chore(deps): update ghcr.io/element-hq/synapse docker tag to v1.140.0 #715
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jessebot
approved these changes
Oct 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.132.0->v1.140.0Release Notes
element-hq/synapse (ghcr.io/element-hq/synapse)
v1.140.0Compare Source
Synapse 1.140.0 (2025-10-14)
Compatibility notice for users of
synapse-s3-storage-providerDeployments that make use of the synapse-s3-storage-provider module must upgrade to v1.6.0.
Using older versions of the module with this release of Synapse will prevent users from being able to upload or download media.
No significant changes since 1.140.0rc1.
Synapse 1.140.0rc1 (2025-10-10)
Features
the
origin/media_ididentifier found in a Matrix Content URI. (#18911)GET /_matrix/client/v1/rtc/transportsendpoint for the latest draft of MSC4143: MatrixRTC. (#18967)defer_to_threadpoolfunction in the Synapse Module API that allows modules to run a function on a separate thread in a custom threadpool. (#19032)Bugfixes
room_configargument and documentation foruser_may_create_roomspam-checker callback. (#18721)user_ips_max_age. (#18948)Improved Documentation
Deferredcallbacks interact with logcontexts. (#18914)rc_room_creationandrc_reportsto clarify that aper_userrate limit is not supported. (#18998)Deprecations and Removals
LoggingContext.set_current_context/LoggingContext.current_contextmethods which already have equivalent bare methods insynapse.logging.context. (#18989)Internal Changes
SynapseHomeServerobject, allowing artifacts of embedded small hosts to be properly garbage collected. (#18828)server_namein logging context for multiple Synapse instances in one process. (#18868)make_deferred_yieldableso it follows Synapse logcontext rules. (#18903)_get_e2e_cross_signing_signatures_for_devicesby increasing the batch size of devices the query is called with, reducing DB load. (#18939)no active span when trying to logtracing error on startup (when OpenTracing is enabled). (#18959)run_coroutine_in_background(...)incorrectly handling logcontext. (#18964)timeout_deferredtests. (#18974)ReplicationUploadKeysForUserRestServletas a follow-up to the work in https://github.com/element-hq/synapse/pull/18581 that moved device changes off the main process. (#18988)MockClock()in tests. (#18992)LogContextScopeManagerinstead of OpenTracing'sContextVarsScopeManagerwhich was causing problems when using the experimentalSYNAPSE_ASYNC_IO_REACTORoption with tracing enabled. (#19007)version_stringargument fromHomeServersince it's always the same. (#19012)hs.start_background_tasks()introduced from a bad merge. (#19013)create_homeserver) and setup (setup). (#19015)macos-13GitHub Actions runner for themacos-15-intelvariant. (#19025)RootConfig.validate_config()which can be subclassed inHomeServerConfigto do cross-config class validation. (#19027)release.pyscript to accept a--gh-tokenargument. (#19035)Updates to locked dependencies
v1.139.2Compare Source
Synapse 1.139.2 (2025-10-07)
Bugfixes
device_keys: nullin the request toPOST /_matrix/client/v3/keys/upload. (#19023)v1.139.1Compare Source
Synapse 1.139.1 (2025-10-07)
Security Fixes
Deprecations and Removals
v1.139.0Compare Source
Synapse 1.139.0 (2025-09-30)
/registerrequests from old application service implementations may break when using MASIf you are using Matrix Authentication Service (MAS), as of this release any Application Services that do not set
inhibit_login=truewhen callingPOST /_matrix/client/v3/registerwill receive the errorIO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTEDin response.Please see the upgrade notes for more information.
No significant changes since 1.139.0rc3.
