10 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	43cbd8409d	chore(deps): security fixes for dev/build tooling (Storybook, Vitest, Vite, transitive) ... The npm advisory database flagged 19 packages in pnpm-lock.yaml. None of them ship in the embedded call bundle (checked against the built dist); they run on developer machines and in CI: - storybook / @storybook/* 10.6.0 -> 10.6.3: critical, dev server code injection from the local network. - vitest 4.1.12 (+ @vitest/ui unpinned to ^4.1.12), tinypool ^2.1.2: mock registration code injection, prototype-pollution RCE. - vite ^8.3.5: dev-server file exposure, launch-editor issues. - Overrides for transitive tooling: brace-expansion, browserslist, smol-toml, source-map-js, postcss-selector-parser, baseline-browser- mapping, fflate, pbkdf2, zod 4; existing qs/js-yaml/undici/dompurify overrides raised to the fixed versions. Left: elliptic (no fixed release, low), zod 3 (no 3.x fix; a dependency pins it). Lotus unit tests 144/144, build:embedded OK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-25 23:50:09 -04:00
Valere	979b521563	Build Element Call as a component a host can import ... Adds component/index.tsx as a fourth build target: <ElementCall client roomId /> and an initializeElementCall to await once beforehand. It gives Element Call everything it would otherwise take from the page it is on — the parameters, the host bridge, media devices, translations, a container to confine itself to — and hands it the host's client rather than finding one of its own. React, the Matrix SDK and LiveKit stay external, since the host has them and a second copy of any would not merely be wasteful: React would hold two sets of hooks and the client would run two sync loops. Every subpath has to be listed by name, because the pattern and callback forms of rollupOptions.external are silently ignored here — a lesson worth the comment that records it. Element Call's own navigation runs in a MemoryRouter, so being embedded cannot disturb the host's URL. ClientContext and GroupCallView both navigate, so some router has to be present. The bundle is not yet a reasonable size: library mode base64-inlines assets referenced through import.meta.url, so MediaPipe's vision runtime lands in it whole. Left for its own change, since the fix — loading the background blur transformer lazily — is worth doing for the standalone app too.	2026-09-03 15:18:03 +02:00
Robin	81da4c9093	Remove need to approve builds of matrix-js-sdk after every update	2026-08-10 13:13:58 +02:00
Robin	66a676f2f5	Resolve most existing Dependbot warnings	2026-07-15 18:05:06 +02:00
Robin	3e9d7b7cf7	Exclude packages developed in-house from release age requirements	2026-07-13 17:00:02 +02:00
Johannes Marbach	669f4264c7	Reformat ... Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>	2026-06-17 15:35:47 +02:00
Johannes Marbach	dc6511b99e	Document why we override resolved versions	2026-06-17 15:33:36 +02:00
Johannes Marbach	032968ea2d	Merge branch 'livekit' into johannes/pnpm-11	2026-06-17 15:07:28 +02:00
Johannes Marbach	9537c7657c	Switch to pnpm 11.6.0	2026-06-15 12:34:32 +02:00
Timo K	d28cad3f12	fix matrix-js-sdk branch reference	2026-04-21 16:45:00 +02:00