feat: client-side ClamAV scanning for encrypted rooms (Issue #19)

Synapse's own check_media_file_for_spam module can never see E2EE
attachment content - only the client ever holds the decryption key.
Adds two hooks that call a self-hosted scan service
(https://axion1337.chat/_scan, deployed separately in the gitops repo):

- DecryptFile.ts: scans every decrypted attachment (image/audio/video/
  file all funnel through this one function via MediaEventHelper)
  before returning it as a Blob.
- ContentMessages.ts: scans plaintext before encryption/upload in
  uploadFile(), the shared function behind all attachment uploads
  (main file, thumbnails, voice messages), regardless of room
  encryption state.

New ContentScanRejectedError surfaces through the existing error-
rendering paths (MediaProcessingError, upload failure dialog) using
the same pattern as DecryptError/DownloadError/UploadFailedError.

Live-tested: EICAR blocked pre-upload in encrypted rooms and DMs;
receive-side hook also blocks EICAR sent by an unpatched client
(app.element.io), confirming it isn't just self-protection for our
own uploads. Fails open on scanner errors so an outage can't block
all uploads/downloads.

apps/web/package.json

@@ -81,7 +81,7 @@
         "lodash": "npm:lodash-es@4.18.1",
         "maplibre-gl": "^5.0.0",
         "matrix-encrypt-attachment": "^1.0.3",
-        "matrix-js-sdk": "github:matrix-org/matrix-js-sdk#develop",
+        "matrix-js-sdk": "github:matrix-org/matrix-js-sdk#d19cb751da8bbdc75c19db751fff25f21761d23a",
         "matrix-widget-api": "^1.16.1",
         "memoize-one": "^6.0.0",
         "mime": "^4.0.4",
@@ -125,7 +125,7 @@
         "@babel/preset-react": "^7.12.10",
         "@babel/preset-typescript": "^7.12.7",
         "@casualbot/jest-sonar-reporter": "2.7.0",
-        "@element-hq/element-call-embedded": "0.19.2",
+        "@sorb/threadnet-call-embedded": "0.19.2-threadnet.5",
         "@element-hq/element-web-playwright-common": "workspace:*",
         "@fetch-mock/jest": "^0.2.20",
         "@jest/globals": "^30.2.0",

apps/web/src/ContentMessages.ts

@@ -49,6 +49,7 @@ import SettingsStore from "./settings/SettingsStore";
 import { decorateStartSendingTime, sendRoundTripMetric } from "./sendTimePerformanceMetrics";
 import { TimelineRenderingType } from "./contexts/RoomContext";
 import { addReplyToMessageContent } from "./utils/Reply";
+import { scanContent, ContentScanRejectedError } from "./utils/ContentScanner";
 import ErrorDialog from "./components/views/dialogs/ErrorDialog";
 import UploadFailureDialog from "./components/views/dialogs/UploadFailureDialog";
 import UploadConfirmDialog from "./components/views/dialogs/UploadConfirmDialog";
@@ -350,10 +351,24 @@ export async function uploadFile(
 ): Promise<{ url?: string; file?: EncryptedFile }> {
     const abortController = controller ?? new AbortController();
 
+    // Issue #19 extension: scan the plaintext before it's ever encrypted or uploaded - the
+    // one place both directions of client-side scanning meet, since this function backs
+    // every room-attachment upload (main file, generated thumbnails, and voice messages -
+    // see VoiceMessageRecording.ts) regardless of whether the target room is encrypted.
+    // This does mean reading the whole file into memory even for unencrypted-room uploads,
+    // which previously streamed straight from the File object - unavoidable, since scanning
+    // requires the bytes in hand either way.
+    const dataForScan = await readFileAsArrayBuffer(file);
+    if (abortController.signal.aborted) throw new UploadCanceledError();
+    const accessTokenForScan = matrixClient.getAccessToken();
+    if (accessTokenForScan) {
+        await scanContent(dataForScan, accessTokenForScan);
+    }
+
     // If the room is encrypted then encrypt the file before uploading it.
     if (await matrixClient.getCrypto()?.isEncryptionEnabledInRoom(roomId)) {
-        // First read the file into memory.
-        const data = await readFileAsArrayBuffer(file);
+        // Already read into memory above (dataForScan).
+        const data = dataForScan;
         if (abortController.signal.aborted) throw new UploadCanceledError();
 
