chore(deps): update dependency cargo-bins/cargo-binstall to v1.20.1

chore(deps): update actions/checkout action to v7
chore(deps): update rust crate itertools to 0.15.0
2026-07-07 14:21:40 +00:00 · 2026-06-23 13:38:23 +00:00 · 2026-06-23 13:20:40 +00:00 · 2026-06-23 13:20:22 +00:00 · 2026-06-23 13:20:10 +00:00 · 2026-06-23 05:01:57 +00:00
41 changed files with 530 additions and 473 deletions
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
+      uses: https://github.com/taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -10,7 +10,7 @@ on:
      - "v*.*.*"
  workflow_dispatch:
  schedule:
-    - cron: '30 0 * * *'
+    - cron: '30 0 * * 1'

 jobs:
  build:
@@ -41,20 +41,9 @@ jobs:
      #    else
      #      echo "No workaround needed for llvm-project#153385"
      #    fi
-      - name: Pick compatible clang version
-        id: clang-version
-        run: |
-          # both latest need to use clang-23, but oldstable and previous can just use clang
-          if [[ "${{ matrix.container }}" == "ubuntu-latest" ]]; then
-            echo "Using clang-23 package for ${{ matrix.container }}"
-            echo "version=clang-23" >> $GITHUB_OUTPUT
-          else
-            echo "Using default clang package for ${{ matrix.container }}"
-            echo "version=clang" >> $GITHUB_OUTPUT
-          fi

      - name: Checkout repository with full history
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
@@ -93,10 +82,10 @@ jobs:
          # VERSION is the package version, COMPONENT is used in
          # apt's repository config like a git repo branch
          VERSION=$BASE_VERSION
-          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]\.+[0-9]\.+[0-9]$ ]]; then
+          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+$ ]]; then
            # Use the "stable" component for tagged semver releases
            COMPONENT="stable"
-          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]\.+[0-9]\.+[0-9] ]]; then
+          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+ ]]; then
            # Use the "unstable" component for tagged semver pre-releases
            COMPONENT="unstable"
          else
@@ -130,7 +119,7 @@ jobs:
        run: |
          apt-get update -y
          # Build dependencies for rocksdb
-          apt-get install -y liburing-dev ${{ steps.clang-version.outputs.version }}
+          apt-get install -y liburing-dev clang

      - name: Run cargo-deb
        id: cargo-deb
@@ -16,7 +16,7 @@ on:
    #   - '.forgejo/workflows/build-fedora.yml'
  workflow_dispatch:
  schedule:
-    - cron: '30 0 * * *'
+    - cron: '30 0 * * 2'

 jobs:
  build:
@@ -30,7 +30,7 @@ jobs:
          echo "Fedora version: $VERSION"

      - name: Checkout repository with full history
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
@@ -0,0 +1,71 @@
+name: Build / Static via Nix
+
+concurrency:
+  group: "build-nix-${{ forge.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+  schedule:
+    - cron: '30 0 * * 3'
+
+jobs:
+  build:
+    name: "Build ${{ matrix.filename }} Binary"
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        include:
+          - package: default-static-x86_64
+            filename: conduwuit-linux-static-amd64
+          - package: default-static-aarch64
+            filename: conduwuit-linux-static-arm64
+
+          - package: max-perf-static-aarch64
+            filename: conduwuit-linux-static-arm64-maxperf
+          - package: max-perf-haswell-static-x86_64
+            filename: conduwuit-haswell-linux-static-amd64-maxperf
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      - name: Install Lix
+        uses: https://github.com/samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d
+        with:
+          extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
+
+      - name: Build static binary
+        run: |
+          nix build .#${{ matrix.package }}
+          install -D result/bin/conduwuit /tmp/binaries/${{ matrix.filename }}
+
+      - name: Upload binary artifact
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: ${{ matrix.filename }}
+          path: /tmp/binaries/${{ matrix.filename }}
+
+  release-binaries:
+    name: "Release Binaries"
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    permissions:
+      contents: write
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Download binary artifacts
+        uses: forgejo/download-artifact@v4
+        with:
+          pattern: conduwuit*
+          path: binaries
+          merge-multiple: true
+      - name: Create Release and Upload
+        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        with:
+          draft: true
+          files: binaries/*
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Sync repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -41,7 +41,7 @@ jobs:
      DOCKER_MIRROR_TOKEN: ${{ secrets.DOCKER_MIRROR_TOKEN }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

@@ -55,7 +55,7 @@ jobs:
      #     repositories: continuwuity

      - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@14f9d37db17b5dc41fefd1ffdd1af4b9e2490560 # main
+        uses: https://github.com/regclient/actions/regsync-installer@4b4db1dcc7dad75ad67a788a380f75a20cc8a040 # main

      - name: Check what images need mirroring
        run: |
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

@@ -48,7 +48,7 @@ jobs:
      rust: ${{ steps.filter.outputs.rust }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

@@ -70,7 +70,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

@@ -46,7 +46,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
      - name: Prepare Docker build environment
@@ -100,7 +100,7 @@ jobs:
    needs: build-release
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
      - name: Create multi-platform manifest
@@ -133,7 +133,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
      - name: Prepare max-perf Docker build environment
@@ -187,7 +187,7 @@ jobs:
    needs: build-maxperf
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
      - name: Create max-perf manifest
@@ -216,7 +216,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
+        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          draft: true
          files: binaries/*
@@ -43,11 +43,11 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.222.1@sha256:b9af3f59f3f4d92b2c41e9f4ca3ffe92400503f20158d0bd67d07a3fdbe781d2
+      image: ghcr.io/renovatebot/renovate:43.234.0@sha256:bff111bfe347c559c615b658b28721eba5b7bb32a7b7901ea321336767209fe1
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          show-progress: false

@@ -14,7 +14,7 @@ jobs:
  update-flake-hashes:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: true
          token: ${{ secrets.FORGEJO_TOKEN }}
@@ -27,7 +27,7 @@ jobs:
      - name: Get new toolchain hash
        run: |
          # Set the current sha256 to an empty hash to make `nix build` calculate a new one
-          awk '/fromToolchainFile *\{/{found=1; print; next} found && /sha256 =/{sub(/sha256 = .*/, "sha256 = lib.fakeSha256;"); found=0} 1' nix/rust.nix > temp.nix
+          awk '/fromToolchainName *\{/{found=1; print; next} found && /sha256 =/{sub(/sha256 = .*/, "sha256 = lib.fakeSha256;"); found=0} 1' nix/rust.nix > temp.nix
          mv temp.nix nix/rust.nix

          # Build continuwuity and filter for the new hash
@@ -39,7 +39,7 @@ jobs:
          sed -i "s|lib.fakeSha256|\"$new_hash\"|" nix/rust.nix

          echo "New hash:"
-          awk -F'"' '/fromToolchainFile/{found=1; next} found && /sha256 =/{print $2; found=0}' nix/rust.nix
+          awk -F'"' '/fromToolchainName/{found=1; next} found && /sha256 =/{print $2; found=0}' nix/rust.nix
          echo "Expected new hash:"
          cat new_toolchain_hash.txt

@@ -560,9 +560,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"

 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"

