Update ghcr.io/element-hq/synapse Docker tag to v1.121.1 #11
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/ghcr.io-element-hq-synapse-1.x
branch
from
6c3e20e to
1da10fb
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/ghcr.io-element-hq-synapse-1.x
branch
from
1da10fb to
654a974
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/ghcr.io-element-hq-synapse-1.x
branch
from
654a974 to
785b307
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/ghcr.io-element-hq-synapse-1.x
branch
from
785b307 to
aadc932
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/ghcr.io-element-hq-synapse-1.x
branch
from
aadc932 to
c928d76
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/ghcr.io-element-hq-synapse-1.x
branch
from
729cb9b to
82970b3
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.115.0->v1.121.1Release Notes
element-hq/synapse (ghcr.io/element-hq/synapse)
v1.121.1Compare Source
Synapse 1.121.1 (2024-12-11)
This release contains a fix for our docker build CI. It is functionally identical to 1.121.0, whose changelog is below.
Internal Changes
Synapse 1.121.0 (2024-12-11)
Internal Changes
Synapse 1.121.0rc1 (2024-12-04)
Features
$LAZY-loading room members. (#17947)M_USER_LOCKEDerror code for locked accounts, as per Matrix 1.12. (#17965)disable_badge_countto pusher configuration. (#17975)Bugfixes
Improved Documentation
Internal Changes
Content-Typeheader on thePUTresponse to work around a faulty behavior in some caching reverse proxies. (#17253)/_matrix/client/v3/login/sso/redirect(/{idpId}). (#17972)public_baseurl. (#17986)Updates to locked dependencies
v1.120.2Compare Source
Synapse 1.120.2 (2024-12-03)
This version has building of wheels for macOS disabled.
It is functionally identical to 1.120.1, which contains multiple security fixes.
If you are already using 1.120.1, there is no need to upgrade to this version.
Synapse 1.120.1 (2024-12-03)
This patch release fixes multiple security vulnerabilities, some affecting all prior versions of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild.
Administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below.
Security advisory
The following issues are fixed in 1.120.1.
GHSA-rfq8-j7rh-8hf2 / CVE-2024-52805 (high): Unsupported content types can lead to memory exhaustion
Synapse instances which have a high
max_upload_sizeand which don't have a reverse proxy in front of them that would otherwise limit upload size are affected.Fixed by 4b7154c58501b4bf5e1c2d6c11ebef96529f2fdf.
GHSA-f3r3-h2mq-hx2h / CVE-2024-52815 (high): Malicious invites via federation can break a user's sync
Fixed by d82e1ed357b7ee21dff83d06cba7a67840cfd464.
GHSA-vp6v-whfm-rv3g / CVE-2024-53863 (high): Synapse can be forced to thumbnail unexpected file formats, invoking potentially untrustworthy decoders
Synapse instances can disable dynamic thumbnailing by setting
dynamic_thumbnailstofalsein the configuration file.Fixed by b64a4e5fbbbf119b6c65aedf0d999b4237d55503.
GHSA-56w4-5538-8v8h / CVE-2024-53867 (moderate): The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room
Non-state events, like messages, are unaffected.
Synapse instances can disable the Sliding Sync feature by setting
experimental_features.msc3575_enabledtofalsein the configuration file.Fixed by 4daa533e82f345ce87b9495d31781af570ba3ead.
Additionally, we disclose the following vulnerabilities, both have been fixed in Synapse 1.106.0:
GHSA-4mhg-xv73-xq2x / CVE-2024-37302 (high): Denial of service through media disk space consumption
GHSA-gjgr-7834-rhxr / CVE-2024-37303 (moderate): Unauthenticated writes to the media repository allow planting of problematic content
See the advisories for more details. If you have any questions, email security at element.io.
Bug fixes
v1.120.1Compare Source
v1.120.0Compare Source
Synapse 1.120.0 (2024-11-26)
This release enables the enforcement of authenticated media by default, with exemptions for media that is already present in the
homeserver's media store.
Most homeservers operating in the public federation will not be impacted by this change, given that
the large homeserver
matrix.orgenabled this in September 2024 and therefore most clients and serverswill already have updated as a result.
Some server administrators may still wish to disable this enforcement for the time being, in the interest of compatibility with older clients
and older federated homeservers.
See the upgrade notes for more information.
