Security update for matrix-synapse

<updates>
  <update from="okurz" status="stable" type="security" version="1">
    <id>openSUSE_Backports_SLE-16.0_PullRequest_2051__patchinfo.20260527135522081029.187004354831441</id>
    <title>Security update for matrix-synapse</title>
    <severity>important</severity>
    <release>openSUSE Backports SLE-16.0 PullRequest 2051</release>
    <issued date="1779892198"/>
    <references>
      <reference href="https://bugzilla.opensuse.org/show_bug.cgi?id=1247970" id="1247970" title="VUL-0: CVE-2025-49090: matrix: high severity protocol vulnerability" type="bugzilla"/>
      <reference href="https://www.cve.org/CVERecord?id=2025-49090" id="CVE-2025-49090" title="VUL-0: CVE-2025-49090: matrix: high severity protocol vulnerability" type="cve"/>
      <reference href="https://www.cve.org/CVERecord?id=2025-8714" id="CVE-2025-8714" title="VUL-0: CVE-2025-8714: postgresql: untrusted data inclusion in pg_dump allows superuser of origin server to execute arbitrary code in psql client" type="cve"/>
      <reference href="https://bugzilla.opensuse.org/show_bug.cgi?id=1251231" id="1251231" title="VUL-0:  CVE-2025-61672: matrix-synapse: lack of validation for device keys allows registered attacker to break outbound federation to other homeservers" type="bugzilla"/>
      <reference href="https://www.cve.org/CVERecord?id=2026-24044" id="CVE-2026-24044" title="Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure Matrix server key generation method, allowing network attackers to potentially recreate the same key pair, allowing them to impersonate t..." type="cve"/>
      <reference href="https://bugzilla.opensuse.org/show_bug.cgi?id=1264445" id="1264445" title="VUL-0: matrix-synapse: security fixes in Synapse 1.152.1 (2026-05-07)" type="bugzilla"/>
      <reference href="https://www.cve.org/CVERecord?id=2025-61672" id="CVE-2025-61672" title="VUL-0:  CVE-2025-61672: matrix-synapse: lack of validation for device keys allows registered attacker to break outbound federation to other homeservers" type="cve"/>
    </references>
    <description>This update for matrix-synapse fixes the following issues:

Changes in matrix-synapse:

Update to 1.152.1 (boo#1264445)

  - Prevent CPU starvation (Denial of Service) under worker lock
    contention, additionally capping the WorkerLock time out
    interval to a maximum of 60 seconds. Contributed by Famedly.
    (#19394, ELEMENTSEC-2026-1706, GHSA-8q93-326v-3m7g, CVE
    pending)
  - Prevent pagination ending when a page is full of rejected
    events. (ELEMENTSEC-2025-1636, GHSA-6qf2-7x63-mm6v, CVE
    pending)

Update to 1.152.0

  For deployments using workers, please note that this version
  introduces a new quarantined_media_changes stream writer, which
  may require configuration changes. Please see the the relevant
  section in the upgrade notes for details.

  Without configuring this new stream writer, only the main process
  will be able to handle the /media/quarantine admin API endpoints
  for quarantining media.

  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11520

  - Features
    - Add a &quot;Listing quarantined media changes&quot; Admin API for
      retrieving a paginated record of when media became
      (un)quarantined. (#19558, #19677)
    - Advertise MSC4445 sync timeline order in unstable_features.
      (#19642)
    - Report the Rust compiler version used in the Prometheus
      metrics. Contributed by Noah Markert. (#19643)
    - Passthrough 'article' and 'profile' OpenGraph metadata on URL
      preview requests. (#19659)
    - Add a way to re-sign local events with a new signing key.
      (#19668)
    - Support MSC4450: Identity Provider selection for
      User-Interactive Authentication with Legacy Single Sign-On.
      (#19693)
    - Add a &quot;Listing quarantined media changes&quot; Admin API for
      retrieving a paginated record of when media became
      (un)quarantined. (#19694)
    - Add experimental support for MSC4242: State DAGs. Excludes
      federation support. (#19424)
    - Adds Admin API endpoints to
    - list, fetch and delete user reports. (#19657)
    - Reduce database disk space usage by pruning old rows from
      device_lists_changes_in_room. (#19473, #19709)
  - Bugfixes
    - Reject device_keys: null in the request to POST
      /_matrix/client/v3/keys/upload, as per the spec. This was
      temporarily allowed as a workaround for misbehaving clients.
      (#19637)
    - Fix database migrations failing on platforms where SQLite is
      configured with SQLITE_DBCONFIG_DEFENSIVE by default, such as
      macOS. (#19690)
    - Fix a bug introduced in v1.145 where a non-admin could bypass
      admin checks for downloading remote quarantined media. This
      relied on the media already being previously present on the
      homeserver. (#19639)
  - Improved Documentation
    - Include a workaround for running the unit tests with SQLite
      under recent versions of MacOS. (#19615)
    - Fix Docker image link typo in worker docs. (#19645)
    - Update developer stream docs for creating a new stream to
      point out _setup_sequence(...) in portdb. (#19675)
    - Update the developer stream docs for creating a new stream to
      highlight places that require documentation updates. (#19696)
  - Internal Changes
    - Update CI to use re-usable Complement GitHub CI workflow.
      (#19533)
    - Fix docstring for limit argument in
      _maybe_backfill_inner(...). (#19630)
    - Document context for why increase timeout for policy server
      requests. (#19633)
    - Run lint script to format Complement tests introduced in
      #19509. (#19636)
    - Small simplifications to the events class. (#19680, #19712)
    - Introduce spam_checker_spammy internal event metadata.
      (#19453)
    - Add a FilteredEvent class that saves us copying events.
      (#19640)
    - Convert EventInternalMetadata to use Arc&lt;RwLock&lt;_&gt;&gt;. (#19669)

- Update to 1.151.0
  - Features
    - Add stable support for MSC4284 Policy Servers. (#19503)
    - Update and stabilize support for MSC2666: Get rooms in common
      with another user. Contributed by @tulir @ Beeper. (#19511)
    - Updated experimental support for MSC4388: Secure out-of-band
      channel for sign in with QR. (#19573)
    - Stabilize room_version and encryption fields in the
      space/room /hierarchy API (part of MSC3266). (#19576)
    - Introduce a configuration option to allow using HTTP/2 over
      plaintext when Synapse connects to Matrix Authentication
      Service. (#19586)
  - Bugfixes
    - Fix KNOWN_ROOM_VERSIONS.__contains__ raising TypeError for
      non-string keys, which could cause /sync to fail for rooms
      with a NULL room version in the database. Bug introduced in
      #19589 as part of v1.151.0rc1. (#19649)
    - Fix MSC4284 Policy Servers implementation to skip signing
      org.matrix.msc4284.policy and m.room.policy state events.
      (#19503)
    - Correctly apply MSC4284 Policy Server signatures to events
      when the sender and policy server have the same server name.
      (#19503)
    - Allow Synapse to start up even when discovery fails for an
      OpenID Connect provider. (#19509)
    - Fix quarantine media admin APIs sometimes returning
      inaccurate counts for remote media. (#19559)
    - Fix Build and push complement image CI job not having poetry
      available for the Complement runner script. (#19578)
    - Increase timeout for policy server requests to avoid repeated
      requests for checking media. (#19629)
  - Deprecations and Removals
    - Remove support for MSC3852: Expose user agent information on
      Device as the MSC was closed. (#19430)
  - Internal Changes
    - Fix small comment typo in config output from the
      demo/start.sh script. (#19538)
    - Add MSC3820 comment context to RoomVersion attributes.
      (#19577)
    - Remove redacted_because from internal unsigned. (#19581)
    - Prevent sending registration emails if registration is
      disabled. (#19585)
    - Port RoomVersion to Rust. (#19589)
    - Only show failing Complement tests in the formatted output in
      CI. (#19590)
    - Ensure old Complement test files are removed when downloading
      a Complement checkout via ./scripts-dev/complement.sh.
      (#19592)
    - Update HomeserverTestCase.pump() docstring to demystify
      behavior (Twisted reactor/clock). (#19602)
    - Deprecate HomeserverTestCase.pump() in favor of more direct
      HomeserverTestCase.reactor.advance(...) usage. (#19602)
    - Lower the Postgres database statement_timeout to 10m
      (previously 1h). (#19604)

