Block a user
npm audit: 11 advisories in runtime deps (pdfjs-dist JS-execution, react-router, sanitize-html, katex, uuid)
OIDC callback does not invalidate a cached client id the provider rejects
Dedupe the screenshare confirmation and route CallControls through useRoomCallPolicy
Voice-channel "Channel Full" limit is bypassed by joining from the sidebar
Soundboard upload limit double-counts staged clips and reads a stale count
Notification profile presets don't clear an active "Pause Notifications" snooze
Call-status bar bypasses the room screenshare/camera policy and the share confirmation
Avatar Decoration settings panel shows "None" on any fetch failure, not just true absence
Profile field edits can be clobbered by a slow-loading initial fetch (pronouns, timezone, avatar decoration)
Room widgets never render — matrix-widget-api 1.17.0
isValidUrl is broken
OIDC token refresh force-reloads every other tab, dropping in-progress calls
Any OIDC login failure discards the cached dynamic client id
Push-to-talk, the deafen hotkey and AFK auto-mute stop working outside the call room
PTT window blur/focus force-mutes unconditionally, revoking a manual unmute
In-iframe PTT/deafen key listeners are lost if the EC iframe reloads
Bookmarks and reminders upload decrypted message text to server account data
Persistent search index keeps decrypted plaintext of redacted messages and left rooms