chore(deps): update matrixdotorg/synapse docker tag to v1.136.0

renovaterequested to merge
renovate/matrixdotorg-synapse-1.x into main

This MR contains the following updates:

Package Update Change
matrixdotorg/synapse (source) minor v1.103.0 -> v1.136.0

Release Notes

element-hq/synapse (matrixdotorg/synapse)

v1.136.0

Compare Source

Synapse 1.136.0 (2025-08-12)

Note: This release includes the security fixes from 1.135.2 and 1.136.0rc2, detailed below.

Please also check the relevant section in the upgrade notes for the changes to MAS support, metrics labels and the module API which may require your attention when upgrading.

Bugfixes
  • Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make Room Admin API would not treat a room v12's creator power level as the highest in room. (#​18805)

Synapse 1.136.0rc2 (2025-08-11)

This is the Synapse portion of the Matrix coordinated security release. This release includes support for room version 12 which fixes a number of security vulnerabilities, including CVE-2025-49090.

The default room version is not changed. Not all clients will support room version 12 immediately, and not all users will be using the latest version of their clients. Large, public rooms are advised to wait a few weeks before upgrading to room version 12 to allow users throughout the Matrix ecosystem to update their clients.

Note: release 1.135.1 was skipped due to issues discovered during the release process.

Two patched Synapse releases are now available:

  • 1.135.2: stable release comprised of 1.135.0 + security patches
    • Upgrade to this release if you are currently running 1.135.0 or below.
  • 1.136.0rc2: unstable release candidate comprised of 1.136.0rc1 + security patches.
    • Upgrade to this release only if you are on 1.136.0rc1.
Bugfixes
  • Update MSC4293 redaction logic for room v12. (#​80)
Internal Changes
  • Add a parameter to upgrade_rooms(..) to allow auto join local users. (#​83)

Synapse 1.136.0rc1 (2025-08-05)

Features
  • Add configurable rate limiting for the creation of rooms. (#​18514)
  • Add support for MSC4293 - Redact on Kick/Ban. (#​18540)
  • When admins enable themselves to see soft-failed events, they will also see if the cause is due to the policy server flagging them as spam via unsigned. (#​18585)
  • Add ability to configure forward/outbound proxy via homeserver config instead of environment variables. See http_proxy, https_proxy, no_proxy_hosts. (#​18686)
  • Advertise experimental support for MSC4306 (Thread Subscriptions) through /_matrix/clients/versions if enabled. (#​18722)
  • Stabilise support for delegating authentication to Matrix Authentication Service. (#​18759)
  • Implement the push rules for experimental MSC4306: Thread Subscriptions. (#​18762)
Bugfixes
  • Allow return code 403 (allowed by C2S Spec since v1.2) when fetching profiles via federation. (#​18696)
  • Register the MSC4306 (Thread Subscriptions) endpoints in the CS API when the experimental feature is enabled. (#​18726)
  • Fix a long-standing bug where suspended users could not have server notices sent to them (a 403 was returned to the admin). (#​18750)
  • Fix an issue that could cause logcontexts to be lost on rate-limited requests. Found by @​realtyem. (#​18763)
  • Fix invalidation of storage cache that was broken in 1.135.0. (#​18786)
Improved Documentation
  • Minor improvements to README. (#​18700)
  • Document that there can be multiple workers handling the receipts stream. (#​18760)
  • Improve worker documentation for some device paths. (#​18761)
Deprecations and Removals
Internal Changes
  • Add debug logging for HMAC digest verification failures when using the admin API to register users. (#​18474)
  • Speed up upgrading a room with large numbers of banned users. (#​18574)
  • Fix config documentation generation script on Windows by enforcing UTF-8. (#​18580)
  • Refactor cache, background process, Counter, LaterGauge, GaugeBucketCollector, Histogram, and Gauge metrics to be homeserver-scoped. (#​18656, #​18714, #​18715, #​18724, #​18753, #​18725, #​18670, #​18748, #​18751)
  • Reduce database usage in Sliding Sync by not querying for background update completion after the update is known to be complete. (#​18718)
  • Improve order of validation and ratelimiting in room creation. (#​18723)
  • Bump minimum version bound on Twisted to 21.2.0. (#​18727, #​18729)
  • Use twisted.internet.testing module in tests instead of deprecated twisted.test.proto_helpers. (#​18728)
  • Remove obsolete /send_event replication endpoint. (#​18730)
  • Update metrics linting to be able to handle custom metrics. (#​18733)
  • Work around twisted.protocols.amp.TooLong error by reducing logging in some tests. (#​18736)
  • Prevent "Move labelled issues to correct projects" GitHub Actions workflow from failing when an issue is already on the project board. (#​18755)
  • Bump minimum supported Rust version (MSRV) to 1.82.0. Missed in #​18553 (released in Synapse 1.134.0). (#​18757)
  • Make Clock.sleep(...) return a coroutine, so that mypy can catch places where we don't await on it. (#​18772)
  • Update implementation of MSC4306: Thread Subscriptions to include automatic subscription conflict prevention as introduced in later drafts. (#​18756)
Updates to locked dependencies
  • Bump gitpython from 3.1.44 to 3.1.45. (#​18743)
  • Bump mypy-zope from 1.0.12 to 1.0.13. (#​18744)
  • Bump phonenumbers from 9.0.9 to 9.0.10. (#​18741)
  • Bump ruff from 0.12.4 to 0.12.5. (#​18742)
  • Bump sentry-sdk from 2.32.0 to 2.33.2. (#​18745)
  • Bump tokio from 1.46.1 to 1.47.0. (#​18740)
  • Bump types-jsonschema from 4.24.0.20250708 to 4.25.0.20250720. (#​18703)
  • Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718. (#​18706)

v1.135.2

Compare Source

Synapse 1.135.2 (2025-08-11)

This is the Synapse portion of the Matrix coordinated security release. This release includes support for room version 12 which fixes a number of security vulnerabilities, including CVE-2025-49090.

The default room version is not changed. Not all clients will support room version 12 immediately, and not all users will be using the latest version of their clients. Large, public rooms are advised to wait a few weeks before upgrading to room version 12 to allow users throughout the Matrix ecosystem to update their clients.

Note: release 1.135.1 was skipped due to issues discovered during the release process.

Two patched Synapse releases are now available:

  • 1.135.2: stable release comprised of 1.135.0 + security patches
    • Upgrade to this release if you are currently running 1.135.0 or below.
  • 1.136.0rc2: unstable release candidate comprised of 1.136.0rc1 + security patches.
    • Upgrade to this release only if you are on 1.136.0rc1.
Bugfixes
  • Fix invalidation of storage cache that was broken in 1.135.0. (#​18786)
Internal Changes
  • Add a parameter to upgrade_rooms(..) to allow auto join local users. (#​82)
  • Speed up upgrading a room with large numbers of banned users. (#​18574)

v1.135.1

Compare Source

v1.135.0

Compare Source

Synapse 1.135.0 (2025-08-01)

No significant changes since 1.135.0rc2.

Synapse 1.135.0rc2 (2025-07-30)

Bugfixes
  • Fix user failing to deactivate with MAS when /_synapse/mas is handled by a worker. (#​18716)
Internal Changes
  • Fix performance regression introduced in #​18238 by adding a cache to is_server_admin. (#​18747)

Synapse 1.135.0rc1 (2025-07-22)

Features
Bugfixes
  • Fix CPU and database spinning when retrying sending events to servers whilst at the same time purging those events. (#​18499)
  • Don't allow creation of tags with names longer than 255 bytes, as per the spec. (#​18660)
  • Fix sliding_sync_connections-related errors when porting from SQLite to Postgres. (#​18677)
  • Fix the MAS integration not working when Synapse is started with --daemonize or using synctl. (#​18691)
Improved Documentation
  • Document that some config options for the user directory are in violation of the Matrix spec. (#​18548)
  • Update rc_delayed_event_mgmt docs to the actual nesting level. Contributed by @​HarHarLinks. (#​18692)
Internal Changes
  • Add a dedicated internal API for Matrix Authentication Service to Synapse communication. (#​18520)
  • Allow user registrations to be done on workers. (#​18552)
  • Remove unnecessary HTTP replication calls. (#​18564)
  • Refactor Measure block metrics to be homeserver-scoped. (#​18601)
  • Refactor cache metrics to be homeserver-scoped. (#​18604)
  • Unbreak "Latest dependencies" workflow by using the --without dev poetry option instead of removed --no-dev. (#​18617)
  • Update URL Preview code to work with lxml 6.0.0+. (#​18622)
  • Use markdown-it-py instead of commonmark in the release script. (#​18637)
  • Fix typing errors with upgraded mypy version. (#​18653)
  • Add doc comment explaining that config files are shallowly merged. (#​18664)
  • Minor speed up of insertion into stream_positions table. (#​18672)
  • Remove unused allow_no_prev_events option when creating an event. (#​18676)
  • Clean up MetricsResource and Prometheus hacks. (#​18687)
  • Fix dirty Cargo.lock changes appearing after install (base64). (#​18689)
  • Prevent dirty Cargo.lock changes from install. (#​18693)
  • Correct spelling of 'Admin token used' log line. (#​18697)
  • Reduce log spam when client stops downloading media while it is being streamed to them. (#​18699)
Updates to locked dependencies
  • Bump authlib from 1.6.0 to 1.6.1. (#​18704)
  • Bump base64 from 0.21.7 to 0.22.1. (#​18666)
  • Bump jsonschema from 4.24.0 to 4.25.0. (#​18707)
  • Bump lxml from 5.4.0 to 6.0.0. (#​18631)
  • Bump mypy from 1.13.0 to 1.16.1. (#​18653)
  • Bump once_cell from 1.19.0 to 1.21.3. (#​18710)
  • Bump phonenumbers from 9.0.8 to 9.0.9. (#​18681)
  • Bump ruff from 0.12.2 to 0.12.5. (#​18683, #​18705)
  • Bump serde_json from 1.0.140 to 1.0.141. (#​18709)
  • Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#​18708)
  • Bump types-jsonschema from 4.24.0.20250528 to 4.24.0.20250708. (#​18682)

v1.134.0

Compare Source

Synapse 1.134.0 (2025-07-15)

No significant changes since 1.134.0rc1.

Synapse 1.134.0rc1 (2025-07-09)

Features
  • Support for MSC4235: via query param for hierarchy endpoint. Contributed by Krishan (@​kfiven). (#​18070)
  • Add forget_forced_upon_leave capability as per MSC4267. (#​18196)
  • Add federated_user_may_invite spam checker callback which receives the entire invite event. Contributed by @​tulir @​ Beeper. (#​18241)
Bugfixes
  • Fix KeyError on background updates when using split main/state databases. (#​18509)
  • Improve performance of device deletion by adding missing index. (#​18582)
  • Fix avatar_url and displayname being sent on federation profile queries when they are not set. (#​18593)
  • Respond with 401 & M_USER_LOCKED when a locked user calls POST /login, as per the spec. (#​18594)
  • Ensure policy servers are not asked to scan policy server change events, allowing rooms to disable the use of a policy server while the policy server is down. (#​18605)
Improved Documentation
  • Fix documentation of the Delete Room Admin API's status field. (#​18519)
Deprecations and Removals
  • Stop adding the "origin" field to newly-created events (PDUs). (#​18418)
Internal Changes
  • Replace PyICU crate with equivalent icu_segmenter Rust crate. (#​18553, #​18646)
  • Improve docstring on simple_upsert_many. (#​18573)
  • Raise poetry-core version cap to 2.1.3. (#​18575)
  • Raise setuptools_rust version cap to 1.11.1. (#​18576)
  • Better handling of ratelimited requests. (#​18595, #​18600)
  • Update to Rust 1.87.0 in CI, and bump the pinned commit of the dtolnay/rust-toolchain GitHub Action to b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#​18596)
  • Speed up bulk device deletion. (#​18602)
  • Speed up the building of arm-based wheels in CI. (#​18618)
  • Speed up the building of Docker images in CI. (#​18620)
  • Add .zed/ directory to .gitignore. (#​18623)
  • Log the room ID we're purging state for. (#​18625)
Updates to locked dependencies
  • Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#​18612)
  • Bump attrs from 24.2.0 to 25.3.0. (#​18649)
  • Bump authlib from 1.5.2 to 1.6.0. (#​18642)
  • Bump base64 from 0.21.7 to 0.22.1. (#​18589)
  • Bump base64 from 0.21.7 to 0.22.1. (#​18629)
  • Bump docker/build-push-action from 6.17.0 to 6.18.0. (#​18497)
  • Bump docker/setup-buildx-action from 3.10.0 to 3.11.1. (#​18587)
  • Bump hiredis from 3.1.0 to 3.2.1. (#​18638)
  • Bump ijson from 3.3.0 to 3.4.0. (#​18650)
  • Bump jsonschema from 4.23.0 to 4.24.0. (#​18630)
  • Bump msgpack from 1.1.0 to 1.1.1. (#​18651)
  • Bump mypy-zope from 1.0.11 to 1.0.12. (#​18640)
  • Bump phonenumbers from 9.0.2 to 9.0.8. (#​18652)
  • Bump pillow from 11.2.1 to 11.3.0. (#​18624)
  • Bump prometheus-client from 0.21.0 to 0.22.1. (#​18609)
  • Bump pyasn1-modules from 0.4.1 to 0.4.2. (#​18495)
  • Bump pydantic from 2.11.4 to 2.11.7. (#​18639)
  • Bump reqwest from 0.12.15 to 0.12.20. (#​18590)
  • Bump reqwest from 0.12.20 to 0.12.22. (#​18627)
  • Bump ruff from 0.11.11 to 0.12.1. (#​18645)
  • Bump ruff from 0.12.1 to 0.12.2. (#​18657)
  • Bump sentry-sdk from 2.22.0 to 2.32.0. (#​18633)
  • Bump setuptools-rust from 1.10.2 to 1.11.1. (#​18655)
  • Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#​18588)
  • Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#​18608)
  • Bump stefanzweifel/git-auto-commit-action from 5.2.0 to 6.0.1. (#​18607)
  • Bump tokio from 1.45.1 to 1.46.0. (#​18628)
  • Bump tokio from 1.46.0 to 1.46.1. (#​18667)
  • Bump treq from 24.9.1 to 25.5.0. (#​18610)
  • Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514. (#​18634)
  • Bump types-jsonschema from 4.23.0.20250516 to 4.24.0.20250528. (#​18611)
  • Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622. (#​18586)
  • Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516. (#​18658)
  • Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516. (#​18643)
  • Bump types-setuptools from 75.2.0.20241019 to 80.9.0.20250529. (#​18644)
  • Bump typing-extensions from 4.12.2 to 4.14.0. (#​18654)
  • Bump typing-extensions from 4.14.0 to 4.14.1. (#​18668)
  • Bump urllib3 from 2.2.2 to 2.5.0. (#​18572)

