open-engineering/matrix-chart

Fork 0

Code Issues Pull requests Packages 1 Activity

chore(deps): update ghcr.io/element-hq/synapse docker tag to v1.152.1 #3

Merged

forgejo merged 0 commits from refs/pull/3/head into main

2026年05月15日 00:05:13 +02:00

Conversation 1 Commits - Files changed -

forgejo commented

2026年05月14日 21:03:47 +02:00

(Migrated from git.smallhack.org)

Copy link

This PR contains the following updates:

Package	Update	Change
ghcr.io/element-hq/synapse	minor	`v1.145.0` → `v1.152.1`

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

element-hq/synapse (ghcr.io/element-hq/synapse)

Synapse 1.152.1 (2026年05月07日)

Security Fixes

Prevent CPU starvation (Denial of Service) under worker lock contention, additionally capping the WorkerLock time out interval to a maximum of 60 seconds. Contributed by Famedly. (#19394, ELEMENTSEC-2026-1706, GHSA-8q93-326v-3m7g, CVE-2026-45078)
Prevent pagination ending when a page is full of rejected events. (ELEMENTSEC-2025-1636, GHSA-6qf2-7x63-mm6v, CVE-2026-45076)

Synapse 1.152.0 (2026年04月28日)

No significant changes since 1.152.0rc1.

Configuration changes needed for deployments using workers

For deployments using workers, please note that this version introduces a new quarantined_media_changes stream writer, which may require configuration changes.
Please see the the relevant section in the upgrade notes for details.

Without configuring this new stream writer, only the main process will be able to handle the /media/quarantine admin API endpoints for quarantining media.

Synapse 1.152.0rc1 (2026年04月22日)

Features

Add a "Listing quarantined media changes" Admin API for retrieving a paginated record of when media became (un)quarantined. (#19558, #19677, #19694)
Advertise MSC4445 sync timeline order in unstable_features. (#19642)
Report the Rust compiler version used in the Prometheus metrics. Contributed by Noah Markert. (#19643)
Passthrough 'article' and 'profile' OpenGraph metadata on URL preview requests. (#19659)
Add a way to re-sign local events with a new signing key. (#19668)
Support MSC4450: Identity Provider selection for User-Interactive Authentication with Legacy Single Sign-On. (#19693)
Add experimental support for MSC4242: State DAGs. Excludes federation support. (#19424)
Adds Admin API endpoints to
list, fetch and delete user reports. (#19657)
Reduce database disk space usage by pruning old rows from device_lists_changes_in_room. (#19473, #19709)

Bugfixes

Reject device_keys: null in the request to POST /_matrix/client/v3/keys/upload, as per the spec. This was temporarily allowed as a workaround for misbehaving clients. (#19637)
Fix database migrations failing on platforms where SQLite is configured with SQLITE_DBCONFIG_DEFENSIVE by default, such as macOS. (#19690)
Fix a bug introduced in v1.145 where a non-admin could bypass admin checks for downloading remote quarantined media. This relied on the media already being previously present on the homeserver. (#19639)

Improved Documentation

Include a workaround for running the unit tests with SQLite under recent versions of MacOS. (#19615)
Fix Docker image link typo in worker docs. (#19645)
Update the developer stream docs for creating a new stream to point out _setup_sequence(...) in portdb. (#19675)
Update the developer stream docs for creating a new stream to highlight places that require documentation updates. (#19696)

Internal Changes

Update CI to use re-usable Complement GitHub CI workflow. (#19533)
Fix docstring for limit argument in _maybe_backfill_inner(...). (#19630)
Document context for why increase timeout for policy server requests. (#19633)
Run lint script to format Complement tests introduced in #19509. (#19636)
Small simplifications to the events class. (#19680, #19712)
Introduce spam_checker_spammy internal event metadata. (#19453)
Add a FilteredEvent class that saves us copying events. (#19640)
Convert EventInternalMetadata to use Arc<RwLock<_>>. (#19669)

`v1.151.0`

Compare Source

Synapse 1.151.0 (2026年04月07日)

Bugfixes

Fix KNOWN_ROOM_VERSIONS.__contains__ raising TypeError for non-string keys, which could cause /sync to fail for rooms with a NULL room version in the database. Bug introduced in #19589 as part of v1.151.0rc1. (#19649)

Synapse 1.151.0rc1 (2026年03月31日)

Features

Add stable support for MSC4284 Policy Servers. (#19503)
Update and stabilize support for MSC2666: Get rooms in common with another user. Contributed by @tulir @ Beeper. (#19511)
Updated experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#19573)
Stabilize room_version and encryption fields in the space/room /hierarchy API (part of MSC3266). (#19576)
Introduce a configuration option to allow using HTTP/2 over plaintext when Synapse connects to Matrix Authentication Service. (#19586)

