This causes issues with F-Droid, since now Posthog unconditionally references some Firebase classes, which are detected by their checks.
Note these don't do anything if Firebase messaging isn't included, which is already the case for the F-droid variant of the app.
The R8 changes should remove any code referencing Firebase in Posthog, making the offending classes unused and removing them from the final APKs.
This is not the ideal fix, that would be Posthog actually extracting these classes to an optional dependency, but it's a workaround to be able to publish F-droid versions.
* Upgrade to `rustls-platform-verifier:0.2.0`.
This re-enables certificate revocation checks, but v0.2.0 contains a list of CRL servers that can be accessed using clear text requests to check the validity of certain certificates, which should fix the issue that prevented us from using certificate revocation and at the same time strengthening the security of the client app.
Since we already had some network configuration in Element X, and `network_security_config.xml` files can't be merged, what we can do is manually download and merge the XML contents using `tools/dependencies/update_rustls_platform_verifier.py` like this:
```sh
./update_rustls_platform_verifier.py 0.2.0
```
It will automatically bump the Gradle dependency and merge the security config entries.
* Bump SDK bindings to `v26.09.28`, containing the rustls bump on the SDK side
* Fix unused resources caused by `app/src/main/res/xml/network_security_config_element.xml`
* Migrate `SqliteStoreBuilder.passphrase` usage to use `highEntropyPassphrase`
This is the first step in migrating existing sessions from using a passphrase that needs key derivation, slowing down opening SDK DBs to just a raw key using the already random keys of the 'passphrase'
* Remove no longer necessary `keyOfSize` extension function
Reduce the max concurrent requests and max requests per second to 5. We bumped it to 10 before because it seemed to work well, but we're seeing rate-limit issues again.
Add an optional thumbnail to `MatrixUser` and `AvatarData`, filled from the session
database for the other accounts in the room list header, the settings and the account
selection screen. `ImageAvatar` renders this thumbnail instead of the initial letter while
the avatar is loading or when it fails to load, for instance when the homeserver of the
current account is not federated with the one of the other account.
Fixes#5571
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add a `userAvatarData` column to the session database, containing the base64 encoded
thumbnail of the user avatar. It will allow rendering the avatar of an account without
having to use its Matrix client, for instance on the signed out screen, or for other
accounts when the homeservers are not federated.
The thumbnail is downloaded when the user profile is retrieved or updated, and only if
the avatar URL has changed. The profile is now also persisted when received from the
own profile subscription.
Part of #5571
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
PreferencesFlowNode routed navigateToLinkNewDevice() to
callback.navigateToAddAccount(), so tapping "Link new device" under
Account settings opened the "Add an account" screen instead — the
opposite direction, signing an extra account into this device rather
than authorising a new one.
The correct destination was already implemented and simply unreachable:
LoggedInFlowNode handles navigateToLinkNewDevice() by pushing
NavTarget.LinkNewDevice. Call that instead.
Regression from 9b2577f1dd ("Split settings: app settings / account
settings"); the previous code called callback.navigateToLinkNewDevice().
It went unnoticed because FeatureFlags.QrCodeLogin defaults to false,
which hides the entry point on default builds.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017y1etzTCPzowrNcPyRBdjm
* Don't show fading edge if the code block can't scroll. Use `canScrollForward || canScrollBackwards` for displaying the fading edges in the code blocks
* Don't add extra vertical padding to the mention pills. This should make them look like they did in the previous renderer
* Allow passing through touch events in `Modifier.linkTapHandler` if no url annotation is clicked or long clicked
`detectTapGestures` always consumes the touch events, no matter if they are handled or not, blocking these events from reaching parent components. Should fix the issue of `ParagraphView` blocking the long press action in the message bubbles
* Update screenshots
---------
Co-authored-by: ElementBot <android@element.io>
* Bump SDK bindings to `v26.09.26`
This version contains a fix for issues in `v26.09.25` related to certificate verification.
* Fix breaking API changes in the latest bindings
* Unify `FeatureFlags.RoomThreadList` with `FeatureFlags.Threads`
* Display the unread notification count only when needed
* Adjust `CounterAtom` and `UnreadIndicatorAtom` to use the official M3's `Badge` component, with a few tweaks to ensure single digit items are always displayed as a circle
* +99 is now 99+
* Update screenshots
---------
Co-authored-by: ElementBot <android@element.io>
The script logs in to MAS with the web login form (username and password),
then uses the MAS GraphQL API to end all the active compat, OAuth 2.0 and
browser sessions of the account. MAS pagination of browser sessions does not
always progress, so sessions are fetched and ended in batches until none are
left.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Jorge Martin Espinosa
Benoit Marty
ElementBot
ganfra
ganfra
Benoit Marty
renovate[bot]
ElementBot
Yan Minagawa
gradle-update-robot