- Update to 1.150.0
  - Features
    - Add experimental support for the MSC4370 Federation API GET
      /extremities endpoint. (#19314)
    - MSC4140: Cancellable delayed events: When persisting a
      delayed event to the timeline, include its delay_id in the
      event's unsigned section in /sync responses to the event
      sender. (#19479)
    - Expose MSC4354 Sticky Events over the legacy (v3) /sync API.
      (#19487)
    - When Matrix Authentication Service (MAS) integration is
      enabled, allow MAS to set the user locked status in Synapse.
      (#19554)
  - Bugfixes
    - Fix Build and push complement image CI job pointing to
      non-existent image. (#19523)
    - Fix a bug introduced in v1.26.0 that caused deactivated,
      erased users to not be removed from the user directory.
      (#19542)
  - Improved Documentation
    - In the Admin API documentation, always express path
      parameters as /&lt;param&gt; instead of as /$param. (#19307)
    - Update docs to clarify outbound_federation_restricted_to can
      also be used with the Secure Border Gateway (SBG). (#19517)
    - Unify Complement developer docs. (#19518)
  - Internal Changes
    - Put membership updates in a background resumable task when
      changing the avatar or the display name. (#19311)
    - Add in-repo Complement test to sanity check Synapse version
      matches git checkout (testing what we think we are). (#19476)
    - Migrate dev dependencies to PEP 735 dependency groups.
      (#19490)
    - Remove the optional systemd-python dependency and the systemd
      extra on the synapse package. (#19491)
    - Avoid re-computing the event ID when cloning events. (#19527)
    - Allow caching of the /versions and /auth_metadata public
      endpoints. (#19530)
    - Add a few labels to the number groupings in the Processed
      request logs. (#19548)

- Update to 1.149.1
  - Bump matrix-synapse-ldap3 to 0.4.0 to support
    setuptools&gt;=82.0.0. Fixes #19541. (#19543)

- Update to 1.149.0
  - features
    - Add experimental support for MSC4388: Secure out-of-band
      channel for sign in with QR. (#19127)
    - Add stable support for MSC4380 invite blocking. (#19431)
  - Bugfixes
    - Fix the 'Login as a user' Admin API not checking if the user
      exists before issuing an access token. (#18518)
    - Fix /sync missing membership event in state_after
      (experimental MSC4222 implementation) in some scenarios.
      (#19460)
  - Internal Changes
    - Add log to explain when and why we freeze objects in the
      garbage collector. (#19440)
    - Better instrument JoinRoomAliasServlet with tracing. (#19461)
    - Fix Complement CI not running against the code from our PRs.
      (#19475)
    - Log docker system info in CI so we have a plain record of how
      GitHub runners evolve over time. (#19480)
    - Rename the test_disconnect test helper so that pytest doesn't
      see it as a test. (#19486)
    - Add a log line when we delete devices. Contributed by
      @bradtgmurray @ Beeper. (#19496)
    - Pre-allocate the buffer based on the expected Content-Length
      with the Rust HTTP client. (#19498)
    - Cancel long-running sync requests if the client has gone
      away. (#19499)
    - Try and reduce reactor tick times when under heavy load.
      (#19507)
    - Simplify Rust HTTP client response streaming and limiting.
      (#19510)
    - Replace deprecated collection import locations with current
      locations. (#19515)
    - Bump most locked Python dependencies to their latest
      versions. (#19519)

- Update to 1.148.0
  - Features
    - Support sending and receiving MSC4354 Sticky Event metadata.
      (#19365)
  - Improved Documentation
    - Fix reference to the experimental_features section of the
      configuration manual documentation. (#19435)
  - Deprecations and Removals
    - Remove support for MSC3244: Room version capabilities as the
      MSC was rejected. (#19429)
  - Internal Changes
    - Add in-repo Complement tests so we can test Synapse specific
      behavior at an end-to-end level. (#19406)
    - Push Synapse docker images to Element OCI Registry. (#19420)
    - Allow configuring the Rust HTTP client to use HTTP/2 only.
      (#19457)
    - Correctly refuse to start if the Rust workspace config has
      changed and the Rust library has not been rebuilt. (#19470)
- the generate config script now needs to call the generator twice

- Update to 1.147.1
  Block federation requests and events authenticated using a known
  insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670.
  (#19459)

  https://github.com/element-hq/ess-helm/security/advisories/GHSA-qwcj-h6m8-vp6q

- Update to 1.147.0
  - Bugfixes
    - Fix memory leak caused by not cleaning up stopped looping
      calls. Introduced in v1.140.0. (#19416)
    - Fix a typo that incorrectly made setuptools_rust a runtime
      dependency. (#19417)
  - Internal Changes
    - Prune stale entries from
      sliding_sync_connection_required_state table. (#19306)
    - Update &quot;Event Send Time Quantiles&quot; graph to only use dots for
      the event persistence rate (Grafana dashboard). (#19399)
    - Update and align Grafana dashboard to use regex matching for
      job selectors (job=~&quot;$job&quot;) so the &quot;all&quot; value works
      correctly across all panels. (#19400)
    - Don't retry joining partial state rooms all at once on
      startup. (#19402)
    - Disallow requests to the health endpoint from containing
      trailing path characters. (#19405)
    - Add notes that new experimental features should have
      associated tracking issues. (#19410)
    - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
      0.27.0. Contributed by @razvp @ ERCOM. (#19412)

