element-hq · Half-Shot · Jan 16, 2026
@@ -55,54 +55,54 @@
     "tsconfig.json"
   ],
   "dependencies": {
-    "@matrix-org/matrix-sdk-crypto-nodejs": "0.4.0-beta.1",
-    "@types/express": "^4.17.21",
+    "@matrix-org/matrix-sdk-crypto-nodejs": "0.4.0",
+    "@types/express": "^5.0.6",
     "another-json": "^0.2.0",
-    "async-lock": "^1.4.0",
+    "async-lock": "^1.4.1",
     "chalk": "4",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
     "glob-to-regexp": "^0.4.1",
     "hash.js": "^1.1.7",
     "html-to-text": "^9.0.5",
     "htmlencode": "^0.0.4",
     "lowdb": "1",
-    "lru-cache": "^10.0.1",
+    "lru-cache": "^11.2.4",
     "mkdirp": "^3.0.1",
-    "morgan": "^1.10.0",
-    "postgres": "^3.4.1",
+    "morgan": "^1.10.1",
+    "postgres": "^3.4.8",
     "request": "^2.88.2",
     "request-promise": "^4.2.6",
-    "sanitize-html": "^2.11.0"
+    "sanitize-html": "^2.17.0"
   },
   "devDependencies": {
     "@babel/core": "^7.23.2",
     "@babel/eslint-parser": "^7.22.15",
     "@babel/eslint-plugin": "^7.22.10",
-    "@testcontainers/postgresql": "^10.2.2",
-    "@types/async-lock": "^1.4.1",
-    "@types/jest": "^29.5.6",
-    "@types/lowdb": "^1.0.14",
-    "@types/mocha": "^10.0.3",
-    "@types/node": "22",
-    "@types/sanitize-html": "^2.9.3",
-    "@types/simple-mock": "^0.8.4",
     "@typescript-eslint/eslint-plugin": "^6.9.0",
     "@typescript-eslint/parser": "^6.9.0",
-    "better-docs": "^2.7.2",
     "eslint": "^8.52.0",
+    "@testcontainers/postgresql": "^11.11.0",
+    "@types/async-lock": "^1.4.2",
+    "@types/jest": "^30.0.0",
+    "@types/lowdb": "^2.0.3",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "25.0.9",
+    "@types/sanitize-html": "^2.16.0",
+    "@types/simple-mock": "^0.8.6",
+    "better-docs": "^2.7.3",
     "eslint-config-google": "^0.14.0",
     "eslint-plugin-import": "^2.29.0",
     "eslint-plugin-matrix-org": "0.5",
-    "get-port": "5",
-    "jest": "^29.7.0",
-    "jsdoc": "^4.0.2",
+    "get-port": "7.1.0",
+    "jest": "^30.2.0",
+    "jsdoc": "^4.0.5",
     "matrix-mock-request": "^2.6.0",
     "simple-mock": "^0.8.0",
     "taffydb": "^2.7.3",
-    "testcontainers": "^10.2.2",
-    "tmp": "^0.2.1",
-    "ts-jest": "^29.1.1",
-    "typescript": "^5.2.2"
+    "testcontainers": "^11.11.0",
+    "tmp": "^0.2.5",
+    "ts-jest": "^29.4.6",
+    "typescript": "^5.9.3"
   },
   "jest": {
     "preset": "ts-jest",

@@ -950,6 +950,11 @@ export class Appservice extends EventEmitter {
 
         const { txnId } = req.params;
 
+        if (typeof txnId !== "string") {
+            res.status(400).json({ errcode: "BAD_REQUEST", error: "txnId must be a string" });
+            return;
+        }
+
         if (this.pendingTransactions.has(txnId)) {
             // The homeserver has retried a transaction while we're still handling it.
             try {
@@ -991,6 +996,11 @@ export class Appservice extends EventEmitter {
         }
 
         const userId = req.params["userId"];
+        if (typeof userId !== "string") {
+            res.status(400).json({ errcode: "BAD_REQUEST", error: "userId must be a string" });
+            return;
+        }
+
         this.emit("query.user", userId, async (result) => {
             if (result.then) result = await result;
             if (result === false) {
@@ -1012,6 +1022,10 @@ export class Appservice extends EventEmitter {
         }
 
         const roomAlias = req.params["roomAlias"];
+        if (typeof roomAlias !== "string") {
+            res.status(400).json({ errcode: "BAD_REQUEST", error: "roomAlias must be a string" });
+            return;
+        }
         this.emit("query.room", roomAlias, async (result) => {
             if (result.then) result = await result;
             if (result === false) {
@@ -1105,6 +1119,11 @@ export class Appservice extends EventEmitter {
         }
 