v1.133.0

Compare Source

Synapse 1.133.0 (2025-07-01)

Pre-built wheels are now built using the manylinux_2_28 base, which is expected to be compatible with distros using glibc 2.28 or later, including:

  • Debian 10+
  • Ubuntu 18.10+
  • Fedora 29+
  • CentOS/RHEL 8+

Previously, wheels were built using the manylinux2014 base, which was expected to be compatible with distros using glibc 2.17 or later.

Bugfixes
  • Bump cibuildwheel to 3.0.0 to fix the manylinux wheel builds. (#​18615)

Synapse 1.133.0rc1 (2025-06-24)

Features
Bugfixes
  • Fix an issue where, during state resolution for v11 rooms, Synapse would incorrectly calculate the power level of the creator when there was no power levels event in the room. (#​18534, #​18547)
  • Fix long-standing bug where sliding sync did not honour the room_id_to_include config option. (#​18535)
  • Fix an issue where "Lock timeout is getting excessive" warnings would be logged even when the lock timeout was <10 minutes. (#​18543)
  • Fix an issue where Synapse could calculate the wrong power level for the creator of the room if there was no power levels event. (#​18545)
Improved Documentation
  • Generate config documentation from JSON Schema file. (#​18528)
  • Fix typo in user type documentation. (#​18568)
Internal Changes
Updates to locked dependencies
  • Bump actions/setup-python from 5.5.0 to 5.6.0. (#​18555)
  • Bump base64 from 0.21.7 to 0.22.1. (#​18559)
  • Bump dawidd6/action-download-artifact from 9 to 11. (#​18556)
  • Bump headers from 0.4.0 to 0.4.1. (#​18529)
  • Bump requests from 2.32.2 to 2.32.4. (#​18533)
  • Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611. (#​18558)

v1.132.0

Compare Source

Synapse 1.132.0 (2025-06-17)

Improved Documentation
  • Improvements to generate config documentation from JSON Schema file. (#​18522)

Synapse 1.132.0rc1 (2025-06-10)

Features
  • Add support for MSC4155 Invite Filtering. (#​18288)
  • Add experimental user_may_send_state_event module API callback. (#​18455)
  • Add experimental get_media_config_for_user and is_user_allowed_to_upload_media_of_size module API callbacks that allow overriding of media repository maximum upload size. (#​18457)
  • Add experimental get_ratelimit_override_for_user module API callback that allows overriding of per-user ratelimits. (#​18458)
  • Pass room_config argument to user_may_create_room spam checker module callback. (#​18486)
  • Support configuration of default and extra user types. (#​18456)
  • Successful requests to /_matrix/app/v1/ping will now force Synapse to reattempt delivering transactions to appservices. (#​18521)
  • Support the import of the RatelimitOverride type from synapse.module_api in modules and rename messages_per_second to per_second. (#​18513)
Bugfixes
  • Remove destinations from sending if not whitelisted. (#​18484)
  • Fixed room summary API incorrectly returning that a room is private in the room summary response when the join rule is omitted by the remote server. Contributed by @​nexy7574. (#​18493)
  • Prevent users from adding themselves to their own user ignore list. (#​18508)
Improved Documentation
  • Generate config documentation from JSON Schema file. (#​17892)
  • Mention CAP_NET_BIND_SERVICE as an alternative to running Synapse as root in order to bind to a privileged port. (#​18408)
  • Surface hidden Admin API documentation regarding fetching of scheduled tasks. (#​18516)
  • Mark the new module APIs in this release as experimental. (#​18536)
Internal Changes
  • Mark dehydrated devices in the List All User Devices Admin API. (#​18252)
  • Reduce disk wastage by cleaning up received_transactions older than 1 day, rather than 30 days. (#​18310)
  • Distinguish all vs local events being persisted in the "Event Send Time Quantiles" graph (Grafana). (#​18510)

v1.131.0

Compare Source

Synapse 1.131.0 (2025-06-03)

No significant changes since 1.131.0rc1.

Synapse 1.131.0rc1 (2025-05-28)

Features
Bugfixes
  • Prevent race-condition in _maybe_retry_device_resync entrance. (#​18391)
  • Fix the tests.handlers.test_worker_lock.WorkerLockTestCase.test_lock_contention test which could spuriously time out on RISC-V architectures due to performance differences. (#​18430)
  • Fix admin redaction endpoint not redacting encrypted messages. (#​18434)
Improved Documentation
  • Update room_list_publication_rules docs to consider defaults that changed in v1.126.0. Contributed by @​HarHarLinks. (#​18286)
  • Add advice for upgrading between major PostgreSQL versions to the database documentation. (#​18445)
Internal Changes
  • Fix a memory leak in _NotifierUserStream. (#​18380)
  • Fix a couple type annotations in the RootConfig/Config. (#​18409)
  • Explicitly enable PyPy builds in cibuildwheels config to avoid it being disabled on a future upgrade to cibuildwheel v3. (#​18417)
  • Update the MR review template to remove an erroneous line break from the final bullet point. (#​18419)
  • Explain why we flush_buffer() for Python print(...) output. (#​18420)
  • Add lint to ensure we don't add a CREATE/DROP INDEX in a schema delta. (#​18440)
  • Allow checking only for the existence of a field in an SSO provider's response, rather than requiring the value(s) to check. (#​18454)
  • Add unit tests for homeserver usage statistics. (#​18463)
  • Don't move invited users to new room when shutting down room. (#​18471)
Updates to locked dependencies
  • Bump actions/setup-python from 5.5.0 to 5.6.0. (#​18398)
  • Bump authlib from 1.5.1 to 1.5.2. (#​18452)
  • Bump docker/build-push-action from 6.15.0 to 6.17.0. (#​18397, #​18449)
  • Bump lxml from 5.3.0 to 5.4.0. (#​18480)
  • Bump mypy-zope from 1.0.9 to 1.0.11. (#​18428)
  • Bump pyo3 from 0.23.5 to 0.24.2. (#​18460)
  • Bump pyo3-log from 0.12.3 to 0.12.4. (#​18453)
  • Bump pyopenssl from 25.0.0 to 25.1.0. (#​18450)
  • Bump ruff from 0.7.3 to 0.11.11. (#​18451, #​18482)
  • Bump tornado from 6.4.2 to 6.5.0. (#​18459)
  • Bump setuptools from 72.1.0 to 78.1.1. (#​18461)
  • Bump types-jsonschema from 4.23.0.20241208 to 4.23.0.20250516. (#​18481)
  • Bump types-requests from 2.32.0.20241016 to 2.32.0.20250328. (#​18427)

v1.130.0

Compare Source

Synapse 1.130.0 (2025-05-20)

Bugfixes
  • Fix startup being blocked on creating a new index that was introduced in v1.130.0rc1. (#​18439)
  • Fix the ordering of local messages in rooms that were affected by GHSA-v56r-hwv5-mxg6. (#​18447)

Synapse 1.130.0rc1 (2025-05-13)

Features
  • Add an Admin API endpoint GET /_synapse/admin/v1/scheduled_tasks to fetch scheduled tasks. (#​18214)
  • Add config option user_directory.exclude_remote_users which, when enabled, excludes remote users from user directory search results. (#​18300)
  • Add support for handling GET /devices/ on workers. (#​18355)
Bugfixes
  • Fix a longstanding bug where Synapse would immediately retry a failing push endpoint when a new event is received, ignoring any backoff timers. (#​18363)
  • Pass leave from remote invite rejection down Sliding Sync. (#​18375)
Updates to the Docker image
  • In configure_workers_and_start.py, use the same absolute path of Python in the interpreter shebang, and invoke child Python processes with sys.executable. (#​18291)
  • Optimize the build of the workers image. (#​18292)
  • In start_for_complement.sh, replace some external program calls with shell builtins. (#​18293)
  • When generating container scripts from templates, don't add a leading newline so that their shebangs may be handled correctly. (#​18295)
Improved Documentation
  • Improve formatting of the README file. (#​18218)
  • Add documentation for configuring Pocket ID as an OIDC provider. (#​18237)
  • Fix typo in docs about the push config option. Contributed by @​HarHarLinks. (#​18320)
  • Add /_matrix/federation/v1/version to list of federation endpoints that can be handled by workers. (#​18377)
  • Add an Admin API endpoint GET /_synapse/admin/v1/scheduled_tasks to fetch scheduled tasks. (#​18384)
Internal Changes
  • Return specific error code when adding an email address / phone number to account is not supported (MSC4178). (#​17578)
  • Stop auto-provisionning missing users & devices when delegating auth to Matrix Authentication Service. Requires MAS 0.13.0 or later. (#​18181)
  • Apply file hashing and existing quarantines to media downloaded for URL previews. (#​18297)
  • Allow a few admin APIs used by matrix-authentication-service to run on workers. (#​18313)
  • Apply should_drop_federated_event to federation invites. (#​18330)
  • Allow /rooms/ admin API to be run on workers. (#​18360)
  • Minor performance improvements to the notifier. (#​18367)
  • Slight performance increase when using the ratelimiter. (#​18369)
  • Don't validate the at_hash (access token hash) field in OIDC ID Tokens if we don't end up actually using the OIDC Access Token. (#​18374, #​18385)
  • Fixed test failures when using authlib 1.5.2. (#​18390)
  • Refactor MSC4186 Simplified Sliding Sync room list tests to cover both new and fallback logic paths. (#​18399)
Updates to locked dependencies
  • Bump actions/add-to-project from 280af8a to 5b1a254. (#​18365)
  • Bump actions/download-artifact from 4.2.1 to 4.3.0. (#​18364)
  • Bump actions/setup-go from 5.4.0 to 5.5.0. (#​18426)
  • Bump anyhow from 1.0.97 to 1.0.98. (#​18336)
  • Bump packaging from 24.2 to 25.0. (#​18393)
  • Bump pillow from 11.1.0 to 11.2.1. (#​18429)
  • Bump pydantic from 2.10.3 to 2.11.4. (#​18394)
  • Bump pyo3-log from 0.12.2 to 0.12.3. (#​18317)
  • Bump pyopenssl from 24.3.0 to 25.0.0. (#​18315)
  • Bump sha2 from 0.10.8 to 0.10.9. (#​18395)
  • Bump sigstore/cosign-installer from 3.8.1 to 3.8.2. (#​18366)
  • Bump softprops/action-gh-release from 1 to 2. (#​18264)
  • Bump stefanzweifel/git-auto-commit-action from 5.1.0 to 5.2.0. (#​18354)
  • Bump txredisapi from 1.4.10 to 1.4.11. (#​18392)
  • Bump types-jsonschema from 4.23.0.20240813 to 4.23.0.20241208. (#​18305)
  • Bump types-psycopg2 from 2.9.21.20250121 to 2.9.21.20250318. (#​18316)

v1.129.0

Compare Source

Synapse 1.129.0 (2025-05-06)

No significant changes since 1.129.0rc2.