- Update to 1.146.0
  - Deprecations and Removals
    - MSC2697 (Dehydrated devices) has been removed, as the MSC is
      closed. Developers should migrate to MSC3814. (#19346)
    - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
      Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
    - Add a new config option enable_local_media_storage which
      controls whether media is additionally stored locally when
      using configured media_storage_providers. Setting this to
      false allows off-site media storage without a local cache.
      Contributed by Patrice Brend'amour @dr.allgood. (#19204)
    - Stabilise support for MSC4312's m.oauth User-Interactive Auth
      stage for resetting cross-signing identity with the OAuth 2.0
      API. The old, unstable name (org.matrix.cross_signing_reset)
      is now deprecated and will be removed in a future release.
      (#19273)
    - Refactor Grafana dashboard to use server_name label (instead
      of instance). (#19337)
  - Bugfixes
    - Fix joining a restricted v12 room locally when no local room
      creator is present but local users with sufficient power
      levels are. Contributed by @nexy7574. (#19321)
    - Fixed parallel calls to /_matrix/media/v1/create being
      ratelimited for appservices even if rate_limited: false was
      set in the registration. Contributed by @tulir @ Beeper.
      (#19335)
    - Fix a bug introduced in 1.61.0 where a user's membership in a
      room was accidentally ignored when considering access to
      historical state events in rooms with the &quot;shared&quot; history
      visibility. Contributed by Lukas Tautz. (#19353)
    - MSC4140: Store the JSON content of scheduled delayed events
      as text instead of a byte array. This fixes the inability to
      schedule a delayed event with non-ASCII characters in its
      content. (#19360)
    - Always rollback database transactions when retrying (avoid
      orphaned connections). (#19372)
    - Fix InFlightGauge typing to allow upgrading to
      prometheus_client 0.24. (#19379)
  - Updates to the Docker image
    - Add Prometheus HTTP service discovery endpoint for easy
      discovery of all workers when using the
      docker/Dockerfile-workers image (see the Metrics section of
      our Docker testing docs). (#19336)
  - Improved Documentation
    - Remove docs on legacy metric names (no longer in the codebase
      since 2022-12-06). (#19341)
    - Clarify how the estimated value of room complexity is
      calculated internally. (#19384)
  - Internal Changes
    - Add an internal cancel_task API to the task scheduler.
      (#19310)
    - Tweak docstrings and signatures of auth_types_for_event and
      get_catchup_room_event_ids. (#19320)
    - Replace usage of deprecated assertEquals with assertEqual in
      unit test code. (#19345)
    - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
      for Ubuntu 25.10 'Questing Quokka'. (#19348)
    - Revert &quot;Add an Admin API endpoint for listing quarantined
      media (#19268)&quot;. (#19351)
    - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
      table-of-contents plugin in favour of the new default
      functionality. (#19356)
    - Replace deprecated usage of PyGitHub's GitRelease.title with
      .name in release script. (#19358)
    - Update the Element logo in Synapse's README to be an absolute
      URL, allowing it to render on other sites (such as PyPI).
      (#19368)
    - Apply minor tweaks to v1.145.0 changelog. (#19376)
    - Update Grafana dashboard syntax to use the latest from
      importing/exporting with Grafana 12.3.1. (#19381)
    - Warn about skipping reactor metrics when using unknown
      reactor type. (#19383)
    - Add support for reactor metrics with the ProxiedReactor used
      in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.

- Update to 1.145.0
  - Features
    - Add memberships endpoint to the admin API. This is useful for
      forensics and T&amp;S purpose. (#19260)
    - Server admins can bypass the quarantine media check when
      downloading media by setting the
      admin_unsafely_bypass_quarantine query parameter to true on
      Client-Server API media download requests. (#19275)
    - Implemented pagination for the MSC2666 mutual rooms endpoint.
      Contributed by @tulir @ Beeper. (#19279)
    - Admin API: add worker support to GET
      /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
    - Improve proxy support for the federation_client.py dev
      script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
    - Fix sliding sync performance slow down for long lived
      connections. (#19206)
    - Fix a bug where Mastodon posts (and possibly other embeds)
      have the wrong description for URL previews. (#19231)
    - Fix bug where Duration was logged incorrectly. (#19267)
    - Fix bug introduced in 1.143.0 that broke support for versions
      of zope-interface older than 6.2. (#19274)
    - Transform events with client metadata before serialising in
      /event response. (#19340)
  - Updates to the Docker image
    - Add a way to expose metrics from the Docker image
      (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
    - Document the importance of public_baseurl when configuring
      OpenID Connect authentication. (#19270)
  - Deprecations and Removals
    - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
      2026. Synapse will stop building packages for Ubuntu 25.04
      shortly thereafter.
    - Remove the &quot;Updates to locked dependencies&quot; section from the
      changelog due to lack of use and the maintenance burden.
      (#19254)
  - Internal Changes
    - Group together dependabot update PRs to reduce the review
      load. (#18402)
    - Fix HomeServer.shutdown() failing if the homeserver hasn't
      been setup yet. (#19187)
    - Respond with useful error codes with Content-Length header/s
      are invalid. (#19212)
    - Fix HomeServer.shutdown() failing if the homeserver failed to
      start. (#19232)
    - Switch the build backend from poetry-core to maturin.
      (#19234)
    - Raise the limit for concurrently-open non-security
      @dependabot PRs from 5 to 10. (#19253)
    - Require 14 days to pass before pulling in general dependency
      updates to help mitigate upstream supply chain attacks.
      (#19258)
    - Drop the broken netlify documentation workflow until a new
      one is implemented. (#19262)
    - Don't include debug logs in Clock unless explicitly enabled.
      (#19278)
    - Use uv to test olddeps to ensure all transitive dependencies
      use minimum versions. (#19289)
    - Add a config to be able to rate limit search in the user
      directory. (#19291)
    - Log the original bind exception when encountering Failed to
      listen on 0.0.0.0, continuing because listening on [::].
      (#19297)
    - Unpin the version of Rust we use to build Synapse wheels (was
      1.82.0) now that MacOS support has been dropped. (#19302)
    - Make it more clear how shared_extra_conf is combined in our
      Docker configuration scripts. (#19323)
    - Update CI to stream Complement progress and format logs in a
      separate step after all tests are done. (#19326)
    - Format .github/workflows/tests.yml. (#19327)

- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.

  - Features
    - Add experimentatal implememntation of MSC4380 (invite
      blocking). (#19203)
    - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
    - Fix a bug in the database function for fetching state deltas
      that could result in unnecessarily long query times. (#18960)
    - Fix v12 rooms when running with use_frozen_dicts: True.
      (#19235)
    - Fix bug where invalid canonical_alias content would return
      500 instead of 400. (#19240)
    - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
    - Document in the --config-path help how multiple files are
      merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
    - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
    - Improve event filtering for Simplified Sliding Sync. (#17782)
    - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
      variable from scripts-dev/complement.sh. (#19208)
    - Refactor scripts-dev/complement.sh logic to avoid exit to
      facilitate being able to source it from other scripts
      (composable). (#19209)
    - Expire sliding sync connections that are too old or have too
      much pending data. (#19211)
    - Require an experimental feature flag to be enabled in order
      for the unstable MSC2666 endpoint
      (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
      to be available. (#19219)
    - Prevent changelog check CI running on @dependabot's PRs even
      when a human has modified the branch. (#19220)
    - Auto-fix trailing spaces in multi-line strings and comments
      when running the lint script. (#19221)
    - Move towards using a dedicated Duration type. (#19223,
      #19229)
    - Improve robustness of the SQL schema linting in CI. (#19224)
    - Add log to determine whether clients are using /messages as
      expected. (#19226)
    - Simplify README and add ESS Getting started section. (#19228,
      #19259)
    - Add a unit test for ensuring associated refresh tokens are
      erased when a device is deleted. (#19230)
    - Prompt user to consider adding future deprecations to the
      changelog in release script. (#19239)
    - Fix check of the Rust compiled code being outdated when using
      source checkout and .egg-info. (#19251)
    - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
    - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
    - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
    - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
    - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
    - Bump attrs from 25.3.0 to 25.4.0. (#19215)
    - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
    - Bump http from 1.3.1 to 1.4.0. (#19249)
    - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
    - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
    - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
    - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
    - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
    - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
      (#19217)
    - Bump types-jsonschema from 4.25.1.20250822 to
      4.25.1.20251009. (#19252)

- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.

