deps: Update dependency matrix-js-sdk to v24 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
matrix-js-sdk	^19.5.0 -> ^24.0.0

GitHub Vulnerability Alerts

CVE-2022-39236

Impact

Improperly formed beacon events (from MSC3488) can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.

Patches

This is patched in matrix-js-sdk v19.7.0

Workarounds

Redacting applicable events, waiting for the sync processor to store data, and restarting the client can often fix it. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues.

Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.

References

N/A - This was a logic error in the SDK.

For more information

If you have any questions or comments about this advisory please email us at security at matrix.org.

CVE-2022-39249

Impact

An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others.

This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end.

Key forwarding is a mechanism allowing clients to recover from “unable to decrypt” messages when they missed the initial key distribution, at the time the message was originally sent. Examples include accessing message history before they joined the room but also when some network/federation errors have occurred.

Patches

The default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices.

A unique exception to this rule is with the experimental MSC3061, that is forwarding room keys for past messages when invited in a room configured with the proper history visibility setting. Such key forwards are parked upon receipt and are only accepted if the SDK receives an invitation for that room from the inviter in a limited time window.

The SDK now sets a trusted flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with trusted = false are decorated appropriately (for example, by showing a warning for such messages).

Workarounds

As this attack requires coordination between a malicious homeserver and an attacker, if you trust your homeserver, no particular workaround is needed.

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.

CVE-2022-39251

Impact

An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield.

Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver.

These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.

Patches

matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages.

Out of caution, several other checks have been audited or added:

• Cleartext m.room_key, m.forwarded_room_key and m.secret.send to_device messages are discarded.
• Secrets received from untrusted devices are discarded.
• Key backups are only usable if they have a valid signature from a trusted device (no more local trust, or trust-on-decrypt).
• The origin of a to-device message should only be determined by observing the Olm session which managed to decrypt the message, and not by using claimed sender_key, user_id, or any other fields controllable by the homeserver.

Workarounds

As this attack requires coordination between a malicious home server and an attacker, if you trust your home server no particular workaround is needed. Notice that the backup spoofing attack is a particularly sophisticated targeted attack.

We are not aware of this attack being used in the wild, though specifying a false positive-free way of noticing malicious key backups key is challenging.

As an abundance of caution, to avoid malicious backup attacks, you should not verify your new logins using emoji/QR verifications methods until patched. Prefer verifying with your security passphrase instead.

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.

CVE-2022-39250

Impact

An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one.

The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps.

Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable.

Patches

The matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key.

Workarounds

As this attack requires coordination between a malicious homeserver and an attacker -- if you trust your homeserver no particular workaround is needed.

As a potential way of detecting compromise, it’s possible to review your device list or the device list of other users for devices with IDs in the form of a base64 cross-signing key (5XaczGNlfz0bl8R1IX5qn+tBoue2tWJqLMh+SDUuvCk) instead of classical device ID (SEHACYDHMG).

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org

CVE-2023-28427

Impact

In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic.

(This is part 2, where CVE-2022-36059 / GHSA-rfv9-x7hh-xc32 is part 1. Part 2 covers remaining vectors not covered by part 1, found in a codebase audit scheduled after part 1.)

Patches

The issue has been patched in matrix-js-sdk 24.0.0.

Workarounds

None.

References

• Release blog post
• The advisory GHSA-rfv9-x7hh-xc32 (CVE-2022-36059) refers to an initial set of vulnerable locations discovered and patched in matrix-js-sdk 19.4.0. We opted not to disclose that advisory while we performed an audit of the codebase and are now disclosing it jointly with this one.

For more information

If you have any questions or comments about this advisory please email us at security at matrix.org.

CVE-2023-29529

Impact

An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.

This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case.

Legacy 1:1 calls are unaffected.

Workarounds

Users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.