         // Then encrypt the file.
@@ -670,6 +685,10 @@ export default class ContentMessages {
                     desc = _t("upload_failed_size", {
                         fileName: upload.fileName,
                     });
+                } else if (unwrappedError instanceof ContentScanRejectedError) {
+                    desc = _t("upload_failed_scan_rejected", {
+                        fileName: upload.fileName,
+                    });
                 }
                 Modal.createDialog(ErrorDialog, {
                     title: _t("upload_failed_title"),

apps/web/src/components/views/messages/MAudioBody.tsx

@@ -21,9 +21,10 @@ import RoomContext, { TimelineRenderingType } from "../../../contexts/RoomContex
 import MediaProcessingError from "./shared/MediaProcessingError";
 import { AudioPlayerViewModel } from "../../../viewmodels/room/timeline/event-tile/body/AudioPlayerViewModel";
 import { FileBodyFactory, renderMBody } from "./MBodyFactory";
+import { ContentScanRejectedError } from "../../../utils/ContentScanner";
 
 interface IState {
-    error?: boolean;
+    error?: unknown;
     playback?: Playback;
 }
 
@@ -40,12 +41,12 @@ export default class MAudioBody extends React.PureComponent<IBodyProps, IState>
                 const blob = await this.props.mediaEventHelper!.sourceBlob.value;
                 buffer = await blob.arrayBuffer();
             } catch (e) {
-                this.setState({ error: true });
+                this.setState({ error: e });
                 logger.warn("Unable to decrypt audio message", e);
                 return; // stop processing the audio file
             }
         } catch (e) {
-            this.setState({ error: true });
+            this.setState({ error: e });
             logger.warn("Unable to decrypt/download audio message", e);
             return; // stop processing the audio file
         }
@@ -81,11 +82,11 @@ export default class MAudioBody extends React.PureComponent<IBodyProps, IState>
 
     public render(): React.ReactNode {
         if (this.state.error) {
-            return (
-                <MediaProcessingError className="mx_MAudioBody">
-                    {_t("timeline|m.audio|error_processing_audio")}
-                </MediaProcessingError>
-            );
+            const errorText =
+                this.state.error instanceof ContentScanRejectedError
+                    ? _t("timeline|m.audio|error_scan_rejected")
+                    : _t("timeline|m.audio|error_processing_audio");
+            return <MediaProcessingError className="mx_MAudioBody">{errorText}</MediaProcessingError>;
         }
 
         if (this.props.forExport) {

apps/web/src/components/views/messages/MImageBody.tsx

@@ -34,6 +34,7 @@ import { presentableTextForFile } from "../../../utils/FileUtils";
 import { createReconnectedListener } from "../../../utils/connection";
 import MediaProcessingError from "./shared/MediaProcessingError";
 import { DecryptError, DownloadError } from "../../../utils/DecryptFile";
+import { ContentScanRejectedError } from "../../../utils/ContentScanner";
 import { useMediaVisible } from "../../../hooks/useMediaVisible";
 import { isMimeTypeAllowed } from "../../../utils/blobs.ts";
 import { FileBodyFactory, renderMBody } from "./MBodyFactory";
@@ -673,6 +674,8 @@ export class MImageBodyInner extends React.Component<IProps, IState> {
                 errorText = _t("timeline|m.image|error_decrypting");
             } else if (this.state.error instanceof DownloadError) {
                 errorText = _t("timeline|m.image|error_downloading");
+            } else if (this.state.error instanceof ContentScanRejectedError) {
+                errorText = _t("timeline|m.image|error_scan_rejected");
             }
 