  - Features
    - Support multiple config files in register_new_matrix_user.
      (#18784)
    - Remove authentication from POST
      /_matrix/client/v1/delayed_events, and allow calling this
      endpoint with the update action to take (send/cancel/restart)
      in the request path instead of the body. (#19152)
  - Bugfixes
    - Fixed a longstanding bug where background updates were only
      run on the main database. (#19181)
    - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
      endpoints from working. (#19186)
    - Fix the SQLite-to-PostgreSQL migration script to correctly
      migrate a boolean column in the delayed_events table.
      (#19155)
  - Improved Documentation
    - Improve documentation around streams, particularly ID
      generators and adding new streams. (#18943)
  - Deprecations and Removals
    - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
    - Fixes docker image creation in the release workflow.
    - Provide additional servers with federation room directory
      results. (#18970)
    - Add a shortcut return when there are no events to purge.
      (#19093)
    - Write union types as X | Y where possible, as per PEP 604,
      added in Python 3.10. (#19111)
    - Reduce cardinality of
      synapse_storage_events_persisted_events_sep_total metric by
      removing origin_entity label. This also separates out events
      sent by local application services by changing the
      origin_type for such events to application_service. The type
      field also only tracks common event types, and anything else
      is bucketed under *other*. (#19133, #19168)
    - Run trial tests on Python 3.14 for PRs. (#19135)
    - Update pyproject.toml project metadata to be compatible with
      standard Python packaging tooling. (#19137)
    - Minor speed up of processing of inbound replication. (#19138,
      #19145, #19146)
    - Ignore recent Python language refactors from git blame
      (.git-blame-ignore-revs). (#19150)
    - Bump lower bounds of dependencies parameterized to 0.9.0 and
      idna to 3.3 as those are the first to advertise support for
      Python 3.10. (#19167)
    - Point out which event caused the exception when checking
      MSC4293 redactions. (#19169)
    - Restore printing sentinel for the log record request when no
      logcontext is active. (#19172)
    - Add debug logs to track Clock utilities. (#19173)
    - Remove explicit python version skips in cibuildwheel config
      as it's no longer required after #19137. (#19177)
    - Fix potential lost logcontext when
      PerDestinationQueue.shutdown(...) is called. (#19178)
    - Fix bad deferred logcontext handling across the codebase.
      (#19180)
  - Updates to locked dependencies
    - Bump bytes from 1.10.1 to 1.11.0. (#19193)
    - Bump click from 8.1.8 to 8.3.1. (#19195)
    - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
    - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
    - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
    - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
    - Bump ruff from 0.14.3 to 0.14.5. (#19196)
    - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
    - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
    - Bump tomli from 2.2.1 to 2.3.0. (#19194)
    - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
      (#19160)

- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)

- Update to 1.142.0
  - Features
    - Add support for Python 3.14. (#19055, #19134)
    - Add an Admin API
    - to allow an admin to fetch the space/room hierarchy for a
      given space. (#19021)
  - Bugfixes
    - Fix a bug introduced in 1.142.0rc1 where any attempt to
      configure matrix_authentication_service.secret_path would
      prevent the homeserver from starting up. (#19144)
    - Fix a bug introduced in 1.111.0 where failed attempts to
      download authenticated remote media would not be handled
      correctly. (#19062)
    - Update the oidc_session_no_samesite cookie to have the Secure
      attribute, so the only difference between it and the paired
      oidc_session cookie, is the configuration of the SameSite
      attribute as described in the comments / cookie names.
      Contributed by @kieranlane. (#19079)
    - Fix a bug introduced in 1.140.0 where lost logcontext
      warnings would be emitted from timeouts in sync and requests
      made by Synapse itself. (#19090)
    - Fix a bug introdued in 1.140.0 where lost logcontext warning
      were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
    - Update the link to the Debian oldstable package for SQLite.
      (#19047)
    - Point out additional Redis configuration options available in
      the worker docs. Contributed by @servisbryce. (#19073)
    - Update the list of Debian releases that the downstream Debian
      package is maintained for. (#19100)
    - Add a page to the documentation describing the steps the
      Synapse team takes to review the release notes before
      publishing them. (#19109)
  - Deprecations and Removals
    - Drop support for Python 3.9. (#19099)
    - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
    - Properly stop building wheels for Python 3.9 and
      free-threaded CPython. (#19154)
    - Update release scripts to prevent building wheels for
      free-threaded Python, as Synapse does not currently support
      it. (#19140)
    - Manually skip building Python 3.9 wheels, to prevent errors
      in the release workflow. (#19119)
    - Fix CI linter for schema delta files to correctly handle all
      types of CREATE TABLE syntax. (#19020)
    - Use type hinting generics in standard collections, as per PEP
      585, added in Python 3.9. (#19046)
    - Always treat RETURNING as supported by SQL engines, now that
      the minimum-supported versions of both SQLite and PostgreSQL
      support it. (#19047)
    - Move oidc.load_metadata() startup into _base.start().
      (#19056)
    - Remove logcontext problems caused by awaiting raw
      deferLater(...). (#19058)
    - Prevent duplicate logging setup when running multiple Synapse
      instances. (#19067)
    - Be mindful of other logging context filters in 3rd-party code
      and avoid overwriting log record fields unless we know the
      log record is relevant to Synapse. (#19068)
    - Update pydantic to v2. (#19071)
    - Update deprecated code in the release script to prevent a
      warning message from being printed. (#19080)
    - Update the deprecated poetry development dependencies group
      name in pyproject.toml. (#19081)
    - Remove pp38* skip selector from cibuildwheel to silence
      warning. (#19085)
    - Don't immediately exit the release script if the checkout is
      dirty. Instead, allow the user to clear the dirty changes and
      retry. (#19088)
    - Update the release script's generated announcement text to
      include a title and extra text for RC's. (#19089)
    - Fix lints on main branch. (#19092)
    - Use cheaper random string function in logcontext utilities.
      (#19094)
    - Avoid clobbering other SIGHUP handlers in 3rd-party code.
      (#19095)
    - Prevent duplicate GitHub draft releases being created during
      the Synapse release process. (#19096)
    - Use Pillow's Image.getexif method instead of the experimental
      Image._getexif. (#19098)
    - Prevent uv /usr/local/.lock file from appearing in built
      Synapse docker images. (#19107)
    - Allow Synapse's runtime dependency checking code to take
      packaging markers (i.e. python &lt;= 3.14) into account when
      checking dependencies. (#19110)
    - Move exception handling up the stack (avoid exit(1) in our
      composable functions). (#19116)
    - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
    - Refactor and align app entrypoints (avoid exit(1) in our
      composable functions). (#19121, #19131)
    - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
    - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
    - Bump actions/upload-artifact from 4 to 5. (#19106)
    - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
    - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
    - Bump idna from 3.10 to 3.11. (#19053)
    - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
    - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
    - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
    - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
    - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
    - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
    - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
    - Bump ruff from 0.12.10 to 0.14.3. (#19124)
    - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
    - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
      7.0.0. (#19052)
    - Bump tokio from 1.47.1 to 1.48.0. (#19076)
    - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
      (#19054)

