🔒 Security

• Fixes for CVE-2023-37259 / GHSA-c9vx-2g7w-rp65

🦖 Deprecations

• Deprecate customisations in favour of Module API (#25736). Fixes #25733.

✨ Features

• OIDC: store initial screen in session storage (#25688). Fixes #25656. Contributed by @kerryarchibald.
• Allow default_server_config as a fallback config (#25682). Contributed by @ShadowRZ.
• OIDC: remove auth params from url after login attempt (#25664). Contributed by @kerryarchibald.
• feat(faq): remove keyboard shortcuts button (#9342). Fixes #22625. Contributed by @gefgu.
• GYU: Update banner (#11211). Fixes #25530. Contributed by @justjanne.
• Linkify mxc:// URLs as links to your media repo (#11213). Fixes #6942.
• OIDC: Log in (#11199). Fixes #25657. Contributed by @kerryarchibald.
• Handle all permitted url schemes in linkify (#11215). Fixes #4457 and #8720.
• Autoapprove Element Call oidc requests (#11209). Contributed by @toger5.
• Allow creating knock rooms (#11182). Contributed by @charlynguyen.
• Expose and pre-populate thread ID in devtools dialog (#10953).
• Hide URL preview if it will be empty (#9029).
• Change wording from avatar to profile picture (#7015). Fixes vector-im/element-meta#1331. Contributed by @aaronraimist.
• Quick and dirty devtool to explore state history (#11197).
• Consider more user inputs when calculating zxcvbn score (#11180).
• GYU: Account Notification Settings (#11008). Fixes #24567. Contributed by @justjanne.
• Compound Typography pass (#11103). Fixes #25548.
• OIDC: navigate to authorization endpoint (#11096). Fixes #25574. Contributed by @kerryarchibald.

🐛 Bug Fixes

• Fix read receipt sending behaviour around thread roots (#3600).
• Fix missing metaspace notification badges (#11269). Fixes #25679.
• Make checkboxes less rounded (#11224). Contributed by @andybalaam.
• GYU: Fix issues with audible keywords without activated mentions (#11218). Contributed by @justjanne.
• PosthogAnalytics unwatch settings on logout (#11207). Fixes #25703.
• Avoid trying to set room account data for pinned events as guest (#11216). Fixes #6300.
• GYU: Disable sound for DMs checkbox when DM notifications are disabled (#11210). Contributed by @justjanne.
• force to allow calls without video and audio in embedded mode (#11131). Contributed by @EnricoSchw.
• Fix room tile text clipping (#11196). Fixes #25718.
• Handle newlines in user pills (#11166). Fixes #10994.
• Limit width of user menu in space panel (#11192). Fixes #22627.
• Add isLocation to ComposerEvent analytics events (#11187). Contributed by @andybalaam.
• Fix: hide unsupported login elements (#11185). Fixes #25711. Contributed by @kerryarchibald.
• Scope smaller font size to user info panel (#11178). Fixes #25683.
• Apply i18n to strings in the html export (#11176).
• Inhibit url previews on MXIDs containing slashes same as those without (#11160).
• Make event info size consistent with state events (#11181).
• Fix markdown content spacing (#11177). Fixes #25685.
• Fix font-family definition for emojis (#11170). Fixes #25686.
• Fix spurious error sending receipt in thread errors (#11157).
• Consider the empty push rule actions array equiv to deprecated dont_notify (#11155). Fixes #25674.
• Only trap escape key for cancel reply if there is a reply (#11140). Fixes #25640.
• Update linkify to 4.1.1 (#11132). Fixes #23806.