         const protocol = req.params["protocol"];
+        if (typeof protocol !== "string") {
+            res.status(400).json({ errcode: "BAD_REQUEST", error: "protocol must be a string" });
+            return;
+        }
+
         if (!this.registration.protocols.includes(protocol)) {
             res.status(404).json({
                 errcode: "PROTOCOL_NOT_HANDLED",
@@ -1124,6 +1143,11 @@ export class Appservice extends EventEmitter {
         }
 
         const protocol = req.params["protocol"];
+        if (typeof protocol !== "string") {
+            res.status(400).json({ errcode: "BAD_REQUEST", error: "protocol must be a string" });
+            return;
+        }
+
         const responseFunc = (items: any[]) => {
             if (items && items.length > 0) {
                 res.status(200).json(items);

@@ -1,31 +1,31 @@
 /**
  * Encodes Base64.
  * @category Utilities
- * @param {ArrayBuffer | Uint8Array} b The buffer to encode.
- * @returns {string} The Base64 string.
+ * @param b The buffer to encode.
+ * @returns The Base64 string.
  */
-export function encodeBase64(b: ArrayBuffer | Uint8Array): string {
-    return Buffer.from(b).toString('base64');
+export function encodeBase64(...params: Parameters<typeof Buffer["from"]>): string {
+    return Buffer.from(...params).toString('base64');
 }
 
 /**
  * Encodes Unpadded Base64.
  * @category Utilities
- * @param {ArrayBuffer | Uint8Array} b The buffer to encode.
- * @returns {string} The Base64 string.
+ * @param b The buffer to encode.
+ * @returns The Base64 string.
  */
-export function encodeUnpaddedBase64(b: ArrayBuffer | Uint8Array): string {
-    return encodeBase64(b).replace(/=+/g, '');
+export function encodeUnpaddedBase64(...params: Parameters<typeof Buffer["from"]>): string {
+    return encodeBase64(...params).replace(/=+/g, '');
 }
 
 /**
  * Encodes URL-Safe Unpadded Base64.
  * @category Utilities
- * @param {ArrayBuffer | Uint8Array} b The buffer to encode.
- * @returns {string} The Base64 string.
+ * @param b The buffer to encode.
+ * @returns The Base64 string.
  */
-export function encodeUnpaddedUrlSafeBase64(b: ArrayBuffer | Uint8Array): string {
-    return encodeUnpaddedBase64(b).replace(/\+/g, '-').replace(/\//g, '_');
+export function encodeUnpaddedUrlSafeBase64(...params: Parameters<typeof Buffer["from"]>): string {
+    return encodeUnpaddedBase64(...params).replace(/\+/g, '-').replace(/\//g, '_');
 }
 
 /**

@@ -1,4 +1,4 @@
-import * as chalk from "chalk";
+import chalk from "chalk";
 
 import { ILogger } from "./ILogger";
 
@@ -8,6 +8,7 @@
  * Prints to the console with colors and a format.
  * @category Logging
  */
+
 export class RichConsoleLogger implements ILogger {
     protected chalkDebug = chalk.cyan;
     protected chalkInfo = chalk.green;

@@ -4,11 +4,11 @@ import {
     UserID,
 } from "..";
 
-const CREATOR_ROOM_VERSIONS = ["12", "org.matrix.hydra.11"];
+const LEGACY_PLS_ROOM_VERSIONS = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11"];
 
 interface CreateEventContentHydra {
     additional_creators?: string[];
-    room_version: "12" | "org.matrix.hydra.11";
+    room_version: string;
 }
 
 interface CreateEventContentLegacy {
@@ -58,13 +58,12 @@ export class PLManager {
     public readonly creators: Set<string>;
 
     public static areCreatorsPriviledged(roomVersion: string): boolean {
-        return CREATOR_ROOM_VERSIONS.includes(roomVersion);
+        return !LEGACY_PLS_ROOM_VERSIONS.includes(roomVersion);
     }
 
     public get areCreatorsPriviledged(): boolean {
         return (
-            !!this.createEvent.content.room_version &&
-            CREATOR_ROOM_VERSIONS.includes(
+            !LEGACY_PLS_ROOM_VERSIONS.includes(
                 this.createEvent.content.room_version,
             )
         );

@@ -1,4 +1,4 @@
-import * as getPort from "get-port";
+import getPort from "get-port";
 import * as requestPromise from "request-promise";
 import * as simple from "simple-mock";
 import HttpBackend from 'matrix-mock-request';

@@ -7,7 +7,7 @@ import {
     encodeUnpaddedUrlSafeBase64,
 } from "../src";
 
-function sb(s: string): ArrayBuffer {
+function sb(s: string): Buffer {
     return Buffer.from(s);
 }