- Update to 1.141.0
  - Features
    - Allow using MSC4190 behavior without the opt-in registration
      flag. Contributed by @tulir @ Beeper. (#19031)
    - Stabilize support for MSC4326: Device masquerading for
      appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
    - Fix users being unable to log in if their password, or the
      server's configured pepper, was too long. (#19101)
    - Fix a bug introduced in 1.136.0 that would prevent Synapse
      from being able to be reload-ed more than once when running
      under systemd. (#19060)
    - Fix a bug introduced in 1.140.0 where an internal server
      error could be raised when hashing user passwords that are
      too long. (#19078)
  - Updates to the Docker image
    - Update docker image to use Debian trixie as the base and thus
      Python 3.13. (#19064)
  - Internal Changes
    - Move unique snowflake homeserver background tasks to
      start_background_tasks (the standard pattern for this kind of
      thing). (#19037)
    - Drop a deprecated field of the PyGitHub dependency in the
      release script and raise the dependency's minimum version to
      1.59.0. (#19039)
    - Update TODO list of conflicting areas where we encounter
      metrics being clobbered (ApplicationService). (#19040)

- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
    - Deployments that make use of the synapse-s3-storage-provider
      module must upgrade to v1.6.0. Using older versions of the
      module with this release of Synapse will prevent users from
      being able to upload or download media.
  - Features
    - Add a new Media Query by ID Admin API that allows server
      admins to query and investigate the metadata of local or
      cached remote media via
    - the origin/media_id identifier found in a Matrix Content URI.
      (#18911)
    - Add a new Fetch Event Admin API to fetch an event by ID.
      (#18963)
    - Update MSC4284: Policy Servers implementation to support
      signatures when available. (#18934)
    - Add experimental implementation of the GET
      /_matrix/client/v1/rtc/transports endpoint for the latest
      draft of MSC4143: MatrixRTC. (#18967)
    - Expose a defer_to_threadpool function in the Synapse Module
      API that allows modules to run a function on a separate
      thread in a custom threadpool. (#19032)
  - Bugfixes
    - Fix room upgrade room_config argument and documentation for
      user_may_create_room spam-checker callback. (#18721)
    - Compute a user's last seen timestamp from their devices' last
      seen timestamps instead of IPs, because the latter are
      automatically cleared according to user_ips_max_age. (#18948)
    - Fix bug where ephemeral events were not filtered by room ID.
      Contributed by @frastefanini. (#19002)
    - Update Synapse main process version string to include git
      info. (#19011)
  - Improved Documentation
    - Explain how Deferred callbacks interact with logcontexts.
      (#18914)
    - Fix documentation for rc_room_creation and rc_reports to
      clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
    - Remove deprecated
      LoggingContext.set_current_context/LoggingContext.current_context
      methods which already have equivalent bare methods in
      synapse.logging.context. (#18989)
    - Drop support for unstable field names from the long-accepted
      MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
    - Cleanly shutdown SynapseHomeServer object, allowing artifacts
      of embedded small hosts to be properly garbage collected.
      (#18828)
    - Update OEmbed providers to use 'X' instead of 'Twitter' in
      URL previews, following a rebrand. Contributed by
      @HammyHavoc. (#18767)
    - Fix server_name in logging context for multiple Synapse
      instances in one process. (#18868)
    - Wrap the Rust HTTP client with make_deferred_yieldable so it
      follows Synapse logcontext rules. (#18903)
    - Fix the GitHub Actions workflow that moves issues labeled
      &quot;X-Needs-Info&quot; to the &quot;Needs info&quot; column on the team's
      internal triage board. (#18913)
    - Disconnect background process work from request trace.
      (#18932)
    - Reduce overall number of calls to
      _get_e2e_cross_signing_signatures_for_devices by increasing
      the batch size of devices the query is called with, reducing
      DB load. (#18939)
    - Update error code used when an appservice tries to masquerade
      as an unknown device using MSC4326. Contributed by @tulir @
      Beeper. (#18947)
    - Fix no active span when trying to log tracing error on
      startup (when OpenTracing is enabled). (#18959)
    - Fix run_coroutine_in_background(...) incorrectly handling
      logcontext. (#18964)
    - Add debug logs wherever we change current logcontext.
      (#18966)
    - Update dockerfile metadata to fix broken link; point to
      documentation website. (#18971)
    - Note that the code is additionally licensed under the Element
      Commercial license in SPDX expression field configs. (#18973)
    - Fix logcontext handling in timeout_deferred tests. (#18974)
    - Remove internal ReplicationUploadKeysForUserRestServlet as a
      follow-up to the work in #18581 that moved device changes off
      the main process. (#18988)
    - Switch task scheduler from raw logcontext manipulation to
      using the dedicated logcontext utils. (#18990)
    - Remove MockClock() in tests. (#18992)
    - Switch back to our own custom LogContextScopeManager instead
      of OpenTracing's ContextVarsScopeManager which was causing
      problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
      option with tracing enabled. (#19007)
    - Remove version_string argument from HomeServer since it's
      always the same. (#19012)
    - Remove duplicate call to hs.start_background_tasks()
      introduced from a bad merge. (#19013)
    - Split homeserver creation (create_homeserver) and setup
      (setup). (#19015)
    - Swap near-end-of-life macos-13 GitHub Actions runner for the
      macos-15-intel variant. (#19025)
    - Introduce RootConfig.validate_config() which can be
      subclassed in HomeServerConfig to do cross-config class
      validation. (#19027)
    - Allow any command of the release.py script to accept a
      --gh-token argument. (#19035)
  - Updates to locked dependencies
    - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
    - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
    - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
    - Bump authlib from 1.6.3 to 1.6.4. (#18957)
    - Bump authlib from 1.6.4 to 1.6.5. (#19019)
    - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
    - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
    - Bump lxml from 6.0.0 to 6.0.2. (#18979)
    - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
    - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
    - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
    - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
    - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
    - Bump regex from 1.11.2 to 1.11.3. (#18981)
    - Bump serde from 1.0.224 to 1.0.226. (#18953)
    - Bump serde from 1.0.226 to 1.0.228. (#18982)
    - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
    - Bump twine from 6.1.0 to 6.2.0. (#18985)
    - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
      (#19018)
    - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
      (#18951)
    - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)

- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)

- Update to 1.139.1 (boo#1251231)
  - Security Fixes
    - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
      for device keys in Synapse before 1.139.1 allows an attacker
      registered on the victim homeserver to degrade federation
      functionality, unpredictably breaking outbound federation to
      other homeservers. (#17097)
  - Deprecations and Removals
    - Drop support for unstable field names from the long-accepted
      MSC2732 (Olm fallback keys) proposal. This change allows unit
      tests to pass following the security patch above. (#18996)

- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS

  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.