Bugfixes

Fix MSC4284 Policy Servers implementation to skip signing org.matrix.msc4284.policy and m.room.policy state events. (#19503)
Correctly apply MSC4284 Policy Server signatures to events when the sender and policy server have the same server name. (#19503)
Allow Synapse to start up even when discovery fails for an OpenID Connect provider. (#19509)
Fix quarantine media admin APIs sometimes returning inaccurate counts for remote media. (#19559)
Fix Build and push complement image CI job not having poetry available for the Complement runner script. (#19578)
Increase timeout for policy server requests to avoid repeated requests for checking media. (#19629)

Deprecations and Removals

Remove support for MSC3852: Expose user agent information on Device as the MSC was closed. (#19430)

Internal Changes

Fix small comment typo in config output from the demo/start.sh script. (#19538)
Add MSC3820 comment context to RoomVersion attributes. (#19577)
Remove redacted_because from internal unsigned. (#19581)
Prevent sending registration emails if registration is disabled. (#19585)
Port RoomVersion to Rust. (#19589)
Only show failing Complement tests in the formatted output in CI. (#19590)
Ensure old Complement test files are removed when downloading a Complement checkout via ./scripts-dev/complement.sh. (#19592)
Update HomeserverTestCase.pump() docstring to demystify behavior (Twisted reactor/clock). (#19602)
Deprecate HomeserverTestCase.pump() in favor of more direct HomeserverTestCase.reactor.advance(...) usage. (#19602)
Lower the Postgres database statement_timeout to 10m (previously 1h). (#19604)

`v1.150.0`

Compare Source

Synapse 1.150.0 (2026年03月24日)

No significant changes since 1.150.0rc1.

Upgrade notes

Please read the upgrade notes as this release includes a few changes that may affect your deployment.

Synapse 1.150.0rc1 (2026年03月17日)

Features

Add experimental support for the MSC4370 Federation API GET /extremities endpoint. (#19314)
MSC4140: Cancellable delayed events: When persisting a delayed event to the timeline, include its delay_id in the event's unsigned section in /sync responses to the event sender. (#19479)
Expose MSC4354 Sticky Events over the legacy (v3) /sync API. (#19487)
When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. (#19554)

Bugfixes

Fix Build and push complement image CI job pointing to non-existent image. (#19523)
Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. (#19542)

Improved Documentation

In the Admin API documentation, always express path parameters as /<param> instead of as /$param. (#19307)
Update docs to clarify outbound_federation_restricted_to can also be used with the Secure Border Gateway (SBG). (#19517)
Unify Complement developer docs. (#19518)

Internal Changes

Put membership updates in a background resumable task when changing the avatar or the display name. (#19311)
Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). (#19476)
Migrate dev dependencies to PEP 735 dependency groups. (#19490)
Remove the optional systemd-python dependency and the systemd extra on the synapse package. (#19491)
Avoid re-computing the event ID when cloning events. (#19527)
Allow caching of the /versions and /auth_metadata public endpoints. (#19530)
Add a few labels to the number groupings in the Processed request logs. (#19548)

`v1.149.1`

Compare Source

Synapse 1.149.1 (2026年03月11日)

Internal Changes

Bump matrix-synapse-ldap3 to 0.4.0 to support setuptools>=82.0.0. Fixes #19541. (#19543)

`v1.149.0`

Compare Source

Synapse 1.149.0 (2026年03月10日)

No significant changes since 1.149.0rc1.

Synapse 1.149.0rc1 (2026年03月03日)

Features

Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#19127)
Add stable support for MSC4380 invite blocking. (#19431)

Bugfixes

Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#18518)
Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#19460)

Internal Changes

Add log to explain when and why we freeze objects in the garbage collector. (#19440)
Better instrument JoinRoomAliasServlet with tracing. (#19461)
Fix Complement CI not running against the code from our PRs. (#19475)
Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#19480)
Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#19486)
Add a log line when we delete devices. Contributed by @bradtgmurray @ Beeper. (#19496)
Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#19498)
Cancel long-running sync requests if the client has gone away. (#19499)
Try and reduce reactor tick times when under heavy load. (#19507)
Simplify Rust HTTP client response streaming and limiting. (#19510)
Replace deprecated collection import locations with current locations. (#19515)
Bump most locked Python dependencies to their latest versions. (#19519)

`v1.148.0`

Compare Source

Synapse 1.148.0 (2026年02月24日)

No significant changes since 1.148.0rc1.

Synapse 1.148.0rc1 (2026年02月17日)

Features

Support sending and receiving MSC4354 Sticky Event metadata. (#19365)

Improved Documentation

Fix reference to the experimental_features section of the configuration manual documentation. (#19435)

Deprecations and Removals

Remove support for MSC3244: Room version capabilities as the MSC was rejected. (#19429)

Internal Changes

Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. (#19406)
Push Synapse docker images to Element OCI Registry. (#19420)
Allow configuring the Rust HTTP client to use HTTP/2 only. (#19457)
Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. (#19470)

`v1.147.1`

Compare Source

Synapse 1.147.1 (2026年02月12日)

Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670. (#19459)

`v1.147.0`

Compare Source

Synapse 1.147.0 (2026年02月10日)

No significant changes since 1.147.0rc1.

