[dependabot]

Bumps the npm group with 83 updates in the / directory:

Package	From	To
@arborium/arborium	2.18.1	2.18.2
@atlaskit/pragmatic-drag-and-drop	3.0.0	4.0.0
@atlaskit/pragmatic-drag-and-drop-auto-scroll	3.0.1	3.2.1
@atlaskit/pragmatic-drag-and-drop-hitbox	2.1.0	3.0.0
@choochmeque/tauri-plugin-sharekit-api	0.4.0-rc.5	0.4.0-rc.7
@livekit/components-react	2.9.24	2.9.25
@lottiefiles/dotlottie-react	0.19.14	0.21.1
@lottiefiles/dotlottie-web	0.79.1	0.82.1
@matrix-org/matrix-sdk-crypto-wasm	18.4.0	19.0.0
@noble/hashes	2.3.0	2.4.0
@rolldown/plugin-node-polyfills	1.0.3	1.0.4
@sableclient/tauri-plugin-livekit-mobile	0.2.0	0.7.0
@sentry/react	10.70.0	11.11.0
@tanstack/react-query	5.101.4	5.106.1
@tanstack/react-query-devtools	5.101.4	5.106.1
@tanstack/react-virtual	3.14.9	3.14.26
@tauri-apps/api	2.11.1	2.12.4
@tauri-apps/plugin-clipboard-manager	2.3.2	2.5.0
@tauri-apps/plugin-deep-link	2.4.9	2.6.3
@tauri-apps/plugin-dialog	2.7.2	2.8.4
@tauri-apps/plugin-fs	2.5.1	2.7.1
@tauri-apps/plugin-geolocation	2.3.3	2.5.0
@tauri-apps/plugin-http	2.5.9	2.8.3
@tauri-apps/plugin-opener	2.5.4	2.7.2
@tauri-apps/plugin-os	2.3.2	2.4.0
@tauri-apps/plugin-process	2.3.1	2.4.0
@tauri-apps/plugin-store	2.4.4	2.5.0
@tauri-apps/plugin-updater	2.10.1	2.14.1
@vanilla-extract/css	1.21.2	1.21.3
dompurify	3.4.13	3.4.17
emojibase	17.0.0	18.0.0
emojibase-data	17.0.0	18.0.0
folds	2.7.1	2.7.3
html-react-parser	6.1.7	6.1.9
i18next	26.3.6	26.7.2
i18next-browser-languagedetector	8.2.1	8.3.0
i18next-http-backend	4.0.1	4.0.10
immer	11.1.17	11.2.9
is-hotkey	0.2.0	0.2.1
jotai	2.20.2	3.0.1
katex	0.18.4	0.19.1
linkify-react	4.3.3	4.4.0
linkifyjs	4.3.3	4.4.0
livekit-client	2.22.0	2.23.0
marked	18.0.9	18.1.3
matrix-js-sdk	42.3.0	45.0.0
matrix-widget-api	1.18.0	1.20.0
nanoid	6.0.1	6.0.2
pdfjs-dist	6.2.108	6.5.438
prosemirror-history	1.5.0	1.5.1
prosemirror-model	1.25.11	1.25.12
prosemirror-view	1.42.2	1.42.9
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
react-aria	3.51.0	3.53.1
react-colorful	5.8.0	5.8.1
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.4	19.3.0
react-i18next	17.0.11	17.1.13
react-router	8.3.0	8.5.1
tauri-plugin-android-fs-api	29.0.0	30.2.0
virtua	0.50.1	0.54.2
@playwright/test	1.62.1	1.65.0
@sentry/vite-plugin	5.4.0	11.11.0
@tauri-apps/cli	2.11.4	2.12.4
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.4	14.6.8
@types/chroma-js	3.1.2	3.1.3
@types/node	26.2.0	26.6.6
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
@vitejs/plugin-react	6.0.5	6.2.1
@vitest/coverage-v8	4.1.10	5.1.0
@vitest/ui	4.1.10	5.1.0
fake-indexeddb	6.2.5	6.2.7
jsdom	30.0.1	31.0.0
knip	6.32.2	6.44.1
oxfmt	0.63.0	0.76.0
oxlint	1.78.0	1.91.0
oxlint-tsgolint	7.0.2001	7.0.2006
testcontainers	12.1.0	12.2.1
vite	8.2.1	8.3.6
vite-plugin-compression2	2.5.3	2.5.4
vite-plugin-pwa	1.3.0	2.0.0
vitest	4.1.10	5.1.0

