RoomMemberEvent.Membership is emitted on the RoomMember object and re-emitted only on the MatrixClient (matrix-js-sdk/lib/sync.js:1758), never on Room. The (room as any).on(RoomMemberEvent.Membership, onMembership) cast silences the type error but the handler can never run, so read-receipt positions are not recomputed when someone joins/leaves — they only refresh on the next receipt. The as any cast is what hid the mistake.
How to trigger
Have a member leave a room while its timeline is open; their read avatar stays until an unrelated receipt arrives.
Suggested fix
Subscribe on the client (mx.on(RoomMemberEvent.Membership, …) filtered by roomId) and drop the as any.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** bug · **Confidence:** high
**Location:** `src/app/hooks/useRoomReadPositions.ts:57,61`
### Problem
`RoomMemberEvent.Membership` is emitted on the `RoomMember` object and re-emitted only on the **MatrixClient** (`matrix-js-sdk/lib/sync.js:1758`), never on `Room`. The `(room as any).on(RoomMemberEvent.Membership, onMembership)` cast silences the type error but the handler can never run, so read-receipt positions are not recomputed when someone joins/leaves — they only refresh on the next receipt. The `as any` cast is what hid the mistake.
### How to trigger
Have a member leave a room while its timeline is open; their read avatar stays until an unrelated receipt arrives.
### Suggested fix
Subscribe on the client (`mx.on(RoomMemberEvent.Membership, …)` filtered by `roomId`) and drop the `as any`.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:20 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: bug · Confidence: high
Location:
src/app/hooks/useRoomReadPositions.ts:57,61Problem
RoomMemberEvent.Membershipis emitted on theRoomMemberobject and re-emitted only on the MatrixClient (matrix-js-sdk/lib/sync.js:1758), never onRoom. The(room as any).on(RoomMemberEvent.Membership, onMembership)cast silences the type error but the handler can never run, so read-receipt positions are not recomputed when someone joins/leaves — they only refresh on the next receipt. Theas anycast is what hid the mistake.How to trigger
Have a member leave a room while its timeline is open; their read avatar stays until an unrelated receipt arrives.
Suggested fix
Subscribe on the client (
mx.on(RoomMemberEvent.Membership, …)filtered byroomId) and drop theas any.Filed from the September 2026 client audit (branch
lotus@4bea4895).