If the client of the selected account cannot be restored, the room list was
never loaded and there was no feedback to the user.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add the `screen.multi_account_announcement.*` keys to the home module
Localazy configuration and import the latest strings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Removing unused dependencies changed the library manifest merge order, so
RECEIVE_BOOT_COMPLETED is now listed after DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION.
The set of permissions is unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Upgrade to `rustls-platform-verifier:0.2.0`.
This re-enables certificate revocation checks, but v0.2.0 contains a list of CRL servers that can be accessed using clear text requests to check the validity of certain certificates, which should fix the issue that prevented us from using certificate revocation and at the same time strengthening the security of the client app.
Since we already had some network configuration in Element X, and `network_security_config.xml` files can't be merged, what we can do is manually download and merge the XML contents using `tools/dependencies/update_rustls_platform_verifier.py` like this:
```sh
./update_rustls_platform_verifier.py 0.2.0
```
It will automatically bump the Gradle dependency and merge the security config entries.
* Bump SDK bindings to `v26.09.28`, containing the rustls bump on the SDK side
* Fix unused resources caused by `app/src/main/res/xml/network_security_config_element.xml`
The script logs in to MAS with the web login form (username and password),
then uses the MAS GraphQL API to end all the active compat, OAuth 2.0 and
browser sessions of the account. MAS pagination of browser sessions does not
always progress, so sessions are fetched and ended in batches until none are
left.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Add a script to install and launch an APK given a PR URL
This is easier than manually downloading, then installing the APK or scanning the QR code using the device
* Allow fetching the APK using the PR number too
* Integrate the new renderer with the timeline UI
* Composable functions are now in `:libraries:htmlrenderer:api` so we don't need to add `impl` to other modules.
* Improve inline code span
* Return both the text and URL in `onLinkClick` and `onLinkLongClick` so we can check the URL is not misleading
* Remove `SelectionContainer` for now - it creates issues when long pressing
* Make `LocalComposeTimelineEventRenderer` contain a `ComposeLocalTimelineEventRendererData` instance. This checks if the new rendering is enabled and what is the current user id so it can be used for styling mention pills
* Add fading edges to code block to indicate scrolling is possible
* Long pressing in a code block copies its contents to the clipboard
* Fix alignment of ordered list item prefixes
* Don't use default values in State data classes
---------
Co-authored-by: ElementBot <android@element.io>
detekt's default configuration excludes test source sets from
`TooManyFunctions` and `StringLiteralDuplication`, but not from
`LargeClass`, so large test classes were reported and had to carry a
`@Suppress("LargeClass")` annotation.
Add the same kind of exclusion to the `LargeClass` rule in
`tools/detekt/detekt.yml` and remove the 24 now-redundant suppressions
from test files. The two remaining suppressions are in production code,
where the rule still applies.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The script was relying on the external git-flow tool and on a local
`git config gitflow.*` initialisation, which made its behaviour depend on
the machine setup and hid what was actually done to the branches.
The release branch is now created with `git checkout -b`, and the release
is finished with explicit merge, tag, back-merge and branch deletion
commands. The merge and tag messages are provided explicitly so that the
generated history stays identical to the previous releases. Each step now
aborts the script with a clear message when it fails, instead of letting
the script continue.
Note that tools/release/release.sh (V1) still uses git flow.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The PR metadata checks move to a new PR Checks workflow, and the lint,
ktlint and detekt reports are now surfaced as inline annotations from the
quality workflow. This removes the danger-js dependency, its ad-hoc npm
installs and the need for the ElementBot token, so the checks also run on
pull requests from forks.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`git flow release finish` opened the editor three times, and the content was
never edited: twice for the merge commits, where the message generated by git is
always kept, and once for the message of the annotated tag, where a placeholder
was typed by hand. The last tags carry the message "tag" for that reason.
GIT_MERGE_AUTOEDIT=no keeps the merge messages git already generates, and -m
provides the tag message. git flow appends the tag name to that message, so the
tag of the next release will read "Release v26.09.0".
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
releaseV2.sh is a copy of release.sh in which the GitHub CLI is mandatory and
does what was previously done by hand: it finds and waits for the release.yml
run, downloads and extracts its artifacts, creates the pre-release with its 6
assets and the generated release notes, and prepends those notes to CHANGES.md.
It also compares the version code and version name of the signed artifacts to
the expected values instead of asking the user to check them, and no longer
needs ELEMENT_GITHUB_TOKEN, since the CLI uses its own credentials. release.sh
is left untouched, so that the next release can be done with releaseV2.sh while
keeping a way back if something goes wrong. The installation documentation is
also fixed, as it referred to an asset name that does not exist anymore.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The gallery gave no indication of how old the screenshots on the page were,
which is one of the remaining items on the GitHub Pages improvement list.
The generator now writes the time it ran alongside the screenshot data, and the
page renders it in the footer next to the existing links.
The 174 commits develop gained since this branch was cut touch preview data
in three ways, and each is resolved so the flipped konsist rule still holds
across the merged tree.
Two screens the branch had renamed were deleted upstream by "Remove the
account provider search screen and homeserver resolver": the
changeaccountprovider and searchaccountprovider packages. Their deletion
wins, so ChangeAccountProviderStatePreviewParam, SearchAccountProviderStatePreviewParam
and the two views that used them go with them rather than coming back
under the new name.
Two preview classes develop added still carried the old suffix and are
renamed here, along with the `@PreviewParameter` reference in each view:
GlobalSearchStateProvider -> GlobalSearchStatePreviewParam and
SendFailureDialogStateProvider -> SendFailureDialogStatePreviewParam.
Everything else merged textually. No production class extending
PreviewParameterProvider is left with a `Provider` name, and no reference
to any of the 194 renamed names survives outside the CHANGES.md entry that
records a past pull request title.
