Resolve most existing Dependbot warnings

* Update ghcr.io/element-hq/element-web:develop Docker digest to d184182

* Target the toast 'Join' button specifically in end-to-end tests

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Robin <robin@robin.town>

.github/workflows/test.yaml

@@ -56,8 +56,8 @@ jobs:
         run: pnpm exec playwright install --with-deps
       - name: Run backend components
         run: |
-          docker compose -f playwright-backend-docker-compose.yml -f playwright-backend-docker-compose.override.yml pull
-          docker compose -f playwright-backend-docker-compose.yml -f playwright-backend-docker-compose.override.yml up -d
+          docker compose -f docker-compose-dev.yml -f docker-compose-playwright.yml pull
+          docker compose -f docker-compose-dev.yml -f docker-compose-playwright.yml up -d
           docker ps
       - name: Run Playwright tests
         env:

README.md

@@ -212,7 +212,7 @@ See also:
 
 ### Backend
 
-A docker compose file `dev-backend-docker-compose.yml` is provided to start the
+A docker compose file `docker-compose-dev.yml` is provided to start the
 whole stack of components which is required for a local development environment
 including federation:
 
@@ -239,7 +239,7 @@ the backend components:
 ```sh
 pnpm backend
 # or for podman-compose:
-# podman-compose -f dev-backend-docker-compose.yml up
+# podman-compose -f docker-compose-dev.yml up
 ```
 
 > [!NOTE]

docker-compose-dev.yml

@@ -156,7 +156,7 @@ services:
   nginx:
     #  see backend/dev_tls_setup for how to generate the tls certs
     hostname: synapse.m.localhost
-    image: nginx:latest
+    image: nginx:latest@sha256:4ae259ae64fbedb67918c07d167fdcb0e05855a1615480ca445bea485e7d65ff
     pull_policy: always
     volumes:
       - ./backend/dev_nginx.conf:/etc/nginx/conf.d/default.conf:Z

docker-compose-playwright.yml

@@ -0,0 +1,19 @@
+# This file contains overrides to docker-compose-dev.yml and should
+# only be used in combination with that file.
+services:
+  synapse:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/synapse:latest@sha256:da325af40104051923899e5f5a2f1d537e6e3ccf2f0f38285689ae9bbfdb190a
+    volumes:
+      - ./backend/playwright_homeserver.yaml:/data/cfg/homeserver.yaml:Z
+  synapse-1:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/synapse:latest@sha256:da325af40104051923899e5f5a2f1d537e6e3ccf2f0f38285689ae9bbfdb190a
+    volumes:
+      - ./backend/playwright_homeserver-othersite.yaml:/data/cfg/homeserver.yaml:Z
+  element-web:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/element-web:develop@sha256:d1841828a390d96da2ee64232949db641f11766fb506ec561374819d10533b9a
+  element-web-1:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/element-web:develop@sha256:d1841828a390d96da2ee64232949db641f11766fb506ec561374819d10533b9a

knip.ts

@@ -20,7 +20,12 @@ export default {
     // This is a shell built-in.
     "printf",
   ],
-  ignoreFiles: ["scripts/.pnpmfile.cjs"],
+  ignoreFiles: [
+    "scripts/.pnpmfile.cjs",
+    // Deliberately added prior to any component or business logic
+    // implementation
+    "src/state/ServiceInterruptionsViewModel.ts",
+  ],
   ignoreDependencies: [
     // Used in CSS
     "normalize.css",

package.json

@@ -30,8 +30,8 @@
     "test:storybook": "vitest --project=storybook",
     "test:unit": "vitest --project=unit",
     "test:coverage": "vitest --coverage",
-    "backend": "docker-compose -f dev-backend-docker-compose.yml up",
-    "backend-playwright": "docker-compose -f playwright-backend-docker-compose.yml -f playwright-backend-docker-compose.override.yml up",
+    "backend": "docker-compose -f docker-compose-dev.yml up",
+    "backend-playwright": "docker-compose -f docker-compose-dev.yml -f docker-compose-playwright.yml up",
     "test:playwright": "playwright test",
     "test:playwright:open": "pnpm test:playwright --ui",
     "links:on": "cp scripts/.pnpmfile.cjs .pnpmfile.cjs & pnpm install",