Updates @arborium/arborium from 2.18.1 to 2.18.2

Commits

• See full diff in compare view

Updates @atlaskit/pragmatic-drag-and-drop from 3.0.0 to 4.0.0

Commits

• See full diff in compare view

Updates @atlaskit/pragmatic-drag-and-drop-auto-scroll from 3.0.1 to 3.2.1

Commits

• See full diff in compare view

Updates @atlaskit/pragmatic-drag-and-drop-hitbox from 2.1.0 to 3.0.0

Commits

• See full diff in compare view

Updates @choochmeque/tauri-plugin-sharekit-api from 0.4.0-rc.5 to 0.4.0-rc.7

Release notes

Sourced from @​choochmeque/tauri-plugin-sharekit-api's releases.

v0.4.0-rc.7

Maintenance release — dependency, CI and example-app updates only; no functional changes to the plugin API.

Changes

• Widen the clippy allow on the desktop stubs share_text / share_file to unknown_lints, clippy::unused_async, clippy::unused_async_trait_impl; lint compatibility only, the stubs still return Error::UnsupportedPlatform (5443132)

Build & tooling

• Kotlin Gradle plugin 1.9.25 → 2.1.21 for the Android example (bbbcb20)
• CI: Node 24 in every workflow (2d568b1)
• CI: refresh the apt index before cache-apt-pkgs-action, add libglib2.0-dev to the package list and bump the apt cache key to 1.2 (8806dee, 1d634f7)
• CI: forward ANDROID_NDK_LATEST_HOME into NDK_HOME / ANDROID_NDK_HOME at shell runtime for the Android demo build; pin Xcode 26.5 and drop MetalToolchain for the iOS demo build (62fede7)
• CI: publish.yml apt setup aligned with checks.yml — index refresh, libglib2.0-dev, cache key 1.2 (#245)
• Security advisories resolved in transitive dependencies: picomatch, and serde_with / tauri in the example app (#244)

Dependencies

• eslint 10.4.1 → 10.9.1, typescript-eslint 8.61.0 → 8.68.0, prettier 3.8.4 → 3.9.6, rollup 4.61.1 → 4.63.1, eslint-plugin-security 4.0.0 → 4.0.1
• actions/checkout 6 → 7, actions/setup-node 6 → 7, actions/setup-java 5 → 6
• example app: vite 8.0.16 → 8.2.2, @​sveltejs/kit 2.65.0 → 2.70.3, @​sveltejs/vite-plugin-svelte 7.1.2 → 7.3.0, svelte 5.56.3 → 5.56.10, svelte-check 4.6.0 → 4.7.6, @​tauri-apps/cli 2.11.2 → 2.11.4, @​tauri-apps/api 2.11.0 → 2.11.1, picomatch 4.0.4 → 4.0.7
• example app (Cargo): tauri 2.11.0 → 2.11.1, serde_with 3.16.1 → 3.21.0
• example app (Gradle): androidx.webkit:webkit 1.14.0 → 1.17.0

Full changelog: Choochmeque/tauri-plugin-sharekit@v0.4.0-rc.5...v0.4.0-rc.7

Commits

• c2a9cc3 Bump version to 0.4.0-rc.7
• 92eb711 Merge pull request #246 from Choochmeque/ci/publish-pnpm
• f523645 Pin the npm self-update to major 11
• aa6a33b Bump version to 0.4.0-rc.6
• 6ce6b60 Merge pull request #245 from Choochmeque/fix/publish-apt
• 5f53b95 Align publish.yml apt setup with checks.yml
• 7d2256d Merge pull request #244 from Choochmeque/chore/advisories-20260830
• 13f9c1f Resolve security advisories in example app dependencies (serde_with, tauri)
• a9e81b6 Resolve security advisories in dependencies (picomatch)
• 14c262d Merge pull request #235 from Choochmeque/dependabot/npm_and_yarn/eslint-10.9.1
• Additional commits viewable in compare view

Updates @livekit/components-react from 2.9.24 to 2.9.25

Release notes

Sourced from @​livekit/components-react's releases.

