoji: EmojiMapping, index: number) => {
-                expect(emojiBlocks[index].textContent.toLowerCase()).to.eq(emoji[0] + emoji[1]);
+                // VerificationShowSas munges the case of the emoji descriptions returned by the js-sdk before
+                // displaying them. Once we drop support for legacy crypto, that code can go away, and so can the
+                // case-munging here.
+                expect(emojiBlocks[index].textContent.toLowerCase()).to.eq(emoji[0] + emoji[1].toLowerCase());
             });
         });
     });

cypress/e2e/crypto/verification.spec.ts

@@ -17,7 +17,7 @@ limitations under the License.
 import type { VerificationRequest, Verifier } from "matrix-js-sdk/src/crypto-api/verification";
 import { CypressBot } from "../../support/bot";
 import { HomeserverInstance } from "../../plugins/utils/homeserver";
-import { emitPromise, skipIfRustCrypto } from "../../support/util";
+import { emitPromise } from "../../support/util";
 import { checkDeviceIsCrossSigned, doTwoWaySasVerification, logIntoElement, waitForVerificationRequest } from "./utils";
 import { getToast } from "../../support/toasts";
 
@@ -26,7 +26,6 @@ describe("Device verification", () => {
     let homeserver: HomeserverInstance;
 
     beforeEach(() => {
-        skipIfRustCrypto();
         cy.startHomeserver("default").then((data: HomeserverInstance) => {
             homeserver = data;
 
@@ -37,7 +36,7 @@ describe("Device verification", () => {
             cy.window({ log: false }).should("have.property", "matrixcs");
 
             // Create a new device for alice
-            cy.getBot(homeserver, { bootstrapCrossSigning: true }).then((bot) => {
+            cy.getBot(homeserver, { rustCrypto: true, bootstrapCrossSigning: true }).then((bot) => {
                 aliceBotClient = bot;
             });
         });
@@ -72,9 +71,9 @@ describe("Device verification", () => {
 
         // Handle emoji SAS verification
         cy.get(".mx_InfoDialog").within(() => {
-            cy.get<VerificationRequest>("@verificationRequest").then((request: VerificationRequest) => {
+            cy.get<VerificationRequest>("@verificationRequest").then(async (request: VerificationRequest) => {
                 // the bot chooses to do an emoji verification
-                const verifier = request.beginKeyVerification("m.sas.v1");
+                const verifier = await request.startVerification("m.sas.v1");
 
                 // Handle emoji request and check that emojis are matching
                 doTwoWaySasVerification(verifier);

cypress/e2e/login/login.spec.ts

@@ -47,6 +47,30 @@ describe("Login", () => {
             // wait for the dialog to go away
             cy.get(".mx_ServerPickerDialog").should("not.exist");
 
+            cy.get(".mx_Spinner").should("not.exist");
+            cy.get(".mx_ServerPicker_server").should("have.text", homeserver.baseUrl);
+
+            cy.findByRole("button", { name: "Edit" }).click();
+
+            // select the default server again
+            cy.get(".mx_StyledRadioButton").first().click();
+            cy.findByRole("button", { name: "Continue" }).click();
+            cy.get(".mx_ServerPickerDialog").should("not.exist");
+            cy.get(".mx_Spinner").should("not.exist");
+            // name of default server
+            cy.get(".mx_ServerPicker_server").should("have.text", "server.invalid");
+
+            // switch back to the custom homeserver
+
+            cy.findByRole("button", { name: "Edit" }).click();
+            cy.findByRole("textbox", { name: "Other homeserver" }).type(homeserver.baseUrl);
+            cy.findByRole("button", { name: "Continue" }).click();
+            // wait for the dialog to go away
+            cy.get(".mx_ServerPickerDialog").should("not.exist");
+
+            cy.get(".mx_Spinner").should("not.exist");
+            cy.get(".mx_ServerPicker_server").should("have.text", homeserver.baseUrl);
+
             cy.findByRole("textbox", { name: "Username", timeout: 15000 }).should("be.visible");
             // Disabled because flaky - see https://github.com/vector-im/element-web/issues/24688
             //cy.percySnapshot("Login");

cypress/e2e/right-panel/file-panel.spec.ts

@@ -238,22 +238,6 @@ describe("FilePanel", () => {
                 });
             });
         });
-
-        it("should not add inline padding to a tile when it is selected with right click", () => {
-            // Upload a file
-            uploadFile("cypress/fixtures/1sec.ogg");
-
-            cy.get(".mx_FilePanel .mx_RoomView_MessageList").within(() => {
-                // Wait until the spinner of the audio player vanishes
-                cy.get(".mx_InlineSpinner").should("not.exist");
-
-                // Right click the uploaded file to select the tile
-                cy.get(".mx_EventTile").rightclick();
-
-                // Assert that inline padding is not applied
-                cy.get(".mx_EventTile_selected .mx_EventTile_line").should("have.css", "padding-inline", "0px");
-            });
-        });
     });
 
     describe("download", () => {

cypress/e2e/settings/appearance-user-settings-tab.spec.ts

@@ -122,9 +122,10 @@ describe("Appearance user settings tab", () => {
                 // Click the left position of the slider
                 cy.get("input").realClick({ position: "left" });
 
+                const MIN_FONT_SIZE = 11;
                 // Assert that the smallest font size is selected
-                cy.get("input[value='13']").should("exist");
-                cy.get("output .mx_Slider_selection_label").findByText("13");
+                cy.get(`input[value='${MIN_FONT_SIZE}']`).should("exist");
+                cy.get("output .mx_Slider_selection_label").findByText(MIN_FONT_SIZE);
             });
 
             cy.get(".mx_FontScalingPanel_fontSlider").percySnapshotElement("Font size slider - smallest (13)", {
@@ -135,12 +136,13 @@ describe("Appearance user settings tab", () => {
                 // Click the right position of the slider
                 cy.get("input").realClick({ position: "right" });
 
+                const MAX_FONT_SIZE = 21;
                 // Assert that the largest font size is selected
-                cy.get("input[value='18']").should("exist");
-                cy.get("output .mx_Slider_selection_label").findByText("18");
+                cy.get(`input[value='${MAX_FONT_SIZE}']`).should("exist");
+                cy.get("output .mx_Slider_selection_label").findByText(MAX_FONT_SIZE);
             });
 
-            cy.get(".mx_FontScalingPanel_fontSlider").percySnapshotElement("Font size slider - largest (18)", {
+            cy.get(".mx_FontScalingPanel_fontSlider").percySnapshotElement("Font size slider - largest (21)", {
                 widths: [486],
             });
         });