playwright-backend-docker-compose.override.yml

@@ -1,7 +0,0 @@
-services:
-  synapse:
-    volumes:
-      - ./backend/playwright_homeserver.yaml:/data/cfg/homeserver.yaml:Z
-  synapse-1:
-    volumes:
-      - ./backend/playwright_homeserver-othersite.yaml:/data/cfg/homeserver.yaml:Z

playwright-backend-docker-compose.yml

@@ -1,2 +0,0 @@
-include:
-  - dev-backend-docker-compose.yml

playwright/widget/test-helpers.ts

@@ -73,9 +73,6 @@ export class TestHelpers {
     audioOnly: boolean = false,
     isDM: boolean = false,
   ): Promise<void> {
-    // XXX This using the notification toast to join the room.
-    // Not the button in the header
-
     await page.waitForTimeout(3000);
     const label = isDM
       ? audioOnly
@@ -85,7 +82,9 @@ export class TestHelpers {
     await expect(page.getByText(label)).toBeVisible({
       timeout: 10000,
     });
-    await page.getByRole("button", { name: "Join" }).click({
+    // XXX This using the notification toast to join the room.
+    // Not the buttons in the header or timeline
+    await page.getByRole("alert").getByRole("button", { name: "Join" }).click({
       timeout: 5000,
     });
   }

playwright/widget/voice-call-dm.spec.ts

@@ -39,7 +39,10 @@ widgetTest(
     ).toBeVisible();
 
     await expect(whistler.page.getByText("Incoming voice call")).toBeVisible();
-    await whistler.page.getByRole("button", { name: "Join" }).click();
+    await whistler.page
+      .getByRole("alert")
+      .getByRole("button", { name: "Join" })
+      .click();
 
     await expect(
       whistler.page.locator('iframe[title="Element Call"]'),
@@ -129,7 +132,10 @@ widgetTest(
     ).toBeVisible();
 
     await expect(whistler.page.getByText("Incoming video call")).toBeVisible();
-    await whistler.page.getByRole("button", { name: "Join" }).click();
+    await whistler.page
+      .getByRole("alert")
+      .getByRole("button", { name: "Join" })
+      .click();
 
     await expect(
       whistler.page.locator('iframe[title="Element Call"]'),

pnpm-lock.yaml

@@ -10,11 +10,13 @@ overrides:
   tar: ^7.5.11
   minimatch: ^10.2.3
   glob: ^10.5.0
-  qs: ^6.14.1
-  js-yaml: ^4.1.1
+  qs: ^6.15.2
+  js-yaml: ^4.2.0
   esbuild: ^0.28.0
-  undici: ^6.24.0
+  undici: ^6.27.0
   flatted: ^3.4.2
+  ws: ^8.21.0
+  dompurify: ^3.4.11
 
 importers:
 
@@ -127,10 +129,10 @@ importers:
         version: 10.3.1(react@19.2.7)
       '@vector-im/compound-design-tokens':
         specifier: ^10.0.0
-        version: 10.2.2(@types/react@19.2.17)(react@19.2.7)
+        version: 10.2.3(@types/react@19.2.17)(react@19.2.7)
       '@vector-im/compound-web':
         specifier: ^9.3.0
-        version: 9.7.1(@fontsource/inconsolata@5.2.8)(@fontsource/inter@5.2.8)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@vector-im/compound-design-tokens@10.2.2(@types/react@19.2.17)(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 9.8.0(@fontsource/inconsolata@5.2.8)(@fontsource/inter@5.2.8)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@vector-im/compound-design-tokens@10.2.3(@types/react@19.2.17)(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@vitejs/plugin-react':
         specifier: ^6.0.2
         version: 6.0.3(vite@8.1.0(@types/node@24.13.2)(esbuild@0.28.1)(jiti@2.7.0)(sass@1.101.0)(terser@5.46.1)(yaml@2.9.0))
@@ -3413,8 +3415,8 @@ packages:
     peerDependencies:
       react: '>= 16.8.0'
 