Synapse 1.139.0rc3 (2025-09-25)
Bugfixes
run_coroutine_in_background(...)incorrectly handled logcontexts, resulting in partially broken logging. (#18964)Synapse 1.139.0rc2 (2025-09-23)
Internal Changes
Synapse 1.139.0rc1 (2025-09-23)
Features
get_media_upload_limits_for_userandon_media_upload_limit_exceededmodule API callbacks to the media repository. (#18848)/sendendpoint. Contributed by @SpiritCroc @ Beeper. (#18898)_get_e2e_cross_signing_signatures_for_devicesto reduce DB load. (#18899)Bugfixes
/sendpass canonical JSON checks. (#18641)idpquery parameter. (#18909)Updates to the Docker image
SYNAPSE_LOG_TESTINGis set. (#18878)Improved Documentation
jwt_configparameter in OIDC documentation for authentik. Contributed by @maxkratz. (#18931)Deprecations and Removals
/sync/e2eeendpoint. (#18583)Internal Changes
LaterGaugemetrics to collect from all servers. (#18791)sentinellogcontext usage where we log insetup,startandexit. (#18870)Enum's value for the dictionary key when responding to an admin request for experimental features. (#18874)run_in_background(...)andrun_as_background_process(...). (#18900, #18906)sentinellogcontext usage inClockutilities likelooping_callandcall_later. (#18907)pkg_resourcesinterface in preparation of setuptools dropping it soon. (#18910)setup. (#18933)run_in_backgroundnot being awaited properly in some tests causingLoggingContextproblems. (#18937)run_as_background_processnot being awaited properly causingLoggingContextproblems in experimental MSC4140: Delayed events implementation. (#18938)Clock.call_when_running(...)to wrap startup code in a logcontext, ensuring we can identify which server generated the logs. (#18944)Clock.add_system_event_trigger(...)to wrap system event callback code in a logcontext, ensuring we can identify which server generated the logs. (#18945)Updates to locked dependencies
v1.138.4Compare Source
Synapse 1.138.4 (2025-10-07)
Bugfixes
device_keys: nullin the request toPOST /_matrix/client/v3/keys/upload. (#19023)v1.138.3Compare Source
Synapse 1.138.3 (2025-10-07)
Security Fixes
Deprecations and Removals
v1.138.2Compare Source
Synapse 1.138.2 (2025-09-24)
Internal Changes
Synapse 1.138.1 (2025-09-24)
Bugfixes
v1.138.1Compare Source
v1.138.0Compare Source
Synapse 1.138.0 (2025-09-09)
No significant changes since 1.138.0rc1.
Synapse 1.138.0rc1 (2025-09-02)
Features
Bugfixes
Improved Documentation
Internal Changes
_ByteProducerwith tracing to measure potential dead time while writing bytes to the request. (#18804)ContextVarsScopeManagerinstead of our own customLogContextScopeManager. (#18849)Producerto write bytes to the request. (#18855)EventPersistencePairtype. (#18857)Updates to locked dependencies
c0c5949to4515659. (#18863)b3b07batoe97e2d8. (#18862)v1.137.0Compare Source
Synapse 1.137.0 (2025-08-26)
No significant changes since 1.137.0rc1.
Synapse 1.137.0rc1 (2025-08-19)
Bugfixes
register_new_matrix_userutility script for emptyregistration_shared_secret. (#18780)Improved Documentation
denied-peer-ipsof coturn setup. Contributed by @litetex. (#18781)Internal Changes
encode_responsepart of Sliding Sync requests for more complete traces in Jaeger. (#18815)wait_for_events. (#18816)portdbCI by hardcoding the newpg_dumprestrict key that was added due to CVE-2025-8714. (#18824)Updates to locked dependencies
5b1a254to0c37450. (#18557)v1.136.0Compare Source
Synapse 1.136.0 (2025-08-12)
Note: This release includes the security fixes from
1.135.2and1.136.0rc2, detailed below.Please also check the relevant section in the upgrade notes for the changes to MAS support, metrics labels and the module API which may require your attention when upgrading.
Bugfixes
Synapse 1.136.0rc2 (2025-08-11)
This is the Synapse portion of the Matrix coordinated security release. This release includes support for room version 12 which fixes a number of security vulnerabilities, including CVE-2025-49090.
The default room version is not changed. Not all clients will support room version 12 immediately, and not all users will be using the latest version of their clients. Large, public rooms are advised to wait a few weeks before upgrading to room version 12 to allow users throughout the Matrix ecosystem to update their clients.
Note: release 1.135.1 was skipped due to issues discovered during the release process.