---

Release Notes

matrix-org/matrix-js-sdk (matrix-js-sdk)

v24.1.0

Compare Source

==================================================================================================

✨ Features

• Allow via_servers property in findPredecessor (update to MSC3946) (#​3240). Contributed by @​andybalaam.
• Fire closed event when IndexedDB closes unexpectedly (#​3218).
• Implement MSC3952: intentional mentions (#​3092). Fixes vector-im/element-web#24376.
• Send one time key count and unused fallback keys for rust-crypto (#​3215). Fixes vector-im/element-web#24795. Contributed by @​florianduros.
• Improve processBeaconEvents hotpath (#​3200).
• Implement MSC3966: a push rule condition to check if an array contains a value (#​3180).

🐛 Bug Fixes

• indexddb-local-backend - return the current sync to database promise … (#​3222). Contributed by @​texuf.
• Revert "Add the call object to Call events" (#​3236).
• Handle group call redaction (#​3231). Fixes vector-im/voip-internal#128.
• Stop doing O(n^2) work to find event's home (eventShouldLiveIn) (#​3227). Contributed by @​jryans.
• Fix bug where video would not unmute if it started muted (#​3213). Fixes vector-im/element-call#925.
• Fixes to event encryption in the Rust Crypto implementation (#​3202).

v24.0.0

Compare Source

==================================================================================================

🔒 Security

• Fixes for CVE-2023-28427 / GHSA-mwq8-fjpf-c2gr

v23.5.0

Compare Source

==================================================================================================

✨ Features

• Implement MSC3758: a push rule condition to match event properties exactly (#​3179).
• Enable group calls without video and audio track by configuration of MatrixClient (#​3162). Contributed by @​EnricoSchw.
• Updates to protocol used for Sign in with QR code (#​3155). Contributed by @​hughns.
• Implement MSC3873 to handle escaped dots in push rule keys (#​3134). Fixes undefined#1454.

🐛 Bug Fixes

• Fix spec compliance issue around encrypted m.relates_to (#​3178).
• Fix reactions in threads sometimes causing stuck notifications (#​3146). Fixes vector-im/element-web#24000. Contributed by @​justjanne.

v23.4.0

Compare Source

==================================================================================================

✨ Features

• Add easy way to determine if the decryption failure is due to "DecryptionError: The sender has disabled encrypting to unverified devices." (#​3167). Contributed by @​florianduros.
• Polls: expose end event id on poll model (#​3160). Contributed by @​kerryarchibald.
• Polls: count undecryptable poll relations (#​3163). Contributed by @​kerryarchibald.

🐛 Bug Fixes

• Better type guard parseTopicContent (#​3165). Fixes matrix-org/element-web-rageshakes#20177 and matrix-org/element-web-rageshakes#20178.
• Fix a bug where events in encrypted rooms would sometimes erroneously increment the total unread counter after being processed locally. (#​3130). Fixes vector-im/element-web#24448. Contributed by @​Half-Shot.
• Stop the ICE disconnected timer on call terminate (#​3147).
• Clear notifications when we can infer read status from receipts (#​3139). Fixes vector-im/element-web#23991.
• Messages sent out of order after one message fails (#​3131). Fixes vector-im/element-web#22885 and vector-im/element-web#18942. Contributed by @​justjanne.

v23.3.0

Compare Source

==================================================================================================

✨ Features

• Element-R: implement encryption of outgoing events (#​3122).
• Poll model - page /relations results (#​3073). Contributed by @​kerryarchibald.
• Poll model - validate end events (#​3072). Contributed by @​kerryarchibald.
• Handle optional last_known_event_id property in m.predecessor (#​3119). Contributed by @​andybalaam.
• Add support for stable identifier for fixed MAC in SAS verification (#​3101).
• Provide eventId as well as roomId from Room.findPredecessor (#​3095). Contributed by @​andybalaam.
• MSC3946 Dynamic room predecessors (#​3042). Contributed by @​andybalaam.
• Poll model (#​3036). Contributed by @​kerryarchibald.
• Remove video tracks on video mute without renegotiating (#​3091).
• Introduces a backwards-compatible API change. MegolmEncrypter#prepareToEncrypt's return type has changed from void to () => void. (#​3035). Contributed by @​clarkf.