 [[package]]
 name = "bytesize"
@@ -805,7 +805,7 @@ dependencies = [

 [[package]]
 name = "conduwuit"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "aws-lc-rs",
 "clap",
@@ -843,7 +843,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_admin"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "assign",
 "clap",
@@ -868,7 +868,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_api"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "assign",
 "async-trait",
@@ -889,7 +889,7 @@ dependencies = [
 "http-body-util",
 "hyper",
 "ipaddress",
- "itertools 0.14.0",
+ "itertools 0.15.0",
 "lettre",
 "log",
 "rand 0.10.1",
@@ -906,7 +906,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_build_metadata"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "built",
 "cargo_metadata",
@@ -914,7 +914,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_core"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "argon2",
 "arrayvec",
@@ -942,7 +942,7 @@ dependencies = [
 "http-body-util",
 "hyper-util",
 "ipaddress",
- "itertools 0.14.0",
+ "itertools 0.15.0",
 "lettre",
 "libc",
 "libloading 0.9.0",
@@ -980,7 +980,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_database"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "async-channel",
 "conduwuit_core",
@@ -1001,10 +1001,10 @@ dependencies = [

 [[package]]
 name = "conduwuit_macros"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "cargo_toml",
- "itertools 0.14.0",
+ "itertools 0.15.0",
 "proc-macro2",
 "quote",
 "syn",
@@ -1012,7 +1012,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_router"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "assign",
 "axum",
@@ -1044,13 +1044,13 @@ dependencies = [
 "serde_json",
 "tokio",
 "tower",
- "tower-http",
+ "tower-http 0.7.0",
 "tracing",
 ]

 [[package]]
 name = "conduwuit_service"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "askama",
 "assign",
@@ -1070,7 +1070,7 @@ dependencies = [
 "http",
 "image",
 "ipaddress",
- "itertools 0.14.0",
+ "itertools 0.15.0",
 "lettre",
 "log",
 "loole",
@@ -1099,7 +1099,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_web"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "askama",
 "assign",
@@ -1116,7 +1116,7 @@ dependencies = [
 "ruma",
 "serde",
 "thiserror",
- "tower-http",
+ "tower-http 0.7.0",
 "tower-sec-fetch",
 "tracing",
 "validator",
@@ -2036,9 +2036,9 @@ dependencies = [

 [[package]]
 name = "granit-parser"
-version = "0.0.2"
+version = "0.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e736dfe3881c53a7dce0685eb18202d0d9fe6911782f9870946eb9ee89d778"
+checksum = "f50ba32164f9e098d5da618776a32afbb32270adcbe3d3d006107dae11e37c91"
 dependencies = [
 "arraydeque",
 "smallvec",
@@ -2641,6 +2641,15 @@ dependencies = [
 "either",
 ]

+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -3945,9 +3954,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
 "proc-macro2",
 ]
@@ -4112,7 +4121,7 @@ dependencies = [
 "tokio",
 "tokio-rustls",
 "tower",
- "tower-http",
+ "tower-http 0.6.11",
 "tower-service",
 "url",
 "wasm-bindgen",
@@ -4157,7 +4166,7 @@ dependencies = [
 "tokio-rustls",
 "tokio-util",
 "tower",
- "tower-http",
+ "tower-http 0.6.11",
 "tower-service",
 "url",
 "wasm-bindgen",
@@ -4386,7 +4395,7 @@ dependencies = [

 [[package]]
 name = "ruminuwuity"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "assign",
 "ruma",
@@ -4779,9 +4788,9 @@ dependencies = [

 [[package]]
 name = "serde-saphyr"
-version = "0.0.26"
+version = "0.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcc7fe48e34d02a97bc8e6253b8b91e5a47fe2c47eaacb5149cefbb69922eaf0"
+checksum = "5897b4c3faadadd35fdb6689f015641f3bc481d5adaaac56231ea15aeb243db3"
 dependencies = [
 "ahash",
 "annotate-snippets",
@@ -5144,9 +5153,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -5627,10 +5636,33 @@ dependencies = [
 "tower",
 "tower-layer",
 "tower-service",
- "tracing",
 "url",
 ]

+[[package]]
+name = "tower-http"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233"
+dependencies = [
+ "async-compression",
+ "bitflags",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -6481,7 +6513,7 @@ dependencies = [

 [[package]]
 name = "xtask"
-version = "0.5.9"
+version = "26.6.0-alpha.1"
 dependencies = [
 "askama",
 "cargo_metadata",
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "0.5.9"
+version = "26.6.0-alpha.1"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -124,7 +124,7 @@ default-features = false
 features = ["util"]

 [workspace.dependencies.tower-http]
-version = "0.6.8"
+version = "0.7.0"
 default-features = false
 features = [
    "add-extension",
@@ -164,7 +164,7 @@ features = ["raw_value"]

 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.26"
+version = "0.0.27"

 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -316,7 +316,7 @@ default-features = false

 # Used to make working with iterators easier, was already a transitive depdendency
 [workspace.dependencies.itertools]
-version = "0.14.0"
+version = "0.15.0"

 # to parse user-friendly time durations in admin commands
 #TODO: overlaps chrono?
@@ -0,0 +1 @@
+Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
@@ -0,0 +1 @@
+Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical).
@@ -0,0 +1 @@
+Adjusted legacy sync logic to no longer use the `roomsynctoken_shortstatehash` database column. Once this change has been confirmed to be stable and reliable, a future update will remove it entirely, significantly decreasing database sizes. Contributed by @ginger.
@@ -50,7 +50,7 @@ EOF

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.0
+ENV BINSTALL_VERSION=1.20.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -18,7 +18,7 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.0
+ENV BINSTALL_VERSION=1.20.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -47,9 +47,15 @@ #### Performance-optimised builds

 ### Nix

-Theres a Nix package defined in our flake, available for Linux and MacOS. Add continuwuity as an input to your flake, and use `inputs.continuwuity.packages.${system}.default` to get a working Continuwuity package.
+If you wish to generate a static binary, you can do so using Nix: `nix build git+https://forgejo.ellis.link/continuwuation/continuwuity#packageName`, where `packageName` is one of:

-If you simply wish to generate a binary using Nix, you can run `nix build git+https://forgejo.ellis.link/continuwuation/continuwuity` to generate a binary in `result/bin/conduwuit`.
+- `default-static-x86_64`
+- `default-static-aarch64`
+- `max-perf-static-x86_64`
+- `max-perf-haswell-static-x86_64`
+- `max-perf-static-aarch64`
+
+`max-perf` takes longer to build, but has more runtime optimizations. Haswell builds are optimized for modern CPUs.