  Please see the upgrade notes for more information.

  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas

  - Features
    - Add experimental support for MSC4308: Thread Subscriptions
      extension to Sliding Sync when MSC4306: Thread Subscriptions
      and MSC4186: Simplified Sliding Sync are enabled. (#18695)
    - Update push rules for experimental MSC4306: Thread
      Subscriptions to follow a newer draft. (#18846)
    - Add get_media_upload_limits_for_user and
      on_media_upload_limit_exceeded module API callbacks to the
      media repository. (#18848)
    - Support MSC4169 for backwards-compatible redaction sending
      using the /send endpoint. Contributed by @SpiritCroc @
      Beeper. (#18898)
    - Add an in-memory cache to
      _get_e2e_cross_signing_signatures_for_devices to reduce DB
      load. (#18899)
    - Update MSC4190 support to return correct errors and allow
      appservices to reset cross-signing keys without
      user-interactive authentication. Contributed by @tulir @
      Beeper. (#18946)
  - Bugfixes
    - Fix a bug introduced in 1.139.0rc1 where
      `run_coroutine_in_background(...)` incorrectly handling
      logcontext (#18964)
    - Ensure all PDUs sent via /send pass canonical JSON checks.
      (#18641)
    - Fix bug where we did not send invite revocations over
      federation. (#18823)
    - Fix prefixed support for MSC4133. (#18875)
    - Fix open redirect in legacy SSO flow with the idp query
      parameter. (#18909)
    - Fix a performance regression related to the experimental
      Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
    - Suppress &quot;Applying schema&quot; log noise bulk when
      SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
    - Clarify Python dependency constraints in our deprecation
      policy. (#18856)
    - Clarify necessary jwt_config parameter in OIDC documentation
      for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
    - Remove obsolete and experimental /sync/e2ee endpoint.
      (#18583)
  - Internal Changes
    - Fix LaterGauge metrics to collect from all servers. (#18791)
    - Configure Synapse to run MSC4306: Thread Subscriptions
      Complement tests. (#18819)
    - Remove sentinel logcontext usage where we log in setup, start
      and exit. (#18870)
    - Use the Enum's value for the dictionary key when responding
      to an admin request for experimental features. (#18874)
    - Start background tasks after we fork the process (daemonize).
      (#18886)
    - Better explain how we manage the logcontext in
      run_in_background(...) and run_as_background_process(...).
      (#18900, #18906)
    - Remove sentinel logcontext usage in Clock utilities like
      looping_call and call_later. (#18907)
    - Replace usages of the deprecated pkg_resources interface in
      preparation of setuptools dropping it soon. (#18910)
    - Split loading config from homeserver setup. (#18933)
    - Fix run_in_background not being awaited properly in some
      tests causing LoggingContext problems. (#18937)
    - Fix run_as_background_process not being awaited properly
      causing LoggingContext problems in experimental MSC4140:
      Delayed events implementation. (#18938)
    - Introduce Clock.call_when_running(...) to wrap startup code
      in a logcontext, ensuring we can identify which server
      generated the logs. (#18944)
    - Introduce Clock.add_system_event_trigger(...) to wrap system
      event callback code in a logcontext, ensuring we can identify
      which server generated the logs. (#18945)
  - Updates to locked dependencies
    - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
    - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
    - Bump authlib from 1.6.1 to 1.6.3. (#18921)
    - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
    - Bump log from 0.4.27 to 0.4.28. (#18892)
    - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
    - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
    - Bump serde from 1.0.219 to 1.0.223. (#18920)
    - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
    - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
    - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
    - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
      (#18918)
    - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
      (#18895)
    - Bump types-setuptools from 80.9.0.20250809 to
      80.9.0.20250822. (#18924)

- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)

- Update to 1.138.0
  - Features
    - Support for the stable endpoint and scopes of MSC3861 &amp; co.
      (#18549)
  - Bugfixes
    - Improve database performance of MSC4293 - Redact on Kick/Ban.
      (#18851)
    - Do not throw an error when fetching a rejected delayed state
      event on startup. (#18858)
  - Improved Documentation
    - Fix worker documentation incorrectly indicating all room
      Admin API requests were capable of being handled by workers.
      (#18853)
  - Internal Changes
    - Instrument _ByteProducer with tracing to measure potential
      dead time while writing bytes to the request. (#18804)
    - Switch to OpenTracing's ContextVarsScopeManager instead of
      our own custom LogContextScopeManager. (#18849)
    - Trace how much work is being done while &quot;recursively fetching
      redactions&quot;. (#18854)
    - Link upstream Twisted bug tracking the problem that explains
      why we have to use a Producer to write bytes to the request.
      (#18855)
    - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
    - Bump actions/add-to-project from
      c0c5949b017d0d4a39f7ba888255881bdac2a823 to
      4515659e2b458b27365e167605ac44f219494b66. (#18863)
    - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
    - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
    - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
    - Bump dtolnay/rust-toolchain from
      b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
      e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
    - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
    - Bump regex from 1.11.1 to 1.11.2. (#18864)
    - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
    - Bump ruff from 0.12.7 to 0.12.10. (#18865)
    - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
    - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
      (#18838)
    - Bump types-jsonschema from 4.25.0.20250720 to
      4.25.1.20250822. (#18867)
    - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
      (#18836)

- Update to 1.137.0
  - Bugfixes
    - Fix a bug which could corrupt auth chains making it
      impossible to perform state resolution. (#18746)
    - Fix error message in register_new_matrix_user utility script
      for empty registration_shared_secret. (#18780)
    - Allow enabling MSC4108 when the stable Matrix Authentication
      Service integration is enabled. (#18832)
  - Improved Documentation
    - Include IPv6 networks in denied-peer-ips of coturn setup.
      Contributed by @litetex. (#18781)
  - Internal Changes
    - Update tests to ensure all database tables are emptied when
      purging a room. (#18794)
    - Instrument the encode_response part of Sliding Sync requests
      for more complete traces in Jaeger. (#18815)
    - Tag Sliding Sync traces when we wait_for_events. (#18816)
    - Fix portdb CI by hardcoding the new pg_dump restrict key that
      was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
    - Bump actions/add-to-project from
      5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
      0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
    - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
    - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
    - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
    - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
    - Bump mypy from 1.16.1 to 1.17.1. (#18775)
    - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
    - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
    - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
    - Bump slab from 0.4.10 to 0.4.11. (#18809)
    - Bump tokio from 1.47.0 to 1.47.1. (#18774)
    - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
      (#18798)
    - Bump types-setuptools from 80.9.0.20250529 to
      80.9.0.20250809. (#18796)

- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.

  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.

  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.