Synapse 1.147.0rc1 (2026年02月03日)

Bugfixes

Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. (#19416)
Fix a typo that incorrectly made setuptools_rust a runtime dependency. (#19417)

Internal Changes

Prune stale entries from sliding_sync_connection_required_state table. (#19306)
Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). (#19399)
Update and align Grafana dashboard to use regex matching for job selectors (job=~"$job") so the "all" value works correctly across all panels. (#19400)
Don't retry joining partial state rooms all at once on startup. (#19402)
Disallow requests to the health endpoint from containing trailing path characters. (#19405)
Add notes that new experimental features should have associated tracking issues. (#19410)
Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to 0.27.0. Contributed by @razvp @ ERCOM. (#19412)

`v1.146.0`

Compare Source

Synapse 1.146.0 (2026年01月27日)

No significant changes since 1.146.0rc1.

Deprecations and Removals

MSC2697 (Dehydrated devices) has been removed, as the MSC is closed. Developers should migrate to MSC3814. (#19346)
Support for Ubuntu 25.04 (Plucky Puffin) has been dropped. Synapse no longer builds debian packages for Ubuntu 25.04.

Synapse 1.146.0rc1 (2026年01月20日)

Features

Add a new config option enable_local_media_storage which controls whether media is additionally stored locally when using configured media_storage_providers. Setting this to false allows off-site media storage without a local cache. Contributed by Patrice Brend'amour @dr.allgood. (#19204)
Stabilise support for MSC4312's m.oauth User-Interactive Auth stage for resetting cross-signing identity with the OAuth 2.0 API. The old, unstable name (org.matrix.cross_signing_reset) is now deprecated and will be removed in a future release. (#19273)
Refactor Grafana dashboard to use server_name label (instead of instance). (#19337)

Bugfixes

Fix joining a restricted v12 room locally when no local room creator is present but local users with sufficient power levels are. Contributed by @nexy7574. (#19321)
Fixed parallel calls to /_matrix/media/v1/create being ratelimited for appservices even if rate_limited: false was set in the registration. Contributed by @tulir @ Beeper. (#19335)
Fix a bug introduced in 1.61.0 where a user's membership in a room was accidentally ignored when considering access to historical state events in rooms with the "shared" history visibility. Contributed by Lukas Tautz. (#19353)
MSC4140: Store the JSON content of scheduled delayed events as text instead of a byte array. This fixes the inability to schedule a delayed event with non-ASCII characters in its content. (#19360)
Always rollback database transactions when retrying (avoid orphaned connections). (#19372)
Fix InFlightGauge typing to allow upgrading to prometheus_client 0.24. (#19379)

Updates to the Docker image

Add Prometheus HTTP service discovery endpoint for easy discovery of all workers when using the docker/Dockerfile-workers image (see the Metrics section of our Docker testing docs). (#19336)

Improved Documentation

Remove docs on legacy metric names (no longer in the codebase since 2022年12月06日). (#19341)
Clarify how the estimated value of room complexity is calculated internally. (#19384)