 ### Compiling

@@ -47,9 +47,16 @@ ### Available options
 - `extraEnvironment`: Extra environment variables to pass to the Continuwuity server
 - `package`: The Continuwuity package to use, defaults to `pkgs.matrix-continuwuity`
    - You may want to override this to be from our flake, for faster updates and unstable versions:
+
    ```nix
-    package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.default;
+    package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.packageName;
    ```
+
+    Where `packageName` is one of:
+    - `default`
+    - `max-perf`: Takes longer to build, but has more runtime optimizations
+    - `max-perf-haswell`: Optimized for modern CPUs, don't use if your CPU is not Haswell or later.
+
 - `admin.enable`: Whether to add the `conduwuit` binary to `PATH` for administration (enabled by default)
 - `settings`: The Continuwuity configuration

@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 13,
+            "id": 14,
            "mention_room": true,
-            "date": "2026-05-08",
-            "message": "[v0.5.9](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.9) has been released, fixing a few low-severity federation-related vulnerabilities. It is recommended you read the changelog and update as soon as possible. There are no new features or other changes in this release, only related bugfixes. Deployments tracking the main branch should also update to the latest commit."
+            "date": "2026-06-20",
+            "message": "[v0.5.10](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.10) has been released. It is a security release, so we suggest you update as soon as possible. Don't forget to also join [our announcements room](https://matrix.to/#/!jIdNjSM5X-V5JVx2h2kAhUZIIQ08GyzPL55NFZAH1vM/%24K1ISNKIqfNiZzsNVCaTt2E7ZtNeP6Dsy6sbz9l3rO0A?via=ellis.link&via=gingershaped.computer&via=matrix.org)."
        }
    ]
 }
@@ -1,14 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem =
-    {
-      pkgs,
-      self',
-      ...
-    }:
-    {
-      _module.args.craneLib = (inputs.crane.mkLib pkgs).overrideToolchain (
-        pkgs: self'.packages.stable-toolchain
-      );
-    };
-}
@@ -1,7 +1,6 @@
 {
  imports = [
    ./rust.nix
-    ./crane.nix
    ./packages
    ./devshell.nix
    ./fmt.nix
@@ -1,7 +1,6 @@
-{
+{ inputs, ... }: {
  perSystem =
    {
-      craneLib,
      self',
      lib,
      pkgs,
@@ -9,34 +8,36 @@
    }:
    {
      # basic nix shell containing all things necessary to build continuwuity in all flavors manually (on x86_64-linux)
-      devShells.default = craneLib.devShell {
-        packages = [
-          self'.packages.rocksdb
-          pkgs.nodejs
-          pkgs.pkg-config
-        ]
-        ++ lib.optionals pkgs.stdenv.isLinux [
-          pkgs.liburing
-          pkgs.rust-jemalloc-sys-unprefixed
-        ];
-
-        env = {
-          LIBCLANG_PATH = lib.makeLibraryPath [ pkgs.llvmPackages.libclang.lib ];
-          LD_LIBRARY_PATH = lib.makeLibraryPath (
-            [
-              pkgs.stdenv.cc.cc.lib
+      devShells.default =
+        (inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.stable-toolchain).devShell
+          {
+            packages = [
+              self'.packages.rocksdb
+              pkgs.nodejs
+              pkgs.pkg-config
            ]
            ++ lib.optionals pkgs.stdenv.isLinux [
              pkgs.liburing
-              pkgs.jemalloc
-            ]
-          );
-        }
-        // lib.optionalAttrs pkgs.stdenv.isLinux {
-          PKG_CONFIG_PATH = lib.makeSearchPath "lib/pkgconfig" [
-            pkgs.liburing.dev
-          ];
-        };
-      };
+              pkgs.rust-jemalloc-sys-unprefixed
+            ];
+
+            env = {
+              LIBCLANG_PATH = lib.makeLibraryPath [ pkgs.llvmPackages.libclang.lib ];
+              LD_LIBRARY_PATH = lib.makeLibraryPath (
+                [
+                  pkgs.stdenv.cc.cc.lib
+                ]
+                ++ lib.optionals pkgs.stdenv.isLinux [
+                  pkgs.liburing
+                  pkgs.jemalloc
+                ]
+              );
+            }
+            // lib.optionalAttrs pkgs.stdenv.isLinux {
+              PKG_CONFIG_PATH = lib.makeSearchPath "lib/pkgconfig" [
+                pkgs.liburing.dev
+              ];
+            };
+          };
    };
 }
@@ -2,14 +2,14 @@
  lib,
  self,
  stdenv,
-  liburing,
+  rocksdb,
  craneLib,
  pkg-config,
+  liburing,
  rustPlatform,
  cargoExtraArgs ? "",
  rustflags ? "",
  target_cpu ? null,
-  rocksdb,
  profile ? "release",
 }:
 let
@@ -28,18 +28,26 @@ let
  };

  attrs = {
+    __structuredAttrs = true;
+    strictDeps = true;
+
    inherit src;
+
    nativeBuildInputs = [
      pkg-config
      rustPlatform.bindgenHook
    ];
+
    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ liburing ];
+
    env = {
-      ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
-      ROCKSDB_LIB_DIR = "${rocksdb}/lib";
      CARGO_PROFILE = profile;
      RUSTFLAGS = rustflags;
    }
+    // (lib.optionalAttrs (rocksdb != null) {
+      ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
+      ROCKSDB_LIB_DIR = "${rocksdb}/lib";
+    })
    // (lib.optionalAttrs (target_cpu != null) {
      TARGET_CPU = target_cpu;
    });
@@ -51,7 +59,7 @@ craneLib.buildPackage (
    cargoArtifacts = craneLib.buildDepsOnly attrs;

    # Needed to make continuwuity link to rocksdb
-    postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    postFixup = lib.optionalString (stdenv.hostPlatform.isLinux && rocksdb != null) ''
      old_rpath="$(patchelf --print-rpath $out/bin/conduwuit)"
      extra_rpath="${
        lib.makeLibraryPath [
@@ -1,4 +1,5 @@
 {
+  inputs,
  self,
  ...
 }:
@@ -6,32 +7,84 @@
  perSystem =
    {
      self',
+      lib,
      pkgs,
+      inputs',
+      system,
      craneLib,
+      mkToolchain,
      ...
    }:
    {
-      packages = {
-        rocksdb = pkgs.callPackage ./rocksdb.nix { };
-        default = pkgs.callPackage ./continuwuity.nix {
-          inherit self craneLib;
-          inherit (self'.packages) rocksdb;
-          # extra features via `cargoExtraArgs`
-          cargoExtraArgs = "-F http3";
-          # extra RUSTFLAGS via `rustflags`
-          # the stuff below is required for http3
-          rustflags = "--cfg reqwest_unstable";
-        };
-        # users may also override this with other cargo profiles to build for other feature sets
-        # for features configuration see `default` package which enables http3 by default
+      packages =
+        let
+          mkPackages =
+            pkgs:
+            let
+              fnx = inputs'.fenix.packages;

-        # example: different compilation profile and different target_cpu
-        max-perf-haswell = self'.packages.default.override {
-          # compiles explicitly for haswell arch cpus
-          target_cpu = "haswell";
-          # compiles slower but with more thorough optimizations
-          profile = "release-max-perf";
-        };
-      };
+              isStatic = pkgs.stdenv.hostPlatform.isMusl;
+