@​livekit/components-react@​2.9.25

Patch Changes

• Keep chat setup stable when equivalent options are passed inline, preventing render loops and message history resets. - #1450 (@​fatihcvs)

• Link chat URLs whose scheme is not lowercase, such as Https://, to that URL instead of prefixing another https://. - #1505 (@​RaphaelFakhri)

• Update the local screen share track returned by useSession when screen sharing starts or stops. - #1447 (@​fatihcvs)

• Prevent outdated useToken requests from overwriting the token after the endpoint, room, or user changes. - #1454 (@​fatihcvs)

• Fix TypeError: ...getLogger is not a function on import in environments with a global AMD loader (define.amd). The bundled loglevel UMD wrapper now takes its CommonJS branch at build time, as in 2.9.23. - #1466 (@​niconicocarrera)

• Mark the track parameter of useMediaDeviceSelect as deprecated. - #1473 (@​RaphaelFakhri)

• Detect horizontal swipes that start or end at a clientX coordinate of zero. - #1452 (@​fatihcvs)

• Fix the agent-connect timeout leaking when a session ends early, which could fail the next session before its agent had a chance to connect. - #1469 (@​1egoman)

• Clear stale useParticipantAttribute values when switching to a participant or key without that attribute. - #1453 (@​fatihcvs)

• Use areTokenSourceFetchOptionsEqual from livekit-client in useSession instead of a local copy, so the token fetch options comparison stays in sync with the SDK - #1479 (@​ninglinLiu)

• Updated dependencies [baf02cd, 6bf0e61, b62a39f, e24c281, d4e449e, c94f414, 6a3049f]:

  • @​livekit/components-core@​0.12.16

Changelog

Sourced from @​livekit/components-react's changelog.

2.9.25

Patch Changes

• Keep chat setup stable when equivalent options are passed inline, preventing render loops and message history resets. - #1450 (@​fatihcvs)

• Link chat URLs whose scheme is not lowercase, such as Https://, to that URL instead of prefixing another https://. - #1505 (@​RaphaelFakhri)

• Update the local screen share track returned by useSession when screen sharing starts or stops. - #1447 (@​fatihcvs)

• Prevent outdated useToken requests from overwriting the token after the endpoint, room, or user changes. - #1454 (@​fatihcvs)

• Fix TypeError: ...getLogger is not a function on import in environments with a global AMD loader (define.amd). The bundled loglevel UMD wrapper now takes its CommonJS branch at build time, as in 2.9.23. - #1466 (@​niconicocarrera)

• Mark the track parameter of useMediaDeviceSelect as deprecated. - #1473 (@​RaphaelFakhri)

• Detect horizontal swipes that start or end at a clientX coordinate of zero. - #1452 (@​fatihcvs)

• Fix the agent-connect timeout leaking when a session ends early, which could fail the next session before its agent had a chance to connect. - #1469 (@​1egoman)

• Clear stale useParticipantAttribute values when switching to a participant or key without that attribute. - #1453 (@​fatihcvs)

• Use areTokenSourceFetchOptionsEqual from livekit-client in useSession instead of a local copy, so the token fetch options comparison stays in sync with the SDK - #1479 (@​ninglinLiu)

• Updated dependencies [baf02cd, 6bf0e61, b62a39f, e24c281, d4e449e, c94f414, 6a3049f]:

  • @​livekit/components-core@​0.12.16

Commits

• 5465096 Version Packages (#1456)
• 2a4e3fc fix(react): match the URL scheme case-insensitively in chat links (#1505)
• 3f74806 refactor(react): use areTokenSourceFetchOptionsEqual from livekit-client in u...
• af10b16 Mark the track parameter of useMediaDeviceSelect as deprecated (#1473)
• 21c767b Clear agent-connect timeout when a session ends early (#1469)
• f3c995c fix(react): resolve bundled loglevel UMD wrapper at build time (#1428) (#1466)
• d3e5c8a fix(react): ignore stale token responses (#1454)
• 536b054 fix(react): reset missing participant attributes (#1453)
• 0360cd5 fix(react): recognize swipes at coordinate zero (#1452)
• 6be1b95 fix(react): keep chat stable with inline options (#1450)
• Additional commits viewable in compare view

Updates @lottiefiles/dotlottie-react from 0.19.14 to 0.21.1

Release notes

Sourced from @​lottiefiles/dotlottie-react's releases.