             return (

apps/web/src/i18n/strings/en_EN.json

@@ -3400,7 +3400,8 @@
         "m.audio": {
             "error_downloading_audio": "Error downloading audio",
             "error_processing_audio": "Error processing audio message",
-            "error_processing_voice_message": "Error processing voice message"
+            "error_processing_voice_message": "Error processing voice message",
+            "error_scan_rejected": "This audio was blocked by the content scanner"
         },
         "m.beacon_info": {
             "view_live_location": "View live location"
@@ -3432,12 +3433,14 @@
             "voice_call_unsupported": "%(senderName)s placed a voice call. (not supported by this browser)"
         },
         "m.file": {
-            "error_decrypting": "Error decrypting attachment"
+            "error_decrypting": "Error decrypting attachment",
+            "error_scan_rejected": "This file was blocked by the content scanner"
         },
         "m.image": {
             "error": "Unable to show image due to error",
             "error_decrypting": "Error decrypting image",
             "error_downloading": "Error downloading image",
+            "error_scan_rejected": "This image was blocked by the content scanner",
             "sent": "%(senderDisplayName)s sent an image.",
             "show_image": "Show image"
         },
@@ -3563,6 +3566,7 @@
         "m.sticker": "%(senderDisplayName)s sent a sticker.",
         "m.video": {
             "error_decrypting": "Error decrypting video",
+            "error_scan_rejected": "This video was blocked by the content scanner",
             "show_video": "Show video"
         },
         "m.widget": {
@@ -3805,6 +3809,7 @@
         "title": "Allow guest users to join this room"
     },
     "upload_failed_generic": "The file '%(fileName)s' failed to upload.",
+    "upload_failed_scan_rejected": "The file '%(fileName)s' was blocked by the content scanner.",
     "upload_failed_size": "The file '%(fileName)s' exceeds this homeserver's size limit for uploads",
     "upload_failed_title": "Upload Failed",
     "upload_file": {

apps/web/src/utils/ContentScanner.ts

@@ -0,0 +1,63 @@
+/*
+Copyright 2026 aXion1337
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+// Client-side ClamAV scanning (Issue #19 extension): Synapse's own server-side spam-checker
+// module can never see E2EE attachment content - only a cooperating client can, since only
+// the client ever holds the room's decryption key. This calls a small self-hosted scan
+// service (same ClamAV instance the server-side module uses) directly from the browser, both
+// before encrypting/uploading a file and after downloading/decrypting one - see
+// ContentMessages.ts (send) and DecryptFile.ts (receive) for the two call sites.
+
+import { logger } from "matrix-js-sdk/src/logger";
+
+export class ContentScanRejectedError extends Error {
+    public readonly signature: string;
+
+    public constructor(signature: string) {
+        super(`Blocked by content scanner: ${signature}`);
+        this.name = "ContentScanRejectedError";
+        this.signature = signature;
+    }
+}
+
+/**
+ * Scans plaintext bytes against the self-hosted ClamAV scan service.
+ * Fails open (resolves normally) on any network/scanner-side error, matching the same
+ * fail-open policy as the server-side Synapse module - a scanner outage should not block
+ * uploads or downloads site-wide.
+ * @throws {ContentScanRejectedError} if the scanner positively identifies the content as infected.
+ */
+export async function scanContent(data: ArrayBuffer | ArrayBufferView, accessToken: string): Promise<void> {
+    let response: Response;
+    try {
+        response = await fetch("/_scan", {
+            method: "POST",
+            headers: { Authorization: `Bearer ${accessToken}` },
+            body: data as BodyInit,
+        });
+    } catch (e) {
+        logger.warn("Content scan request failed (scanner unreachable?) - allowing through", e);
+        return;
+    }
+
+    if (!response.ok) {
+        logger.warn("Content scan request failed with status", response.status, "- allowing through");
+        return;
+    }
+
+    let result: { clean: boolean; signature?: string };
+    try {
+        result = await response.json();
+    } catch (e) {
+        logger.warn("Content scan response was not valid JSON - allowing through", e);
+        return;
+    }
+
+    if (result.clean === false) {
+        throw new ContentScanRejectedError(result.signature ?? "unknown");
+    }
+}

apps/web/src/utils/DecryptFile.ts

@@ -13,6 +13,8 @@ import { type EncryptedFile, type MediaEventInfo } from "matrix-js-sdk/src/types
 
 import { mediaFromContent } from "../customisations/Media";
 import { getBlobSafeMimeType } from "./blobs";
+import { MatrixClientPeg } from "../MatrixClientPeg";
+import { scanContent, ContentScanRejectedError } from "./ContentScanner";
 
 export class DownloadError extends Error {
     public constructor(e: Error) {
@@ -30,6 +32,8 @@ export class DecryptError extends Error {
     }
 }
 