+              craneLib = (inputs.crane.mkLib pkgs).overrideToolchain (
+                _:
+                if isStatic then
+                  fnx.combine [
+                    self'.packages.stable-toolchain
+                    (mkToolchain fnx.targets.${pkgs.stdenv.hostPlatform.config}).rust-std
+                  ]
+                else
+                  self'.packages.stable-toolchain
+              );
+
+              default = pkgs.callPackage ./continuwuity.nix {
+                inherit self craneLib;
+
+                liburing = (if isStatic then pkgs.pkgsStatic else pkgs).liburing;
+                rocksdb = if isStatic then null else self'.packages.rocksdb;
+
+                # extra features via `cargoExtraArgs`
+                cargoExtraArgs = "-F http3";
+                # extra RUSTFLAGS via `rustflags`
+                # the stuff below is required for http3
+                rustflags = "--cfg reqwest_unstable";
+              };
+
+              # users may also override this with other cargo profiles to build for other feature sets
+              # for features configuration see `default` package which enables http3 by default
+
+              max-perf = default.override {
+                # compiles slower but with more thorough optimizations
+                profile = "release-max-perf";
+              };
+
+              max-perf-haswell = max-perf.override {
+                # compiles explicitly for haswell arch cpus
+                target_cpu = "haswell";
+              };
+            in
+            {
+              inherit default max-perf max-perf-haswell;
+            };
+        in
+        {
+          rocksdb = pkgs.callPackage ./rocksdb.nix { };
+        }
+        // (mkPackages pkgs)
+        // (lib.mapAttrs' (name: value: lib.nameValuePair "${name}-static-x86_64" value) (
+          mkPackages (
+            import inputs.nixpkgs {
+              localSystem = system;
+              crossSystem = "x86_64-unknown-linux-musl";
+            }
+          )
+        ))
+        // (lib.mapAttrs' (name: value: lib.nameValuePair "${name}-static-aarch64" value) (
+          mkPackages (
+            import inputs.nixpkgs {
+              localSystem = system;
+              crossSystem = "aarch64-unknown-linux-musl";
+            }
+          )
+        ));
    };
 }
@@ -2,22 +2,26 @@
 {
  perSystem =
    {
-      system,
      lib,
+      inputs',
      pkgs,
      ...
    }:
+    let
+      mkToolchain =
+        target:
+        target.fromToolchainName {
+          name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
+          sha256 = "sha256-mvUGEOHYJpn3ikC5hckneuGixaC+yGrkMM/liDIDgoU=";
+        };
+    in
    {
+      _module.args = { inherit mkToolchain; };
+
      packages =
        let
-          fnx = inputs.fenix.packages.${system};
-
-          stable-toolchain = fnx.fromToolchainFile {
-            file = inputs.self + "/rust-toolchain.toml";
-
-            # See also `rust-toolchain.toml`
-            sha256 = "sha256-mvUGEOHYJpn3ikC5hckneuGixaC+yGrkMM/liDIDgoU=";
-          };
+          fnx = inputs'.fenix.packages;
+          stable-toolchain = (mkToolchain fnx).toolchain;
        in
        {
          inherit stable-toolchain;
@@ -87,6 +87,10 @@ pub(crate) async fn handle_login(
 		return Err!(Request(InvalidParam("User ID does not belong to this homeserver")));
 	}

+	if services.users.is_deactivated(&user_id).await? {
+		return Err!(Request(UserDeactivated("This account has been deactivated.")));
+	}
+
 	if services.users.is_locked(&user_id).await? {
 		return Err!(Request(UserLocked("This account has been locked.")));
 	}
@@ -48,6 +48,13 @@ async fn load_timeline(
 	ending_count: Option<PduCount>,
 	limit: usize,
 ) -> Result<TimelinePdus> {
+	if let (Some(starting_count), Some(ending_count)) = (starting_count, ending_count) {
+		debug_assert!(
+			starting_count <= ending_count,
+			"starting count {starting_count} > ending count {ending_count}"
+		);
+	}
+
 	let mut pdu_stream = match starting_count {
 		| Some(starting_count) => {
 			let last_timeline_count = services
@@ -38,6 +38,7 @@
 	uint,
 };
 use service::{account_data::AnyRawAccountDataEvent, rooms::short::ShortStateHash};
+use tokio::pin;

 use super::{load_timeline, share_encrypted_room};
 use crate::client::{
@@ -96,12 +97,19 @@ pub(super) async fn load_joined_room(
 		);
 	}

+	let state_events =
+		StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect());
+
 	let joined_room = assign!(JoinedRoom::new(), {
 		account_data,
 		summary: summary.unwrap_or_default(),
 		unread_notifications: notification_counts.unwrap_or_default(),
 		timeline,
-		state: RoomState::Before(StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect())),
+		state: if sync_context.use_state_after {
+			RoomState::After(state_events)
+		} else {
+			RoomState::Before(state_events)
+		},
 		ephemeral,
 		unread_thread_notifications: BTreeMap::new(),
 	});
@@ -344,7 +352,7 @@ struct ShortStateHashes {
 #[tracing::instrument(level = "debug", skip_all)]
 async fn fetch_shortstatehashes(
 	services: &Services,
-	SyncContext { last_sync_end_count, current_count, .. }: SyncContext<'_>,
+	SyncContext { last_sync_end_count, .. }: SyncContext<'_>,
 	room_id: &RoomId,
 ) -> Result<ShortStateHashes> {
 	// the room state currently.
@@ -354,46 +362,45 @@ async fn fetch_shortstatehashes(
 		.rooms
 		.state
 		.get_room_shortstatehash(room_id)
-		.map_err(|_| err!(Database(error!("Room {room_id} has no state"))));
+		.map_err(|_| err!(Database(error!("Room {room_id} has no state"))))
+		.await?;

-	// the room state as of the end of the last sync.
-	// this will be None if we are doing an initial sync or if we just joined this
-	// room.
+	// The room state as of the end of the last sync.
+	// This will be None if we are doing an initial sync.
 	let last_sync_end_shortstatehash =
-		OptionFuture::from(last_sync_end_count.map(|last_sync_end_count| {
-			// look up the shortstatehash saved by the last sync's call to
-			// `associate_token_shortstatehash`
-			services
-				.rooms
-				.user
-				.get_token_shortstatehash(room_id, last_sync_end_count)
-				.inspect_err(move |_| {
-					debug_warn!(
-						token = last_sync_end_count,
-						"Room has no shortstatehash for this token"
-					);
-				})
-				.ok()
+		OptionFuture::from(last_sync_end_count.map(async |last_sync_end_count| {
+			pin! {
+				let pdus = services
+					.rooms
+					.timeline
+					.pdus(room_id, Some(PduCount::Normal(last_sync_end_count)))
+					.ignore_err();
+			}
+
+			match pdus.next().await {
+				| Some((_, pdu_after_last_sync_end)) => {
+					trace!(?pdu_after_last_sync_end.event_id, "pdu at last sync end");
+
+					Some(
+						services
+							.rooms
+							.state_accessor
+							.pdu_shortstatehash(&pdu_after_last_sync_end.event_id)
+							.await
+							.map_err(|err| {
+								err!("Last sync end PDU has no shortstatehash: {err}")
+							}),
+					)
+				},
+				| None => {
+					// No events have been sent since the last sync, or we just joined this room
+					None
+				},
+			}
 		}))
-		.map(Option::flatten)
-		.map(Ok);
-