🐛 Bug Fixes

• Stop the ICE disconnected timer on call terminate (#​3147).
• Clear notifications when we can infer read status from receipts (#​3139). Fixes vector-im/element-web#23991.
• Messages sent out of order after one message fails (#​3131). Fixes vector-im/element-web#22885 and vector-im/element-web#18942. Contributed by @​justjanne.
• Element-R: fix a bug which prevented encryption working after a reload (#​3126).
• Element-R: Fix invite processing (#​3121).
• Don't throw with no opponentDeviceInfo (#​3107).
• Remove flaky megolm test (#​3098). Contributed by @​clarkf.
• Fix "verifyLinks" functionality of getRoomUpgradeHistory (#​3089). Contributed by @​andybalaam.

v23.2.0

Compare Source

==================================================================================================

✨ Features

• Implement decryption via the rust sdk (#​3074).
• Handle edits which are bundled with an event, per MSC3925 (#​3045).

🐛 Bug Fixes

• Add null check for our own member event (#​3082).
• Handle group call getting initialised twice in quick succession (#​3078). Fixes vector-im/element-call#847.
• Correctly handle limited sync responses by resetting the thread timeline (#​3056). Fixes vector-im/element-web#23952. Contributed by @​justjanne.
• Fix failure to start in firefox private browser (#​3058). Fixes vector-im/element-web#24216.
• Fix spurious "Decryption key withheld" messages (#​3061). Fixes vector-im/element-web#23803.
• Fix browser entrypoint (#​3051). Fixes #​3013.

v23.1.1

Compare Source

==================================================================================================

🐛 Bug Fixes

• Fix backwards compability for environment not support Array.prototype.at (#​3080).

v23.1.0

Compare Source

==================================================================================================

🦖 Deprecations

• Remove extensible events v1 field population on legacy events (#​3040).

✨ Features

• Improve hasUserReadEvent and getUserReadUpTo realibility with threads (#​3031). Fixes vector-im/element-web#24164.
• Remove video track when muting video (#​3028). Fixes vector-im/element-call#209.
• Make poll start event type available (PSG-962) (#​3034).
• Add alt event type matching in Relations model (#​3018).
• Remove usage of v1 Identity Server API (#​3003).
• Add device_id to /account/whoami types (#​3005).
• Implement MSC3912: Relation-based redactions (#​2954).
• Introduce a mechanism for using the rust-crypto-sdk (#​2969).
• Support MSC3391: Account data deletion (#​2967).

🐛 Bug Fixes

• Fix threaded cache receipt when event holds multiple receipts (#​3026).
• Fix false key requests after verifying new device (#​3029). Fixes vector-im/element-web#24167 and vector-im/element-web#23333.
• Avoid triggering decryption errors when decrypting redacted events (#​3004). Fixes vector-im/element-web#24084.
• bugfix: upload OTKs in sliding sync mode (#​3008).
• Apply edits discovered from sync after thread is initialised (#​3002). Fixes vector-im/element-web#23921.
• Sliding sync: Fix issue where no unsubs are sent when switching rooms (#​2991).
• Threads are missing from the timeline (#​2996). Fixes vector-im/element-web#24036.
• Close all streams when a call ends (#​2992). Fixes vector-im/element-call#742.
• Resume to-device message queue after resumed sync (#​2920). Fixes matrix-org/element-web-rageshakes#17170.
• Fix browser entrypoint (#​3051). Fixes #​3013.
• Fix failure to start in firefox private browser (#​3058). Fixes vector-im/element-web#24216.
• Correctly handle limited sync responses by resetting the thread timeline (#​3056). Fixes vector-im/element-web#23952.

v23.0.0

Compare Source

==================================================================================================

🚨 BREAKING CHANGES

• Process m.room.encryption events before emitting RoomMember events (#​2914). Fixes vector-im/element-web#23819.
• Don't expose calls on GroupCall (#​2941).