+export { ContentScanRejectedError };
+
 /**
  * Decrypt a file attached to a matrix event.
  * @param {EncryptedFile} file The encrypted file information taken from the matrix event.
@@ -55,19 +59,31 @@ export async function decryptFile(file?: EncryptedFile, info?: MediaEventInfo):
         throw new DownloadError(e as Error);
     }
 
+    let dataArray: ArrayBuffer;
+    let mimetype: string;
     try {
         // Decrypt the array buffer using the information taken from the event content.
-        const dataArray = await encrypt.decryptAttachment(responseData, file!);
-        // Turn the array into a Blob and give it the correct MIME-type.
+        dataArray = await encrypt.decryptAttachment(responseData, file!);
 
         // IMPORTANT: we must not allow scriptable mime-types into Blobs otherwise
         // they introduce XSS attacks if the Blob URI is viewed directly in the
         // browser (e.g. by copying the URI into a new tab or window.)
         // See warning at top of file.
-        const mimetype = getBlobSafeMimeType(info?.mimetype?.split(";")[0].trim() ?? "");
-
-        return new Blob([dataArray], { type: mimetype });
+        mimetype = getBlobSafeMimeType(info?.mimetype?.split(";")[0].trim() ?? "");
     } catch (e) {
         throw new DecryptError(e as Error);
     }
+
+    // Issue #19 extension: Synapse's own media scanner never sees this content (it's
+    // ciphertext to the server) - this is the one place in the whole app where decrypted
+    // plaintext for *every* attachment type first exists, so scanning here covers all of
+    // them in one spot. Deliberately outside the try/catch above: a scan rejection is a
+    // distinct outcome from a decrypt failure, not wrapped as a DecryptError.
+    const accessToken = MatrixClientPeg.safeGet()?.getAccessToken();
+    if (accessToken) {
+        await scanContent(dataArray, accessToken);
+    }
+
+    // Turn the array into a Blob and give it the correct MIME-type.
+    return new Blob([dataArray], { type: mimetype });
 }

apps/web/src/viewmodels/message-body/FileBodyViewModel.ts

@@ -25,6 +25,7 @@ import { FileDownloader } from "../../utils/FileDownloader";
 import { type MediaEventHelper } from "../../utils/MediaEventHelper";
 import { TimelineRenderingType } from "../../contexts/RoomContext";
 import ErrorDialog from "../../components/views/dialogs/ErrorDialog";
+import { ContentScanRejectedError } from "../../utils/ContentScanner";
 
 export interface FileBodyViewModelProps {
     mxEvent: MatrixEvent;
@@ -249,7 +250,10 @@ export class FileBodyViewModel
             logger.warn("Unable to decrypt attachment: ", err);
             Modal.createDialog(ErrorDialog, {
                 title: _t("common|error"),
-                description: _t("timeline|m.file|error_decrypting"),
+                description:
+                    err instanceof ContentScanRejectedError
+                        ? _t("timeline|m.file|error_scan_rejected")
+                        : _t("timeline|m.file|error_decrypting"),
             });
         }
     };

apps/web/src/viewmodels/message-body/VideoBodyViewModel.ts

@@ -23,6 +23,7 @@ import { mediaFromContent } from "../../customisations/Media";
 import { BLURHASH_FIELD } from "../../utils/image-media";
 import { type ImageSize, suggestedSize as suggestedVideoSize } from "../../settings/enums/ImageSize";
 import { type MediaEventHelper } from "../../utils/MediaEventHelper";
+import { ContentScanRejectedError } from "../../utils/ContentScanner";
 
 export interface VideoBodyViewModelProps {
     /**
@@ -203,7 +204,10 @@ export class VideoBodyViewModel
         if (state.error !== null) {
             return {
                 state: VideoBodyViewState.ERROR,
-                errorLabel: _t("timeline|m.video|error_decrypting"),
+                errorLabel:
+                    state.error instanceof ContentScanRejectedError
+                        ? _t("timeline|m.video|error_scan_rejected")
+                        : _t("timeline|m.video|error_decrypting"),
                 maxWidth,
                 maxHeight,
                 aspectRatio,

