Block a user
npm audit: 11 advisories in runtime deps (pdfjs-dist JS-execution, react-router, sanitize-html, katex, uuid)
"Focus camera" pins a participant with no way to unpin
CallControl.setPipMode writes state nothing reads
Soundboard clip blob URLs are never revoked and survive logout
No warning when closing the tab or reloading during an active call
RoomMemberEvent.Membership listener on Room never fires (dead handler)
OIDC callback does not invalidate a cached client id the provider rejects
Dedupe the screenshare confirmation and route CallControls through useRoomCallPolicy
Voice-channel "Channel Full" limit is bypassed by joining from the sidebar
Soundboard upload limit double-counts staged clips and reads a stale count
Notification profile presets don't clear an active "Pause Notifications" snooze
Call-status bar bypasses the room screenshare/camera policy and the share confirmation
Avatar Decoration settings panel shows "None" on any fetch failure, not just true absence
Profile field edits can be clobbered by a slow-loading initial fetch (pronouns, timezone, avatar decoration)
Room widgets never render — matrix-widget-api 1.17.0
isValidUrl is broken
OIDC token refresh force-reloads every other tab, dropping in-progress calls
Any OIDC login failure discards the cached dynamic client id
Persistent search index keeps decrypted plaintext of redacted messages and left rooms