✨ Features

• Support MSC3391: Account data deletion (#​2967).
• Add a message ID on each to-device message (#​2938).
• Enable multiple users' power levels to be set at once (#​2892). Contributed by @​GoodGuyMarco.
• Include pending events in thread summary and count again (#​2922). Fixes vector-im/element-web#23642.
• Make GroupCall work better with widgets (#​2935).
• Add method to get outgoing room key requests for a given event (#​2930).

🐛 Bug Fixes

• Fix messages loaded during initial fetch ending up out of order (#​2971). Fixes vector-im/element-web#23972.
• Fix #​23919: Root message for new thread loaded from network (#​2965). Fixes vector-im/element-web#23919.
• Fix #​23916: Prevent edits of the last message in a thread getting lost (#​2951). Fixes vector-im/element-web#23916 and vector-im/element-web#23942.
• Fix infinite loop when restoring cached read receipts (#​2963). Fixes vector-im/element-web#23951.
• Don't swallow errors coming from the shareSession call (#​2962). Fixes vector-im/element-web#23792.
• Make sure that MegolmEncryption.setupPromise always resolves (#​2960).
• Do not calculate highlight notifs for threads unknown to the room (#​2957).
• Cache read receipts for unknown threads (#​2953).
• bugfix: sliding sync initial room timelines shouldn't notify (#​2933).
• Redo key sharing after own device verification (#​2921). Fixes vector-im/element-web#23333.
• Move updated threads to the end of the thread list (#​2923). Fixes vector-im/element-web#23876.
• Fix highlight notifications increasing when total notification is zero (#​2937). Fixes vector-im/element-web#23885.
• Fix synthesizeReceipt (#​2916). Fixes vector-im/element-web#23827 vector-im/element-web#23754 and vector-im/element-web#23847.

v22.0.0

Compare Source

==================================================================================================

🚨 BREAKING CHANGES

• Enable users to join group calls from multiple devices (#​2902).

🦖 Deprecations

• Deprecate a function containing a typo (#​2904).

✨ Features

• sliding sync: add receipts extension (#​2912).
• Define a spec support policy for the js-sdk (#​2882).
• Further improvements to e2ee logging (#​2900).
• sliding sync: add support for typing extension (#​2893).
• Improve logging on Olm session errors (#​2885).
• Improve logging of e2ee messages (#​2884).

🐛 Bug Fixes

• Fix 3pid invite acceptance not working due to mxid being sent in body (#​2907). Fixes vector-im/element-web#23823.
• Don't hang up calls that haven't started yet (#​2898).
• Read receipt accumulation for threads (#​2881).
• Make GroupCall work better with widgets (#​2935).
• Fix highlight notifications increasing when total notification is zero (#​2937). Fixes vector-im/element-web#23885.
• Fix synthesizeReceipt (#​2916). Fixes vector-im/element-web#23827 vector-im/element-web#23754 and vector-im/element-web#23847.

v21.2.0

Compare Source

==================================================================================================

✨ Features

• Make calls go back to 'connecting' state when media lost (#​2880).
• Add ability to send unthreaded receipt (#​2878).
• Add way to abort search requests (#​2877).
• sliding sync: add custom room subscriptions support (#​2834).
• webrtc: add advanced audio settings (#​2434). Contributed by @​MrAnno.
• Add support for group calls using MSC3401 (#​2553).
• Make the js-sdk conform to tsc --strict (#​2835). Fixes #​2112 #​2116 and #​2124.
• Let leave requests outlive the window (#​2815). Fixes vector-im/element-call#639.
• Add event and message capabilities to RoomWidgetClient (#​2797).
• Misc fixes for group call widgets (#​2657).
• Support nested Matrix clients via the widget API (#​2473).
• Set max average bitrate on PTT calls (#​2499). Fixes vector-im/element-call#440.
• Add config option for e2e group call signalling (#​2492).
• Enable DTX on audio tracks in calls (#​2482).
• Don't ignore call member events with a distant future expiration date (#​2466).
• Expire call member state events after 1 hour (#​2446).
• Emit unknown device errors for group call participants without e2e (#​2447).
• Mute disconnected peers in PTT mode (#​2421).
• Add support for sending encrypted to-device events with OLM (#​2322). Contributed by @​robertlong.
• Support for PTT group call mode (#​2338).