Internal Changes

Add an internal cancel_task API to the task scheduler. (#19310)
Tweak docstrings and signatures of auth_types_for_event and get_catchup_room_event_ids. (#19320)
Replace usage of deprecated assertEquals with assertEqual in unit test code. (#19345)
Drop support for Ubuntu 25.04 'Plucky Puffin', add support for Ubuntu 25.10 'Questing Quokka'. (#19348)
Revert "Add an Admin API endpoint for listing quarantined media (#19268)". (#19351)
Bump mdbook from 0.4.17 to 0.5.2 and remove our custom table-of-contents plugin in favour of the new default functionality. (#19356)
Replace deprecated usage of PyGitHub's GitRelease.title with .name in release script. (#19358)
Update the Element logo in Synapse's README to be an absolute URL, allowing it to render on other sites (such as PyPI). (#19368)
Apply minor tweaks to v1.145.0 changelog. (#19376)
Update Grafana dashboard syntax to use the latest from importing/exporting with Grafana 12.3.1. (#19381)
Warn about skipping reactor metrics when using unknown reactor type. (#19383)
Add support for reactor metrics with the ProxiedReactor used in worker Complement tests. (#19385)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/element-hq/synapse](https://github.com/element-hq/synapse) | minor | `v1.145.0` → `v1.152.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>element-hq/synapse (ghcr.io/element-hq/synapse)</summary> ### [`v1.152.1`](https://github.com/element-hq/synapse/releases/tag/v1.152.1) [Compare Source](https://github.com/element-hq/synapse/compare/v1.152.0...v1.152.1) ### Synapse 1.152.1 (2026年05月07日) #### Security Fixes - Prevent CPU starvation (Denial of Service) under worker lock contention, additionally capping the `WorkerLock` time out interval to a maximum of 60 seconds. Contributed by Famedly. ([#19394](https://github.com/element-hq/synapse/issues/19394), ELEMENTSEC-2026-1706, [GHSA-8q93-326v-3m7g](https://github.com/element-hq/synapse/security/advisories/GHSA-8q93-326v-3m7g), CVE-2026-45078) - Prevent pagination ending when a page is full of rejected events. (ELEMENTSEC-2025-1636, [GHSA-6qf2-7x63-mm6v](https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v), CVE-2026-45076) ### [`v1.152.0`](https://github.com/element-hq/synapse/releases/tag/v1.152.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.151.0...v1.152.0) ### Synapse 1.152.0 (2026年04月28日) No significant changes since 1.152.0rc1. #### Configuration changes needed for deployments using workers For deployments using workers, please note that this version introduces a new `quarantined_media_changes` stream writer, which may require configuration changes. Please see the [the relevant section in the upgrade notes](https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11520) for details. Without configuring this new stream writer, only the main process will be able to handle the `/media/quarantine` admin API endpoints for quarantining media. ### Synapse 1.152.0rc1 (2026年04月22日) #### Features - Add a ["Listing quarantined media changes" Admin API](https://element-hq.github.io/synapse/latest/admin_api/media_admin_api.html#listing-quarantined-media-changes) for retrieving a paginated record of when media became (un)quarantined. ([#19558](https://github.com/element-hq/synapse/issues/19558), [#19677](https://github.com/element-hq/synapse/issues/19677), [#19694](https://github.com/element-hq/synapse/issues/19694)) - Advertise [MSC4445](https://github.com/matrix-org/matrix-spec-proposals/pull/4445) sync timeline order in `unstable_features`. ([#19642](https://github.com/element-hq/synapse/issues/19642)) - Report the Rust compiler version used in the Prometheus metrics. Contributed by Noah Markert. ([#19643](https://github.com/element-hq/synapse/issues/19643)) - Passthrough 'article' and 'profile' OpenGraph metadata on URL preview requests. ([#19659](https://github.com/element-hq/synapse/issues/19659)) - Add a way to re-sign local events with a new signing key. ([#19668](https://github.com/element-hq/synapse/issues/19668)) - Support [MSC4450: Identity Provider selection for User-Interactive Authentication with Legacy Single Sign-On](https://github.com/matrix-org/matrix-spec-proposals/pull/4450). ([#19693](https://github.com/element-hq/synapse/issues/19693)) - Add experimental support for [MSC4242](https://github.com/matrix-org/matrix-spec-proposals/pull/4242): State DAGs. Excludes federation support. ([#19424](https://github.com/element-hq/synapse/issues/19424)) - Adds [Admin API](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html) endpoints to list, fetch and delete user reports. ([#19657](https://github.com/element-hq/synapse/issues/19657)) - Reduce database disk space usage by pruning old rows from `device_lists_changes_in_room`. ([#19473](https://github.com/element-hq/synapse/issues/19473), [#19709](https://github.com/element-hq/synapse/issues/19709)) #### Bugfixes - Reject `device_keys: null` in the request to [`POST /_matrix/client/v3/keys/upload`](https://spec.matrix.org/v1.16/client-server-api/#post_matrixclientv3keysupload), as per the spec. This was temporarily allowed as a workaround for misbehaving clients. ([#19637](https://github.com/element-hq/synapse/issues/19637)) - Fix database migrations failing on platforms where SQLite is configured with `SQLITE_DBCONFIG_DEFENSIVE` by default, such as macOS. ([#19690](https://github.com/element-hq/synapse/issues/19690)) - Fix a bug introduced in v1.145 where a non-admin could bypass admin checks for downloading remote quarantined media. This relied on the media already being previously present on the homeserver. ([#19639](https://github.com/element-hq/synapse/issues/19639)) #### Improved Documentation - Include a workaround for running the unit tests with SQLite under recent versions of MacOS. ([#19615](https://github.com/element-hq/synapse/issues/19615)) - Fix Docker image link typo in worker docs. ([#19645](https://github.com/element-hq/synapse/issues/19645)) - Update the developer stream docs for creating a new stream to point out `_setup_sequence(...)