@​lottiefiles/dotlottie-react@​0.21.1

Patch Changes

• Updated dependencies [a0a6601]
  • @​lottiefiles/dotlottie-web@​0.82.1

@​lottiefiles/dotlottie-react@​0.21.0

Minor Changes

• bbf324c: Add audio volume control: a volume config option, setVolume() and a volume getter on DotLottie and DotLottieWorker, and a volume prop on the React, Vue, Svelte, Solid and web component players. It goes from 0 (muted) to 1 (full), defaults to 1, and is kept across loads.

Patch Changes

• Updated dependencies [bbf324c]
• Updated dependencies [d8a4e9e]
• Updated dependencies [3011b70]
• Updated dependencies [211d271]
• Updated dependencies [bbf324c]
• Updated dependencies [ea7250c]
  • @​lottiefiles/dotlottie-web@​0.82.0

@​lottiefiles/dotlottie-react@​0.20.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

Patch Changes

• 629eb6c: Avoid loading the initial src twice when the React player is mounted. Both the regular and worker players now rely on their constructor to load the first animation, while later src changes still call load.
• Updated dependencies [e46482e]
  • @​lottiefiles/dotlottie-web@​0.81.0

@​lottiefiles/dotlottie-react@​0.19.16

Patch Changes

• Updated dependencies [0874fae]
• Updated dependencies [727add3]
  • @​lottiefiles/dotlottie-web@​0.80.0

@​lottiefiles/dotlottie-react@​0.19.15

Patch Changes

• Updated dependencies [14aee74]
  • @​lottiefiles/dotlottie-web@​0.79.2

Changelog

Sourced from @​lottiefiles/dotlottie-react's changelog.

0.21.1

Patch Changes

• Updated dependencies [a0a6601]
  • @​lottiefiles/dotlottie-web@​0.82.1

0.21.0

Minor Changes

• bbf324c: Add audio volume control: a volume config option, setVolume() and a volume getter on DotLottie and DotLottieWorker, and a volume prop on the React, Vue, Svelte, Solid and web component players. It goes from 0 (muted) to 1 (full), defaults to 1, and is kept across loads.

Patch Changes

• Updated dependencies [bbf324c]
• Updated dependencies [d8a4e9e]
• Updated dependencies [3011b70]
• Updated dependencies [211d271]
• Updated dependencies [bbf324c]
• Updated dependencies [ea7250c]
  • @​lottiefiles/dotlottie-web@​0.82.0

0.20.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

Patch Changes

• 629eb6c: Avoid loading the initial src twice when the React player is mounted. Both the regular and worker players now rely on their constructor to load the first animation, while later src changes still call load.
• Updated dependencies [e46482e]
  • @​lottiefiles/dotlottie-web@​0.81.0

0.19.16

Patch Changes

• Updated dependencies [0874fae]
• Updated dependencies [727add3]
  • @​lottiefiles/dotlottie-web@​0.80.0

0.19.15

Patch Changes

• Updated dependencies [14aee74]
  • @​lottiefiles/dotlottie-web@​0.79.2

Commits

• 2f3693a chore: update versions (#996)
• 65d576c chore: update versions (#989)
• bbf324c feat: audio volume control, dotlottie-rs e09b196 (#991)
• 4be8c16 test(react): use a real animationId in the same-id rerender test (#988)
• e34f2cf chore: update versions (#971)
• 629eb6c fix(react): avoid reloading initial animation source (#977)
• e46482e feat(web): add setWorkerUrl() for CSP-compatible worker loading (#968)
• bb5abcf chore: update versions (#964)
• 7f717f9 chore: update versions (#956)
• See full diff in compare view

Updates @lottiefiles/dotlottie-web from 0.79.1 to 0.82.1

Release notes

Sourced from @​lottiefiles/dotlottie-web's releases.