🐛 Bug Fixes

• Fix registration add phone number not working (#​2876). Contributed by @​bagvand.
• Use an underride rule for Element Call notifications (#​2873). Fixes vector-im/element-web#23691.
• Fixes unwanted highlight notifications with encrypted threads (#​2862).
• Extra insurance that we don't mix events in the wrong timelines - v2 (#​2856). Contributed by @​MadLittleMods.
• Hide pending events in thread timelines (#​2843). Fixes vector-im/element-web#23684.
• Fix pagination token tracking for mixed room timelines (#​2855). Fixes vector-im/element-web#23695.
• Extra insurance that we don't mix events in the wrong timelines (#​2848). Contributed by @​MadLittleMods.
• Do not freeze state in initialiseState() (#​2846).
• Don't remove our own member for a split second when entering a call (#​2844).
• Resolve races between initLocalCallFeed and leave (#​2826).
• Add throwOnFail to groupCall.setScreensharingEnabled (#​2787).
• Fix connectivity regressions (#​2780).
• Fix screenshare failing after several attempts (#​2771). Fixes vector-im/element-call#625.
• Don't block muting/unmuting on network requests (#​2754). Fixes vector-im/element-call#592.
• Fix ICE restarts (#​2702).
• Target widget actions at a specific room (#​2670).
• Add tests for ice candidate sending (#​2674).
• Prevent exception when muting (#​2667). Fixes vector-im/element-call#578.
• Fix race in creating calls (#​2662).
• Add client.waitUntilRoomReadyForGroupCalls() (#​2641).
• Wait for client to start syncing before making group calls (#​2632). Fixes #​2589.
• Add GroupCallEventHandlerEvent.Room (#​2631).
• Add missing events from reemitter to GroupCall (#​2527). Contributed by @​toger5.
• Prevent double mute status changed events (#​2502).
• Don't mute the remote side immediately in PTT calls (#​2487). Fixes vector-im/element-call#425.
• Fix some MatrixCall leaks and use a shared AudioContext (#​2484). Fixes vector-im/element-call#412.
• Don't block muting on determining whether the device exists (#​2461).
• Only clone streams on Safari (#​2450). Fixes vector-im/element-call#267.
• Set PTT mode on call correctly (#​2445). Fixes vector-im/element-call#382.
• Wait for mute event to send in PTT mode (#​2401).
• Handle other members having no e2e keys (#​2383). Fixes vector-im/element-call#338.
• Fix races when muting/unmuting (#​2370).

v21.1.0

Compare Source

==================================================================================================

✨ Features

• Loading threads with server-side assistance (#​2735). Contributed by @​justjanne.
• Support sign in + E2EE set up using QR code implementing MSC3886, MSC3903 and MSC3906 (#​2747). Contributed by @​hughns.

🐛 Bug Fixes

• Replace instanceof Array with Array.isArray (#​2812). Fixes #​2811.
• Emit UnreadNotification event on notifications reset (#​2804). Fixes vector-im/element-web#23590.
• Fix incorrect prevEv being sent in ClientEvent.AccountData events (#​2794).
• Fix build error caused by wrong ts-strict improvements (#​2783). Contributed by @​justjanne.
• Encryption should not hinder verification (#​2734).

v21.0.1

Compare Source

==================================================================================================

🐛 Bug Fixes

• Fix default behavior of Room.getBlacklistUnverifiedDevices (#​2830). Contributed by @​duxovni.
• Catch server versions API call exception when starting the client (#​2828). Fixes vector-im/element-web#23634.
• Fix authedRequest including Authorization: Bearer undefined for password resets (#​2822). Fixes vector-im/element-web#23655.

v21.0.0

Compare Source

==================================================================================================

🚨 BREAKING CHANGES

• Changes the uploadContent API, kills off request and browser-request in favour of fetch, removed callback support on a lot of the methods, adds a lot of tests. (#​2719). Fixes #​2415 and #​801.
• Remove deprecated m.room.aliases references (#​2759). Fixes vector-im/element-web#12680.