` in `portdb`. ([#19675](https://github.com/element-hq/synapse/issues/19675)) - Update the developer stream docs for creating a new stream to highlight places that require documentation updates. ([#19696](https://github.com/element-hq/synapse/issues/19696)) #### Internal Changes - Update CI to use re-usable Complement GitHub CI workflow. ([#19533](https://github.com/element-hq/synapse/issues/19533)) - Fix docstring for `limit` argument in `_maybe_backfill_inner(...)`. ([#19630](https://github.com/element-hq/synapse/issues/19630)) - Document context for why increase timeout for policy server requests. ([#19633](https://github.com/element-hq/synapse/issues/19633)) - Run lint script to format Complement tests introduced in [#19509](https://github.com/element-hq/synapse/pull/19509). ([#19636](https://github.com/element-hq/synapse/issues/19636)) - Small simplifications to the events class. ([#19680](https://github.com/element-hq/synapse/issues/19680), [#19712](https://github.com/element-hq/synapse/issues/19712)) - Introduce `spam_checker_spammy` internal event metadata. ([#19453](https://github.com/element-hq/synapse/issues/19453)) - Add a `FilteredEvent` class that saves us copying events. ([#19640](https://github.com/element-hq/synapse/issues/19640)) - Convert `EventInternalMetadata` to use `Arc<RwLock<_>>`. ([#19669](https://github.com/element-hq/synapse/issues/19669)) ### [`v1.151.0`](https://github.com/element-hq/synapse/releases/tag/v1.151.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.150.0...v1.151.0) ### Synapse 1.151.0 (2026年04月07日) #### Bugfixes - Fix `KNOWN_ROOM_VERSIONS.__contains__` raising `TypeError` for non-string keys, which could cause `/sync` to fail for rooms with a `NULL` room version in the database. Bug introduced in [#19589](https://github.com/element-hq/synapse/pull/19589) as part of v1.151.0rc1. ([#19649](https://github.com/element-hq/synapse/issues/19649)) ### Synapse 1.151.0rc1 (2026年03月31日) #### Features - Add stable support for [MSC4284](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) Policy Servers. ([#19503](https://github.com/element-hq/synapse/issues/19503)) - Update and stabilize support for [MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666): Get rooms in common with another user. Contributed by [@tulir](https://github.com/tulir) @ Beeper. ([#19511](https://github.com/element-hq/synapse/issues/19511)) - Updated experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](https://github.com/matrix-org/matrix-spec-proposals/pull/4388). ([#19573](https://github.com/element-hq/synapse/issues/19573)) - Stabilize `room_version` and `encryption` fields in the space/room `/hierarchy` API (part of [MSC3266](https://github.com/matrix-org/matrix-spec-proposals/pull/3266)). ([#19576](https://github.com/element-hq/synapse/issues/19576)) - Introduce a [configuration option](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#matrix_authentication_service) to allow using HTTP/2 over plaintext when Synapse connects to Matrix Authentication Service. ([#19586](https://github.com/element-hq/synapse/issues/19586)) #### Bugfixes - Fix [MSC4284](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) Policy Servers implementation to skip signing `org.matrix.msc4284.policy` and `m.room.policy` state events. ([#19503](https://github.com/element-hq/synapse/issues/19503)) - Correctly apply [MSC4284](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) Policy Server signatures to events when the sender and policy server have the same server name. ([#19503](https://github.com/element-hq/synapse/issues/19503)) - Allow Synapse to start up even when discovery fails for an OpenID Connect provider. ([#19509](https://github.com/element-hq/synapse/issues/19509)) - Fix quarantine media admin APIs sometimes returning inaccurate counts for remote media. ([#19559](https://github.com/element-hq/synapse/issues/19559)) - Fix `Build and push complement image` CI job not having `poetry` available for the Complement runner script. ([#19578](https://github.com/element-hq/synapse/issues/19578)) - Increase timeout for policy server requests to avoid repeated requests for checking media. ([#19629](https://github.com/element-hq/synapse/issues/19629)) #### Deprecations and Removals - Remove support for [MSC3852: Expose user agent information on Device](https://github.com/matrix-org/matrix-spec-proposals/pull/3852) as the MSC was closed. ([#19430](https://github.com/element-hq/synapse/issues/19430)) #### Internal Changes - Fix small comment typo in config output from the `demo/start.sh` script. ([#19538](https://github.com/element-hq/synapse/issues/19538)) - Add MSC3820 comment context to `RoomVersion` attributes. ([#19577](https://github.com/element-hq/synapse/issues/19577)) - Remove `redacted_because` from internal unsigned. ([#19581](https://github.com/element-hq/synapse/issues/19581)) - Prevent sending registration emails if registration is disabled. ([#19585](https://github.com/element-hq/synapse/issues/19585)) - Port `RoomVersion` to Rust. ([#19589](https://github.com/element-hq/synapse/issues/19589)) - Only show failing Complement tests in the formatted output in CI. ([#19590](https://github.com/element-hq/synapse/issues/19590)) - Ensure old Complement test files are removed when downloading a Complement checkout via `./scripts-dev/complement.sh`. ([#19592](https://github.com/element-hq/synapse/issues/19592)) - Update `HomeserverTestCase.pump()` docstring to demystify behavior (Twisted reactor/clock). ([#19602](https://github.com/element-hq/synapse/issues/19602)) - Deprecate `HomeserverTestCase.pump()` in favor of more direct `HomeserverTestCase.reactor.advance(...)