Update ghcr.io/element-hq/synapse Docker tag to v1.157.1

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/element-hq/synapse	minor	v1.152.0 → v1.157.1

---

Release Notes

element-hq/synapse (ghcr.io/element-hq/synapse)

v1.157.1

Compare Source

Synapse 1.157.1 (2026-07-22)

Bugfixes

• Fix config regression around falsy experimental_features no longer being accepted. (#​19987)

v1.157.0

Compare Source

Synapse 1.157.0 (2026-07-21)

No significant changes since 1.157.0rc1.

Synapse 1.157.0rc1 (2026-07-14)

Features

• MSC4140: Cancellable delayed events: Limit how many delayed events a user may have scheduled at once. (#​19539)
• Support MSC4446 for moving fully read markers backwards. Contributed by @​SpiritCroc @​ Beeper. (#​19663)
• Add before and after time filters to the 'Redact events of a user' Admin API. (#​19802)
• Updated experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#​19808)
• Add an exclude_rooms_from_presence configuration option to stop presence being routed between users solely because they share one of the listed rooms. (#​19935)

Bugfixes

• MSC4140: Cancellable delayed events: Update error responses to match their format in the current draft of the MSC. (#​19539)
• Lock Sliding Sync connections when inserting lazy members, to prevent repeated deadlocks. (#​19826)
• Fix the flag_existing_quarantined_media background update skipping some quarantined remote media. Introduced in v1.152.0. (#​19901)
• Fix a bug introduced in Synapse v1.150.0 where reactivating a deactivated and erased user did not restore their profile, breaking login, name changes, and invitations.
  Contributed by @​m4us1ne. (#​19902)
• Fix a regression where application services that opted into ephemeral events using the legacy de.sorunome.msc2409.push_ephemeral registration flag stopped receiving ephemeral events (including to-device messages used for encryption). Introduced in v1.156.0. (#​19928)
• Fix a bug causing device list pruning to skip some rows when the transaction gets retried. (#​19947)
• Fix presence states being shown to clients forever after presence is disabled, by marking any previously only users as offline. (#​19948)
• Fix SYNAPSE_ASYNC_IO_REACTOR=1 on Python 3.14. (#​19949)

Deprecations and Removals

• Remove support for experimental MSC3861 auth delegation, in favour of the stable Matrix Authentication Service integration support. See the upgrade notes. (#​19895)

Internal Changes

• Port the synchronous core of client event serialization to Rust. (#​19837, #​19922)
• Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool). (#​19871, #​19879)
• Allow Rust code to have database access via Python database connection pool. (#​19878)
• Add golangci-lint to CI. (#​19888)
• Remove wall-clock dependency of test_redact_messages_all_rooms test, as this caused flakiness. (#​19890)
• Change the MSC3814 dehydrated device /events endpoint from POST to GET. (#​19896)
• Change the MSC3814 dehydrated device /events endpoint paging to match spec conventions. (#​19897)
• Fix storage type mismatches where values were bound with a type that didn't match their database column. (#​19911)
• Speed up deletion of old sliding sync connections by adding an index. (#​19912)
• Add note to 3PID email token request unit tests that the endpoint being tested can have an expected, artificial delay of up to 1s. (#​19916)
• Add an index to sliding_sync_connection_lazy_members to speed up deleting old sliding sync connection positions. (#​19923)
• Fix test_lock_contention being flaky when running against PostgreSQL by budgeting CPU time rather than wall-clock time. (#​19929)
• Fix Complement test flake when restarting Synapse workers (cross-test pollution caused by nginx upstreams being temporarily unavailable). (#​19936)
• Add clean deploy FIXME note for TestOIDCProviderUnavailable (problem tracked by #​19937). (#​19938)
• Minor presence performance improvements for large servers. (#​19939)
• Reduce replication traffic caused by presence. (#​19941)
• Add last_active_granularity, sync_online_timeout and idle_timeout options to the presence config section to allow tuning the presence state machine timers. (#​19942)

v1.156.0

Compare Source

Synapse 1.156.0 (2026-07-07)

No significant changes since 1.156.0rc1.

Synapse 1.156.0rc1 (2026-06-30)

Features

• Expose MSC4354 Sticky Events over MSC4186 (Simplified) Sliding Sync. (#​19591)
• Stabilize support for sending ephemeral events to application services, as per MSC2409. Contributed by @​jason-famedly @​ Famedly. (#​19758)
• Include allowed_room_ids in the /summary client-server API response for rooms with restricted join rules, as required by Matrix 1.15.
  Contributed by @​FrenchGithubUser @​Famedly. (#​19762)
• MSC4140: Cancellable delayed events: Allow authentication on delayed event management endpoints (such as /restart) to bypass ratelimits for unauthenticated requests based on the client IP address. (#​19794)
• Add new metric synapse_non_deactivated_user_count which tracks the number of non-deactivated users in the database, split by app_service. (#​19848)
• The GET /_matrix/client/unstable/org.matrix.msc1763/retention/configuration endpoint is now provided when retention
  is enabled and experimental_features.msc1763_enabled is enabled, based on
  MSC1763. (#​19853)
• Add experimental support for MSC4491: Invite reasons in room creation. (#​19874)