-  '@vector-im/compound-design-tokens@10.2.2':
-    resolution: {integrity: sha512-kncYroDEwyvvk4K4E67ExP4RYp9NEineD1tB38KeJwTmOvcrPtGjWyBAyJgOGeRuc7G5edNLkWnAbvk5yZJ+5w==}
+  '@vector-im/compound-design-tokens@10.2.3':
+    resolution: {integrity: sha512-K2xNkjOzYn2Ya0kUqCy7JIYyx9jbkNIWpex2t9m3FUG4wzkNscvaiRJ/a9Wse1aJmwDDARcHU6mUjtHf5os5MA==}
     peerDependencies:
       '@types/react': '*'
       react: ^17 || ^18 || ^19.0.0
@@ -3424,8 +3426,8 @@ packages:
       react:
         optional: true
 
-  '@vector-im/compound-web@9.7.1':
-    resolution: {integrity: sha512-kR2lJTeudadPYPH9eeZLX+iO+5yEUihb3idp2IH4NDvm0/0W1l1Ok3ljoIcf0W74V2piyiNu4jME2Byy4byosg==}
+  '@vector-im/compound-web@9.8.0':
+    resolution: {integrity: sha512-1Xy9eacbp9qD0uhLKb9SoyZ2iM868+M2BOiVX8oGfoZOyJYwihTwWmh2+0K8Kn8pag86t0yqyYplL0NVLY0sUA==}
     peerDependencies:
       '@fontsource/inconsolata': ^5
       '@fontsource/inter': ^5
@@ -4020,8 +4022,8 @@ packages:
     resolution: {integrity: sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==}
     engines: {node: '>= 4'}
 
-  dompurify@3.4.5:
-    resolution: {integrity: sha512-OrwIBKsdNSVEeubdJ1HBv/wNENRM9ytAVCv7YXt//A3vPdVMNuACRqK9mXCGCBW2ln7BT/A4X0jXHo2Gu89miA==}
+  dompurify@3.4.12:
+    resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==}
 
   domutils@2.8.0:
     resolution: {integrity: sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==}
@@ -4643,10 +4645,6 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@4.1.1:
-    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
-    hasBin: true
-
   js-yaml@4.3.0:
     resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
     hasBin: true
@@ -5423,8 +5421,8 @@ packages:
     engines: {node: '>=10.13.0'}
     hasBin: true
 
-  qs@6.15.1:
-    resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==}
+  qs@6.15.3:
+    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
     engines: {node: '>=0.6'}
 
   query-selector-shadow-dom@1.0.1:
@@ -5734,8 +5732,8 @@ packages:
     resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
     engines: {node: '>= 0.4'}
 
-  side-channel@1.1.0:
-    resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
     engines: {node: '>= 0.4'}
 
   siginfo@2.0.0:
@@ -5991,8 +5989,8 @@ packages:
   undici-types@7.18.2:
     resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
 
-  undici@6.25.0:
-    resolution: {integrity: sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==}
+  undici@6.27.0:
+    resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==}
     engines: {node: '>=18.17'}
 
   unhomoglyph@1.0.6:
@@ -6293,18 +6291,6 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  ws@8.20.0:
-    resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==}
-    engines: {node: '>=10.0.0'}
-    peerDependencies:
-      bufferutil: ^4.0.1
-      utf-8-validate: '>=5.0.2'
-    peerDependenciesMeta:
-      bufferutil:
-        optional: true
-      utf-8-validate:
-        optional: true
-
   ws@8.21.0:
     resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
@@ -6389,12 +6375,12 @@ snapshots:
       '@octokit/plugin-rest-endpoint-methods': 10.4.1(@octokit/core@5.2.2)
       '@octokit/request': 8.4.1
       '@octokit/request-error': 5.1.1
-      undici: 6.25.0
+      undici: 6.27.0
 
   '@actions/http-client@2.2.3':
     dependencies:
       tunnel: 0.0.6
-      undici: 6.25.0
+      undici: 6.27.0
 
   '@actions/io@1.1.3': {}
 
@@ -9054,14 +9040,15 @@ snapshots:
       '@use-gesture/core': 10.3.1
       react: 19.2.7
 
-  '@vector-im/compound-design-tokens@10.2.2(@types/react@19.2.17)(react@19.2.7)':
+  '@vector-im/compound-design-tokens@10.2.3(@types/react@19.2.17)(react@19.2.7)':
     optionalDependencies:
       '@types/react': 19.2.17
       react: 19.2.7
 