Two patched Synapse releases are now available:
1.135.2: stable release comprised of1.135.0+ security patches1.136.0rc2: unstable release candidate comprised of1.136.0rc1+ security patches.Bugfixes
Internal Changes
upgrade_rooms(..)to allow auto join local users. (#83)Synapse 1.136.0rc1 (2025-08-05)
Features
unsigned. (#18585)http_proxy,https_proxy,no_proxy_hosts. (#18686)/_matrix/clients/versionsif enabled. (#18722)Bugfixes
Improved Documentation
receiptsstream. (#18760)Deprecations and Removals
run_as_background_processexported as part of the module API interface in favor ofModuleApi.run_as_background_process. See the relevant section in the upgrade notes for more information. (#18737)Internal Changes
Counter,LaterGauge,GaugeBucketCollector,Histogram, andGaugemetrics to be homeserver-scoped. (#18656, #18714, #18715, #18724, #18753, #18725, #18670, #18748, #18751)twisted.internet.testingmodule in tests instead of deprecatedtwisted.test.proto_helpers. (#18728)/send_eventreplication endpoint. (#18730)twisted.protocols.amp.TooLongerror by reducing logging in some tests. (#18736)Clock.sleep(...)return a coroutine, so that mypy can catch places where we don't await on it. (#18772)Updates to locked dependencies
v1.135.2Compare Source
Synapse 1.135.2 (2025-08-11)
This is the Synapse portion of the Matrix coordinated security release. This release includes support for room version 12 which fixes a number of security vulnerabilities, including CVE-2025-49090.
The default room version is not changed. Not all clients will support room version 12 immediately, and not all users will be using the latest version of their clients. Large, public rooms are advised to wait a few weeks before upgrading to room version 12 to allow users throughout the Matrix ecosystem to update their clients.
Note: release 1.135.1 was skipped due to issues discovered during the release process.
Two patched Synapse releases are now available:
1.135.2: stable release comprised of1.135.0+ security patches1.136.0rc2: unstable release candidate comprised of1.136.0rc1+ security patches.Bugfixes
Internal Changes
upgrade_rooms(..)to allow auto join local users. (#82)v1.135.1Compare Source
v1.135.0Compare Source
Synapse 1.135.0 (2025-08-01)
No significant changes since 1.135.0rc2.
Synapse 1.135.0rc2 (2025-07-30)
Bugfixes
/_synapse/masis handled by a worker. (#18716)Internal Changes
is_server_admin. (#18747)Synapse 1.135.0rc1 (2025-07-22)
Features
recaptcha_private_key_pathandrecaptcha_public_key_pathconfig option. (#17984, #18684)event_idwhen getting state with?format=event. Contributed by @tulir @ Beeper. (#18675)Bugfixes
sliding_sync_connections-related errors when porting from SQLite to Postgres. (#18677)--daemonizeor usingsynctl. (#18691)Improved Documentation
rc_delayed_event_mgmtdocs to the actual nesting level. Contributed by @HarHarLinks. (#18692)Internal Changes
Measureblock metrics to be homeserver-scoped. (#18601)--without devpoetry option instead of removed--no-dev. (#18617)lxml6.0.0+. (#18622)markdown-it-pyinstead ofcommonmarkin the release script. (#18637)stream_positionstable. (#18672)allow_no_prev_eventsoption when creating an event. (#18676)MetricsResourceand Prometheus hacks. (#18687)Cargo.lockchanges appearing after install (base64). (#18689)Cargo.lockchanges from install. (#18693)Updates to locked dependencies
v1.134.0Compare Source
Synapse 1.134.0 (2025-07-15)
No significant changes since 1.134.0rc1.
Synapse 1.134.0rc1 (2025-07-09)
Features
viaquery param for hierarchy endpoint. Contributed by Krishan (@kfiven). (#18070)forget_forced_upon_leavecapability as per MSC4267. (#18196)federated_user_may_invitespam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. (#18241)Bugfixes
KeyErroron background updates when using split main/state databases. (#18509)avatar_urlanddisplaynamebeing sent on federation profile queries when they are not set. (#18593)M_USER_LOCKEDwhen a locked user callsPOST /login, as per the spec. (#18594)Improved Documentation
Deprecations and Removals
Internal Changes
PyICUcrate with equivalenticu_segmenterRust crate. (#18553, #18646)simple_upsert_many. (#18573)dtolnay/rust-toolchainGitHub Action tob3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596).zed/directory to.gitignore. (#18623)Updates to locked dependencies
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.