Update zxcvbn-ts monorepo to v4 (#33880)

* Update zxcvbn-ts monorepo to v4

* Handle breaking changes

* Improve coverage

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Michael Telatynski <7t3chguy@gmail.com>

apps/web/src/utils/PasswordScorer.test.ts

@@ -0,0 +1,37 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { vi, describe, it, expect } from "vitest";
+import { ZxcvbnFactory } from "@zxcvbn-ts/core";
+
+import { scorePassword, baseOptions } from "./PasswordScorer.ts";
+
+vi.mock("../languageHandler", () => ({
+    getCurrentLanguage: vi.fn().mockReturnValue("en"),
+    _t: vi.fn((k) => k),
+}));
+vi.mock("../SdkConfig", () => ({
+    default: {
+        get: vi.fn().mockReturnValue({
+            brand: "BRAND",
+        }),
+    },
+}));
+
+describe("scorePassword", () => {
+    const baseZxcvbn = new ZxcvbnFactory(baseOptions);
+
+    it("should handle inputs with spaces by removing them", () => {
+        const input = "apple banana cherry";
+        const baseResult = baseZxcvbn.check(input);
+
+        const output = scorePassword(null, input);
+        expect(output).toBeDefined();
+        expect(output!.score).toBe(3);
+        expect(output!.score).toBeLessThan(baseResult.score);
+    });
+});

apps/web/src/utils/PasswordScorer.ts

@@ -5,7 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Com
 Please see LICENSE files in the repository root for full details.
 */
 
-import { zxcvbn, zxcvbnOptions, type ZxcvbnResult, type TranslationKeys } from "@zxcvbn-ts/core";
+import { ZxcvbnFactory, type ZxcvbnResult, type TranslationKeys } from "@zxcvbn-ts/core";
 import * as zxcvbnCommonPackage from "@zxcvbn-ts/language-common";
 import * as zxcvbnEnPackage from "@zxcvbn-ts/language-en";
 import { type MatrixClient } from "matrix-js-sdk/src/matrix";
@@ -13,7 +13,11 @@ import { type MatrixClient } from "matrix-js-sdk/src/matrix";
 import { _t } from "../languageHandler";
 import SdkConfig from "../SdkConfig";
 
-zxcvbnOptions.setOptions({
+/**
+ * Base zxcvbn options
+ * @knipignore - exported for tests
+ */
+export const baseOptions = {
     dictionary: {
         ...zxcvbnCommonPackage.dictionary,
         ...zxcvbnEnPackage.dictionary,
@@ -21,7 +25,7 @@ zxcvbnOptions.setOptions({
     },
     graphs: zxcvbnCommonPackage.adjacencyGraphs,
     useLevenshteinDistance: true,
-});
+};
 
 function getTranslations(): TranslationKeys {
     return {
@@ -95,12 +99,15 @@ export function scorePassword(
         }
     }
 
-    zxcvbnOptions.setTranslations(getTranslations());
+    const zxcvbn = new ZxcvbnFactory({
+        ...baseOptions,
+        translations: getTranslations(),
+    });
 
-    let zxcvbnResult = zxcvbn(password, inputs);
+    let zxcvbnResult = zxcvbn.check(password, inputs);
     // Work around https://github.com/dropbox/zxcvbn/issues/216
     if (password.includes(" ")) {
-        const resultNoSpaces = zxcvbn(password.replace(/ /g, ""), inputs);
+        const resultNoSpaces = zxcvbn.check(password.replace(/ /g, ""), inputs);
         if (resultNoSpaces.score < zxcvbnResult.score) zxcvbnResult = resultNoSpaces;
     }