Synapse 1.129.0rc2 (2025-04-30)

Synapse 1.129.0rc1 was never formally released due to regressions discovered during the release process. 1.129.0rc2 fixes those regressions by reverting the affected MRs.

Internal Changes
  • Revert the slow background update introduced by #​18068 in v1.128.0. (#​18372)
  • Revert "Add total_event_count, total_message_count, and total_e2ee_event_count fields to the homeserver usage statistics.", added in v1.129.0rc1. (#​18373)

Synapse 1.129.0rc1 (2025-04-15)

Features
  • Add passthrough_authorization_parameters in OIDC configuration to allow passing parameters to the authorization grant URL. (#​18232)
  • ~~Add total_event_count, total_message_count, and total_e2ee_event_count fields to the homeserver usage statistics. (#​18260)~~ This was reverted in 1.129.0rc2.
Bugfixes
  • Fix force_tracing_for_users config when using delegated auth. (#​18334)
  • Fix the token introspection cache logging access tokens when MAS integration is in use. (#​18335)
  • Stop caching introspection failures when delegating auth to MAS. (#​18339)
  • Fix ExternalIDReuse exception after migrating to MAS on workers with a high traffic. (#​18342)
  • Fix minor performance regression caused by tracking of room participation. Regressed in v1.128.0. (#​18345)
Updates to the Docker image
  • Optimize the build of the complement-synapse image. (#​18294)
Internal Changes
  • Disable statement timeout during room purge. (#​18133)
  • Add cache to storage functions used to auth requests when using delegated auth. (#​18337)

v1.128.0

Compare Source

Synapse 1.128.0 (2025-04-08)

No significant changes since 1.128.0rc1.

Synapse 1.128.0rc1 (2025-04-01)

Features
  • Add an access token introspection cache to make Matrix Authentication Service integration (MSC3861) more efficient. (#​18231)
  • Add background job to clear unreferenced state groups. (#​18254)
  • Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. (#​18277, #​18302, #​18296)
Bugfixes
  • Add index to sliding sync (MSC4186) membership snapshot table, to fix a performance issue. (#​18074)
Updates to the Docker image
  • Specify the architecture of installed packages via an APT config option, which is more reliable than appending package names with :{arch}. (#​18271)
  • Always specify base image debian versions with a build argument. (#​18272)
  • Allow passing arguments to start_for_complement.sh (to be sent to configure_workers_and_start.py). (#​18273)
  • Make some improvements to the prefix-log script in the workers image. (#​18274)
  • Use uv pip to install supervisor in the worker image. (#​18275)
  • Avoid needing to download & use rsync in a build layer. (#​18287)
Improved Documentation
  • Fix how to obtain access token and change naming from riot to element (#​18225)
  • Correct a small typo in the SSO mapping providers documentation. (#​18276)
  • Add docs for how to clear out the Poetry wheel cache. (#​18283)
Internal Changes
  • Add a column participant to room_memberships table. (#​18068)
  • Update Poetry to 2.1.1, including updating the lock file version. (#​18251)
  • Pin GitHub Actions dependencies by commit hash. (#​18255)
  • Add DB delta to remove the old state group deletion job. (#​18284)
Updates to locked dependencies
  • Bump actions/add-to-project from f5473ac to 280af8a. (#​18303)
  • Bump actions/cache from 4.2.2 to 4.2.3. (#​18266)
  • Bump actions/download-artifact from 4.2.0 to 4.2.1. (#​18268)
  • Bump actions/setup-python from 5.4.0 to 5.5.0. (#​18298)
  • Bump actions/upload-artifact from 4.6.1 to 4.6.2. (#​18304)
  • Bump authlib from 1.4.1 to 1.5.1. (#​18306)
  • Bump dawidd6/action-download-artifact from 8 to 9. (#​18204)
  • Bump jinja2 from 3.1.5 to 3.1.6. (#​18223)
  • Bump log from 0.4.26 to 0.4.27. (#​18267)
  • Bump phonenumbers from 8.13.50 to 9.0.2. (#​18299)
  • Bump pygithub from 2.5.0 to 2.6.1. (#​18243)
  • Bump pyo3-log from 0.12.1 to 0.12.2. (#​18269)

v1.127.1

Compare Source

Synapse 1.127.1 (2025-03-26)

Security

v1.127.0

Compare Source

Synapse 1.127.0 (2025-03-25)

No significant changes since 1.127.0rc1.

Synapse 1.127.0rc1 (2025-03-18)

Features
  • Update MSC4140 implementation to no longer cancel a user's own delayed state events with an event type & state key that match a more recent state event sent by that user. (#​17810)
Improved Documentation
Internal Changes
  • Remove undocumented SYNAPSE_USE_FROZEN_DICTS environment variable. (#​18123)
  • Fix detection of workflow failures in the release script. (#​18211)
  • Add caching support to media endpoints. (#​18235)
Updates to locked dependencies
  • Bump anyhow from 1.0.96 to 1.0.97. (#​18201)
  • Bump bcrypt from 4.2.1 to 4.3.0. (#​18207)
  • Bump bytes from 1.10.0 to 1.10.1. (#​18227)
  • Bump http from 1.2.0 to 1.3.1. (#​18245)
  • Bump sentry-sdk from 2.19.2 to 2.22.0. (#​18205)
  • Bump serde from 1.0.218 to 1.0.219. (#​18228)
  • Bump serde_json from 1.0.139 to 1.0.140. (#​18202)
  • Bump ulid from 1.2.0 to 1.2.1. (#​18246)

v1.126.0

Compare Source

Synapse 1.126.0 (2025-03-11)

No significant changes since 1.126.0rc3.

Synapse 1.126.0rc3 (2025-03-07)

Bugfixes
  • Revert the background job to clear unreferenced state groups (that was introduced in v1.126.0rc1), due to a suspected issue that causes increased disk usage. (#​18222)

Synapse 1.126.0rc2 (2025-03-05)

Administrators using the Debian/Ubuntu packages from packages.matrix.org, please check the relevant section in the upgrade notes as we have recently updated the expiry date on the repository's GPG signing key. The old version of the key will expire on 2025-03-15.

Internal Changes

Synapse 1.126.0rc1 (2025-03-04)

Synapse 1.126.0rc1 was not fully released due to an error in CI.

Features
  • Define ratelimit configuration for delayed event management. (#​18019)
  • Add form_secret_path config option. (#​18090)
  • Add the --no-secrets-in-config command line option. (#​18092)
  • Add background job to clear unreferenced state groups. (#​18154)
  • Add support for specifying/overriding id_token_signing_alg_values_supported for an OpenID identity provider. (#​18177)
  • Add worker_replication_secret_path config option. (#​18191)
  • Add support for specifying/overriding redirect_uri in the authorization and token requests against an OpenID identity provider. (#​18197)
Bugfixes
  • Make sure we advertise registration as disabled when MSC3861 is enabled. (#​17661)
  • Prevent suspended users from sending encrypted messages. (#​18157)
  • Cleanup deleted state group references. (#​18165)
  • Fix MSC4108 QR-code login not working with some reverse-proxy setups. (#​18178)
  • Support device IDs that can't be represented in a scope when delegating auth to Matrix Authentication Service 0.15.0+. (#​18174)
Updates to the Docker image
  • Speed up the building of the Docker image. (#​18038)
Improved Documentation
  • Move incorrectly placed version indicator in User Event Redaction Admin API docs. (#​18152)
  • Document suspension Admin API. (#​18162)
Deprecations and Removals
  • Disable room list publication by default. (#​18175)
Updates to locked dependencies
  • Bump anyhow from 1.0.95 to 1.0.96. (#​18187)
  • Bump authlib from 1.4.0 to 1.4.1. (#​18190)
  • Bump click from 8.1.7 to 8.1.8. (#​18189)
  • Bump log from 0.4.25 to 0.4.26. (#​18184)
  • Bump pyo3-log from 0.12.0 to 0.12.1. (#​18046)
  • Bump serde from 1.0.217 to 1.0.218. (#​18183)
  • Bump serde_json from 1.0.138 to 1.0.139. (#​18186)
  • Bump sigstore/cosign-installer from 3.8.0 to 3.8.1. (#​18185)
  • Bump types-psycopg2 from 2.9.21.20241019 to 2.9.21.20250121. (#​18188)

v1.125.0

Compare Source

Synapse 1.125.0 (2025-02-25)

No significant changes since 1.125.0rc1.

Synapse 1.125.0rc1 (2025-02-18)

Features
  • Add functionality to be able to use multiple values in SSO feature attribute_requirements. (#​17949)
  • Add experimental config options admin_token_path and client_secret_path for MSC3861. (#​18004)
  • Add get_current_time_msec() method to the module API for sound time comparisons with Synapse. (#​18144)
Bugfixes
  • Update the response when a client attempts to add an invalid email address to the user's account from a 500, to a 400 with error text. (#​18125)
  • Fix user directory search when using a legacy module with a check_username_for_spam callback. Broke in v1.122.0. (#​18135)
Updates to the Docker image
  • Add SYNAPSE_HTTP_PROXY/SYNAPSE_HTTPS_PROXY/SYNAPSE_NO_PROXY environment variables to pass through specifically to the Synapse process (instead of needing to apply http_proxy/https_proxy/no_proxy globally). (#​18158)
Improved Documentation
  • Add Oracle Linux 8 and 9 installation instructions. (#​17436)
  • Document missing server config options (daemonize, print_pidfile, user_agent_suffix, use_frozen_dicts, manhole). (#​18122)
  • Document consequences of replacing secrets. (#​18138)
  • Make burst_count field an integer in rc_presence config documentation example. (#​18159)
Internal Changes
  • Overload DatabasePool.simple_select_one_txn to return non-None when the allow_none parameter is False. (#​17616)
  • Python 3.8 EOL: compile native extensions with the 3.9 ABI and use typing hints from the standard library. (#​17967)
  • Add log message when worker lock timeouts get large. (#​18124)
  • Make it explicit that you can buy an AGPL-alternative commercial license from Element. (#​18134)
  • Fix the 'Fix linting' GitHub Actions workflow. (#​18136)
  • Do not log at the exception-level when clients provide empty since token to /sync API. (#​18139)
  • Reduce database load of user search when using large search terms. (#​18172)
Updates to locked dependencies
  • Bump bcrypt from 4.2.0 to 4.2.1. (#​18127)
  • Bump bytes from 1.9.0 to 1.10.0. (#​18149)
  • Bump gitpython from 3.1.43 to 3.1.44. (#​18128)
  • Bump hiredis from 3.0.0 to 3.1.0. (#​18169)
  • Bump serde_json from 1.0.137 to 1.0.138. (#​18129)
  • Bump service-identity from 24.1.0 to 24.2.0. (#​18171)
  • Bump sigstore/cosign-installer from 3.7.0 to 3.8.0. (#​18147)
  • Bump twine from 6.0.1 to 6.1.0. (#​18170)
  • Bump types-pyyaml from 6.0.12.20240917 to 6.0.12.20241230. (#​18097)
  • Bump ulid from 1.1.4 to 1.2.0. (#​18148)

v1.124.0

Compare Source

Synapse 1.124.0 (2025-02-11)

No significant changes since 1.124.0rc3.

Synapse 1.124.0rc3 (2025-02-07)

Bugfixes
  • Fix regression in performance of sending events due to superfluous reads and locks. Introduced in v1.124.0rc1. (#​18141)

Synapse 1.124.0rc2 (2025-02-05)

Bugfixes
  • Fix regression where persisting events in some rooms could fail after a previous unclean shutdown. Introduced in v1.124.0rc1. (#​18137)

Synapse 1.124.0rc1 (2025-02-04)

Bugfixes
  • Add rate limit rc_presence.per_user. This prevents load from excessive presence updates sent by clients via sync api. Also rate limit /_matrix/client/v3/presence as per the spec. Contributed by @​rda0. (#​18000)
  • Deactivated users will no longer automatically accept an invite when auto_accept_invites is enabled. (#​18073)
  • Fix join being denied after being invited over federation. Also fixes other out-of-band membership transitions. (#​18075)
  • Updates contributed docker-compose.yml file to PostgreSQL v15, as v12 is no longer supported by Synapse. Contributed by @​maxkratz. (#​18089)
  • Fix rare edge case where state groups could be deleted while we are persisting new events that reference them. (#​18107, #​18130, #​18131)
  • Raise an error if someone is using an incorrect suffix in a config duration string. (#​18112)
  • Fix a bug where the Delete Room Admin API would fail if the block parameter was set to true and a worker other than the main process was configured to handle background tasks. (#​18119)
Internal Changes
  • Increase the length of the generated nonce parameter when perfoming OIDC logins to comply with the TI-Messenger spec. (#​18109)
Updates to locked dependencies
  • Bump dawidd6/action-download-artifact from 7 to 8. (#​18108)
  • Bump log from 0.4.22 to 0.4.25. (#​18098)
  • Bump python-multipart from 0.0.18 to 0.0.20. (#​18096)
  • Bump serde_json from 1.0.135 to 1.0.137. (#​18099)
  • Bump types-bleach from 6.1.0.20240331 to 6.2.0.20241123. (#​18082)

v1.123.0

Compare Source

Synapse 1.123.0 (2025-01-28)

No significant changes since 1.123.0rc1.