apps/web/webpack.config.ts

@@ -725,7 +725,7 @@ export default (env: string, argv: Record<string, any>): webpack.Configuration =
                     // Element Call embedded widget
                     {
                         from: "**",
-                        context: path.join(getPackageRoot("@element-hq/element-call-embedded"), "dist"),
+                        context: path.join(getPackageRoot("@sorb/threadnet-call-embedded"), "dist"),
                         to: path.join(__dirname, "webapp", "widgets", "element-call"),
                     },
                     // Mobile guide assets

pnpm-lock.yaml

@@ -469,8 +469,8 @@ importers:
         specifier: ^1.0.3
         version: 1.0.3
       matrix-js-sdk:
-        specifier: github:matrix-org/matrix-js-sdk#develop
-        version: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68
+        specifier: github:matrix-org/matrix-js-sdk#d19cb751da8bbdc75c19db751fff25f21761d23a
+        version: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a
       matrix-widget-api:
         specifier: ^1.17.0
         version: 1.17.0
@@ -595,9 +595,6 @@ importers:
       '@casualbot/jest-sonar-reporter':
         specifier: 2.7.0
         version: 2.7.0
-      '@element-hq/element-call-embedded':
-        specifier: 0.19.2
-        version: 0.19.2
       '@element-hq/element-web-playwright-common':
         specifier: workspace:*
         version: link:../../packages/playwright-common
@@ -619,6 +616,9 @@ importers:
       '@sentry/webpack-plugin':
         specifier: ^5.0.0
         version: 5.2.1(encoding@0.1.13)(webpack@5.106.2)
+      '@sorb/threadnet-call-embedded':
+        specifier: 0.19.2-threadnet.5
+        version: 0.19.2-threadnet.5
       '@stylistic/eslint-plugin':
         specifier: ^5.0.0
         version: 5.10.0(eslint@8.57.1)
@@ -2036,6 +2036,9 @@ packages:
     resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/runtime@8.0.0':
+    resolution: {integrity: sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==}
+
   '@babel/template@7.28.6':
     resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
     engines: {node: '>=6.9.0'}
@@ -2525,9 +2528,6 @@ packages:
     engines: {node: '>=14.14'}
     hasBin: true
 
-  '@element-hq/element-call-embedded@0.19.2':
-    resolution: {integrity: sha512-HlqB/5RkWU7LAvArUJdSLsHpZJyTnGzn6LPYPAMinqShLkXa0ILeurL6G6zpTmRH+/uoJUfpHo3DQd+5Tq6/zg==}
-
   '@emnapi/core@1.10.0':
     resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
@@ -3192,8 +3192,8 @@ packages:
   '@matrix-org/emojibase-bindings@1.5.0':
     resolution: {integrity: sha512-+W9/ow2Z3iQa7ZOF698PBhwNcgGkn36B5Sr8VDPx8N8CH7+Uw+7TrtbtKPZVdgf4m/THmgmfX40jS5YDBsLaYg==}
 
-  '@matrix-org/matrix-sdk-crypto-wasm@18.2.0':
-    resolution: {integrity: sha512-puyZefvq6sHfqlmkri8umhA44724H2JL0YtX8wlvhGuNl8awX/Q1tZyW2Iekm9ZJP7BtuOqlNdg9oQd6iaGbNw==}
+  '@matrix-org/matrix-sdk-crypto-wasm@18.4.0':
+    resolution: {integrity: sha512-osxkU1DQ+05+anGHapjWyvZqdHUb94Id37gy54mCKn1Cq/D7iGT5oEUEhjp4oTnCLo4TOtI6ULJ/LHsapaIptQ==}
     engines: {node: '>= 18'}
 
   '@matrix-org/react-sdk-module-api@2.5.0':
@@ -5003,6 +5003,9 @@ packages:
   '@sinonjs/fake-timers@15.1.1':
     resolution: {integrity: sha512-cO5W33JgAPbOh07tvZjUOJ7oWhtaqGHiZw+11DPbyqh2kHTBc3eF/CjJDeQ4205RLQsX6rxCuYOroFQwl7JDRw==}
 