Bugfixes

• Provide remote servers a way to find out about an event created during the remote join handshake. Contributed by @​FrenchGithubUser and @​jason-famedly @​ Famedly. (#​19390, #​19855, #​19856)
• Advertise org.matrix.msc4143 in unstable_features when msc4143_enabled is set. (#​19646)
• Fix a long-standing bug where the badge notification count for a room could become permanently inflated if a read receipt was sent before the room's notification counts were first summarised. (#​19785)
• Fix startup listener logging to report the actual bound TCP port, so listeners configured with port 0 no longer log Synapse now listening on TCP port 0. (#​19810)
• Fix notification counts being inflated after a /purge_history when notifications had already been rotated into the summary table. (#​19834)
• Fix /sync caching transient errors for the sync_response_cache_duration. (#​19845)
• Fix local events being deleted by the Purge History admin API despite delete_local_events being set to false, in room versions other than 1 and 2. (#​19850)
• Fix a bug where a user's dehydrated device (MSC3814) was deleted when their device list was synced from Matrix Authentication Service (e.g. upon logging out their last device), breaking offline key delivery. (#​19892)

Improved Documentation

• Update auto_join_rooms config documentation to cover requirements for auto-joining invite-only rooms. (#​19660)
• Add stable endpoint for MSC3266: Room summary API into worker docs. Contributed by @​olmari. (#​19788)
• Tweak wording of Rust crate dependency update policy. (#​19829)
• Fixed the Admin API user endpoint documentation examples to use JSON booleans (true/false) instead of numeric (0/1) values. (#​19847)

Internal Changes

• Make simple_select_one_onecol_txn() more helpful by naming the table of the select - as all other query wrapper functions already did. (#​19869)
• Refactor get_user_which_could_invite logic to reuse get_users_which_can_issue_invite. Contributed by Noah Markert. (#​19732)
• Fix a flaky test (twisted.protocols.amp.TooLong error under trial -jN) caused by an oversized debug log line. (#​19832)
• Upload Complement test logs as CI artifacts instead of printing the raw output to the build log. (#​19840)
• Fix release script considering any workflow completion as successful. (#​19843)
• Force keyword-args for clear default_config(server_name="test") usage in test utilities. (#​19849)
• Add .ruff_cache/ directory to .gitignore. (#​19854)
• Bump poetry in CI from 2.2.1 to 2.4.1. (#​19866, #​19877)
• Split out deferred and tokio_runtime to their own Rust modules. (#​19868)
• Prevent the cargo-test and cargo-bench CI jobs from being skipped, even on PRs that have Rust changes. (#​19883)

v1.155.0

Compare Source

Synapse 1.155.0 (2026-06-16)

End of Life of Debian 12 Bookworm

The next version of Synapse will not include Debian packages for Debian 12 Bookworm
as it reached end of life on the 10th of June 2026.

Internal Changes

• When building releases, don't cancel Debian package builds when one of them fails. (#​19842)

Synapse 1.155.0rc1 (2026-06-09)

Bugfixes

• Limit the to-device EDU size to a reasonable value to mitigate long queues of to-device messages preventing outgoing federation because of the size of the transaction. (#​19617)
• Work around bug that sometimes breaks joining restricted rooms that require a remote join. Contributed by @​tulir @​ Beeper. (#​19730)
• Update Sliding Sync to return a new response immediately if a room subscription has changed and produced a new response. (#​19734, #​19792)
• Fix the /capabilities endpoint returning a 500 error on non-media workers when MSC4452: Preview URL capabilities API is enabled. (#​19839)

Improved Documentation

• Document how to see Rust build failure output when using poetry install. (#​19818)
• Document that the SQLite version included in Ubuntu LTS, aside from ESM-only versions, is included in our support policy. (#​19823)

Internal Changes

• Port the Python Event classes to Rust. (#​19701, #​19816, #​19817, #​19819)
• Added tests to ensure that email notification links are sanitized. Contributed by Noah Markert. (#​19741)
• Add GcpJsonFormatter logging formatter for use with Google Cloud Logging and GKE deployments. (#​19775)
• Add more logging to the to-device message replication stream. (#​19801, #​19821)
• Port Requester class to Rust. (#​19828)

v1.154.0

Compare Source

Synapse 1.154.0 (2026-06-04)

No significant changes since 1.154.0rc1.