` usage. ([#19602](https://github.com/element-hq/synapse/issues/19602)) - Lower the Postgres database `statement_timeout` to 10m (previously 1h). ([#19604](https://github.com/element-hq/synapse/issues/19604)) ### [`v1.150.0`](https://github.com/element-hq/synapse/releases/tag/v1.150.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.149.1...v1.150.0) ### Synapse 1.150.0 (2026年03月24日) No significant changes since 1.150.0rc1. #### Upgrade notes **Please read the [upgrade notes](https://element-hq.github.io/synapse/latest/upgrade.html#upgrading-to-v11500)** as this release includes a few changes that may affect your deployment. ### Synapse 1.150.0rc1 (2026年03月17日) #### Features - Add experimental support for the [MSC4370](https://github.com/matrix-org/matrix-spec-proposals/pull/4370) Federation API `GET /extremities` endpoint. ([#19314](https://github.com/element-hq/synapse/issues/19314)) - [MSC4140: Cancellable delayed events](https://github.com/matrix-org/matrix-spec-proposals/pull/4140): When persisting a delayed event to the timeline, include its `delay_id` in the event's `unsigned` section in `/sync` responses to the event sender. ([#19479](https://github.com/element-hq/synapse/issues/19479)) - Expose [MSC4354 Sticky Events](https://github.com/matrix-org/matrix-spec-proposals/pull/4354) over the legacy (v3) /sync API. ([#19487](https://github.com/element-hq/synapse/issues/19487)) - When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. ([#19554](https://github.com/element-hq/synapse/issues/19554)) #### Bugfixes - Fix `Build and push complement image` CI job pointing to non-existent image. ([#19523](https://github.com/element-hq/synapse/issues/19523)) - Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. ([#19542](https://github.com/element-hq/synapse/issues/19542)) #### Improved Documentation - In the Admin API documentation, always express path parameters as `/<param>` instead of as `/$param`. ([#19307](https://github.com/element-hq/synapse/issues/19307)) - Update docs to clarify `outbound_federation_restricted_to` can also be used with the [Secure Border Gateway (SBG)](https://element.io/en/server-suite/secure-border-gateways). ([#19517](https://github.com/element-hq/synapse/issues/19517)) - Unify Complement developer docs. ([#19518](https://github.com/element-hq/synapse/issues/19518)) #### Internal Changes - Put membership updates in a background resumable task when changing the avatar or the display name. ([#19311](https://github.com/element-hq/synapse/issues/19311)) - Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). ([#19476](https://github.com/element-hq/synapse/issues/19476)) - Migrate `dev` dependencies to [PEP 735](https://peps.python.org/pep-0735/) dependency groups. ([#19490](https://github.com/element-hq/synapse/issues/19490)) - Remove the optional `systemd-python` dependency and the `systemd` extra on the `synapse` package. ([#19491](https://github.com/element-hq/synapse/issues/19491)) - Avoid re-computing the event ID when cloning events. ([#19527](https://github.com/element-hq/synapse/issues/19527)) - Allow caching of the `/versions` and `/auth_metadata` public endpoints. ([#19530](https://github.com/element-hq/synapse/issues/19530)) - Add a few labels to the number groupings in the `Processed request` logs. ([#19548](https://github.com/element-hq/synapse/issues/19548)) ### [`v1.149.1`](https://github.com/element-hq/synapse/releases/tag/v1.149.1) [Compare Source](https://github.com/element-hq/synapse/compare/v1.149.0...v1.149.1) ### Synapse 1.149.1 (2026年03月11日) #### Internal Changes - Bump `matrix-synapse-ldap3` to `0.4.0` to support `setuptools>=82.0.0`. Fixes [#19541](https://github.com/element-hq/synapse/issues/19541). ([#19543](https://github.com/element-hq/synapse/issues/19543)) ### [`v1.149.0`](https://github.com/element-hq/synapse/releases/tag/v1.149.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.148.0...v1.149.0) ### Synapse 1.149.0 (2026年03月10日) No significant changes since 1.149.0rc1. ### Synapse 1.149.0rc1 (2026年03月03日) #### Features - Add experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](https://github.com/matrix-org/matrix-spec-proposals/pull/4388). ([#19127](https://github.com/element-hq/synapse/issues/19127)) - Add stable support for [MSC4380](https://github.com/matrix-org/matrix-spec-proposals/pull/4380) invite blocking. ([#19431](https://github.com/element-hq/synapse/issues/19431)) #### Bugfixes - Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. ([#18518](https://github.com/element-hq/synapse/issues/18518)) - Fix `/sync` missing membership event in `state_after` (experimental [MSC4222](https://github.com/matrix-org/matrix-spec-proposals/pull/4222) implementation) in some scenarios. ([#19460](https://github.com/element-hq/synapse/issues/19460)) #### Internal Changes - Add log to explain when and why we freeze objects in the garbage collector. ([#19440](https://github.com/element-hq/synapse/issues/19440)) - Better instrument `JoinRoomAliasServlet` with tracing. ([#19461](https://github.com/element-hq/synapse/issues/19461)) - Fix Complement CI not running against