Synapse 1.123.0rc1 (2025-01-21)

Features
Bugfixes
  • Fix membership caches not updating in state reset scenarios. (#​17732)
  • Fix rare race where on upgrade to v1.122.0 a long running database upgrade could lock out new events from being received or sent. (#​18091)
Improved Documentation
  • Document tls option for a worker instance in instance_map. (#​18064)
Deprecations and Removals
Internal Changes
  • Increase invite rate limits (rc_invites.per_issuer) for Complement. (#​18072)
Updates to locked dependencies
  • Bump jinja2 from 3.1.4 to 3.1.5. (#​18067)
  • Bump mypy from 1.12.1 to 1.13.0. (#​18083)
  • Bump pillow from 11.0.0 to 11.1.0. (#​18084)
  • Bump pyo3 from 0.23.3 to 0.23.4. (#​18079)
  • Bump pyopenssl from 24.2.1 to 24.3.0. (#​18062)
  • Bump serde_json from 1.0.134 to 1.0.135. (#​18081)
  • Bump ulid from 1.1.3 to 1.1.4. (#​18080)

v1.122.0

Compare Source

Synapse 1.122.0 (2025-01-14)

Please note that this version of Synapse drops support for PostgreSQL 11 and 12. The minimum version of PostgreSQL supported is now version 13.

No significant changes since 1.122.0rc1.

Synapse 1.122.0rc1 (2025-01-07)

Deprecations and Removals
Features
  • Added the email.tlsname config option. This allows specifying the domain name used to validate the SMTP server's TLS certificate separately from the email.smtp_host to connect to. (#​17849)
  • Module developers will have access to the user ID of the requester when adding check_username_for_spam callbacks to spam_checker_module_callbacks. Contributed by Wilson@Pangea.chat. (#​17916)
  • Add endpoints to the Admin API to fetch the number of invites the provided user has sent after a given timestamp, fetch the number of rooms the provided user has joined after a given timestamp, and get report IDs of event reports against a provided user (i.e. where the user was the sender of the reported event). (#​17948)
  • Support stable account suspension from MSC3823. (#​17964)
  • Add macaroon_secret_key_path config option. (#​17983)
Bugfixes
  • Fix bug when rejecting withdrew invite with a third_party_rules module, where the invite would be stuck for the client. (#​17930)
  • Properly purge state groups tables when purging a room with the Admin API. (#​18024)
  • Fix a bug preventing the admin redaction endpoint from working on messages from remote users. (#​18029, #​18043)
Improved Documentation
  • Update synapse.app.generic_worker documentation to only recommend GET requests for stream writer routes by default, unless the worker is also configured as a stream writer. Contributed by @​evoL. (#​17954)
  • Add documentation for the previously-undocumented last_seen_ts query parameter to the query user Admin API. (#​17976)
  • Improve documentation for the TaskScheduler class. (#​17992)
  • Fix example in reverse proxy docs to include server port. (#​17994)
  • Update Alpine Linux Synapse Package Maintainer within the installation instructions. (#​17846)
Internal Changes
  • Add RoomID & EventID rust types. (#​17996)
  • Fix various type errors across the codebase. (#​17998)
  • Disable DB statement timeout when doing a room purge since it can be quite long. (#​18017)
  • Remove some remaining uses of twisted.internet.defer.returnValue. Contributed by Colin Watson. (#​18020)
  • Refactor get_profile to no longer include fields with a value of None. (#​18063)
Updates to locked dependencies
  • Bump mypy from 1.11.2 to 1.12.1. (#​17999)
  • Bump mypy-zope from 1.0.8 to 1.0.9. (#​18047)
  • Bump pillow from 10.4.0 to 11.0.0. (#​18015)
  • Bump pydantic from 2.9.2 to 2.10.3. (#​18014)
  • Bump pyicu from 2.13.1 to 2.14. (#​18060)
  • Bump pyo3 from 0.23.2 to 0.23.3. (#​18001)
  • Bump python-multipart from 0.0.16 to 0.0.18. (#​17985)
  • Bump sentry-sdk from 2.17.0 to 2.19.2. (#​18061)
  • Bump serde from 1.0.215 to 1.0.217. (#​18031, #​18059)
  • Bump serde_json from 1.0.133 to 1.0.134. (#​18044)
  • Bump twine from 5.1.1 to 6.0.1. (#​18049)

Changelogs for older versions can be found here.

v1.121.1

Compare Source

Synapse 1.121.1 (2024-12-11)

This release contains a fix for our docker build CI. It is functionally identical to 1.121.0, whose changelog is below.

Internal Changes
  • Downgrade the Ubuntu GHA runner when building docker images. (#​18026)

Synapse 1.121.0 (2024-12-11)

Internal Changes
  • Fix release process to not create duplicate releases. (#​18025)

Synapse 1.121.0rc1 (2024-12-04)

Features
  • Support for MSC4190: device management for Application Services. (#​17705)
  • Update MSC4186 Sliding Sync to include invite, ban, kick, targets when $LAZY-loading room members. (#​17947)
  • Use stable M_USER_LOCKED error code for locked accounts, as per Matrix 1.12. (#​17965)
  • MSC4076: Add disable_badge_count to pusher configuration. (#​17975)
Bugfixes
  • Fix long-standing bug where read receipts could get overly delayed being sent over federation. (#​17933)
Improved Documentation
  • Add OIDC example configuration for Forgejo (fork of Gitea). (#​17872)
  • Link to element-docker-demo from contrib/docker*. (#​17953)
Internal Changes
  • MSC4108: Add a Content-Type header on the PUT response to work around a faulty behavior in some caching reverse proxies. (#​17253)
  • Fix incorrect comment in new schema delta. (#​17936)
  • Raise setuptools_rust version cap to 1.10.2. (#​17944)
  • Enable encrypted appservice related experimental features in the complement docker image. (#​17945)
  • Return whether the user is suspended when querying the user account in the Admin API. (#​17952)
  • Fix new scheduled tasks jumping the queue. (#​17962)
  • Bump pyo3 and dependencies to v0.23.2. (#​17966)
  • Update setuptools-rust and fix building abi3 wheels in latest version. (#​17969)
  • Consolidate SSO redirects through /_matrix/client/v3/login/sso/redirect(/{idpId}). (#​17972)
  • Fix Docker and Complement config to be able to use public_baseurl. (#​17986)
  • Fix building wheels for MacOS which was temporarily disabled in Synapse 1.120.2. (#​17993)
  • Fix release process to not create duplicate releases. (#​17970, #​17995)
Updates to locked dependencies
  • Bump bytes from 1.8.0 to 1.9.0. (#​17982)
  • Bump pysaml2 from 7.3.1 to 7.5.0. (#​17978)
  • Bump serde_json from 1.0.132 to 1.0.133. (#​17939)
  • Bump tomli from 2.0.2 to 2.1.0. (#​17959)
  • Bump tomli from 2.1.0 to 2.2.1. (#​17979)
  • Bump tornado from 6.4.1 to 6.4.2. (#​17955)

v1.120.2

Compare Source

Synapse 1.120.2 (2024-12-03)

This version has building of wheels for macOS disabled. It is functionally identical to 1.120.1, which contains multiple security fixes. If you are already using 1.120.1, there is no need to upgrade to this version.

Synapse 1.120.1 (2024-12-03)

This patch release fixes multiple security vulnerabilities, some affecting all prior versions of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild.

Administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below.

Security advisory

The following issues are fixed in 1.120.1.

Additionally, we disclose the following vulnerabilities, both have been fixed in Synapse 1.106.0:

See the advisories for more details. If you have any questions, email security at element.io.

Bug fixes
  • Fix release process to not create duplicate releases. (#​17970)

v1.120.1

Compare Source

v1.120.0

Compare Source

Synapse 1.120.0 (2024-11-26)

This release enables the enforcement of authenticated media by default, with exemptions for media that is already present in the homeserver's media store.

Most homeservers operating in the public federation will not be impacted by this change, given that the large homeserver matrix.org enabled this in September 2024 and therefore most clients and servers will already have updated as a result.

Some server administrators may still wish to disable this enforcement for the time being, in the interest of compatibility with older clients and older federated homeservers. See the upgrade notes for more information.

Bugfixes
  • Fix a bug introduced in Synapse v1.120rc1 which would cause the newly-introduced delete_old_otks job to fail in worker-mode deployments. (#​17960)

Synapse 1.120.0rc1 (2024-11-20)

Features
  • Enforce authenticated media by default. Administrators can revert this by configuring enable_authenticated_media to false. In a future release of Synapse, this option will be removed and become always-on. (#​17889)
  • Add a one-off task to delete old One-Time Keys, to guard against us having old OTKs in the database that the client has long forgotten about. (#​17934)
Improved Documentation
  • Clarify the semantics of the enable_authenticated_media configuration option. (#​17913)
  • Add documentation about backing up Synapse. (#​17931)
Deprecations and Removals
Internal Changes
  • Addressed some typos in docs and returned error message for unknown MXC ID. (#​17865)
  • Unpin the upload release GHA action. (#​17923)
  • Bump macOS version used to build wheels during release, as current version used is end-of-life. (#​17924)
  • Move server event filtering logic to Rust. (#​17928)
  • Support new package name of PyPI package python-multipart 0.0.13 so that distro packagers do not need to work around name conflict with PyPI package multipart. (#​17932)
  • Speed up slow initial sliding syncs on large servers. (#​17946)
Updates to locked dependencies
  • Bump anyhow from 1.0.92 to 1.0.93. (#​17920)
  • Bump bleach from 6.1.0 to 6.2.0. (#​17918)
  • Bump immutabledict from 4.2.0 to 4.2.1. (#​17941)
  • Bump packaging from 24.1 to 24.2. (#​17940)
  • Bump phonenumbers from 8.13.49 to 8.13.50. (#​17942)
  • Bump pygithub from 2.4.0 to 2.5.0. (#​17917)
  • Bump ruff from 0.7.2 to 0.7.3. (#​17919)
  • Bump serde from 1.0.214 to 1.0.215. (#​17938)

v1.119.0

Compare Source

Synapse 1.119.0 (2024-11-13)

No significant changes since 1.119.0rc2.

Python 3.8 support dropped

Python 3.8 is end-of-life and is no longer supported by Synapse. The minimum supported Python version is now 3.9.

If you are running Synapse with Python 3.8, please upgrade to Python 3.9 (or greater) before upgrading Synapse.

Synapse 1.119.0rc2 (2024-11-11)

Note that due to packaging issues there was no v1.119.0rc1.

Features
Bugfixes
  • Fix bug with sliding sync where $LAZY-loading room members would not return required_state membership in incremental syncs. (#​17809)
  • Check if user has membership in a room before tagging it. Contributed by Lama Alosaimi. (#​17839)
  • Fix a bug in the admin redact endpoint where the background task would not run if a worker was specified in the config option run_background_tasks_on. (#​17847)
  • Fix bug where some presence and typing timeouts can expire early. (#​17850)
  • Fix detection when the built Rust library was outdated when using source installations. (#​17861)
  • Fix a long-standing bug in Synapse which could cause one-time keys to be issued in the incorrect order, causing message decryption failures. (#​17903)
  • Fix experimental support for MSC4222 (Adding state_after to sync v2) where we would return the full state on incremental syncs when using lazy loaded members and there were no new events in the timeline. (#​17915)
Internal Changes
  • Remove support for python 3.8. (#​17908)
  • Add a test for downloading and thumbnailing a CMYK JPEG. (#​17786)
  • Refactor database calls to remove Generator usage. (#​17813, #​17814, #​17815, #​17816, #​17817, #​17818, #​17890)
  • Include the destination in the error of 'Destination mismatch' on federation requests. (#​17830)
  • The nix flake inside the repository no longer tracks nixpkgs/master to not catch the latest bugs from a MR merged 5 minutes ago. (#​17852)
  • Minor speed-up of sliding sync by computing extensions results in parallel. (#​17884)
  • Bump the default Python version in the Synapse Dockerfile from 3.11 -> 3.12. (#​17887)
  • Remove usage of internal header encoding API. (#​17894)
  • Use unique name for each os.arch variant when uploading Wheel artifacts. (#​17905)
  • Fix tests to run with latest Twisted. (#​17906, #​17907, #​17911)
  • Update version constraint to allow the latest poetry-core 1.9.1. (#​17902)
  • Update the portdb CI to use Python 3.13 and Postgres 17 as latest dependencies. (#​17909)
  • Add an index to current_state_delta_stream table. (#​17912)
  • Fix building and attaching release artifacts during the release process. (#​17921)
Updates to locked dependencies

v1.118.0

Compare Source

Synapse 1.118.0 (2024-10-29)

No significant changes since 1.118.0rc1.