@​lottiefiles/dotlottie-web@​0.82.1

Patch Changes

• a0a6601: Freeze an autoplaying animation whose canvas isn't rendered (for example inside a display: none ancestor) when freezeOnOffscreen is on. The load-time viewport check treated the canvas's 0x0 rect at (0, 0) as visible, so if setRenderConfig() ran before load (as DotLottieReact does on mount), the hidden animation kept rendering every frame.

@​lottiefiles/dotlottie-web@​0.82.0

Minor Changes

• bbf324c: Add audio volume control: a volume config option, setVolume() and a volume getter on DotLottie and DotLottieWorker, and a volume prop on the React, Vue, Svelte, Solid and web component players. It goes from 0 (muted) to 1 (full), defaults to 1, and is kept across loads.

• d8a4e9e: chore: remove experimental MP4 video asset support and bump thorvg to v1.1.2

  fix: text glyphs dropped when multiple players share an embedded font (#877)

Patch Changes

• 3011b70: fix: apply the themeId and animationId config options on load
• 211d271: fix: Marker type is now { name, start, end }
• bbf324c: Update dotlottie-rs WASM bindings to e09b196. Audio now plays WAV, FLAC, Ogg and M4A, uses the left channel of a layer's volume (static [100, 0] levels were silent), and a volume above 100% or below 0 no longer breaks the player.
• ea7250c: Update dotlottie-rs WASM bindings to v0.1.60 (thorvg v1.1.3). Themes now support BezierPath rules and skip unknown rule types instead of failing.

@​lottiefiles/dotlottie-web@​0.81.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

@​lottiefiles/dotlottie-web@​0.80.0

Minor Changes

• 0874fae: feat: add experimental support for MP4 video assets in dotLottie files

Patch Changes

• 727add3: fix: setWasmUrl() disables the jsdelivr/unpkg fallback instead of still reaching unpkg when the configured URL fails; DotLottieWorker.setWasmUrl() resolves relative URLs against the page (the blob worker can't) and reaches workers that exist but haven't started loading

@​lottiefiles/dotlottie-web@​0.79.2

Patch Changes

• 14aee74: Update dotlottie-rs WASM bindings to 0f16fb8.

Changelog

Sourced from @​lottiefiles/dotlottie-web's changelog.

0.82.1

Patch Changes

• a0a6601: Freeze an autoplaying animation whose canvas isn't rendered (for example inside a display: none ancestor) when freezeOnOffscreen is on. The load-time viewport check treated the canvas's 0x0 rect at (0, 0) as visible, so if setRenderConfig() ran before load (as DotLottieReact does on mount), the hidden animation kept rendering every frame.

0.82.0

Minor Changes

• bbf324c: Add audio volume control: a volume config option, setVolume() and a volume getter on DotLottie and DotLottieWorker, and a volume prop on the React, Vue, Svelte, Solid and web component players. It goes from 0 (muted) to 1 (full), defaults to 1, and is kept across loads.

• d8a4e9e: chore: remove experimental MP4 video asset support and bump thorvg to v1.1.2

  fix: text glyphs dropped when multiple players share an embedded font (#877)

Patch Changes

• 3011b70: fix: apply the themeId and animationId config options on load
• 211d271: fix: Marker type is now { name, start, end }
• bbf324c: Update dotlottie-rs WASM bindings to e09b196. Audio now plays WAV, FLAC, Ogg and M4A, uses the left channel of a layer's volume (static [100, 0] levels were silent), and a volume above 100% or below 0 no longer breaks the player.
• ea7250c: Update dotlottie-rs WASM bindings to v0.1.60 (thorvg v1.1.3). Themes now support BezierPath rules and skip unknown rule types instead of failing.

0.81.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

0.80.0

Minor Changes

• 0874fae: feat: add experimental support for MP4 video assets in dotLottie files

Patch Changes

• 727add3: fix: setWasmUrl() disables the jsdelivr/unpkg fallback instead of still reaching unpkg when the configured URL fails; DotLottieWorker.setWasmUrl() resolves relative URLs against the page (the blob worker can't) and reaches workers that exist but haven't started loading

0.79.2

Patch Changes

• 14aee74: Update dotlottie-rs WASM bindings to 0f16fb8.

Commits

• 2f3693a chore: update versions (#996)
• a0a6601 fix(web): freeze an unrendered canvas when setRenderConfig() runs before load...
• 65d576c chore: update versions (#989)
• bbf324c feat: audio volume control, dotlottie-rs e09b196 (#991)
• ea7250c chore: update dotlottie-rs wasm bindings to v0.1.60 (#990)
• 211d271 fix(web): align Marker type with core { name, start, end } (#987)
• d8a4e9e chore: bump dotlottie-rs, drop video support (#981)
• 3011b70 fix(web): apply themeId and animationId config on load (#980)
• e34f2cf chore: update versions (#971)
• e46482e feat(web): add setWorkerUrl() for CSP-compatible worker loading (#968)
• Additional commits viewable in compare view

Updates @matrix-org/matrix-sdk-crypto-wasm from 18.4.0 to 19.0.0

Release notes

Sourced from @​matrix-org/matrix-sdk-crypto-wasm's releases.

v19.0.0

matrix-sdk-crypto-wasm v19.0.0

• Update matrix-rust-sdk to 1e54358136b

  • SAS verification now cancels with m.mismatched_commitment instead of m.key_mismatch when the public key in the other side's m.key.verification.key event doesn't match the commitment from its m.key.verification.accept event, as the spec requires. (#7270)
  • Decrypted m.room_key to-device events passed to the application now keep their shared_history flag. Previously, the flag was dropped when the session key was zeroized, so applications always saw it as false. (#7256)
  • [breaking] The shared_history flag of m.room_key contents, exported room keys and backed-up room keys is now (de)serialized as shared_history, as defined in the Matrix specification, instead of m.shared_history. The previous m.shared_history name and the unstable org.matrix.msc3061.shared_history name are still accepted when deserializing. Previously, keys from spec-compliant senders were treated as not shareable with newly invited users. Versions of the SDK before this change do not recognise the shared_history name, so they read keys, exports and backups written by this version as not shareable. (#7190)
  • Room keys imported from a backup or file export are no longer made undecryptable under the CrossSignedOrLegacy trust requirement once the sender's device is fetched via /keys/query. Previously, the device lookup replaced the session's sender data with less useful data, dropping its legacy flag, and its events failed with "The sending device is not known". (#7172)
  • [breaking] Attempting to create a QrCodeData with new_msc4388 now returns an error if the rendezvous ID or base URL are longer than 255 bytes of UTF-8. This complies with MSC4388. (#7130)

• Expose the vodozemac HPKE support, which replaces the ECIES module. It can be used to establish the secure channel required for QR code login described in MSC4388. #310

• Update dependencies to their latest versions.

v18.9.2

No functional changes.

v18.9.1

• Update vodozemac to 0.11.2, which fixes a panic when decoding Ed25519 keys from Base64, along with several zeroization issues. (0.11.2)

v18.9.0

matrix-sdk-crypto-wasm v18.9.0

... (truncated)

Changelog

Sourced from @​matrix-org/matrix-sdk-crypto-wasm's changelog.

matrix-sdk-crypto-wasm v19.0.0

• Update matrix-rust-sdk to 1e54358136b

  • SAS verification now cancels with m.mismatched_commitment instead of m.key_mismatch when the public key in the other side's m.key.verification.key event doesn't match the commitment from its m.key.verification.accept event, as the spec requires. (#7270)
  • Decrypted m.room_key to-device events passed to the application now keep their shared_history flag. Previously, the flag was dropped when the session key was zeroized, so applications always saw it as false. (#7256)
  • [breaking] The shared_history flag of m.room_key contents, exported room keys and backed-up room keys is now (de)serialized as shared_history, as defined in the Matrix specification, instead of m.shared_history. The previous m.shared_history name and the unstable org.matrix.msc3061.shared_history name are still accepted when deserializing. Previously, keys from spec-compliant senders were treated as not shareable with newly invited users. Versions of the SDK before this change do not recognise the shared_history name, so they read keys, exports and backups written by this version as not shareable. (#7190)
  • Room keys imported from a backup or file export are no longer made undecryptable under the CrossSignedOrLegacy trust requirement once the sender's device is fetched via /keys/query. Previously, the device lookup replaced the session's sender data with less useful data, dropping its legacy flag, and its events failed with "The sending device is not known". (#7172)
  • [breaking] Attempting to create a QrCodeData with new_msc4388 now returns an error if the rendezvous ID or base URL are longer than 255 bytes of UTF-8. This complies with MSC4388. (#7130)