the code from our PRs. ([#19475](https://github.com/element-hq/synapse/issues/19475)) - Log `docker system info` in CI so we have a plain record of how GitHub runners evolve over time. ([#19480](https://github.com/element-hq/synapse/issues/19480)) - Rename the `test_disconnect` test helper so that pytest doesn't see it as a test. ([#19486](https://github.com/element-hq/synapse/issues/19486)) - Add a log line when we delete devices. Contributed by [@bradtgmurray](https://github.com/bradtgmurray) @ Beeper. ([#19496](https://github.com/element-hq/synapse/issues/19496)) - Pre-allocate the buffer based on the expected `Content-Length` with the Rust HTTP client. ([#19498](https://github.com/element-hq/synapse/issues/19498)) - Cancel long-running sync requests if the client has gone away. ([#19499](https://github.com/element-hq/synapse/issues/19499)) - Try and reduce reactor tick times when under heavy load. ([#19507](https://github.com/element-hq/synapse/issues/19507)) - Simplify Rust HTTP client response streaming and limiting. ([#19510](https://github.com/element-hq/synapse/issues/19510)) - Replace deprecated collection import locations with current locations. ([#19515](https://github.com/element-hq/synapse/issues/19515)) - Bump most locked Python dependencies to their latest versions. ([#19519](https://github.com/element-hq/synapse/issues/19519)) ### [`v1.148.0`](https://github.com/element-hq/synapse/releases/tag/v1.148.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.147.1...v1.148.0) ### Synapse 1.148.0 (2026年02月24日) No significant changes since 1.148.0rc1. ### Synapse 1.148.0rc1 (2026年02月17日) #### Features - Support sending and receiving [MSC4354 Sticky Event](https://github.com/matrix-org/matrix-spec-proposals/pull/4354) metadata. ([#19365](https://github.com/element-hq/synapse/issues/19365)) #### Improved Documentation - Fix reference to the `experimental_features` section of the configuration manual documentation. ([#19435](https://github.com/element-hq/synapse/issues/19435)) #### Deprecations and Removals - Remove support for [MSC3244: Room version capabilities](https://github.com/matrix-org/matrix-spec-proposals/pull/3244) as the MSC was rejected. ([#19429](https://github.com/element-hq/synapse/issues/19429)) #### Internal Changes - Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. ([#19406](https://github.com/element-hq/synapse/issues/19406)) - Push Synapse docker images to Element OCI Registry. ([#19420](https://github.com/element-hq/synapse/issues/19420)) - Allow configuring the Rust HTTP client to use HTTP/2 only. ([#19457](https://github.com/element-hq/synapse/issues/19457)) - Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. ([#19470](https://github.com/element-hq/synapse/issues/19470)) ### [`v1.147.1`](https://github.com/element-hq/synapse/releases/tag/v1.147.1) [Compare Source](https://github.com/element-hq/synapse/compare/v1.147.0...v1.147.1) ### Synapse 1.147.1 (2026年02月12日) - Block federation requests and events authenticated using a known insecure signing key. See [CVE-2026-24044](https://www.cve.org/CVERecord?id=CVE-2026-24044) / [ELEMENTSEC-2025-1670](https://github.com/element-hq/ess-helm/security/advisories/GHSA-qwcj-h6m8-vp6q). ([#19459](https://github.com/element-hq/synapse/issues/19459)) ### [`v1.147.0`](https://github.com/element-hq/synapse/releases/tag/v1.147.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.146.0...v1.147.0) ### Synapse 1.147.0 (2026年02月10日) No significant changes since 1.147.0rc1. ### Synapse 1.147.0rc1 (2026年02月03日) #### Bugfixes - Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. ([#19416](https://github.com/element-hq/synapse/issues/19416)) - Fix a typo that incorrectly made `setuptools_rust` a runtime dependency. ([#19417](https://github.com/element-hq/synapse/issues/19417)) #### Internal Changes - Prune stale entries from `sliding_sync_connection_required_state` table. ([#19306](https://github.com/element-hq/synapse/issues/19306)) - Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). ([#19399](https://github.com/element-hq/synapse/issues/19399)) - Update and align Grafana dashboard to use regex matching for `job` selectors (`job=~"$job"`) so the "all" value works correctly across all panels. ([#19400](https://github.com/element-hq/synapse/issues/19400)) - Don't retry joining partial state rooms all at once on startup. ([#19402](https://github.com/element-hq/synapse/issues/19402)) - Disallow requests to the health endpoint from containing trailing path characters. ([#19405](https://github.com/element-hq/synapse/issues/19405)) - Add notes that new experimental features should have associated tracking issues. ([#19410](https://github.com/element-hq/synapse/issues/19410)) - Bump `pyo3` from 0.26.0 to 0.27.2 and `pythonize` from 0.26.0 to 0.27.0. Contributed by [@razvp](https://github.com/razvp) @ ERCOM. ([#19412](https://github.com/element-hq/synapse/issues/19412)) ### [`v1.146.0`](https://github.com/element-hq/synapse/releases/tag/v1.146.0) [Compare Source](https://github.com/element-hq/synapse/compare/v1.145.0...v1.146.0) ### Synapse 1.146.0 (2026年01月27日) No significant changes since 1.146.0rc1. #### Deprecations and Removals - [MSC2697](https://github.com/matrix-org/matrix-spec-proposals/pull/2697) (Dehydrated devices) has been removed, as the MSC is closed. Developers should migrate to [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814). ([#19346](https://github.com/element-hq/synapse/issues/19346)) - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped. Synapse no longer builds debian packages for Ubuntu 25.04. ### Synapse 1.146.0rc1 (2026年01月20日) #### Features - Add a new config option [`enable_local_media_storage`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_local_media_storage) which controls whether media is additionally stored locally when using configured `media_storage_providers`. Setting this to `false` allows off-site media storage without a local cache. Contributed by Patrice Brend'amour [@dr](https://github.com/dr).allgood. ([#19204](https://github.com/element-hq/synapse/issues/19204)) - Stabilise support for [MSC4312](https://github.com/matrix-org/matrix-spec-proposals/pull/4312)'s `m.oauth` User-Interactive Auth stage for resetting cross-signing identity with the OAuth 2.0 API. The old, unstable name (`org.matrix.cross_signing_reset`) is now deprecated and will be removed in a future release. ([#19273](https://github.com/element-hq/synapse/issues/19273)) - Refactor Grafana dashboard to use `server_name` label (instead of `instance`). ([#19337](https://github.com/element-hq/synapse/issues/19337)) #### Bugfixes - Fix joining a restricted v12 room locally when no local room creator is present but local users with sufficient power levels are. Contributed by [@nexy7574](https://github.com/nexy7574). ([#19321](https://github.com/element-hq/synapse/issues/19321)) - Fixed parallel calls to `/_matrix/media/v1/create` being ratelimited for appservices even if `rate_limited: false` was set in the registration. Contributed by [@tulir](https://github.com/tulir) @ Beeper. ([#19335](https://github.com/element-hq/synapse/issues/19335)) - Fix a bug introduced in 1.61.0 where a user's membership in a room was accidentally ignored when considering access to historical state events in rooms with the "shared" history visibility. Contributed by Lukas Tautz. ([#19353](https://github.com/element-hq/synapse/issues/19353)) - [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140): Store the JSON content of scheduled delayed events as text instead of a byte array. This fixes the inability to schedule a delayed event with non-ASCII characters in its content. ([#19360](https://github.com/element-hq/synapse/issues/19360)) - Always rollback database transactions when retrying (avoid orphaned connections). ([#19372](https://github.com/element-hq/synapse/issues/19372)) - Fix `InFlightGauge` typing to allow upgrading to `prometheus_client` 0.24. ([#19379](https://github.com/element-hq/synapse/issues/19379)) #### Updates to the Docker image - Add [Prometheus HTTP service discovery](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config) endpoint for easy discovery of all workers when using the `docker/Dockerfile-workers` image (see the [*Metrics* section of our Docker testing docs](docker/README-testing.md#metrics)). ([#19336](https://github.com/element-hq/synapse/issues/19336)) #### Improved Documentation - Remove docs on legacy metric names (no longer in the codebase since 2022年12月06日). ([#19341](https://github.com/element-hq/synapse/issues/19341)) - Clarify how the estimated value of room complexity is calculated internally. ([#19384](https://github.com/element-hq/synapse/issues/19384)) #### Internal Changes - Add an internal `cancel_task` API to the task scheduler. ([#19310](https://github.com/element-hq/synapse/issues/19310)) - Tweak docstrings and signatures of `auth_types_for_event` and `get_catchup_room_event_ids`. ([#19320](https://github.com/element-hq/synapse/issues/19320)) - Replace usage of deprecated `assertEquals` with `assertEqual` in unit test code. ([#19345](https://github.com/element-hq/synapse/issues/19345)) - Drop support for Ubuntu 25.04 'Plucky Puffin', add support for Ubuntu 25.10 'Questing Quokka'. ([#19348](https://github.com/element-hq/synapse/issues/19348)) - Revert "Add an Admin API endpoint for listing quarantined media ([#19268](https://github.com/element-hq/synapse/issues/19268))". ([#19351](https://github.com/element-hq/synapse/issues/19351)) - Bump `mdbook` from 0.4.17 to 0.5.2 and remove our custom table-of-contents plugin in favour of the new default functionality. ([#19356](https://github.com/element-hq/synapse/issues/19356)) - Replace deprecated usage of PyGitHub's `GitRelease.title` with `.name` in release script. ([#19358](https://github.com/element-hq/synapse/issues/19358)) - Update the Element logo in Synapse's README to be an absolute URL, allowing it to render on other sites (such as PyPI). ([#19368](https://github.com/element-hq/synapse/issues/19368)) - Apply minor tweaks to v1.145.0 changelog. ([#19376](https://github.com/element-hq/synapse/issues/19376)) - Update Grafana dashboard syntax to use the latest from importing/exporting with Grafana 12.3.1. ([#19381](https://github.com/element-hq/synapse/issues/19381)) - Warn about skipping reactor metrics when using unknown reactor type. ([#19383](https://github.com/element-hq/synapse/issues/19383)) - Add support for reactor metrics with the `ProxiedReactor` used in worker Complement tests. ([#19385](https://github.com/element-hq/synapse/issues/19385)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

jessebot (Migrated from git.smallhack.org) approved these changes

2026年05月15日 00:05:07 +02:00

open-engineering referenced this pull request from a commit

2026年06月15日 18:37:26 +02:00

Merge pull request 'chore(deps): update ghcr.io/element-hq/synapse docker tag to v1.152.1' (#3) from renovate/ghcr.io-element-hq-synapse-1.x into main

Reviewers

No reviewers

jessebot

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-engineering/matrix-chart!3

No description provided.

Delete branch "refs/pull/3/head"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?