Python 3.8 support will be dropped in the next release

Python 3.8 is now end-of-life. As per our Deprecation Policy for Platform Dependencies, Synapse will be dropping support for Python 3.8 in the next release; Synapse 1.119.0.

Synapse 1.118.x will be the final release to support Python 3.8. If you are running Synapse with Python 3.8, please upgrade before the 1.119.0 release, due in less than one month.

Python 3.13 and PostgreSQL 17 support

On the other end of the spectrum, Synapse 1.118.0 is the first release to support Python 3.13! PostgreSQL 17 is also supported as of this release.

Synapse 1.118.0rc1 (2024-10-22)

Features
  • Added the display_name_claim option to the JWT configuration. This option allows specifying the claim key that contains the user's display name in the JWT payload. (#​17708)
  • Implement MSC4210: Remove legacy mentions. Contributed by @​tulir @​ Beeper. (#​17783)
Bugfixes
  • Fix saving of PNG thumbnails, when the original image is in the CMYK color space. (#​17736)
  • Fix bug with sliding sync where the server would not return state that was added to the required_state config. (#​17785, #​17805)
  • Fix a bug in MSC4186 Sliding Sync that would cause rooms to stay forgotten and hidden even after rejoining. (#​17835)
Improved Documentation
  • Clarify when the user_may_invite and user_may_send_3pid_invite module callbacks are called. (#​17627)
  • Correct documentation to refer to the --config-path argument instead of --config-file. (#​17802)
  • Fix typo in target_cache_memory_usage docs. (#​17825)
Internal Changes
  • Slight optimization when fetching state/events for Sliding Sync. (#​17718)
  • Add Python 3.13 and Postgres 17 to the test matrix. (#​17752)
  • Test github token before running release script steps. (#​17803)
  • Build debian packages for new Ubuntu versions, and stop building for no longer supported versions. (#​17824)
  • Enable the .org.matrix.msc4028.encrypted_event push rule by default in accordance with MSC4028. Note that the corresponding experimental feature must still be switched on for this push rule to have any effect. (#​17826)
  • Fix some typing issues uncovered by upgrading mypy to 1.11.x. (#​17842)
Updates to locked dependencies
  • Bump mypy from 1.10.1 to 1.11.2. (#​17842)
  • Bump mypy-zope from 1.0.5 to 1.0.7. (#​17827)
  • Bump phonenumbers from 8.13.46 to 8.13.47. (#​17797)
  • Bump psycopg2 from 2.9.9 to 2.9.10. (#​17843)
  • Bump ruff from 0.6.8 to 0.6.9. (#​17794)
  • Bump sentry-sdk from 2.14.0 to 2.15.0. (#​17795)
  • Bump sentry-sdk from 2.15.0 to 2.16.0. (#​17829)
  • Bump sentry-sdk from 2.16.0 to 2.17.0. (#​17844)
  • Bump sigstore/cosign-installer from 3.6.0 to 3.7.0. (#​17798)
  • Bump tomli from 2.0.1 to 2.0.2. (#​17796)
  • Bump types-requests from 2.32.0.20240914 to 2.32.0.20241016. (#​17841)
  • Bump types-setuptools from 75.1.0.20240917 to 75.1.0.20241014. (#​17828)

v1.117.0

Compare Source

Synapse 1.117.0 (2024-10-15)

No significant changes since 1.117.0rc1.

Synapse 1.117.0rc1 (2024-10-08)

Features
  • Add config option redis.password_path. (#​17717)
Bugfixes
  • Fix a rare bug introduced in v1.29.0 where invalidating a user's access token from a worker could raise an error. (#​17779)
  • In the response to GET /_matrix/client/versions, set the unstable_features flag for MSC4140 to false when server configuration disables support for delayed events. (#​17780)
  • Improve input validation and room membership checks in admin redaction API. (#​17792)
Improved Documentation
  • Clarify the docstring of test_forget_when_not_left. (#​17628)
  • Add documentation note about PYTHONMALLOC for accurate jemalloc memory tracking. Contributed by @​hensg. (#​17709)
  • Remove spurious "TODO UPDATE ALL THIS" note in the Debian installation docs. (#​17749)
  • Explain how load balancing works for federation_sender_instances. (#​17776)
Internal Changes
  • Minor performance increase for large accounts using sliding sync. (#​17751)
  • Increase performance of the notifier when there are many syncing users. (#​17765, #​17766)
  • Fix performance of streams that don't change often. (#​17767)
  • Improve performance of sliding sync connections that do not ask for any rooms. (#​17768)
  • Reduce overhead of sliding sync E2EE loops. (#​17771)
  • Sliding sync minor performance speed up using new table. (#​17787)
  • Sliding sync minor performance improvement by omitting unchanged data from incremental responses. (#​17788)
  • Speed up sliding sync when there are many active subscriptions. (#​17789)
  • Add missing license headers on new source files. (#​17799)
Updates to locked dependencies
  • Bump phonenumbers from 8.13.45 to 8.13.46. (#​17773)
  • Bump python-multipart from 0.0.10 to 0.0.12. (#​17772)
  • Bump regex from 1.10.6 to 1.11.0. (#​17770)
  • Bump ruff from 0.6.7 to 0.6.8. (#​17774)

v1.116.0

Compare Source

Synapse 1.116.0 (2024-10-01)

No significant changes since 1.116.0rc2.

Synapse 1.116.0rc2 (2024-09-26)

Features
  • Add implementation of restricting who can overwrite a state event as proposed by MSC3757. (#​17513)

Synapse 1.116.0rc1 (2024-09-25)

Features
Bugfixes
  • Make sure we get up-to-date state information when using the new MSC4186 Sliding Sync tables to derive room membership. (#​17692)
  • Fix bug where room account data would not correctly be sent down MSC4186 Sliding Sync for old rooms. (#​17695)
  • Fix a bug in MSC4186 Sliding Sync which could prevent /sync from working for certain user accounts. (#​17727, #​17733)
  • Ignore invites from ignored users in Sliding Sync. (#​17729)
  • Fix bug in MSC4186 Sliding Sync where the server would incorrectly return a negative bump stamp, which caused Element X apps to stop syncing. (#​17748)
Internal Changes
  • Import pydantic objects from the _pydantic_compat module. This allows check_pydantic_models.py to mock those pydantic objects only in the synapse module, and not interfere with pydantic objects in external dependencies. (#​17667)
  • Use MSC4186 Sliding Sync tables as a bulk shortcut for getting the max event_stream_ordering of rooms. (#​17693)
  • Speed up MSC4186 sliding sync requests a bit where there are many room changes. (#​17696)
  • Refactor MSC4186 sliding sync filter unit tests so the sliding sync API has better test coverage. (#​17703)
  • Fetch bump_stamps more efficiently in MSC4186 Sliding Sync. (#​17723)
  • Shortcut for checking if certain background updates have completed (utilized in MSC4186 Sliding Sync). (#​17724)
  • More efficiently fetch rooms for MSC4186 Sliding Sync. (#​17725)
  • Fix _bulk_get_max_event_pos being inefficient. (#​17728)
  • Add cache to get_tags_for_room(...). (#​17730)
  • Small performance improvement in speeding up MSC4186 Sliding Sync. (#​17731)
  • Minor speed up of initial MSC4186 sliding sync requests. (#​17734)
  • Remove usage of the deprecated cgi module, deprecated in Python 3.11 and removed in Python 3.13. (#​17741)
  • Fix typing of a variable that is not Unknown anymore after updating treq. (#​17744)
Updates to locked dependencies
  • Bump anyhow from 1.0.86 to 1.0.89. (#​17685, #​17716)
  • Bump bytes from 1.7.1 to 1.7.2. (#​17743)
  • Bump cryptography from 43.0.0 to 43.0.1. (#​17689)
  • Bump idna from 3.8 to 3.10. (#​17758)
  • Bump msgpack from 1.0.8 to 1.1.0. (#​17759)
  • Bump phonenumbers from 8.13.44 to 8.13.45. (#​17762)
  • Bump prometheus-client from 0.20.0 to 0.21.0. (#​17746)
  • Bump pyasn1 from 0.6.0 to 0.6.1. (#​17714)
  • Bump pyasn1-modules from 0.4.0 to 0.4.1. (#​17747)
  • Bump pydantic from 2.8.2 to 2.9.2. (#​17756)
  • Bump python-multipart from 0.0.9 to 0.0.10. (#​17745)
  • Bump ruff from 0.6.4 to 0.6.7. (#​17715, #​17760)
  • Bump sentry-sdk from 2.13.0 to 2.14.0. (#​17712)
  • Bump serde from 1.0.209 to 1.0.210. (#​17686)
  • Bump serde_json from 1.0.127 to 1.0.128. (#​17687)
  • Bump treq from 23.11.0 to 24.9.1. (#​17744)
  • Bump types-pyyaml from 6.0.12.20240808 to 6.0.12.20240917. (#​17755)
  • Bump types-requests from 2.32.0.20240712 to 2.32.0.20240914. (#​17713)
  • Bump types-setuptools from 74.1.0.20240907 to 75.1.0.20240917. (#​17757)

v1.115.0

Compare Source

Synapse 1.115.0 (2024-09-17)

No significant changes since 1.115.0rc2.

Synapse 1.115.0rc2 (2024-09-12)

Internal Changes
  • Pre-populate room data used in experimental MSC3575 Sliding Sync /sync endpoint for quick filtering/sorting. (#​17652)
  • Speed up sliding sync by reducing amount of data pulled out of the database for large rooms. (#​17683)

Synapse 1.115.0rc1 (2024-09-10)

Features
  • Improve cross-signing upload when using MSC3861 to use a custom UIA flow stage, with web fallback support. (#​17509)
Bugfixes
  • Return 400 M_BAD_JSON upon attempting to complete various room actions with a non-local user ID and unknown room ID, rather than an internal server error. (#​17607)
  • Fix authenticated media responses using a wrong limit when following redirects over federation. (#​17626)
  • Fix bug where we returned the wrong bump_stamp for invites in sliding sync response, causing incorrect ordering of invites in the room list. (#​17674)
Improved Documentation
  • Clarify that the admin api resource is only loaded on the main process and not workers. (#​17590)
  • Fixed typo in saml2_config config example. (#​17594)
Deprecations and Removals
  • Stabilise MSC4156 by removing the msc4156_enabled config setting and defaulting it to true. (#​17650)
Internal Changes
Updates to locked dependencies
  • Bump authlib from 1.3.1 to 1.3.2. (#​17679)
  • Bump idna from 3.7 to 3.8. (#​17682)
  • Bump ruff from 0.6.2 to 0.6.4. (#​17680)
  • Bump towncrier from 24.7.1 to 24.8.0. (#​17645)
  • Bump twisted from 24.7.0rc1 to 24.7.0. (#​17647)
  • Bump types-pillow from 10.2.0.20240520 to 10.2.0.20240822. (#​17644)
  • Bump types-psycopg2 from 2.9.21.20240417 to 2.9.21.20240819. (#​17646)
  • Bump types-setuptools from 71.1.0.20240818 to 74.1.0.20240907. (#​17681)

v1.114.0

Compare Source

Synapse 1.114.0 (2024-09-02)

This release enables support for MSC4186 — Simplified Sliding Sync. This allows using the upcoming releases of the Element X mobile apps without having to run a Sliding Sync Proxy.