Synapse 1.154.0rc1 (2026-05-27)

Features

• Add support for MSC4452: Preview URL capabilities API which exposes a io.element.msc4452.preview_url capability.
  If experimental_features.msc4452_enabled is true, the /_matrix/(client/v1/media|media/v3)/preview_url endpoint
  now responds with a 403 status code when the capability is disabled. (#​19715)

Bugfixes

• Fix a bug in MSC4186: Simplified Sliding Sync that could prevent user avatars from showing if the room had an empty name. (#​19468, #​19791)
• Fix access token cache not being invalidated for sessions using refresh tokens. Contributed by @​FrenchGithubUser @​ Famedly. (#​19483)
• Fix bug where Synapse would return 400 (M_BAD_JSON) when sending a message with a mentions field and Synapse module check_event_allowed callback registered (frozen event). Contributed by @​gaetan-sbt. (#​19634)
• Fix long-standing but niche bug with /sync where it could attempt to fetch data with flawed invalid future tokens. (#​19644)
• Fix /sync failing when MSC4354 Sticky Events are enabled and the sync request filters out Ephemeral Data Units (EDUs). (#​19787)
• Fix packaging for Fedora and EPEL caused by unnecessary bumping attrs minimum version requirement in pyproject.toml file. Contributed by Oleg Girko. (#​19789)
• Fix merging signatures when a policy server is running under the same server name as Synapse. The bug was re-introduced in v1.153.0rc1 after being fixed earlier in v1.151.0rc1. Contributed by @​tulir @​ Beeper. (#​19797)

Improved Documentation

• Added details about how Synapse syncs the picture claim when update_profile_information setting is true. (#​19508)

Internal Changes

• Port Event.content field to Rust. (#​19725)
• Prefer close backfill points (absolute distance). (#​19748)
• Replace unique quarantined_media waiting patterns with standard wait_for_stream_token(...). (#​19764)
• Improve Synapse logging around when someone encounters We can't get valid state history. so you can correlate everything by event_id. (#​19765)
• Tidy up Rust RoomVersion structs. (#​19766)
• Update WorkerLock tests to better stress the WORKER_LOCK_MAX_RETRY_INTERVAL. (#​19772)
• Refactor MSC4242: State DAG checks behind a single TypeIs helper to avoid scattered isinstance casts. (#​19774)
• Use StrCollection for prev_state_events. (#​19777)
• Fix up the construction of events in tests, ahead of the Rust event port. (#​19781)

v1.153.0

Compare Source

Synapse 1.153.0 (2026-05-19)

No significant changes since 1.153.0rc3.

Synapse 1.153.0rc3 (2026-05-15)

Bugfixes

• Revert 'Have MSC4186: Simplified Sliding Sync return a new response immediately if a room subscription has changed and produced a new response. (#​19714)' (introduced in 1.153.0rc1) due to performance problems. (#​19784)

Synapse 1.153.0rc2 (2026-05-13)

Bugfixes

• Correctly handle arbitrary precision integers in unsigned field of events. The bug was introduced in 1.153.0rc1. (#​19769)

Synapse 1.153.0rc1 (2026-05-08)

Features

• Make ACLs apply to EDUs per MSC4163. (#​18475)
• Stabilize MSC3266: Room summary API, removing the experimental config flag msc3266_enabled. Contributed by @​dasha-uwu. (#​19720)
• Partial MSC4311 implementation: m.room.create is now a required part of stripped invite_state/knock_state . Contributed by @​FrenchGithubUser @​Famedly. (#​19722)
• Expose tombstoned and replacement_room in room details on admin API endpoint GET /_synapse/admin/v1/rooms/<room_id>. Contributed by Noah Markert. (#​19737)

Bugfixes

• Allow self-requested user erasure (upon account deactivation) to succeed even if Synapse has disabled profile changes. Contributed by Famedly. (#​19398)
• Fix Synapse not backfilling new history when attempting to use a pagination token near a backward extremity. (#​19611)
• Have MSC4186: Simplified Sliding Sync return a new response immediately if a room subscription has changed and produced a new response. (#​19714)
• Fix a bug where when upgrading a room to room version 12, the power level event in the old room got temporarily mutated to remove the user upgrading the room's power. (#​19727)
• Fix packaging for Fedora and EPEL caused by unnecessary bumping authlib minimum version requirement in pyproject.toml file. Contributed by Oleg Girko. (#​19742)

Improved Documentation

• Add warning about known problems when configuring use_frozen_dicts. (#​19711)

Internal Changes

• Port Event.signatures field to Rust. (#​19706)
• Port Event.unsigned field to Rust. (#​19708)
• Add a Rust canonical JSON serializer. (#​19739, #​19763)
• Configure Dependabot to only update Python dependencies in the lockfile, unless widening upper bounds. (#​19743)
• Reduce WORKER_LOCK_MAX_RETRY_INTERVAL to 5 seconds to reduce idle time after lock is released. (#​19755)
• Force keyword-only arguments for Duration so time units have to be specified. (#​19756)

v1.152.1

Compare Source

Synapse 1.152.1 (2026-05-07)

Security Fixes

• Prevent CPU starvation (Denial of Service) under worker lock contention, additionally capping the WorkerLock time out interval to a maximum of 60 seconds. Contributed by Famedly. (#​19394, ELEMENTSEC-2026-1706, GHSA-8q93-326v-3m7g, CVE-2026-45078)
• Prevent pagination ending when a page is full of rejected events. (ELEMENTSEC-2025-1636, GHSA-6qf2-7x63-mm6v, CVE-2026-45076)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.