matrix-sdk 0.13.0

What's Changed

Security Fixes

• Fix SQL injection vulnerability in EventCache
  (d0c0100, Moderate, CVE-2025-53549, GHSA-275g-g844-73jh)

Bug fixes

• When joining a room via Client::join_room_by_id(), if the client has enable_share_history_on_invite enabled,
  we will correctly check for received room key bundles. Previously this was only done when calling Room::join.
  (#5043)

Features

• Add Client::supported_versions(), which returns the results of both Client::server_versions() and
  Client::unstable_features() with a single call.
  (#5357)
• WidgetDriver::send_to_device Now supports sending encrypted to-device messages.
  (#5252)
• Client::add_event_handler: Set Option<EncryptionInfo> in EventHandlerData for to-device messages.
  If the to-device message was encrypted, the EncryptionInfo will be set. If it is None the message was sent in clear.
  (#5099)
• EventCache::subscribe_to_room_generic_updates is added to subscribe to all
  room updates without having to subscribe to all rooms individually
  (#5247)
• [breaking] The element call widget URL configuration struct uses the new header url parameter
  instead of the now deprecated hideHeader parameter. This is only compatible with EC v0.13.0 or newer.
• [breaking] RoomEventCacheGenericUpdate gains a new Clear variant, and sees
  its TimelineUpdated variant being renamed to UpdateTimeline.
  (#5363)

Refactor

• [breaking]: Client::unstable_features() returns a BTreeSet<FeatureFlag>, containing only
  the features whose value was set to true in the response to the /versions endpoint.
  (#5357)
• ClientServerCapabilities has been renamed to ClientServerInfo. Alongside this,
  Client::reset_server_info is now Client::reset_server_info and Client::fetch_server_capabilities
  is now Client::fetch_server_versions, returning the server versions response directly.
  (#5167)
• RoomEventCacheListener is renamed RoomEventCacheSubscriber
  (#5269)
• RoomPreview::join_rule is now optional, and will be set to None if the join rule state event
  is missing for a given room.
  (#5278)

Bug fixes

• m.room.avatar has been added as required state for sliding sync until the existing backend issue
  causing deleted room avatars to not be flagged is fixed. (#5293)