Features

Synapse 1.114.0rc3 (2024-08-30)

Bugfixes
  • Fix regression in v1.114.0rc2 that caused workers to fail to start. (#​17626)

Synapse 1.114.0rc2 (2024-08-30)

Features
  • Improve cross-signing upload when using MSC3861 to use a custom UIA flow stage, with web fallback support. (#​17509)
  • Make hash_password script accept password input from stdin. (#​17608)
Bugfixes
  • Fix hierarchy returning 403 when room is accessible through federation. Contributed by Krishan (@​kfiven). (#​17194)
  • Fix content-length on federation /thumbnail responses. (#​17532)
  • Fix authenticated media responses using a wrong limit when following redirects over federation. (#​17543)
Internal Changes
  • MSC3861: load the issuer and account management URLs from OIDC discovery. (#​17407)
  • Refactor sliding sync class into multiple files. (#​17595)
  • Store sliding sync per-connection state in the database. (#​17599)
  • Make the sliding sync PerConnectionState class immutable. (#​17600)
  • Add support to @tag_args for standalone functions. (#​17604)
  • Speed up incremental syncs in sliding sync by adding some more caching. (#​17606)
  • Always return the user's own read receipts in sliding sync. (#​17617)
  • Replace isort and black with ruff. (#​17620)
  • Refactor sliding sync code to move room list logic out into a separate class. (#​17622)
Updates to locked dependencies
  • Bump attrs from 23.2.0 to 24.2.0. (#​17609)
  • Bump cryptography from 42.0.8 to 43.0.0. (#​17584)
  • Bump phonenumbers from 8.13.43 to 8.13.44. (#​17610)
  • Bump pygithub from 2.3.0 to 2.4.0. (#​17612)
  • Bump pyyaml from 6.0.1 to 6.0.2. (#​17611)
  • Bump sentry-sdk from 2.12.0 to 2.13.0. (#​17585)
  • Bump serde from 1.0.206 to 1.0.208. (#​17581)
  • Bump serde from 1.0.208 to 1.0.209. (#​17613)
  • Bump serde_json from 1.0.124 to 1.0.125. (#​17582)
  • Bump serde_json from 1.0.125 to 1.0.127. (#​17614)
  • Bump types-jsonschema from 4.23.0.20240712 to 4.23.0.20240813. (#​17583)
  • Bump types-setuptools from 71.1.0.20240726 to 71.1.0.20240818. (#​17586)

Synapse 1.114.0rc1 (2024-08-20)

Features
  • Add a flag to /versions, org.matrix.simplified_msc3575, to indicate whether experimental sliding sync support has been enabled. (#​17571)
  • Handle changes in timeline_limit in experimental sliding sync. (#​17579)
  • Correctly track read receipts that should be sent down in experimental sliding sync. (#​17575, #​17589, #​17592)
Bugfixes
  • Start handlers for new media endpoints when media resource configured. (#​17483)
  • Fix timeline ordering (using stream_ordering instead of topological ordering) in experimental MSC3575 Sliding Sync /sync endpoint. (#​17510)
  • Fix experimental sliding sync implementation to remember any updates in rooms that were not sent down immediately. (#​17535)
  • Better exclude partially stated rooms if we must await full state in experimental MSC3575 Sliding Sync /sync endpoint. (#​17538)
  • Handle lower-case http headers in _Mulitpart_Parser_Protocol. (#​17545)
  • Fix fetching federation signing keys from servers that omit old_verify_keys. Contributed by @​tulir @​ Beeper. (#​17568)
  • Fix bug where we would respond with an error when a remote server asked for media that had a length of 0, using the new multipart federation media endpoint. (#​17570)
Improved Documentation
Internal Changes
  • Add more tracing to experimental MSC3575 Sliding Sync /sync endpoint. (#​17514)
  • Fixup comment in sliding sync implementation. (#​17531)
  • Replace override of deprecated method HTTPAdapter.get_connection with get_connection_with_tls_context. (#​17536)
  • Fix performance of device lists in /key/changes and sliding sync. (#​17537, #​17548)
  • Bump setuptools from 67.6.0 to 72.1.0. (#​17542)
  • Add a utility function for generating random event IDs. (#​17557)
  • Speed up responding to media requests. (#​17558, #​17561, #​17564, #​17566, #​17567, #​17569)
  • Test github token before running release script steps. (#​17562)
  • Reduce log spam of multipart files. (#​17563)
  • Refactor per-connection state in experimental sliding sync handler. (#​17574)
  • Add histogram metrics for sliding sync processing time. (#​17593)
Updates to locked dependencies
  • Bump bytes from 1.6.1 to 1.7.1. (#​17526)
  • Bump lxml from 5.2.2 to 5.3.0. (#​17550)
  • Bump phonenumbers from 8.13.42 to 8.13.43. (#​17551)
  • Bump regex from 1.10.5 to 1.10.6. (#​17527)
  • Bump sentry-sdk from 2.10.0 to 2.12.0. (#​17553)
  • Bump serde from 1.0.204 to 1.0.206. (#​17556)
  • Bump serde_json from 1.0.122 to 1.0.124. (#​17555)
  • Bump sigstore/cosign-installer from 3.5.0 to 3.6.0. (#​17549)
  • Bump types-pyyaml from 6.0.12.20240311 to 6.0.12.20240808. (#​17552)
  • Bump types-requests from 2.31.0.20240406 to 2.32.0.20240712. (#​17524)

v1.113.0

Compare Source

Synapse 1.113.0 (2024-08-13)

No significant changes since 1.113.0rc1.

Synapse 1.113.0rc1 (2024-08-06)

Features
  • Track which rooms have been sent to clients in the experimental MSC3575 Sliding Sync /sync endpoint. (#​17447)
  • Add Account Data extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#​17477)
  • Add receipts extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#​17489)
  • Add typing notification extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#​17505)
Bugfixes
  • Update experimental MSC3575 Sliding Sync /sync endpoint to handle invite/knock rooms when filtering. (#​17450)
  • Fix a bug introduced in v1.110.0 which caused /keys/query to return incomplete results, leading to high network activity and CPU usage on Matrix clients. (#​17499)
Improved Documentation
Internal Changes
  • Change sliding sync to use their own token format in preparation for storing per-connection state. (#​17452)
  • Ensure we don't send down negative bump_stamp in experimental sliding sync endpoint. (#​17478)
  • Do not send down empty room entries down experimental sliding sync endpoint. (#​17479)
  • Refactor Sliding Sync tests to better utilize the SlidingSyncBase. (#​17481, #​17482)
  • Add some opentracing tags and logging to the experimental sliding sync implementation. (#​17501)
  • Split and move Sliding Sync tests so we have some more sane test file sizes. (#​17504)
  • Update the limited field description in the Sliding Sync response to accurately describe what it actually represents. (#​17507)
  • Easier to understand timeline assertions in Sliding Sync tests. (#​17511)
  • Reset the sliding sync connection if we don't recognize the per-connection state position. (#​17529)
Updates to locked dependencies
  • Bump bcrypt from 4.1.3 to 4.2.0. (#​17495)
  • Bump black from 24.4.2 to 24.8.0. (#​17522)
  • Bump phonenumbers from 8.13.39 to 8.13.42. (#​17521)
  • Bump ruff from 0.5.4 to 0.5.5. (#​17494)
  • Bump serde_json from 1.0.120 to 1.0.121. (#​17493)
  • Bump serde_json from 1.0.121 to 1.0.122. (#​17525)
  • Bump towncrier from 23.11.0 to 24.7.1. (#​17523)
  • Bump types-pyopenssl from 24.1.0.20240425 to 24.1.0.20240722. (#​17496)
  • Bump types-setuptools from 70.1.0.20240627 to 71.1.0.20240726. (#​17497)

v1.112.0

Compare Source

Synapse 1.112.0 (2024-07-30)

This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again.

Note that this security fix is also available as Synapse 1.111.1, which does not include the rest of the changes in Synapse 1.112.0.

This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request. If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.

With that said, despite being a high severity issue, we consider it unlikely that Synapse installations will be affected. The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.

Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.

pip users: Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. Please manually install the new version of Twisted using pip install Twisted==24.7.0rc1. Note also that even the --upgrade-strategy=eager flag to pip install -U matrix-synapse will not upgrade Twisted to a patched version because it is only a release candidate at this time.

Internal Changes
  • Upgrade locked dependency on Twisted to 24.7.0rc1. (#​17502)

Synapse 1.112.0rc1 (2024-07-23)

Please note that this release candidate does not include the security dependency update included in version 1.111.1 as this version was released before 1.111.1. The same security fix can be found in the full release of 1.112.0.

Features
  • Add to-device extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#​17416)
  • Populate name/avatar fields in experimental MSC3575 Sliding Sync /sync endpoint. (#​17418)
  • Populate heroes and room summary fields (joined_count, invited_count) in experimental MSC3575 Sliding Sync /sync endpoint. (#​17419)
  • Populate is_dm room field in experimental MSC3575 Sliding Sync /sync endpoint. (#​17429)
  • Add room subscriptions to experimental MSC3575 Sliding Sync /sync endpoint. (#​17432)
  • Prepare for authenticated media freeze. (#​17433)
  • Add E2EE extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#​17454)
Bugfixes
  • Add configurable option to always include offline users in presence sync results. Contributed by @​Michael-Hollister. (#​17231)
  • Fix bug in experimental MSC3575 Sliding Sync /sync endpoint when using room type filters and the user has one or more remote invites. (#​17434)
  • Order heroes by stream_ordering as the Matrix specification states (applies to /sync). (#​17435)
  • Fix rare bug where /sync would break for a user when using workers with multiple stream writers. (#​17438)
Improved Documentation
Internal Changes
  • Make sure we always use the right logic for enabling the media repo. (#​17424)
  • Fix argument documentation for method RateLimiter.record_action. (#​17426)
  • Reduce volume of 'Waiting for current token' logs, which were introduced in v1.109.0. (#​17428)
  • Limit concurrent remote downloads to 6 per IP address, and decrement remote downloads without a content-length from the ratelimiter after the download is complete. (#​17439)
  • Remove unnecessary call to resume producing in fake channel. (#​17449)
  • Update experimental MSC3575 Sliding Sync /sync endpoint to bump room when it is created. (#​17453)
  • Speed up generating sliding sync responses. (#​17458)
  • Add cache to get_rooms_for_local_user_where_membership_is to speed up sliding sync. (#​17460)
  • Speed up fetching room keys from backup. (#​17461)
  • Speed up sorting of the room list in sliding sync. (#​17468)
  • Implement handling of $ME as a state key in sliding sync. (#​17469)
Updates to locked dependencies
  • Bump bytes from 1.6.0 to 1.6.1. (#​17441)
  • Bump hiredis from 2.3.2 to 3.0.0. (#​17464)
  • Bump jsonschema from 4.22.0 to 4.23.0. (#​17444)
  • Bump matrix-org/done-action from 2 to 3. (#​17440)
  • Bump mypy from 1.9.0 to 1.10.1. (#​17445)
  • Bump pyopenssl from 24.1.0 to 24.2.1. (#​17465)
  • Bump ruff from 0.5.0 to 0.5.4. (#​17466)
  • Bump sentry-sdk from 2.6.0 to 2.8.0. (#​17456)
  • Bump sentry-sdk from 2.8.0 to 2.10.0. (#​17467)
  • Bump setuptools from 67.6.0 to 70.0.0. (#​17448)
  • Bump twine from 5.1.0 to 5.1.1. (#​17443)
  • Bump types-jsonschema from 4.22.0.20240610 to 4.23.0.20240712. (#​17446)
  • Bump ulid from 1.1.2 to 1.1.3. (#​17442)
  • Bump zipp from 3.15.0 to 3.19.1. (#​17427)

v1.111.1

Compare Source

Synapse 1.111.1 (2024-07-30)

This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again.

This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request. If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.

With that said, despite being a high severity issue, we consider it unlikely that Synapse installations will be affected. The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.

Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.

pip users: Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. Please manually install the new version of Twisted using pip install Twisted==24.7.0rc1. Note also that even the --upgrade-strategy=eager flag to pip install -U matrix-synapse will not upgrade Twisted to a patched version because it is only a release candidate at this time.

Internal Changes
  • Upgrade locked dependency on Twisted to 24.7.0rc1. (#​17502)

v1.111.0

Compare Source

Synapse 1.111.0 (2024-07-16)

No significant changes since 1.111.0rc2.