-	let (current_shortstatehash, last_sync_end_shortstatehash) =
-		try_join(current_shortstatehash, last_sync_end_shortstatehash).await?;
-
-	/*
-	associate the `current_count` with the `current_shortstatehash`, so we can
-	use it on the next sync as the `last_sync_end_shortstatehash`.
-
-	TODO: the table written to by this call grows extremely fast, gaining one new entry for each
-	joined room on _every single sync request_. we need to find a better way to remember the shortstatehash
-	between syncs.
-	*/
-	services
-		.rooms
-		.user
-		.associate_token_shortstatehash(room_id, current_count, current_shortstatehash)
-		.await;
+		.await
+		.flatten()
+		.transpose()?;

 	Ok(ShortStateHashes {
 		current_shortstatehash,
@@ -452,6 +459,7 @@ async fn build_state_events(
 		syncing_user,
 		last_sync_end_count,
 		full_state,
+		use_state_after,
 		..
 	} = sync_context;

@@ -460,32 +468,15 @@ async fn build_state_events(
 		last_sync_end_shortstatehash,
 	} = shortstatehashes;

-	// the spec states that the `state` property only includes state events up to
-	// the beginning of the timeline, so we determine the state of the syncing room
-	// as of the first timeline event. NOTE: this explanation is not entirely
-	// accurate; see the implementation of `build_state_incremental`.
-	let timeline_start_shortstatehash = async {
-		if let Some((_, pdu)) = timeline.pdus.front() {
-			if let Ok(shortstatehash) = services
-				.rooms
-				.state_accessor
-				.pdu_shortstatehash(&pdu.event_id)
-				.await
-			{
-				return shortstatehash;
-			}
-		}
-
-		current_shortstatehash
-	};
+	if timeline.pdus.is_empty() {
+		// If the timeline is empty there can't possibly be any changes to the state
+		return Ok(vec![]);
+	}

 	// the user IDs of members whose membership needs to be sent to the client, if
 	// lazy-loading is enabled.
 	let lazily_loaded_members =
-		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders());
-
-	let (timeline_start_shortstatehash, lazily_loaded_members) =
-		join(timeline_start_shortstatehash, lazily_loaded_members).await;
+		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders()).await;

 	// compute the state delta between the previous sync and this sync.
 	match (last_sync_end_count, last_sync_end_shortstatehash) {
@@ -494,16 +485,14 @@ async fn build_state_events(
 		is Some (meaning the syncing user didn't just join this room for the first time ever), and `full_state` is false,
 		then use `build_state_incremental`.
 		*/
-		| (Some(last_sync_end_count), Some(last_sync_end_shortstatehash)) if !full_state =>
+		| (Some(_), Some(last_sync_end_shortstatehash)) if !full_state =>
 			build_state_incremental(
 				services,
 				syncing_user,
-				room_id,
-				PduCount::Normal(last_sync_end_count),
 				last_sync_end_shortstatehash,
-				timeline_start_shortstatehash,
 				current_shortstatehash,
 				timeline,
+				use_state_after,
 				lazily_loaded_members.as_ref(),
 			)
 			.boxed()
@@ -517,7 +506,9 @@ async fn build_state_events(
 			build_state_initial(
 				services,
 				syncing_user,
-				timeline_start_shortstatehash,
+				current_shortstatehash,
+				timeline,
+				use_state_after,
 				lazily_loaded_members.as_ref(),
 			)
 			.boxed()
@@ -598,23 +589,25 @@ async fn check_joined_since_last_sync(
 	ShortStateHashes { last_sync_end_shortstatehash, .. }: ShortStateHashes,
 	SyncContext { syncing_user, .. }: SyncContext<'_>,
 ) -> Result<bool> {
-	// fetch the syncing user's membership event during the last sync.
-	// this will be None if `previous_sync_end_shortstatehash` is None.
-	let membership_during_previous_sync = match last_sync_end_shortstatehash {
-		| Some(last_sync_end_shortstatehash) => services
-			.rooms
-			.state_accessor
-			.state_get_content(
-				last_sync_end_shortstatehash,
-				&StateEventType::RoomMember,
-				syncing_user.as_str(),
-			)
-			.await
-			.inspect_err(|_| debug_warn!("User has no previous membership"))
-			.ok(),
-		| None => None,
+	let Some(last_sync_end_shortstatehash) = last_sync_end_shortstatehash else {
+		// For initial syncs always return false, since there's no "last sync" for the
+		// user to have joined since.
+		return Ok(false);
 	};

+	// Fetch the syncing user's membership event during the last sync.
+	let membership_during_previous_sync = services
+		.rooms
+		.state_accessor
+		.state_get_content(
+			last_sync_end_shortstatehash,
+			&StateEventType::RoomMember,
+			syncing_user.as_str(),
+		)
+		.await
+		.inspect_err(|_| debug_warn!("User has no previous membership"))
+		.ok();
+
 	// TODO: If the requesting user got state-reset out of the room, this
 	// will be `true` when it shouldn't be. this function should never be called
 	// in that situation, but it may be if the membership cache didn't get updated.
@@ -4,7 +4,7 @@
 	trace,
 	utils::{self, IterStream, future::ReadyEqExt, stream::WidebandExt as _},
 };
-use futures::{StreamExt, future::join};
+use futures::StreamExt;
 use ruma::{
 	EventId, OwnedRoomId, RoomId,
 	api::client::sync::sync_events::v3::{
@@ -181,6 +181,9 @@ pub(super) async fn load_left_room(
 		.collect::<Vec<_>>()
 		.await;

+	let state_events =
+		StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect());
+
 	Ok(Some(assign!(LeftRoom::new(), {
 		account_data: RoomAccountData::new(),
 		timeline: assign!(Timeline::new(), {
@@ -188,7 +191,11 @@ pub(super) async fn load_left_room(
 			prev_batch: Some(current_count.to_string()),
 			events: raw_timeline_pdus,
 		}),
-		state: State::Before(StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect())),
+		state: if sync_context.use_state_after {
+			State::After(state_events)
+		} else {
+			State::Before(state_events)
+		},
 	})))
 }

@@ -233,29 +240,8 @@ async fn build_left_state_and_timeline(
 	)
 	.await?;

-	let timeline_start_shortstatehash = async {
-		if let Some((_, pdu)) = timeline.pdus.front() {
-			if let Ok(shortstatehash) = services
-				.rooms
-				.state_accessor
-				.pdu_shortstatehash(&pdu.event_id)
-				.await
-			{
-				return shortstatehash;
-			}
-		}
-
-		// the timeline generally should not be empty (see the TODO further down),
-		// but in case it is we use `leave_shortstatehash` as the state to
-		// send
-		leave_shortstatehash
-	};
-
 	let lazily_loaded_members =
-		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders());
-
-	let (timeline_start_shortstatehash, lazily_loaded_members) =
-		join(timeline_start_shortstatehash, lazily_loaded_members).await;
+		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders()).await;

 	// TODO: calculate incremental state for incremental syncs.
 	// always calculating initial state _works_ but returns more data and does
@@ -263,7 +249,9 @@ async fn build_left_state_and_timeline(
 	let mut state = build_state_initial(
 		services,
 		syncing_user,
-		timeline_start_shortstatehash,
+		leave_shortstatehash,
+		&timeline,
+		sync_context.use_state_after,
 		lazily_loaded_members.as_ref(),
 	)
 	.await?;
@@ -11,12 +11,11 @@
 use axum::extract::State;
 use axum_client_ip::ClientIp;
 use conduwuit::{
-	Err, Result, at, extract_variant,
+	Err, Result, at, error, extract_variant,
 	utils::{