  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360

  - Features
    - Add configurable rate limiting for the creation of rooms.
      (#18514)
    - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
    - When admins enable themselves to see soft-failed events, they
      will also see if the cause is due to the policy server
      flagging them as spam via unsigned. (#18585)
    - Add ability to configure forward/outbound proxy via
      homeserver config instead of environment variables. See
      http_proxy, https_proxy, no_proxy_hosts. (#18686)
    - Advertise experimental support for MSC4306 (Thread
      Subscriptions) through /_matrix/clients/versions if enabled.
      (#18722)
    - Stabilise support for delegating authentication to Matrix
      Authentication Service. (#18759)
    - Implement the push rules for experimental MSC4306: Thread
      Subscriptions. (#18762)
  - Bugfixes
    - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
      Room Admin API would not treat a room v12's creator power
      level as the highest in room. (#18805)
    - Update MSC4293 redaction logic for room v12. (#80)
    - Allow return code 403 (allowed by C2S Spec since v1.2) when
      fetching profiles via federation. (#18696)
    - Register the MSC4306 (Thread Subscriptions) endpoints in the
      CS API when the experimental feature is enabled. (#18726)
    - Fix a long-standing bug where suspended users could not have
      server notices sent to them (a 403 was returned to the
      admin). (#18750)
    - Fix an issue that could cause logcontexts to be lost on
      rate-limited requests. Found by @realtyem. (#18763)
    - Fix invalidation of storage cache that was broken in 1.135.0.
      (#18786)
  - Improved Documentation
    - Minor improvements to README. (#18700)
    - Document that there can be multiple workers handling the
      receipts stream. (#18760)
    - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
    - Deprecate run_as_background_process exported as part of the
      module API interface in favor of
      ModuleApi.run_as_background_process. See the relevant section
      in the upgrade notes for more information. (#18737)
  - Internal Changes
    - Add a parameter to upgrade_rooms(..) to allow auto join local
      users. (#82)
    - Add debug logging for HMAC digest verification failures when
      using the admin API to register users. (#18474)
    - Speed up upgrading a room with large numbers of banned users.
      (#18574)
    - Fix config documentation generation script on Windows by
      enforcing UTF-8. (#18580)
    - Refactor cache, background process, Counter, LaterGauge,
      GaugeBucketCollector, Histogram, and Gauge metrics to be
      homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
      #18725, #18670, #18748, #18751)
    - Reduce database usage in Sliding Sync by not querying for
      background update completion after the update is known to be
      complete. (#18718)
    - Improve order of validation and ratelimiting in room
      creation. (#18723)
    - Bump minimum version bound on Twisted to 21.2.0. (#18727,
      #18729)
    - Use twisted.internet.testing module in tests instead of
      deprecated twisted.test.proto_helpers. (#18728)
    - Remove obsolete /send_event replication endpoint. (#18730)
    - Update metrics linting to be able to handle custom metrics.
      (#18733)
    - Work around twisted.protocols.amp.TooLong error by reducing
      logging in some tests. (#18736)
    - Prevent &quot;Move labelled issues to correct projects&quot; GitHub
      Actions workflow from failing when an issue is already on the
      project board. (#18755)
    - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
      in #18553 (released in Synapse 1.134.0). (#18757)
    - Make Clock.sleep(...) return a coroutine, so that mypy can
      catch places where we don't await on it. (#18772)
    - Update implementation of MSC4306: Thread Subscriptions to
      include automatic subscription conflict prevention as
      introduced in later drafts. (#18756)
  - Updates to locked dependencies
    - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
    - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
    - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
    - Bump ruff from 0.12.4 to 0.12.5. (#18742)
    - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
    - Bump tokio from 1.46.1 to 1.47.0. (#18740)
    - Bump types-jsonschema from 4.24.0.20250708 to
      4.25.0.20250720. (#18703)
    - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
      (#18706)

- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.

  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.

  - Bugfixes
    - Fix invalidation of storage cache that was broken in 1.135.0.
      (#18786)
  - Internal Changes
    - Add a parameter to upgrade_rooms(..) to allow auto join local
      users. (#82)
    - Speed up upgrading a room with large numbers of banned users.
      (#18574)

- Update to 1.135.0
  - Features
    - Add recaptcha_private_key_path and recaptcha_public_key_path
      config option. (#17984, #18684)
    - Add plain-text handling for rich-text topics as per MSC3765.
      (#18195)
    - If enabled by the user, server admins will see soft failed
      events over the Client-Server API. (#18238)
    - Add experimental support for MSC4277: Harmonizing the
      reporting endpoints. (#18263)
    - Add ability to limit amount of media uploaded by a user in a
      given time period. (#18527)
    - Enable workers to write directly to the device lists stream
      and handle device list updates, reducing load on the main
      process. (#18581)
    - Support arbitrary profile fields. Contributed by @clokep.
      (#18635)
    - Advertise support for Matrix v1.12. (#18647)
    - Add an option to issue redactions as an admin user via the
      admin redaction endpoint. (#18671)
    - Add experimental and incomplete support for MSC4306: Thread
      Subscriptions. (#18674)
    - Include event_id when getting state with ?format=event.
      Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
    - Fix user failing to deactivate with MAS when /_synapse/mas is
      handled by a worker. (#18716)
    - Fix CPU and database spinning when retrying sending events to
      servers whilst at the same time purging those events.
      (#18499)
    - Don't allow creation of tags with names longer than 255
      bytes, as per the spec. (#18660)
    - Fix sliding_sync_connections-related errors when porting from
      SQLite to Postgres. (#18677)
    - Fix the MAS integration not working when Synapse is started
      with --daemonize or using synctl. (#18691)
  - Improved Documentation
    - Document that some config options for the user directory are
      in violation of the Matrix spec. (#18548)
    - Update rc_delayed_event_mgmt docs to the actual nesting
      level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
    - Fix performance regression introduced in #18238 by adding a
      cache to is_server_admin. (#18747)
    - Add a dedicated internal API for Matrix Authentication
      Service to Synapse communication. (#18520)
    - Allow user registrations to be done on workers. (#18552)
    - Remove unnecessary HTTP replication calls. (#18564)
    - Refactor Measure block metrics to be homeserver-scoped.
      (#18601)
    - Refactor cache metrics to be homeserver-scoped. (#18604)
    - Unbreak &quot;Latest dependencies&quot; workflow by using the --without
      dev poetry option instead of removed --no-dev. (#18617)
    - Update URL Preview code to work with lxml 6.0.0+. (#18622)
    - Use markdown-it-py instead of commonmark in the release
      script. (#18637)
    - Fix typing errors with upgraded mypy version. (#18653)
    - Add doc comment explaining that config files are shallowly
      merged. (#18664)
    - Minor speed up of insertion into stream_positions table.
      (#18672)
    - Remove unused allow_no_prev_events option when creating an
      event. (#18676)
    - Clean up MetricsResource and Prometheus hacks. (#18687)
    - Fix dirty Cargo.lock changes appearing after install
      (base64). (#18689)
    - Prevent dirty Cargo.lock changes from install. (#18693)
    - Correct spelling of 'Admin token used' log line. (#18697)
    - Reduce log spam when client stops downloading media while it
      is being streamed to them. (#18699)
  - Updates to locked dependencies
    - Bump authlib from 1.6.0 to 1.6.1. (#18704)
    - Bump base64 from 0.21.7 to 0.22.1. (#18666)
    - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
    - Bump lxml from 5.4.0 to 6.0.0. (#18631)
    - Bump mypy from 1.13.0 to 1.16.1. (#18653)
    - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
    - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
    - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
    - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
    - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
    - Bump types-jsonschema from 4.24.0.20250528 to
      4.24.0.20250708. (#18682)