+  '@sorb/threadnet-call-embedded@0.19.2-threadnet.5':
+    resolution: {integrity: sha512-u2TG7i82ibkpHSH/s6xA4Q6BTJqITdYWyrVieTiRwnm2Z+SCn/GmPK8JZIp/uSnpMrl9619yp/6vDVtpDJsKZg==, tarball: https://rohana.axion1337.de/api/packages/sorb/npm/%40sorb%2Fthreadnet-call-embedded/-/0.19.2-threadnet.5/threadnet-call-embedded-0.19.2-threadnet.5.tgz}
+
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
@@ -7077,6 +7080,10 @@ packages:
     resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
     engines: {node: '>= 0.6'}
 
+  content-type@2.0.0:
+    resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==}
+    engines: {node: '>=18'}
+
   convert-hrtime@5.0.0:
     resolution: {integrity: sha512-lOETlkIeYSJWcbbcvjRKGxVMXJR+8+OQb/mTPbA4ObPMytYIsUbuOE0Jzy60hjARYszq1id0j8KgVhC+WGZVTg==}
     engines: {node: '>=12'}
@@ -9941,9 +9948,9 @@ packages:
   matrix-events-sdk@0.0.1:
     resolution: {integrity: sha512-1QEOsXO+bhyCroIe2/A5OwaxHvBm7EsSQ46DEDn8RBIfQwN5HWBpFvyWWR4QY0KHPPnnJdI99wgRiAl7Ad5qaA==}
 
-  matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68:
-    resolution: {tarball: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68}
-    version: 41.4.0
+  matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a:
+    resolution: {tarball: https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a}
+    version: 41.9.0
     engines: {node: '>=22.0.0'}
 
   matrix-web-i18n@3.6.0:
@@ -14503,6 +14510,8 @@ snapshots:
 
   '@babel/runtime@7.29.2': {}
 
+  '@babel/runtime@8.0.0': {}
+
   '@babel/template@7.28.6':
     dependencies:
       '@babel/code-frame': 7.29.0
@@ -15056,8 +15065,6 @@ snapshots:
       - supports-color
     optional: true
 
-  '@element-hq/element-call-embedded@0.19.2': {}
-
   '@emnapi/core@1.10.0':
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
@@ -15797,7 +15804,7 @@ snapshots:
       emojibase: 17.0.0
       emojibase-data: 17.0.0(emojibase@17.0.0)
 
-  '@matrix-org/matrix-sdk-crypto-wasm@18.2.0': {}
+  '@matrix-org/matrix-sdk-crypto-wasm@18.4.0': {}
 
   '@matrix-org/react-sdk-module-api@2.5.0(patch_hash=016146c9cc96e6363609d2b2ac0896ccef567882eb1d73b75a77b8a30929de96)(react@19.2.6)':
     dependencies:
@@ -17625,6 +17632,8 @@ snapshots:
     dependencies:
       '@sinonjs/commons': 3.0.1
 
+  '@sorb/threadnet-call-embedded@0.19.2-threadnet.5': {}
+
   '@standard-schema/spec@1.1.0': {}
 
   '@storybook/addon-a11y@10.3.6(storybook@10.3.6(@testing-library/dom@10.4.1)(prettier@3.8.3)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))':
@@ -20080,6 +20089,8 @@ snapshots:
 
   content-type@1.0.5: {}
 
+  content-type@2.0.0: {}
+
   convert-hrtime@5.0.0: {}
 
   convert-source-map@2.0.0: {}
@@ -23508,13 +23519,13 @@ snapshots:
 
   matrix-events-sdk@0.0.1: {}
 
-  matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/349e8c5023b74b7ee17b2e9a0cba6dfce6818d68:
+  matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/d19cb751da8bbdc75c19db751fff25f21761d23a:
     dependencies:
-      '@babel/runtime': 7.29.2
-      '@matrix-org/matrix-sdk-crypto-wasm': 18.2.0
+      '@babel/runtime': 8.0.0
+      '@matrix-org/matrix-sdk-crypto-wasm': 18.4.0
       another-json: 0.2.0
       bs58: 6.0.0
-      content-type: 1.0.5
+      content-type: 2.0.0
       jwt-decode: 4.0.0
       loglevel: 1.9.2
       matrix-events-sdk: 0.0.1