 		ReadyExt, TryFutureExtExt,
 		stream::{BroadbandExt, Tools, WidebandExt},
 	},
-	warn,
 };
 use conduwuit_service::Services;
 use futures::{FutureExt, StreamExt, TryFutureExt, future::OptionFuture};
@@ -111,6 +110,9 @@ struct SyncContext<'a> {
 	/// The sync filter, which the client uses to specify what data should be
 	/// included in the sync response.
 	filter: &'a FilterDefinition,
+	/// Whether the state at the end of the timeline should be used when
+	/// calculating state diffs for sync.
+	use_state_after: bool,
 }

 impl<'a> SyncContext<'a> {
@@ -264,6 +266,7 @@ pub(crate) async fn build_sync_events(
 		current_count,
 		full_state,
 		filter: &filter,
+		use_state_after: body.use_state_after,
 	};

 	let joined_rooms = services
@@ -276,7 +279,7 @@ pub(crate) async fn build_sync_events(
 			match joined_room {
 				| Ok((room, updates)) => Some((room_id, room, updates)),
 				| Err(err) => {
-					warn!(?err, %room_id, "error loading joined room");
+					error!(?err, %room_id, "error loading joined room");
 					None
 				},
 			}
@@ -305,7 +308,7 @@ pub(crate) async fn build_sync_events(
 				| Ok(Some(left_room)) => Some((room_id, left_room)),
 				| Ok(None) => None,
 				| Err(err) => {
-					warn!(?err, %room_id, "error loading joined room");
+					error!(?err, %room_id, "error loading joined room");
 					None
 				},
 			}
@@ -1,11 +1,8 @@
-use std::{collections::BTreeSet, ops::ControlFlow};
+use std::collections::HashSet;

 use conduwuit::{
-	Result, at, is_equal_to,
-	matrix::{
-		Event,
-		pdu::{PduCount, PduEvent},
-	},
+	Result, at,
+	matrix::{Event, pdu::PduEvent},
 	utils::{
 		BoolExt, IterStream, ReadyExt, TryFutureExtExt,
 		stream::{BroadbandExt, TryIgnore},
@@ -16,9 +13,7 @@
 	rooms::{lazy_loading::MemberSet, short::ShortStateHash},
 };
 use futures::{FutureExt, StreamExt};
-use itertools::Itertools;
-use ruma::{OwnedEventId, RoomId, UserId, events::StateEventType};
-use service::rooms::short::ShortEventId;
+use ruma::{OwnedEventId, UserId, events::StateEventType};
 use tracing::trace;

 use crate::client::TimelinePdus;
@@ -38,14 +33,22 @@
 pub(super) async fn build_state_initial(
 	services: &Services,
 	sender_user: &UserId,
-	timeline_start_shortstatehash: ShortStateHash,
+	timeline_end_shortstatehash: ShortStateHash,
+	timeline: &TimelinePdus,
+	use_state_after: bool,
 	lazily_loaded_members: Option<&MemberSet>,
 ) -> Result<Vec<PduEvent>> {
+	let event_ids_in_timeline: HashSet<_> =
+		timeline.pdus.iter().map(|pdu| &pdu.1.event_id).collect();
+
 	// load the keys and event IDs of the state events at the start of the timeline
 	let (shortstatekeys, event_ids): (Vec<_>, Vec<_>) = services
 		.rooms
 		.state_accessor
-		.state_full_ids(timeline_start_shortstatehash)
+		.state_full_ids(timeline_end_shortstatehash)
+		.ready_filter(|(_, event_id)| {
+			use_state_after || !event_ids_in_timeline.contains(event_id)
+		})
 		.unzip()
 		.await;

@@ -92,82 +95,32 @@ pub(super) async fn build_state_initial(
 pub(super) async fn build_state_incremental<'a>(
 	services: &Services,
 	sender_user: &'a UserId,
-	room_id: &RoomId,
-	last_sync_end_count: PduCount,
 	last_sync_end_shortstatehash: ShortStateHash,
-	timeline_start_shortstatehash: ShortStateHash,
 	timeline_end_shortstatehash: ShortStateHash,
 	timeline: &TimelinePdus,
+	use_state_after: bool,
 	lazily_loaded_members: Option<&'a MemberSet>,
 ) -> Result<Vec<PduEvent>> {
-	/*
-	NB: a limited sync is one where `timeline.limited == true`. Synapse calls this a "gappy" sync internally.
+	let mut state_event_ids: HashSet<OwnedEventId> = HashSet::new();

-	The algorithm implemented in this function is, currently, quite different from the algorithm vaguely described
-	by the Matrix specification. This is because the specification's description of the `state` property does not accurately
-	reflect how Synapse behaves, and therefore how client SDKs behave. Notable differences include:
-	1. We do not compute the delta using the naive approach of "every state event from the end of the last sync
-	   up to the start of this sync's timeline". see below for details.
-	2. If lazy-loading is enabled, we include lazily-loaded membership events. The specific users to include are determined
-	   elsewhere and supplied to this function in the `lazily_loaded_members` parameter.
-	*/
+	trace!(
+		%use_state_after,
+		%last_sync_end_shortstatehash,
+		%timeline_end_shortstatehash,
+		"computing state for incremental sync"
+	);

-	/*
-	the `state` property of an incremental sync which isn't limited are _usually_ empty.
-	(note: the specification says that the `state` property is _always_ empty for limited syncs, which is incorrect.)
-	however, if an event in the timeline (`timeline.pdus`) merges a split in the room's DAG (i.e. has multiple `prev_events`),
-	the state at the _end_ of the timeline may include state events which were merged in and don't exist in the state
-	at the _start_ of the timeline. because this is uncommon, we check here to see if any events in the timeline
-	merged a split in the DAG.
+	// Fetch lazy-loaded membership events if lazy-loading is enabled
+	if let Some(lazily_loaded_members) = lazily_loaded_members
+		&& !lazily_loaded_members.is_empty()
+	{
+		trace!("including lazy membership events for members: {:?}", lazily_loaded_members);

-	see: https://github.com/element-hq/synapse/issues/16941
-	*/
-
-	let timeline_is_linear = timeline.pdus.is_empty() || {
-		let last_pdu_of_last_sync = services
+		services
 			.rooms
-			.timeline
-			.pdus_rev(room_id, Some(last_sync_end_count.saturating_add(1)))
-			.boxed()
-			.next()
-			.await
-			.transpose()
-			.expect("last sync should have had some PDUs")
-			.map(at!(1));
-
-		// make sure the prev_events of each pdu in the timeline refer only to the
-		// previous pdu
-		timeline
-			.pdus
-			.iter()
-			.try_fold(last_pdu_of_last_sync.map(|pdu| pdu.event_id), |prev_event_id, (_, pdu)| {
-				if let Ok(pdu_prev_event_id) = pdu.prev_events.iter().exactly_one() {
-					if prev_event_id
-						.as_ref()
-						.is_none_or(is_equal_to!(pdu_prev_event_id))
-					{
-						return ControlFlow::Continue(Some(pdu_prev_event_id.to_owned()));
-					}
-				}
-
-				trace!(
-					"pdu {:?} has split prev_events (expected {:?}): {:?}",
-					pdu.event_id, prev_event_id, pdu.prev_events
-				);
-				ControlFlow::Break(())
-			})
-			.is_continue()
-	};
-
-	if timeline_is_linear && !timeline.limited {
-		// if there are no splits in the DAG and the timeline isn't limited, then
-		// `state` will always be empty unless lazy loading is enabled.
-
-		if let Some(lazily_loaded_members) = lazily_loaded_members {
-			if !timeline.pdus.is_empty() {
-				// lazy loading is enabled, so we return the membership events which were
-				// requested by the caller.
-				let lazy_membership_events: Vec<_> = lazily_loaded_members
+			.short
+			.multi_get_eventid_from_short::<'_, OwnedEventId, _>(
+				lazily_loaded_members
 					.iter()
 					.stream()
 					.broad_filter_map(|user_id| async move {
@@ -178,71 +131,24 @@ pub(super) async fn build_state_incremental<'a>(
 						services
 							.rooms