Synapse 1.111.0rc2 (2024-07-10)

Bugfixes
  • Fix bug where using synapse.app.media_repository worker configuration would break the new media endpoints. (#​17420)
Improved Documentation
Internal Changes
  • Route authenticated federation media requests to media repository workers in Complement tests. (#​17422)

Synapse 1.111.0rc1 (2024-07-09)

Features
Bugfixes
  • Fix rare race which caused no new to-device messages to be received from remote server. (#​17362)
  • Fix bug in experimental MSC3575 Sliding Sync /sync endpoint when using an old database. (#​17398)
Improved Documentation
  • Clarify that url_preview_url_blacklist is a usability feature. (#​17356)
  • Fix broken links in README. (#​17379)
  • Clarify that changelog content and file extension need to match in order for entries to merge. (#​17399)
Internal Changes
  • Make the release script create a release branch for Complement as well. (#​17318)
  • Fix uploading packages to PyPi. (#​17363)
  • Add CI check for the README. (#​17367)
  • Fix linting errors from new ruff version. (#​17381, #​17411)
  • Fix building debian packages on non-clean checkouts. (#​17390)
  • Finish up work to allow per-user feature flags. (#​17392, #​17410)
  • Allow enabling sliding sync per-user. (#​17393)
Updates to locked dependencies
  • Bump certifi from 2023.7.22 to 2024.7.4. (#​17404)
  • Bump cryptography from 42.0.7 to 42.0.8. (#​17382)
  • Bump ijson from 3.2.3 to 3.3.0. (#​17413)
  • Bump log from 0.4.21 to 0.4.22. (#​17384)
  • Bump mypy-zope from 1.0.4 to 1.0.5. (#​17414)
  • Bump pillow from 10.3.0 to 10.4.0. (#​17412)
  • Bump pydantic from 2.7.1 to 2.8.2. (#​17415)
  • Bump ruff from 0.3.7 to 0.5.0. (#​17381)
  • Bump serde from 1.0.203 to 1.0.204. (#​17409)
  • Bump serde_json from 1.0.117 to 1.0.120. (#​17385, #​17408)
  • Bump types-setuptools from 69.5.0.20240423 to 70.1.0.20240627. (#​17380)

v1.110.0

Compare Source

Synapse 1.110.0 (2024-07-03)

No significant changes since 1.110.0rc3.

Synapse 1.110.0rc3 (2024-07-02)

Bugfixes
  • Fix bug where /sync requests could get blocked indefinitely after an upgrade from Synapse versions before v1.109.0. (#​17386, #​17391)
Internal Changes
  • Limit size of presence EDUs to 50 entries. (#​17371)
  • Fix building debian package for debian sid. (#​17389)

Synapse 1.110.0rc2 (2024-06-26)

Internal Changes
  • Fix uploading packages to PyPi. (#​17363)

Synapse 1.110.0rc1 (2024-06-26)

Features
  • Add initial implementation of an experimental MSC3575 Sliding Sync /sync endpoint. (#​17187, #​17301)
    • Native sliding sync support is coming, but is not yet ready for usage outside of initial client development and testing. Expect to see much more on this feature in the next few Synapse releases.
  • Add experimental support for MSC3823 - Account suspension. (#​17255)
  • Improve ratelimiting in Synapse. (#​17256)
  • Add support for the unstable MSC4151 report room API. (#​17270, #​17296)
  • Filter for public and empty rooms added to Admin-API List Room API. (#​17276)
  • Add is_dm filtering to experimental MSC3575 Sliding Sync /sync endpoint. (#​17277)
  • Add is_encrypted filtering to experimental MSC3575 Sliding Sync /sync endpoint. (#​17281)
  • Include user membership in events served to clients, per MSC4115. (#​17282)
  • Do not require user-interactive authentication for uploading cross-signing keys for the first time, per MSC3967. (#​17284)
  • Add stream_ordering sort to experimental MSC3575 Sliding Sync /sync endpoint. (#​17293)
  • register_new_matrix_user now supports a --password-file flag, which is useful for scripting. (#​17294)
  • register_new_matrix_user now supports a --exists-ok flag to allow registration of users that already exist in the database. This is useful for scripts that bootstrap user accounts with initial passwords. (#​17304)
  • Add support for via query parameter from MSC4156. (#​17322)
  • Add is_invite filtering to experimental MSC3575 Sliding Sync /sync endpoint. (#​17335)
  • Support MSC3916 by adding a federation /download endpoint. (#​17350)
Bugfixes
  • Fix searching for users with their exact localpart whose ID includes a hyphen. (#​17254)
  • Fix wrong retention policy being used when filtering events. (#​17272)
  • Fix bug where OTKs were not always included in /sync response when using workers. (#​17275)
  • Fix a long-standing bug where an invalid 'from' parameter to /notifications would result in an Internal Server Error. (#​17283)
  • Fix edge case in /sync returning the wrong the state when using sharded event persisters. (#​17295)
  • Fix email notification subject when invited to a space. (#​17336)
Improved Documentation
  • Add missing quotes for example for exclude_rooms_from_sync. (#​17308)
  • Update header in the README to visually fix the the auto-generated table of contents. (#​17329)
  • Fix stale references to the Foundation's Security Disclosure Policy. (#​17341)
  • Add default values for rc_invites.per_issuer to docs. (#​17347)
  • Fix an error in the docs for search_all_users parameter under user_directory. (#​17348)
Internal Changes
  • Remove unused expire_access_token option in the Synapse Docker config file. Contributed by @​AaronDewes. (#​17198)
  • Use fully-qualified PersistedEventPosition when returning RoomsForUser to facilitate proper comparisons and RoomStreamToken generation. (#​17265)
  • Add debug logging for when room keys are uploaded, including whether they are replacing other room keys. (#​17266)
  • Handle OTK uploads off master. (#​17271)
  • Don't try and resync devices for remote users whose servers are marked as down. (#​17273)
  • Re-organize Pydantic models and types used in handlers. (#​17279)
  • Expose the worker instance that persisted the event on event.internal_metadata.instance_name. (#​17300)
  • Update the README with Element branding, improve headers and fix the #synapse:matrix.org support room link rendering. (#​17324)
  • Change path of the experimental MSC3575 Sliding Sync implementation to /org.matrix.simplified_msc3575/sync since our simplified API is slightly incompatible with what's in the current MSC. (#​17331)
  • Handle device lists notifications for large accounts more efficiently in worker mode. (#​17333, #​17358)
  • Do not block event sending/receiving while calculating large event auth chains. (#​17338)
  • Tidy up parse_integer docs and call sites to reflect the fact that they require non-negative integers by default, and bring parse_integer_from_args default in alignment. Contributed by Denis Kasak (@​dkasak). (#​17339)
Updates to locked dependencies
  • Bump authlib from 1.3.0 to 1.3.1. (#​17343)
  • Bump dawidd6/action-download-artifact from 3.1.4 to 5. (#​17289)
  • Bump dawidd6/action-download-artifact from 5 to 6. (#​17313)
  • Bump docker/build-push-action from 5 to 6. (#​17312)
  • Bump jinja2 from 3.1.3 to 3.1.4. (#​17287)
  • Bump lazy_static from 1.4.0 to 1.5.0. (#​17355)
  • Bump msgpack from 1.0.7 to 1.0.8. (#​17317)
  • Bump netaddr from 1.2.1 to 1.3.0. (#​17353)
  • Bump packaging from 24.0 to 24.1. (#​17352)
  • Bump phonenumbers from 8.13.37 to 8.13.39. (#​17315)
  • Bump regex from 1.10.4 to 1.10.5. (#​17290)
  • Bump requests from 2.31.0 to 2.32.2. (#​17345)
  • Bump sentry-sdk from 2.1.1 to 2.3.1. (#​17263)
  • Bump sentry-sdk from 2.3.1 to 2.6.0. (#​17351)
  • Bump tornado from 6.4 to 6.4.1. (#​17344)
  • Bump mypy from 1.8.0 to 1.9.0. (#​17297)
  • Bump types-jsonschema from 4.21.0.20240311 to 4.22.0.20240610. (#​17288)
  • Bump types-netaddr from 1.2.0.20240219 to 1.3.0.20240530. (#​17314)
  • Bump types-pillow from 10.2.0.20240423 to 10.2.0.20240520. (#​17285)
  • Bump types-pyyaml from 6.0.12.12 to 6.0.12.20240311. (#​17316)
  • Bump typing-extensions from 4.11.0 to 4.12.2. (#​17354)
  • Bump urllib3 from 2.0.7 to 2.2.2. (#​17346)

v1.109.0

Compare Source

Synapse 1.109.0 (2024-06-18)

Internal Changes
  • Fix the building of binary wheels for macOS by switching to macOS 12 CI runners. (#​17319)

Synapse 1.109.0rc3 (2024-06-17)

Bugfixes
  • When rolling back to a previous Synapse version and then forwards again to this release, don't require server operators to manually run SQL. (#​17305, #​17309)
Internal Changes
  • Use the release branch for sytest in release-branch MRs. (#​17306)

Synapse 1.109.0rc2 (2024-06-11)

Bugfixes
  • Fix bug where one-time-keys were not always included in /sync response when using workers. Introduced in v1.109.0rc1. (#​17275)
  • Fix bug where /sync could get stuck due to edge case in device lists handling. Introduced in v1.109.0rc1. (#​17292)

Synapse 1.109.0rc1 (2024-06-04)

Features
  • Add the ability to auto-accept invites on the behalf of users. See the auto_accept_invites config option for details. (#​17147)
  • Add experimental MSC3575 Sliding Sync /sync/e2ee endpoint for to-device messages and device encryption info. (#​17167)
  • Support MSC3916 by adding unstable media endpoints to /_matrix/client. (#​17213)
  • Add logging to tasks managed by the task scheduler, showing CPU and database usage. (#​17219)
Bugfixes
  • Fix deduplicating of membership events to not create unused state groups. (#​17164)
  • Fix bug where duplicate events could be sent down sync when using workers that are overloaded. (#​17215)
  • Ignore attempts to send to-device messages to bad users, to avoid log spam when we try to connect to the bad server. (#​17240)
  • Fix handling of duplicate concurrent uploading of device one-time-keys. (#​17241)
  • Fix reporting of default tags to Sentry, such as worker name. Broke in v1.108.0. (#​17251)
  • Fix bug where typing updates would not be sent when using workers after a restart. (#​17252)
Improved Documentation
  • Update the LemonLDAP documentation to say that claims should be explicitly included in the returned id_token, as Synapse won't request them. (#​17204)
Internal Changes
  • Improve DB usage when fetching related events. (#​17083)
  • Log exceptions when failing to auto-join new user according to the auto_join_rooms option. (#​17176)
  • Reduce work of calculating outbound device lists updates. (#​17211)
  • Improve performance of calculating device lists changes in /sync. (#​17216)
  • Move towards using MultiWriterIdGenerator everywhere. (#​17226)
  • Replaces all usages of StreamIdGenerator with MultiWriterIdGenerator. (#​17229)
  • Change the allow_unsafe_locale config option to also apply when setting up new databases. (#​17238)
  • Fix errors in logs about closing incorrect logging contexts when media gets rejected by a module. (#​17239, #​17246)
  • Clean out invalid destinations from device_federation_outbox table. (#​17242)
  • Stop logging errors when receiving invalid User IDs in key querys requests. (#​17250)
Updates to locked dependencies
  • Bump anyhow from 1.0.83 to 1.0.86. (#​17220)
  • Bump bcrypt from 4.1.2 to 4.1.3. (#​17224)
  • Bump lxml from 5.2.1 to 5.2.2. (#​17261)
  • Bump mypy-zope from 1.0.3 to 1.0.4. (#​17262)
  • Bump phonenumbers from 8.13.35 to 8.13.37. (#​17235)
  • Bump prometheus-client from 0.19.0 to 0.20.0. (#​17233)
  • Bump pyasn1 from 0.5.1 to 0.6.0. (#​17223)
  • Bump pyicu from 2.13 to 2.13.1. (#​17236)
  • Bump pyopenssl from 24.0.0 to 24.1.0. (#​17234)
  • Bump serde from 1.0.201 to 1.0.202. (#​17221)
  • Bump serde from 1.0.202 to 1.0.203. (#​17232)
  • Bump twine from 5.0.0 to 5.1.0. (#​17225)
  • Bump types-psycopg2 from 2.9.21.20240311 to 2.9.21.20240417. (#​17222)
  • Bump types-pyopenssl from 24.0.0.20240311 to 24.1.0.20240425. (#​17260)

v1.108.0

Compare Source

Synapse 1.108.0 (2024-05-28)

No significant changes since 1.108.0rc1.