✨ Features

• Remove node-specific crypto bits, use Node 16's WebCrypto (#​2762). Fixes #​2760.
• Export types for MatrixEvent and Room emitted events, and make event handler map types stricter (#​2750). Contributed by @​stas-demydiuk.
• Use even more stable calls to /room_keys (#​2746).
• Upgrade to Olm 3.2.13 which has been repackaged to support Node 18 (#​2744).
• Fix power_level_content_override type (#​2741).
• Add custom notification handling for MSC3401 call events (#​2720).
• Add support for unread thread notifications (#​2726).
• Load Thread List with server-side assistance (MSC3856) (#​2602).
• Use stable calls to /room_keys (#​2729). Fixes vector-im/element-web#22839.

🐛 Bug Fixes

• Fix POST data not being passed for registerWithIdentityServer (#​2769). Fixes matrix-org/element-web-rageshakes#16206.
• Fix IdentityPrefix.V2 containing spurious /api (#​2761). Fixes vector-im/element-web#23505.
• Always send back an httpStatus property if one is known (#​2753).
• Check for AbortError, not any generic connection error, to avoid tightlooping (#​2752).
• Correct the dir parameter of MSC3715 (#​2745). Contributed by @​dhenneke.
• Fix sync init when thread unread notif is not supported (#​2739). Fixes vector-im/element-web#23435.
• Use the correct sender key when checking shared secret (#​2730). Fixes vector-im/element-web#23374.

v20.1.0

Compare Source

============================================================================================================

✨ Features

• Add local notification settings capability (#​2700).
• Implementation of MSC3882 login token request (#​2687). Contributed by @​hughns.
• Typings for MSC2965 OIDC provider discovery (#​2424). Contributed by @​hughns.
• Support to remotely toggle push notifications (#​2686).
• Read receipts for threads (#​2635).

🐛 Bug Fixes

• Use the correct sender key when checking shared secret (#​2730). Fixes vector-im/element-web#23374.
• Unexpected ignored self key request when it's not shared history (#​2724). Contributed by @​mcalinghee.
• Fix IDB initial migration handling causing spurious lazy loading upgrade loops (#​2718). Fixes vector-im/element-web#23377.
• Fix backpagination at end logic being spec non-conforming (#​2680). Fixes vector-im/element-web#22784.

v20.0.2

Compare Source

==================================================================================================

🐛 Bug Fixes

• Fix issue in sync when crypto is not supported by client (#​2715). Contributed by @​stas-demydiuk.

v20.0.1

Compare Source

==================================================================================================

🐛 Bug Fixes

• Fix missing return when receiving an invitation without shared history (#​2710).

v20.0.0

Compare Source

==================================================================================================

🚨 BREAKING CHANGES

• Bump IDB crypto store version (#​2705).

v19.7.0

Compare Source

==================================================================================================

🔒 Security

• Fix for CVE-2022-39249
• Fix for CVE-2022-39250
• Fix for CVE-2022-39251
• Fix for CVE-2022-39236

v19.6.0

Compare Source

==================================================================================================

✨ Features

• Add a property aggregating all names of a NamespacedValue (#​2656).
• Implementation of MSC3824 to add action= param on SSO login (#​2398). Contributed by @​hughns.
• Add invited_count and joined_count to sliding sync room responses. (#​2628).
• Base support for MSC3847: Ignore invites with policy rooms (#​2626). Contributed by @​Yoric.

🐛 Bug Fixes

• Fix handling of remote echoes doubling up (#​2639). Fixes #​2618.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.