 							.state_accessor
-							.state_get(
-								timeline_start_shortstatehash,
+							.state_get_shortid(
+								timeline_end_shortstatehash,
 								&StateEventType::RoomMember,
 								user_id.as_str(),
 							)
 							.ok()
 							.await
-					})
-					.collect()
-					.await;
-
-				if !lazy_membership_events.is_empty() {
-					trace!(
-						"syncing lazy membership events for members: {:?}",
-						lazy_membership_events
-							.iter()
-							.map(|pdu| pdu.state_key().unwrap())
-							.collect::<Vec<_>>()
-					);
-				}
-				return Ok(lazy_membership_events);
-			}
-		}
-
-		// lazy loading is disabled, `state` is empty.
-		return Ok(vec![]);
+					}),
+			)
+			.ignore_err()
+			.ready_for_each(|event_id| {
+				state_event_ids.insert(event_id);
+			})
+			.await;
 	}

-	/*
-	at this point, either the timeline is `limited` or the DAG has a split in it. this necessitates
-	computing the incremental state (which may be empty).
-
-	NOTE: this code path does not use the `lazy_membership_events` parameter. any changes to membership will be included
-	in the incremental state. therefore, the incremental state may include "redundant" membership events,
-	which we do not filter out because A. the spec forbids lazy-load filtering if the timeline is `limited`,
-	and B. DAG splits which require sending extra membership state events are (probably) uncommon enough that
-	the performance penalty is acceptable.
-	*/
-
-	trace!(%timeline_is_linear, %timeline.limited, "computing state for incremental sync");
-
-	// fetch the shorteventids of state events in the timeline
-	let state_events_in_timeline: BTreeSet<ShortEventId> = services
-		.rooms
-		.short
-		.multi_get_or_create_shorteventid(timeline.pdus.iter().filter_map(|(_, pdu)| {
-			if pdu.state_key().is_some() {
-				Some(pdu.event_id.as_ref())
-			} else {
-				None
-			}
-		}))
-		.collect()
-		.await;
-
-	trace!("{} state events in timeline", state_events_in_timeline.len());
-
-	/*
-	fetch the state events which were added since the last sync.
-
-	specifically we fetch the difference between the state at the last sync and the state at the _end_
-	of the timeline, and then we filter out state events in the timeline itself using the shorteventids we fetched.
-	this is necessary to account for splits in the DAG, as explained above.
-	*/
-	let state_diff = services
+	// Fetch the state events added since the last sync.
+	services
 		.rooms
 		.short
 		.multi_get_eventid_from_short::<'_, OwnedEventId, _>(
@@ -252,18 +158,29 @@ pub(super) async fn build_state_incremental<'a>(
 				.state_added((last_sync_end_shortstatehash, timeline_end_shortstatehash))
 				.await?
 				.stream()
-				.ready_filter_map(|(_, shorteventid)| {
-					if state_events_in_timeline.contains(&shorteventid) {
-						None
-					} else {
-						Some(shorteventid)
-					}
-				}),
+				.map(at!(1)),
 		)
-		.ignore_err();
+		.ignore_err()
+		.ready_for_each(|event_id| {
+			state_event_ids.insert(event_id);
+		})
+		.await;

-	// finally, fetch the PDU contents and collect them into a vec
-	let state_diff_pdus = state_diff
+	if !use_state_after {
+		// If state_after isn't enabled, filter out state events which also exist
+		// in the timeline. If splits exist in the DAG, this may not be exactly the same
+		// thing as the state diff ending at the start of the timeline, but Synapse
+		// also does this and it's technically more useful behavior anyway.
+		// See: https://github.com/element-hq/synapse/issues/16941
+
+		for (_, pdu) in &timeline.pdus {
+			state_event_ids.remove(pdu.event_id());
+		}
+	}
+
+	// Finally, fetch the PDU contents and collect them into a vec
+	let state_diff_pdus = state_event_ids
+		.stream()
 		.broad_filter_map(|event_id| async move {
 			services
 				.rooms
@@ -15,7 +15,7 @@
 		BoolExt, FutureBoolExt, IterStream, ReadyExt, TryFutureExtExt,
 		future::ReadyEqExt,
 		math::{ruma_from_usize, usize_from_ruma},
-		stream::WidebandExt,
+		stream::{TryIgnore, WidebandExt},
 	},
 	warn,
 };
@@ -41,6 +41,7 @@
 	uint,
 };
 use service::account_data::AnyRawAccountDataEvent;
+use tokio::pin;

 use super::share_encrypted_room;
 use crate::{
@@ -858,12 +859,31 @@ async fn collect_e2ee<'a, Rooms>(
 			continue;
 		};

-		let since_shortstatehash = services
-			.rooms
-			.user
-			.get_token_shortstatehash(room_id, globalsince)
-			.await
-			.ok();
+		let since_shortstatehash = async {
+			pin! {
+				let pdus_rev = services
+					.rooms
+					.timeline
+					.pdus_rev(room_id, Some(PduCount::Normal(globalsince.saturating_sub(1))))
+					.ignore_err();
+			}
+
+			let (count, pdu_at_last_sync_end) = pdus_rev.next().await?;
+
+			if matches!(count, PduCount::Backfilled(_)) {
+				None
+			} else {
+				Some(
+					services
+						.rooms
+						.state_accessor
+						.pdu_shortstatehash(&pdu_at_last_sync_end.event_id)
+						.await
+						.expect("pdu should have a shortstatehash"),
+				)
+			}
+		}
+		.await;

 		let encrypted_room = services
 			.rooms
@@ -162,6 +162,9 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 		query: AuthQueryParams,
 		route: TypeId,
 	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
 		if let Ok((sender_user, sender_device)) = services.users.find_from_token(&output).await {
 			// Locked users can only use /logout and /logout/all
 			if services
@@ -259,6 +262,9 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 		_query: AuthQueryParams,
 		_route: TypeId,
 	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
 		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
 			return Err!(Request(Unauthorized("Invalid appservice token.")));
 		};
@@ -676,6 +676,13 @@ async fn handle_edu_direct_to_device(
 	messages
 		.into_iter()
 		.stream()
+		.broad_filter_map(|(target_user_id, map)| async move {
+			services
+				.users
+				.is_active_local(&target_user_id)
+				.await
+				.then_some((target_user_id, map))
+		})
 		.for_each_concurrent(automatic_width(), |(target_user_id, map)| {
 			handle_edu_direct_to_device_user(services, target_user_id, sender, &ev_type, map)
 		})
@@ -21,6 +21,7 @@ pub fn versions() -> Vec<String> {
 		"v1.12".to_owned(),
 		"v1.13".to_owned(),
 		"v1.14".to_owned(),
+		"v1.16".to_owned(),
 	]
 }

@@ -193,12 +193,7 @@ pub(super) fn open_list(db: &Arc<Engine>, maps: &[Descriptor]) -> Result<Maps> {
 	},
 	Descriptor {
 		name: "roomsynctoken_shortstatehash",
-		file_shape: 3,
-		val_size_hint: Some(8),
-		block_size: 512,
-		compression_level: 3,
-		bottommost_level: Some(6),
-		..descriptor::SEQUENTIAL
+		..descriptor::DROPPED
 	},
 	Descriptor {
 		name: "roomuserdataid_accountdata",
@@ -423,7 +423,7 @@ pub fn url_preview_allowed(&self, url: &Url) -> bool {
 							 url_preview_domain_explicit_denylist (check 1/3)",
 							&root_domain
 						);
-						return true;
+						return false;
 					}

 					if allowlist_domain_explicit.contains(&root_domain.to_owned()) {
@@ -1,10 +1,10 @@
 use std::sync::Arc;

 use conduwuit::{Result, implement};
-use database::{Database, Deserialized, Map};
+use database::{Deserialized, Map};
 use ruma::{RoomId, UserId};

-use crate::{Dep, globals, rooms, rooms::short::ShortStateHash};