Synapse 1.108.0rc1 (2024-05-21)

Features
  • Add a feature that allows clients to query the configured federation whitelist. Disabled by default. (#​16848, #​17199)
  • Add the ability to allow numeric user IDs with a specific prefix when in the CAS flow. Contributed by Aurélien Grimpard. (#​17098)
Bugfixes
  • Fix bug where push rules would be empty in /sync for some accounts. Introduced in v1.93.0. (#​17142)
  • Add support for optional whitespace around the Federation API's Authorization header's parameter commas. (#​17145)
  • Fix bug where disabling room publication prevented public rooms being created on workers. (#​17177, #​17184)
Improved Documentation
  • Document /v1/make_knock and /v1/send_knock/ federation endpoints as worker-compatible. (#​17058)
  • Update User Admin API with note about prefixing OIDC external_id providers. (#​17139)
  • Clarify the state of the created room when using the autocreate_auto_join_room_preset config option. (#​17150)
  • Update the Admin FAQ with the current libjemalloc version for latest Debian stable. Additionally update the name of the "push_rules" stream in the Workers documentation. (#​17171)
Internal Changes
  • Add note to reflect that MSC3886 is closed but will remain supported for some time. (#​17151)
  • Update dependency PyO3 to 0.21. (#​17162)
  • Fixes linter errors found in MR #​17147. (#​17166)
  • Bump black from 24.2.0 to 24.4.2. (#​17170)
  • Cache literal sync filter validation for performance. (#​17186)
  • Improve performance by fixing a reactor pause. (#​17192)
  • Route /make_knock and /send_knock federation APIs to the federation reader worker in Complement test runs. (#​17195)
  • Prepare sync handler to be able to return different sync responses (SyncVersion). (#​17200)
  • Organize the sync cache key parameter outside of the sync config (separate concerns). (#​17201)
  • Refactor SyncResultBuilder assembly to its own function. (#​17202)
  • Rename to be obvious: joined_rooms -> joined_room_ids. (#​17203, #​17208)
  • Add a short pause when rate-limiting a request. (#​17210)
Updates to locked dependencies
  • Bump cryptography from 42.0.5 to 42.0.7. (#​17180)
  • Bump gitpython from 3.1.41 to 3.1.43. (#​17181)
  • Bump immutabledict from 4.1.0 to 4.2.0. (#​17179)
  • Bump sentry-sdk from 1.40.3 to 2.1.1. (#​17178)
  • Bump serde from 1.0.200 to 1.0.201. (#​17183)
  • Bump serde_json from 1.0.116 to 1.0.117. (#​17182)

v1.107.0

Compare Source

Synapse 1.107.0 (2024-05-14)

No significant changes since 1.107.0rc1.

Synapse 1.107.0rc1 (2024-05-07)

Features
Bugfixes
  • Fixed search feature of Element Android on homesevers using SQLite by returning search terms as search highlights. (#​17000)
  • Fixes a bug introduced in v1.52.0 where the destination query parameter for the Destination Rooms Admin API failed to actually filter returned rooms. (#​17077)
  • For MSC3266 room summaries, support queries at the recommended endpoint of /_matrix/client/unstable/im.nheko.summary/summary/{roomIdOrAlias}. The existing endpoint of /_matrix/client/unstable/im.nheko.summary/rooms/{roomIdOrAlias}/summary is deprecated. (#​17078)
  • Apply user email & picture during OIDC registration if present & selected. (#​17120)
  • Improve error message for cross signing reset with MSC3861 enabled. (#​17121)
  • Fix a bug which meant that to-device messages received over federation could be dropped when the server was under load or networking problems caused problems between Synapse processes or the database. (#​17127)
  • Fix bug where StreamChangeCache would not respect configured cache factors. (#​17152)
Updates to the Docker image
  • Correct licensing metadata on Docker image. (#​17141)
Improved Documentation
  • Update the event_cache_size and global_factor configuration options' documentation. (#​17071)
  • Remove broken sphinx docs. (#​17073, #​17148)
  • Add RuntimeDirectory to example matrix-synapse.service systemd unit. (#​17084)
  • Fix various small typos throughout the docs. (#​17114)
  • Update enable_notifs configuration documentation. (#​17116)
  • Update the Upgrade Notes with the latest minimum supported Rust version of 1.66.0. Contributed by @​jahway603. (#​17140)
Internal Changes
  • Enable MSC3266 by default in the Synapse Complement image. (#​17105)
  • Add optimisation to StreamChangeCache.get_entities_changed(..). (#​17130)
Updates to locked dependencies
  • Bump furo from 2024.1.29 to 2024.4.27. (#​17133)
  • Bump idna from 3.6 to 3.7. (#​17136)
  • Bump jsonschema from 4.21.1 to 4.22.0. (#​17157)
  • Bump lxml from 5.1.0 to 5.2.1. (#​17158)
  • Bump phonenumbers from 8.13.29 to 8.13.35. (#​17106)
  • Bump pillow from 10.2.0 to 10.3.0. (#​17146)
  • Bump pydantic from 2.6.4 to 2.7.0. (#​17107)
  • Bump pydantic from 2.7.0 to 2.7.1. (#​17160)
  • Bump pyicu from 2.12 to 2.13. (#​17109)
  • Bump serde from 1.0.197 to 1.0.198. (#​17111)
  • Bump serde from 1.0.198 to 1.0.199. (#​17132)
  • Bump serde from 1.0.199 to 1.0.200. (#​17161)
  • Bump serde_json from 1.0.115 to 1.0.116. (#​17112)
  • Update tornado Python dependency from 6.2 to 6.4. (#​17131)
  • Bump twisted from 23.10.0 to 24.3.0. (#​17135)
  • Bump types-bleach from 6.1.0.1 to 6.1.0.20240331. (#​17110)
  • Bump types-pillow from 10.2.0.20240415 to 10.2.0.20240423. (#​17159)
  • Bump types-setuptools from 69.0.0.20240125 to 69.5.0.20240423. (#​17134)

v1.106.0

Compare Source

Synapse 1.106.0 (2024-04-30)

No significant changes since 1.106.0rc1.

Synapse 1.106.0rc1 (2024-04-25)

Features
  • Send an email if the address is already bound to an user account. (#​16819)
  • Implement the rendezvous mechanism described by MSC4108. (#​17056)
  • Support delegating the rendezvous mechanism described MSC4108 to an external implementation. (#​17086)
Bugfixes
  • Add validation to ensure that the limit parameter on /publicRooms is non-negative. (#​16920)
  • Return 400 M_NOT_JSON upon receiving invalid JSON in query parameters across various client and admin endpoints, rather than an internal server error. (#​16923)
  • Make the CSAPI endpoint /keys/device_signing/upload idempotent. (#​16943)
  • Redact membership events if the user requested erasure upon deactivating. (#​17076)
Improved Documentation
  • Add a prompt in the contributing guide to manually configure icu4c. (#​17069)
  • Clarify what part of message retention is still experimental. (#​17099)
Internal Changes
  • Use new receipts column to optimise receipt and push action SQL queries. Contributed by Nick @​ Beeper (@​fizzadar). (#​17032, #​17096)
  • Fix mypy with latest Twisted release. (#​17036)
  • Bump minimum supported Rust version to 1.66.0. (#​17079)
  • Add helpers to transform Twisted requests to Rust http Requests/Responses. (#​17081)
  • Fix type annotation for visited_chains after mypy upgrade. (#​17125)
Updates to locked dependencies
  • Bump anyhow from 1.0.81 to 1.0.82. (#​17095)
  • Bump peaceiris/actions-gh-pages from 3.9.3 to 4.0.0. (#​17087)
  • Bump peaceiris/actions-mdbook from 1.2.0 to 2.0.0. (#​17089)
  • Bump pyasn1-modules from 0.3.0 to 0.4.0. (#​17093)
  • Bump pygithub from 2.2.0 to 2.3.0. (#​17092)
  • Bump ruff from 0.3.5 to 0.3.7. (#​17094)
  • Bump sigstore/cosign-installer from 3.4.0 to 3.5.0. (#​17088)
  • Bump twine from 4.0.2 to 5.0.0. (#​17091)
  • Bump types-pillow from 10.2.0.20240406 to 10.2.0.20240415. (#​17090)

v1.105.1

Compare Source

Synapse 1.105.1 (2024-04-23)

Security advisory

The following issues are fixed in 1.105.1.

See the advisories for more details. If you have any questions, email security@element.io.

v1.105.0

Compare Source

Synapse 1.105.0 (2024-04-16)

No significant changes since 1.105.0rc1.

Synapse 1.105.0rc1 (2024-04-11)

Features
Bugfixes
  • Fix various long-standing bugs which could cause incorrect state to be returned from /sync in certain situations. (#​16930, #​16932, #​16942, #​17064, #​17065, #​17066)
  • Fix server notice rooms not always being created as unencrypted rooms, even when encryption_enabled_by_default_for_room_type is in use (server notices are always unencrypted). (#​17033)
  • Fix the .m.rule.encrypted_room_one_to_one and .m.rule.room_one_to_one default underride push rules being in the wrong order. Contributed by @​Sumpy1. (#​17043)
Internal Changes
  • Refactor auth chain fetching to reduce duplication. (#​17044)
  • Improve database performance by adding a missing index to access_tokens.refresh_token_id. (#​17045, #​17054)
  • Improve database performance by reducing number of receipts fetched when sending push notifications. (#​17049)
Updates to locked dependencies
  • Bump packaging from 23.2 to 24.0. (#​17027)
  • Bump regex from 1.10.3 to 1.10.4. (#​17028)
  • Bump ruff from 0.3.2 to 0.3.5. (#​17060)
  • Bump serde_json from 1.0.114 to 1.0.115. (#​17041)
  • Bump types-pillow from 10.2.0.20240125 to 10.2.0.20240406. (#​17061)
  • Bump types-requests from 2.31.0.20240125 to 2.31.0.20240406. (#​17063)
  • Bump typing-extensions from 4.9.0 to 4.11.0. (#​17062)

v1.104.0

Compare Source

Synapse 1.104.0 (2024-04-02)

Bugfixes
  • Fix regression when using OIDC provider. Introduced in v1.104.0rc1. (#​17031)

Synapse 1.104.0rc1 (2024-03-26)

Features
  • Add an OIDC config to specify extra parameters for the authorization grant URL. IT can be useful to pass an ACR value for example. (#​16971)
  • Add support for OIDC provider returning JWT. (#​16972, #​17031)
Bugfixes
  • Fix a bug which meant that, under certain circumstances, we might never retry sending events or to-device messages over federation after a failure. (#​16925)
  • Fix various long-standing bugs which could cause incorrect state to be returned from /sync in certain situations. (#​16949)
  • Fix case in which m.fully_read marker would not get updated. Contributed by @​SpiritCroc. (#​16990)
  • Fix bug which did not retract a user's pending knocks at rooms when their account was deactivated. Contributed by @​hanadi92. (#​17010)
Updates to the Docker image
Improved Documentation
  • Add a query to force a refresh of a remote user's device list to the "Useful SQL for Admins" documentation page. (#​16892)
  • Minor grammatical corrections to the upgrade documentation. (#​16965)
  • Fix the sort order for the documentation version picker, so that newer releases appear above older ones. (#​16966)
  • Remove recommendation for a specific poetry version from contributing guide. (#​17002)
Internal Changes
  • Improve lock performance when a lot of locks are all waiting for a single lock to be released. (#​16840)
  • Update power level default for public rooms. (#​16907)
  • Improve event validation. (#​16908)
  • Multi-worker-docker-container: disable log buffering. (#​16919)
  • Refactor state delta calculation in /sync handler. (#​16929)
  • Clarify docs for some room state functions. (#​16950)
  • Specify IP subnets in canonical form. (#​16953)
  • As done for SAML mapping provider, let's pass the module API to the OIDC one so the mapper can do more logic in its code. (#​16974)
  • Allow containers building on top of Synapse's Complement container is use the included PostgreSQL cluster. (#​16985)
  • Raise poetry-core version cap to 1.9.0. (#​16986)
  • Patch the db conn pool sooner in tests. (#​17017)
Updates to locked dependencies
  • Bump anyhow from 1.0.80 to 1.0.81. (#​17009)
  • Bump black from 23.10.1 to 24.2.0. (#​16936)
  • Bump cryptography from 41.0.7 to 42.0.5. (#​16958)
  • Bump dawidd6/action-download-artifact from 3.1.1 to 3.1.2. (#​16960)
  • Bump dawidd6/action-download-artifact from 3.1.2 to 3.1.4. (#​17008)
  • Bump jinja2 from 3.1.2 to 3.1.3. (#​17005)
  • Bump log from 0.4.20 to 0.4.21. (#​16977)
  • Bump mypy from 1.5.1 to 1.8.0. (#​16901)
  • Bump netaddr from 0.9.0 to 1.2.1. (#​17006)
  • Bump pydantic from 2.6.0 to 2.6.4. (#​17004)
  • Bump pyo3 from 0.20.2 to 0.20.3. (#​16962)
  • Bump ruff from 0.1.14 to 0.3.2. (#​16994)
  • Bump serde from 1.0.196 to 1.0.197. (#​16963)
  • Bump serde_json from 1.0.113 to 1.0.114. (#​16961)
  • Bump types-jsonschema from 4.21.0.20240118 to 4.21.0.20240311. (#​17007)
  • Bump types-psycopg2 from 2.9.21.16 to 2.9.21.20240311. (#​16995)
  • Bump types-pyopenssl from 23.3.0.0 to 24.0.0.20240311. (#​17003)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports