Part of #201. Owner decision 2026-10-24: upgrade the SDKs. This PR is cinny; Element Call is separate.
What it brings: three releases (42.x–44.0) of MatrixRTC and delayed-event fixes, and matrix-sdk-crypto-wasm 18.3.1 → 18.9.0.
Breaking changes handled
SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts. The native-OAuth sign-in is ported. It's used only by people on homeservers with native OAuth (e.g. matrix.org); Lotus uses password and SSO login, which is unchanged.
Login: discovers the auth server via /auth_metadata (the same source the SDK uses to refresh) and registers with OAuth2.registerClient. The PKCE verifier and device are kept in a single-use sessionStorage entry keyed by state (the CSRF check). Results come back in the query string (response_mode=query).
Refresh: done by the SDK (oauthClientId + onTokenRefresh), which persists the rotated tokens. #16 (two tabs signing each other out) is kept. The SDK's OAuth calls use the global fetch, not fetchFn, so a narrow guard on refresh-token grants serialises them with a Web Lock. It adopts a sibling tab's tokens instead of spending a used refresh token, and persists before releasing the lock.
Logout and forced logout: go through mx.logout(), which for OAuth sessions revokes at the auth server instead of calling /logout.
Callback render loop: the callback parsed its params on every render, so the single-use code exchange ran in a loop and froze the page. It's parsed once now.
notification_type is deprecated in MSC4075. When it's omitted: ring in DMs, notify quietly elsewhere (as Element Web does). Today's senders still set it.
PWA precache limit raised from 6 to 10 MB: the crypto wasm is now 7.8 MB, and every session loads it anyway.
Verified locally
Upgrade path, the important one:
signed in and sent an encrypted message on the current production build (41.7 / wasm 18.3.1);
swapped in this build on the same origin and profile;
the crypto store migrated (IndexedDB schema v6 → v8), with the same device (no new device);
the old message still decrypts, and a new one sent on 44 decrypts after another reload;
no "unable to decrypt".
⚠️ The migration is one-way: rolling the web app back below this would hit the IndexedDB version conflict, which the existing handler turns into the "clear cache and reload" screen.
New e2e/oauth-sdk44.spec.ts: a real local Synapse with a faked auth server that hands out real Synapse tokens.
registration, then a PKCE-verified code exchange, then the session saved;
the token "expires" in two tabs at once: exactly one refresh reaches the auth server, the other tab adopts the result, and neither is signed out;
logout through the UI revokes both tokens.
Full Playwright suite: 42 passed, 3 skipped (need prod secrets), 1 failure. That was the touch long-press test, which then passed 2 of 2 on its own, so it's intermittent and unrelated.
Unit tests: 1,423 pass, including new tests for the refresh guard (adopt, persist, other accounts, pass-through) and the pending sign-in store. Lint is at 29.
Follow-up, not in this PR: matrix.org's .well-known no longer advertises an OAuth issuer, so the login page offers matrix.org users the password/SSO compatibility flow rather than native OAuth (/login says oauth_aware_preferred). Detecting via /auth_metadata would fix that. It works today either way.
Part of #201. Owner decision 2026-10-24: upgrade the SDKs. This PR is cinny; Element Call is separate.
**What it brings:** three releases (42.x–44.0) of MatrixRTC and delayed-event fixes, and matrix-sdk-crypto-wasm 18.3.1 → 18.9.0.
**Breaking changes handled**
- **SDK 43 moved OAuth (MSC3861) into the SDK** and dropped `oidc-client-ts`. The native-OAuth sign-in is ported. It's used only by people on homeservers with native OAuth (e.g. matrix.org); Lotus uses password and SSO login, which is unchanged.
- **Login:** discovers the auth server via `/auth_metadata` (the same source the SDK uses to refresh) and registers with `OAuth2.registerClient`. The PKCE verifier and device are kept in a single-use sessionStorage entry keyed by `state` (the CSRF check). Results come back in the query string (`response_mode=query`).
- **Refresh:** done by the SDK (`oauthClientId` + `onTokenRefresh`), which persists the rotated tokens. **#16 (two tabs signing each other out) is kept.** The SDK's OAuth calls use the global `fetch`, not `fetchFn`, so a narrow guard on refresh-token grants serialises them with a Web Lock. It adopts a sibling tab's tokens instead of spending a used refresh token, and persists before releasing the lock.
- **Logout and forced logout:** go through `mx.logout()`, which for OAuth sessions revokes at the auth server instead of calling `/logout`.
- **Callback render loop:** the callback parsed its params on every render, so the single-use code exchange ran in a loop and froze the page. It's parsed once now.
- **`notification_type`** is deprecated in MSC4075. When it's omitted: ring in DMs, notify quietly elsewhere (as Element Web does). Today's senders still set it.
- `_onRTCSessionMemberUpdate()` → `ensureRecalculateSessionMembers()`.
- **PWA precache limit** raised from 6 to 10 MB: the crypto wasm is now 7.8 MB, and every session loads it anyway.
**Verified locally**
- **Upgrade path, the important one:**
- signed in and sent an encrypted message on the current production build (41.7 / wasm 18.3.1);
- swapped in this build on the same origin and profile;
- the crypto store migrated (IndexedDB schema v6 → v8), with the **same device** (no new device);
- the old message still decrypts, and a new one sent on 44 decrypts after another reload;
- no "unable to decrypt".
- ⚠️ The migration is one-way: rolling the web app back below this would hit the IndexedDB version conflict, which the existing handler turns into the "clear cache and reload" screen.
- **New `e2e/oauth-sdk44.spec.ts`:** a real local Synapse with a faked auth server that hands out real Synapse tokens.
- registration, then a PKCE-verified code exchange, then the session saved;
- the token "expires" in **two tabs at once**: exactly **one** refresh reaches the auth server, the other tab adopts the result, and neither is signed out;
- logout through the UI revokes both tokens.
- **Full Playwright suite:** 42 passed, 3 skipped (need prod secrets), 1 failure. That was the touch long-press test, which then passed 2 of 2 on its own, so it's intermittent and unrelated.
- **Unit tests:** 1,423 pass, including new tests for the refresh guard (adopt, persist, other accounts, pass-through) and the pending sign-in store. Lint is at 29.
**Follow-up, not in this PR:** matrix.org's `.well-known` no longer advertises an OAuth issuer, so the login page offers matrix.org users the password/SSO compatibility flow rather than native OAuth (`/login` says `oauth_aware_preferred`). Detecting via `/auth_metadata` would fix that. It works today either way.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Picks up three releases of MatrixRTC / delayed-event fixes and
matrix-sdk-crypto-wasm 18.3.1 -> 18.9.0.
SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts, so
the native-OAuth sign-in is ported:
- login discovers the auth server via /auth_metadata, registers with
OAuth2.registerClient, and keeps the PKCE verifier + device in its own
sessionStorage entry keyed by `state` (single use; CSRF check);
- refresh is done by the SDK (oauthClientId + onTokenRefresh); the #16
cross-tab protection is kept by a narrow guard on refresh-token grants
(the SDK calls the global fetch for OAuth, not fetchFn), which
serialises them with a Web Lock and adopts a sibling tab's tokens;
- logout and forced logout revoke via mx.logout() (the SDK revokes at
the auth server for OAuth sessions);
- the callback page parsed its params on every render, re-running the
single-use code exchange in a loop; parsed once now.
Also: notification_type is deprecated in MSC4075 (ring in DMs, notify
elsewhere when omitted), _onRTCSessionMemberUpdate ->
ensureRecalculateSessionMembers, precache limit 6 -> 10 MB for the
7.8 MB crypto wasm.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #201. Owner decision 2026-10-24: upgrade the SDKs. This PR is cinny; Element Call is separate.
What it brings: three releases (42.x–44.0) of MatrixRTC and delayed-event fixes, and matrix-sdk-crypto-wasm 18.3.1 → 18.9.0.
Breaking changes handled
oidc-client-ts. The native-OAuth sign-in is ported. It's used only by people on homeservers with native OAuth (e.g. matrix.org); Lotus uses password and SSO login, which is unchanged./auth_metadata(the same source the SDK uses to refresh) and registers withOAuth2.registerClient. The PKCE verifier and device are kept in a single-use sessionStorage entry keyed bystate(the CSRF check). Results come back in the query string (response_mode=query).oauthClientId+onTokenRefresh), which persists the rotated tokens. #16 (two tabs signing each other out) is kept. The SDK's OAuth calls use the globalfetch, notfetchFn, so a narrow guard on refresh-token grants serialises them with a Web Lock. It adopts a sibling tab's tokens instead of spending a used refresh token, and persists before releasing the lock.mx.logout(), which for OAuth sessions revokes at the auth server instead of calling/logout.notification_typeis deprecated in MSC4075. When it's omitted: ring in DMs, notify quietly elsewhere (as Element Web does). Today's senders still set it._onRTCSessionMemberUpdate()→ensureRecalculateSessionMembers().Verified locally
e2e/oauth-sdk44.spec.ts: a real local Synapse with a faked auth server that hands out real Synapse tokens.Follow-up, not in this PR: matrix.org's
.well-knownno longer advertises an OAuth issuer, so the login page offers matrix.org users the password/SSO compatibility flow rather than native OAuth (/loginsaysoauth_aware_preferred). Detecting via/auth_metadatawould fix that. It works today either way.🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
5206730c72to70206d6033