- Update to 1.134.0

  - Features

    - Support for MSC4235: via query param for hierarchy endpoint.
      Contributed by Krishan (@kfiven). (#18070)
    - Add forget_forced_upon_leave capability as per MSC4267.
      (#18196)
    - Add federated_user_may_invite spam checker callback which
      receives the entire invite event. Contributed by @tulir @
      Beeper. (#18241)

  - Bugfixes

    - Fix KeyError on background updates when using split
      main/state databases. (#18509)
    - Improve performance of device deletion by adding missing
      index. (#18582)
    - Fix avatar_url and displayname being sent on federation
      profile queries when they are not set. (#18593)
    - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
      POST /login, as per the spec. (#18594)
    - Ensure policy servers are not asked to scan policy server
      change events, allowing rooms to disable the use of a policy
      server while the policy server is down. (#18605)

  - Improved Documentation

    - Fix documentation of the Delete Room Admin API's status
      field. (#18519)
    - Deprecations and Removals
    - Stop adding the &quot;origin&quot; field to newly-created events
      (PDUs). (#18418)

  - Internal Changes

    - Replace PyICU crate with equivalent icu_segmenter Rust crate.
      (#18553, #18646)
    - Improve docstring on simple_upsert_many. (#18573)
    - Raise poetry-core version cap to 2.1.3. (#18575)
    - Raise setuptools_rust version cap to 1.11.1. (#18576)
    - Better handling of ratelimited requests. (#18595, #18600)
    - Update to Rust 1.87.0 in CI, and bump the pinned commit of
      the dtolnay/rust-toolchain GitHub Action to
      b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
    - Speed up bulk device deletion. (#18602)
    - Speed up the building of arm-based wheels in CI. (#18618)
    - Speed up the building of Docker images in CI. (#18620)
    - Add .zed/ directory to .gitignore. (#18623)
    - Log the room ID we're purging state for. (#18625)

- Update to 1.133.0

  - Features

    - Add support for the MSC4260 user report API. (#18120)

  - Bugfixes

    - Fix an issue where, during state resolution for v11 rooms,
      Synapse would incorrectly calculate the power level of the
      creator when there was no power levels event in the room.
      (#18534, #18547)
    - Fix long-standing bug where sliding sync did not honour the
      room_id_to_include config option. (#18535)
    - Fix an issue where &quot;Lock timeout is getting excessive&quot;
      warnings would be logged even when the lock timeout was &lt;10
      minutes. (#18543)
    - Fix an issue where Synapse could calculate the wrong power
      level for the creator of the room if there was no power
      levels event. (#18545)

  - Improved Documentation

    - Generate config documentation from JSON Schema file. (#18528)
    - Fix typo in user type documentation. (#18568)

  - Internal Changes

    - Increase performance of introspecting access tokens when
      using delegated auth. (#18357, #18561)
    - Log user deactivations. (#18541)
    - Enable flake8-logging and flake8-logging-format rules in Ruff
      and fix related issues throughout the codebase. (#18542)
    - Clean up old, unused rows from the device_federation_inbox
      table. (#18546)
    - Run config schema CI on develop and release branches.
      (#18551)
    - Add support for Twisted 25.5.0+ releases. (#18577)
    - Update PyO3 to version 0.25. (#18578)
</description>
    <pkglist>
      <collection>
        <package name="matrix-synapse" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="src" src="src/matrix-synapse-1.152.1-bp160.999999.1.1.src.rpm">
          <filename>matrix-synapse-1.152.1-bp160.999999.1.1.src.rpm</filename>
        </package>
        <package name="matrix-synapse" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="x86_64" src="x86_64/matrix-synapse-1.152.1-bp160.999999.1.1.x86_64.rpm">
          <filename>matrix-synapse-1.152.1-bp160.999999.1.1.x86_64.rpm</filename>
        </package>
        <package name="matrix-synapse-debuginfo" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="x86_64" src="x86_64/matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.x86_64.rpm">
          <filename>matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.x86_64.rpm</filename>
        </package>
        <package name="matrix-synapse-debugsource" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="x86_64" src="x86_64/matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.x86_64.rpm">
          <filename>matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.x86_64.rpm</filename>
        </package>
        <package name="matrix-synapse-test" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="src" src="src/matrix-synapse-test-1.152.1-bp160.999999.1.1.src.rpm">
          <filename>matrix-synapse-test-1.152.1-bp160.999999.1.1.src.rpm</filename>
        </package>
        <package name="matrix-synapse" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="s390x" src="s390x/matrix-synapse-1.152.1-bp160.999999.1.1.s390x.rpm">
          <filename>matrix-synapse-1.152.1-bp160.999999.1.1.s390x.rpm</filename>
        </package>
        <package name="matrix-synapse-debuginfo" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="s390x" src="s390x/matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.s390x.rpm">
          <filename>matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.s390x.rpm</filename>
        </package>
        <package name="matrix-synapse-debugsource" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="s390x" src="s390x/matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.s390x.rpm">
          <filename>matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.s390x.rpm</filename>
        </package>
        <package name="matrix-synapse" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="ppc64le" src="ppc64le/matrix-synapse-1.152.1-bp160.999999.1.1.ppc64le.rpm">
          <filename>matrix-synapse-1.152.1-bp160.999999.1.1.ppc64le.rpm</filename>
        </package>
        <package name="matrix-synapse-debuginfo" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="ppc64le" src="ppc64le/matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.ppc64le.rpm">
          <filename>matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.ppc64le.rpm</filename>
        </package>
        <package name="matrix-synapse-debugsource" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="ppc64le" src="ppc64le/matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.ppc64le.rpm">
          <filename>matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.ppc64le.rpm</filename>
        </package>
        <package name="matrix-synapse" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="aarch64" src="aarch64/matrix-synapse-1.152.1-bp160.999999.1.1.aarch64.rpm">
          <filename>matrix-synapse-1.152.1-bp160.999999.1.1.aarch64.rpm</filename>
        </package>
        <package name="matrix-synapse-debuginfo" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="aarch64" src="aarch64/matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.aarch64.rpm">
          <filename>matrix-synapse-debuginfo-1.152.1-bp160.999999.1.1.aarch64.rpm</filename>
        </package>
        <package name="matrix-synapse-debugsource" epoch="0" version="1.152.1" release="bp160.999999.1.1" arch="aarch64" src="aarch64/matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.aarch64.rpm">
          <filename>matrix-synapse-debugsource-1.152.1-bp160.999999.1.1.aarch64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>