Bugfixes
delete_old_otksjob to fail in worker-mode deployments. (#17960)Synapse 1.120.0rc1 (2024-11-20)
Features
enable_authenticated_mediatofalse. In a future release of Synapse, this option will be removed and become always-on. (#17889)Improved Documentation
enable_authenticated_mediaconfiguration option. (#17913)Deprecations and Removals
Internal Changes
python-multipart0.0.13 so that distro packagers do not need to work around name conflict with PyPI packagemultipart. (#17932)Updates to locked dependencies
v1.119.0Compare Source
Synapse 1.119.0 (2024-11-13)
No significant changes since 1.119.0rc2.
Python 3.8 support dropped
Python 3.8 is end-of-life and is no longer supported by Synapse. The minimum supported Python version is now 3.9.
If you are running Synapse with Python 3.8, please upgrade to Python 3.9 (or greater) before upgrading Synapse.
Synapse 1.119.0rc2 (2024-11-11)
Note that due to packaging issues there was no v1.119.0rc1.
Features
state_afterto sync v2). (#17888)Bugfixes
$LAZY-loading room members would not returnrequired_statemembership in incremental syncs. (#17809)the config option
run_background_tasks_on. (#17847)state_afterto sync v2) where we would return the full state on incremental syncs when using lazy loaded members and there were no new events in the timeline. (#17915)Internal Changes
Generatorusage. (#17813, #17814, #17815, #17816, #17817, #17818, #17890)current_state_delta_streamtable. (#17912)Updates to locked dependencies
v1.118.0Compare Source
Synapse 1.118.0 (2024-10-29)
No significant changes since 1.118.0rc1.
Python 3.8 support will be dropped in the next release
Python 3.8 is now end-of-life. As per our Deprecation Policy for Platform Dependencies, Synapse will be dropping support for Python 3.8 in the next release; Synapse 1.119.0.
Synapse 1.118.x will be the final release to support Python 3.8. If you are running Synapse with Python 3.8, please upgrade before the 1.119.0 release, due in less than one month.
Python 3.13 and PostgreSQL 17 support
On the other end of the spectrum, Synapse 1.118.0 is the first release to support Python 3.13! PostgreSQL 17 is also supported as of this release.
Synapse 1.118.0rc1 (2024-10-22)
Features
display_name_claimoption to the JWT configuration. This option allows specifying the claim key that contains the user's display name in the JWT payload. (#17708)Bugfixes
required_stateconfig. (#17785, #17805)Improved Documentation
user_may_inviteanduser_may_send_3pid_invitemodule callbacks are called. (#17627)--config-pathargument instead of--config-file. (#17802)target_cache_memory_usagedocs. (#17825)Internal Changes
.org.matrix.msc4028.encrypted_eventpush rule by default in accordance with MSC4028. Note that the corresponding experimental feature must still be switched on for this push rule to have any effect. (#17826)Updates to locked dependencies
v1.117.0Compare Source
Synapse 1.117.0 (2024-10-15)
No significant changes since 1.117.0rc1.
Synapse 1.117.0rc1 (2024-10-08)
Features
redis.password_path. (#17717)Bugfixes
GET /_matrix/client/versions, set theunstable_featuresflag for MSC4140 tofalsewhen server configuration disables support for delayed events. (#17780)Improved Documentation
test_forget_when_not_left. (#17628)federation_sender_instances. (#17776)Internal Changes
Updates to locked dependencies
v1.116.0Compare Source
Synapse 1.116.0 (2024-10-01)
No significant changes since 1.116.0rc2.
Synapse 1.116.0rc2 (2024-09-26)
Features
Synapse 1.116.0rc1 (2024-09-25)
Features
and an endpoint to check on the status of that redaction task. (#17506)
tagsandnot_tagsfilters for MSC4186 Sliding Sync. (#17662)turn_shared_secret_path. (#17690)Bugfixes
Internal Changes
_pydantic_compatmodule.This allows
check_pydantic_models.pyto mock those pydantic objectsonly in the synapse module, and not interfere with pydantic objects in
external dependencies. (#17667)
event_stream_orderingof rooms. (#17693)bump_stamps more efficiently in MSC4186 Sliding Sync. (#17723)_bulk_get_max_event_posbeing inefficient. (#17728)get_tags_for_room(...). (#17730)cgimodule, deprecated in Python 3.11 and removed in Python 3.13. (#17741)Unknownanymore after updatingtreq. (#17744)Updates to locked dependencies
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.