-  '@vector-im/compound-web@9.7.1(@fontsource/inconsolata@5.2.8)(@fontsource/inter@5.2.8)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@vector-im/compound-design-tokens@10.2.2(@types/react@19.2.17)(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@vector-im/compound-web@9.8.0(@fontsource/inconsolata@5.2.8)(@fontsource/inter@5.2.8)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@vector-im/compound-design-tokens@10.2.3(@types/react@19.2.17)(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@floating-ui/react': 0.27.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@fontsource/inconsolata': 5.2.8
       '@fontsource/inter': 5.2.8
       '@radix-ui/react-context-menu': 2.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -9070,7 +9057,7 @@ snapshots:
       '@radix-ui/react-progress': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-separator': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@vector-im/compound-design-tokens': 10.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@vector-im/compound-design-tokens': 10.2.3(@types/react@19.2.17)(react@19.2.7)
       classnames: 2.5.1
       react: 19.2.7
       vaul: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -9541,7 +9528,7 @@ snapshots:
   cosmiconfig@8.3.6(typescript@5.9.3):
     dependencies:
       import-fresh: 3.3.1
-      js-yaml: 4.1.1
+      js-yaml: 4.3.0
       parse-json: 5.2.0
       path-type: 4.0.0
     optionalDependencies:
@@ -9712,7 +9699,7 @@ snapshots:
     dependencies:
       domelementtype: 2.3.0
 
-  dompurify@3.4.5:
+  dompurify@3.4.12:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -10393,10 +10380,6 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@4.1.1:
-    dependencies:
-      argparse: 2.0.1
-
   js-yaml@4.3.0:
     dependencies:
       argparse: 2.0.1
@@ -10421,7 +10404,7 @@ snapshots:
       whatwg-encoding: 3.1.1
       whatwg-mimetype: 4.0.0
       whatwg-url: 14.2.0
-      ws: 8.20.0
+      ws: 8.21.0
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - bufferutil
@@ -11298,7 +11281,7 @@ snapshots:
       '@posthog/core': 1.29.3
       '@posthog/types': 1.374.0
       core-js: 3.49.0
-      dompurify: 3.4.5
+      dompurify: 3.4.12
       fflate: 0.4.8
       preact: 10.29.1
       query-selector-shadow-dom: 1.0.1
@@ -11363,9 +11346,10 @@ snapshots:
       pngjs: 5.0.0
       yargs: 15.4.1
 
-  qs@6.15.1:
+  qs@6.15.3:
     dependencies:
-      side-channel: 1.1.0
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
 
   query-selector-shadow-dom@1.0.1: {}
 
@@ -11701,7 +11685,7 @@ snapshots:
       object-inspect: 1.13.4
       side-channel-map: 1.0.1
 
-  side-channel@1.1.0:
+  side-channel@1.1.1:
     dependencies:
       es-errors: 1.3.0
       object-inspect: 1.13.4
@@ -11940,7 +11924,7 @@ snapshots:
 
   undici-types@7.18.2: {}
 
-  undici@6.25.0: {}
+  undici@6.27.0: {}
 
   unhomoglyph@1.0.6: {}
 
@@ -11984,7 +11968,7 @@ snapshots:
   url@0.11.4:
     dependencies:
       punycode: 1.4.1
-      qs: 6.15.1
+      qs: 6.15.3
 
   use-callback-ref@1.3.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
@@ -12034,7 +12018,7 @@ snapshots:
   vite-plugin-generate-file@0.3.1:
     dependencies:
       ejs: 3.1.10
-      js-yaml: 4.1.1
+      js-yaml: 4.3.0
       mime-types: 2.1.35
       picocolors: 1.1.1
 
@@ -12226,8 +12210,6 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  ws@8.20.0: {}
-
   ws@8.21.0: {}
 
   wsl-utils@0.1.0:

pnpm-workspace.yaml

@@ -1,3 +1,8 @@
+minimumReleaseAgeExclude:
+  - "@vector-im/compound-design-tokens"
+  - "@vector-im/compound-web"
+  - matrix-js-sdk
+  - matrix-widget-api
 allowBuilds:
   "@parcel/watcher": true
   "@sentry/cli": true
@@ -24,12 +29,30 @@ overrides:
   # Security fixes:
   # - https://github.com/element-hq/element-call/security/dependabot/110
   # - https://github.com/element-hq/element-call/security/dependabot/122
-  "qs": "^6.14.1"
-  # Security fix: https://github.com/element-hq/element-call/security/dependabot/106
-  "js-yaml": "^4.1.1"
+  # - https://github.com/element-hq/element-call/security/dependabot/179
+  "qs": "^6.15.2"
+  # Security fixes:
+  # - https://github.com/element-hq/element-call/security/dependabot/106
+  # - https://github.com/element-hq/element-call/security/dependabot/203
+  "js-yaml": "^4.2.0"
   # Storybook declares support for 0.27.0 only but empirically works fine with 0.28.0.
   "esbuild": "^0.28.0"
-  # Multiple security fixes: https://github.com/nodejs/undici/releases/tag/v6.24.0
-  "undici": "^6.24.0"
+  # Security fixes:
+  # - https://github.com/nodejs/undici/releases/tag/v6.24.0
+  # - https://github.com/element-hq/element-call/security/dependabot/201
+  # - https://github.com/element-hq/element-call/security/dependabot/199
+  "undici": "^6.27.0"
   # Security fix: https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
   "flatted": "^3.4.2"
+  # Security fix: https://github.com/element-hq/element-call/security/dependabot/184
+  "ws": "^8.21.0"
+  # Security fixes:
+  # - https://github.com/element-hq/element-call/security/dependabot/191
+  # - https://github.com/element-hq/element-call/security/dependabot/190
+  # - https://github.com/element-hq/element-call/security/dependabot/192
+  # - https://github.com/element-hq/element-call/security/dependabot/194
+  # - https://github.com/element-hq/element-call/security/dependabot/198
+  # - https://github.com/element-hq/element-call/security/dependabot/196
+  # - https://github.com/element-hq/element-call/security/dependabot/195
+  # - https://github.com/element-hq/element-call/security/dependabot/193
+  "dompurify": "^3.4.11"

renovate.json

@@ -61,6 +61,15 @@
     {
       "groupName": "Pnpm",
       "matchDepNames": ["pnpm"]
+    },
+    {
+      "description": "Update the element-web image digest daily, in its own PR",
+      "groupName": "Element Web",
+      "matchPackageNames": ["ghcr.io/element-hq/element-web"],
+      "matchUpdateTypes": ["digest"],
+      "schedule": ["* 0-3 * * *"],
+      "minimumReleaseAge": null,
+      "automerge": true
     }
   ],
   "semanticCommits": "disabled",

src/room/__snapshots__/InCallView.test.tsx.snap

@@ -428,7 +428,7 @@ exports[`InCallView > rendering > renders 1`] = `
       </div>
       <fieldset
         aria-label="Layout"
-        class="_toggle_13rnk_9 _layout_20b7b4"
+        class="_toggle_1t5ha_9 _layout_20b7b4"
         data-size="lg"
       >
         <input

src/room/__snapshots__/LobbyView.test.tsx.snap

@@ -84,7 +84,7 @@ exports[`LobbyView > renders with AppBar android 1`] = `
         </div>
       </div>
       <a
-        class="_link_k9ljz_8"
+        class="_link_13esb_8"
         data-kind="primary"
         data-size="md"
         href="/"
@@ -315,7 +315,7 @@ exports[`LobbyView > renders with AppBar ios 1`] = `
         </div>
       </div>
       <a
-        class="_link_k9ljz_8"
+        class="_link_13esb_8"
         data-kind="primary"
         data-size="md"
         href="/"
@@ -592,7 +592,7 @@ exports[`LobbyView > renders with header and participant count 1`] = `
         </div>
       </div>
       <a
-        class="_link_k9ljz_8"
+        class="_link_13esb_8"
         data-kind="primary"
         data-size="md"
         href="/"

src/state/ServiceInterruptionsViewModel.ts

@@ -0,0 +1,27 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE in the repository root for full details.
+*/
+
+export type Service =
+  | { name: "encryption-keys" }
+  | { name: "reactions" }
+  | { name: "screen-sharing" }
+  | { name: "local-media" }
+  | {
+      name: "remote-media";
+      /**
+       * The number of users affected, for the purpose of pluralising the
+       * strings.
+       */
+      count: number;
+    };
+
+export interface ServiceInterruptionsViewModel {
+  /**
+   * A non-empty array of services which are temporarily unavailable.
+   */
+  unavailable: Service[];
+}