• Expose the vodozemac HPKE support, which replaces the ECIES module. It can be used to establish the secure channel required for QR code login described in MSC4388. #310

• Update dependencies to their latest versions.

matrix-sdk-crypto-wasm v18.9.0

• Update matrix-rust-sdk to 0.19.1

  • (No significant changes for matrix-rust-sdk-crypto)

• Update matrix-rust-sdk to 0.19.0

  • (No significant changes for matrix-rust-sdk-crypto)

... (truncated)

Commits

• 662fdfc Update formatting for new nightly version
• f78db57 v19.0.0
• c889366 Changelog for v19.0.0
• 402d3db Update dependencies
• ff94d22 Update matrix-rust-sdk to 1e54358136b
• c9a58fd Fix building outside of a git worktree
• d8cdbd9 Merge pull request #361 from matrix-org/andybalaam/update-rust-sdk-to-12f7c8353
• 39cde8b Update rust-sdk to 12f7c8353
• daceb38 Bump the vodozemac version
• dd74f95 Add a test:unit action that allows passing command-line arguments to jest
• Additional commits viewable in compare view

Updates @noble/hashes from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates @rolldown/plugin-node-polyfills from 1.0.3 to 1.0.4

Commits

• 83da501 1.0.4
• f7269e6 fix: polyfill node: prefixed built-in imports (#55)
• 538828c chore(deps): update oxc apps (#50)
• 60c96c5 chore(deps): update vitest to 4.1.12 and add vite 8 (#58)
• b4df7df chore: bump root pnpm to 11.1.2 (#48)
• c5e0125 chore(deps): update oxc apps (#47)
• 018a6a5 chore(deps): update oxc apps (#45)
• 0d67b67 chore(deps): update oxc apps (#44)
• de01dcb chore(deps): update dependency rolldown to v1.0.0 (#43)
• a60f437 chore(deps): update oxc apps (#41)
• Additional commits viewable in compare view

Updates @sableclient/tauri-plugin-livekit-mobile from 0.2.0 to 0.7.0

Release notes

Sourced from @​sableclient/tauri-plugin-livekit-mobile's releases.

v0.7.0

Full Changelog: SableClient/tauri-plugin-livekit-mobile@v0.6.0...v0.7.0

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.7.0

v0.6.0

Full Changelog: SableClient/tauri-plugin-livekit-mobile@v0.5.0...v0.6.0

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.6.0

v0.5.0

Choose the microphone during an Android call

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.5.0

v0.4.0

Adds microphone processing and per-participant playout volume to the native call bridge.

Added

• setNativeCallAudioProcessing — echo cancellation, noise suppression and automatic gain control, applied to the live microphone track rather than only the next call.
• setNativeCallParticipantVolume — per-identity playout gain. 0 mutes, 1 is unity, and both platform SDKs clamp at 10.
• connectNativeCall takes an optional audioProcessing block. Omitted means every effect on, which is both SDKs' own default, so an existing guest is unchanged.

Gains are re-applied on TrackSubscribed: a track arrives at unity gain, so a volume set before a participant publishes — or before a reconnect resubscribes them — would otherwise be lost.

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.4.0

v0.3.0

What's Changed

• feat: expose reportIncomingCall for the system incoming-call screen by @​eleboucher in SableClient/tauri-plugin-livekit-mobile#1

New Contributors

• @​eleboucher made their first contribution in SableClient/tauri-plugin-livekit-mobile#1

... (truncated)

Commits

• e4c6767 feat(ios): start the outgoing CallKit call when connecting
• 26f2fcc fix(ios): disable CallKit for China storefronts