+use crate::{Dep, globals};

 pub struct Service {
 	db: Data,
@@ -12,32 +12,25 @@ pub struct Service {
 }

 struct Data {
-	db: Arc<Database>,
 	userroomid_notificationcount: Arc<Map>,
 	userroomid_highlightcount: Arc<Map>,
 	roomuserid_lastnotificationread: Arc<Map>,
-	roomsynctoken_shortstatehash: Arc<Map>,
 }

 struct Services {
 	globals: Dep<globals::Service>,
-	short: Dep<rooms::short::Service>,
 }

 impl crate::Service for Service {
 	fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		Ok(Arc::new(Self {
 			db: Data {
-				db: args.db.clone(),
 				userroomid_notificationcount: args.db["userroomid_notificationcount"].clone(),
 				userroomid_highlightcount: args.db["userroomid_highlightcount"].clone(),
 				roomuserid_lastnotificationread: args.db["userroomid_highlightcount"].clone(),
-				roomsynctoken_shortstatehash: args.db["roomsynctoken_shortstatehash"].clone(),
 			},
-
 			services: Services {
 				globals: args.depend::<globals::Service>("globals"),
-				short: args.depend::<rooms::short::Service>("rooms::short"),
 			},
 		}))
 	}
@@ -90,40 +83,3 @@ pub async fn last_notification_read(&self, user_id: &UserId, room_id: &RoomId) -
 		.deserialized()
 		.unwrap_or(0)
 }
-
-#[implement(Service)]
-pub async fn associate_token_shortstatehash(
-	&self,
-	room_id: &RoomId,
-	token: u64,
-	shortstatehash: ShortStateHash,
-) {
-	let shortroomid = self
-		.services
-		.short
-		.get_shortroomid(room_id)
-		.await
-		.expect("room exists");
-
-	let _cork = self.db.db.cork();
-	let key: &[u64] = &[shortroomid, token];
-	self.db
-		.roomsynctoken_shortstatehash
-		.put(key, shortstatehash);
-}
-
-#[implement(Service)]
-pub async fn get_token_shortstatehash(
-	&self,
-	room_id: &RoomId,
-	token: u64,
-) -> Result<ShortStateHash> {
-	let shortroomid = self.services.short.get_shortroomid(room_id).await?;
-
-	let key: &[u64] = &[shortroomid, token];
-	self.db
-		.roomsynctoken_shortstatehash
-		.qry(key)
-		.await
-		.deserialized()
-}
@@ -338,6 +338,7 @@ pub async fn count(&self) -> usize { self.db.userid_password.count().await }

 	/// Find out which user an access token belongs to.
 	pub async fn find_from_token(&self, token: &str) -> Result<(OwnedUserId, OwnedDeviceId)> {
+		assert!(!token.is_empty(), "Empty access token");
 		self.db.token_userdeviceid.get(token).await.deserialized()
 	}
Author	SHA1	Message	Date
Renovate Bot	de24fcbb8c	chore(deps): update dependency cargo-bins/cargo-binstall to v1.20.1	2026-06-23 13:38:23 +00:00
Renovate Bot	2adb9a7941	chore(deps): update actions/checkout action to v7	2026-06-23 13:20:40 +00:00
Renovate Bot	d81f4df61c	chore(deps): update rust crate itertools to 0.15.0	2026-06-23 13:20:22 +00:00
Renovate Bot	6b259d15ee	chore(deps): update rust-non-major	2026-06-23 13:20:10 +00:00
Renovate Bot	eeef60d540	chore(deps): update github-actions-digest	2026-06-23 05:01:57 +00:00
Renovate Bot	a01035e63a	chore(deps): update github-actions-non-major to v43.234.0	2026-06-22 05:03:19 +00:00
stratself	52c1544e6f	fix: Correct date in announcements	2026-06-21 02:36:32 +00:00
Jade Ellis	ed38212391	fix(ci): Correct version regex in debian build	2026-06-21 01:03:14 +01:00
Jade	86fe98c90d	chore: Admin announcement	2026-06-20 23:32:56 +00:00
Henry-Hiles	4078062331	fix: change the update-flake-hashes repo to work with the new rust.nix structure	2026-06-20 15:35:09 -04:00
Henry-Hiles	40935cf96a	fix: use toolchain declared in rust-toolchain.toml for cross rust-std	2026-06-20 15:32:33 -04:00
Henry-Hiles	182c5a120e	fix: add rocksdb as a flake package This fixes the flake-hashes workflow.	2026-06-20 13:45:25 -04:00
Henry-Hiles	8e71ed7b63	fix: dynamically link rocksdb on dynamic nix builds Fixes liburing error.	2026-06-20 13:19:35 -04:00
timedout	4696cbb751	fix: SEC12	2026-06-20 16:03:43 +01:00
timedout	ebea06b687	fix: SEC11	2026-06-20 16:03:43 +01:00
timedout	62b58e1a6a	fix: SEC16	2026-06-20 16:03:37 +01:00
Henry-Hiles	1ba90deeba	chore: Change build workflows to run every week Old behavior was to run every day, which is wasteful.	2026-06-19 22:58:32 -04:00
Henry-Hiles	71ed283141	chore: enable __structuredAttrs on build This is a good practice for modern nix packages	2026-06-20 02:43:52 +00:00
Henry-Hiles	a7ae7b2e75	fix: resolve review comment about Haswell CPUs	2026-06-20 02:43:52 +00:00
Henry-Hiles	0d45ae7e21	chore: more descriptive name for binary build step of workflow	2026-06-20 02:43:52 +00:00
Henry-Hiles	61e121ad5c	feat: improve docs for building with nix	2026-06-20 02:43:52 +00:00
Henry-Hiles	31960beb75	fix: fix max-perf-static packages not statically linking	2026-06-20 02:43:52 +00:00
Henry-Hiles	bdd9b6b50c	chore: add changelog	2026-06-20 02:43:52 +00:00
Henry-Hiles	216033cf20	feat: add build-nix workflow	2026-06-20 02:43:52 +00:00
Henry-Hiles	95ddb1bbe5	feat: add max-perf package	2026-06-20 02:43:52 +00:00
Henry-Hiles	1ad4ca0f67	feat: add static binary build instructions to docs	2026-06-20 02:43:52 +00:00
Henry-Hiles	95790d8152	fix: don't do check on all builds Checks can be done with `nix flake check`, no need to slow down build process with this.	2026-06-20 02:43:52 +00:00
Henry-Hiles	02c61b3840	fix: remove un-needed env vars that crane sets automatically	2026-06-20 02:43:52 +00:00
Henry-Hiles	6ee501ac69	feat: static builds using nix, including cross	2026-06-20 02:43:52 +00:00
spaetz	252ebb4642	CI: Remove the clang detection tomfos.tr act-runner image removed the possibility to install the latest LLVM using an installer script, so let us also remove the detection and just live with the distro's clang image.	2026-06-19 11:23:53 +00:00
Renovate Bot	0fb95df7a5	chore(deps): update rust crate tower-http to 0.7.0	2026-06-18 05:03:03 +00:00
Jade Ellis	a72eda19f1	chore: Release	2026-06-17 15:12:50 +01:00
Jade Ellis	4fc808114f	chore: Release	2026-06-17 15:05:23 +01:00
Ginger	e3a9549824	fix: Correctly sync newly created rooms	2026-06-16 23:41:51 -04:00
Ginger	073c033ab8	fix: Don't panic on missing SSH in sliding sync	2026-06-16 23:41:51 -04:00
Ginger	6e42be95bc	fix: Additional sync logic fixes	2026-06-16 23:41:51 -04:00
Ginger	1a77f57af5	fix: Upgrade warning on room load failures to error	2026-06-16 23:41:51 -04:00
Ginger	d427df0238	fix: Don't panic on missing SSH	2026-06-16 23:41:51 -04:00
Ginger	f9f3ebe571	fix: Calculate state at end of last sync correctly	2026-06-16 23:41:51 -04:00
Ginger	5969c1ae94	chore: News fragments	2026-06-16 23:41:51 -04:00
Ginger	523016a42b	feat: Add support for `state_after`	2026-06-16 23:41:51 -04:00
Ginger	7c42f6075b	feat: Remove all uses of `roomsynctoken_shortstatehash`	2026-06-16 23:41:51 -04:00
Renovate Bot	bc37f7fc5b	chore(deps): update rust crate serde-saphyr to 0.0.27	2026-06-16 18:29:02 +00:00
				`@@ -0,0 +1 @@`
				Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
				`@@ -0,0 +1 @@`
				Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical).
				`@@ -0,0 +1 @@`
				Adjusted legacy sync logic to no longer use the `roomsynctoken_shortstatehash` database column. Once this change has been confirmed to be stable and reliable, a future update will remove it entirely, significantly decreasing database sizes. Contributed by @ginger.