chore(deps): update rust-non-major

.forgejo/actions/timelord/action.yml

@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2
+      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 

.forgejo/workflows/build-nix.yml

@@ -65,7 +65,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           draft: true
           files: binaries/*

.forgejo/workflows/documentation.yml

@@ -32,7 +32,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
 

.forgejo/workflows/element.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
 

.forgejo/workflows/release-image.yml

@@ -218,7 +218,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           draft: true
           files: binaries/*

CONTRIBUTING.md

@@ -26,7 +26,7 @@ ### Pre-commit Checks
 
 
 ```bash
-# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
+# Install prek using cargo-binstall
 cargo binstall prek
 
 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests
 
 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](docs/development/code_style.mdx)
+2. Your code follows the [code style guide](/development/code_style.md)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed

Cargo.lock

@@ -1801,7 +1801,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2443,9 +2443,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.4"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
@@ -3345,7 +3345,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3459,7 +3459,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",
  "chrono",
  "getrandom 0.2.17",
  "http",
@@ -4844,14 +4844,14 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -4903,7 +4903,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5214,7 +5214,7 @@ checksum = "7bd22781911de0ca6debda95f073c8f18bec65d1a94f1fa9573f3102e514cea4"
 dependencies = [
  "ahash",
  "annotate-snippets",
- "base64 0.22.1",
+ "base64 0.21.7",
  "encoding_rs_io",
  "getrandom 0.3.4",
  "granit-parser",
@@ -5552,7 +5552,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6671,7 +6671,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]

changelog.d/+df2f1c78.bugfix.md

@@ -1 +0,0 @@
-Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.

changelog.d/1965.bugfix

@@ -1 +0,0 @@
-Fixed the deeplink redirect for deleting devices. Contributed by @koen

changelog.d/1984.bugfix

@@ -1 +0,0 @@
-Fix status code for oauth registration. Contributed by @n00byking

changelog.d/1987.bugfix

@@ -1 +0,0 @@
-Exempt m.room.create from auth_events check. Contributed by @eleboucher

docs/public/.well-known/continuwuity/announcements

@@ -6,10 +6,10 @@
             "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
         },
         {
-            "id": 16,
+            "id": 15,
             "mention_room": true,
-            "date": "2026-07-13",
-            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
+            "date": "2026-07-10",
+            "message": "[Continuwuity 26.6.1](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release contains a bunch of bugfixes for bugs found initially after 26.6.0's release - please read the changelog before updating!"
         }
     ]
 }

src/api/client/oauth/register_client.rs

@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;
 
-	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
+	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
 }

src/api/router/args.rs

@@ -15,9 +15,10 @@
 #[derive(Deserialize)]
 pub(crate) struct AuthQueryParams {
 	pub(super) user_id: Option<String>,
+	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
+	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
+	#[serde(alias = "org.matrix.msc3202.device_id")]
 	pub(super) device_id: Option<String>,
-	#[serde(rename = "org.matrix.msc3202.device_id")]
-	pub(super) legacy_device_id: Option<String>,
 }
 
 /// Extractor for Ruma request structs

src/api/router/auth.rs

@@ -219,29 +219,25 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
 			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device = if let Some(device_id) = query
-				.device_id
-				.or(query.legacy_device_id)
-				.as_deref()
-				.map(Into::into)
-			{
-				// Verify the device exists for this user
-				if services
-					.users
-					.get_device_metadata(&sender_user, device_id)
-					.await
-					.is_err()
-				{
-					return Err!(Request(Forbidden(
-						"Device does not exist for user or appservice cannot masquerade as this \
-						 device."
-					)));
-				}
+			let sender_device =
+				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
+					// Verify the device exists for this user
+					if services
+						.users
+						.get_device_metadata(&sender_user, device_id)
+						.await
+						.is_err()
+					{
+						return Err!(Request(Forbidden(
+							"Device does not exist for user or appservice cannot masquerade as \
+							 this device."
+						)));
+					}
 
-				Some(device_id.to_owned())
-			} else {
-				None
-			};
+					Some(device_id.to_owned())
+				} else {
+					None
+				};
 
 			Ok(ClientIdentity::Appservice {
 				sender_user,

src/service/rooms/event_handler/pdu_checks.rs

@@ -6,9 +6,8 @@
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, ServerName,
-	api::error::ErrorKind, canonical_json::redact, events::StateEventType,
-	room_version_rules::RoomVersionRules,
+	CanonicalJsonObject, EventId, OwnedEventId, ServerName, api::error::ErrorKind,
+	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
 };
 
 use crate::rooms::{
@@ -43,27 +42,11 @@ pub fn pdu_format_check_1(
 			return Err!(Request(BadJson("PDU has too many auth events")));
 		}
 
-		// The m.room.create event is the genesis event and has empty auth_events
-		// by definition, so it is exempt from the checks below requiring or
-		// forbidding the create event in auth_events (it cannot reference itself).
-		let Some(event_type) = pdu_json.get("type").and_then(CanonicalJsonValue::as_str) else {
-			return Err!(Request(BadJson("PDU is missing a type")));
-		};
-		let state_key = pdu_json
-			.get("state_key")
-			.and_then(CanonicalJsonValue::as_str);
-
-		let is_create_event = event_type == "m.room.create" && state_key == Some("");
-
-		if !is_create_event {
-			let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
-			if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
-				return Err!(Request(BadJson("PDU references a create event")));
-			} else if event_format.allow_room_create_in_auth_events
-				&& !create_event_in_auth_events
-			{
-				return Err!(Request(BadJson("PDU does not reference the room create event")));
-			}
+		let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
+		if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
+			return Err!(Request(BadJson("PDU references a create event")));
+		} else if event_format.allow_room_create_in_auth_events && !create_event_in_auth_events {
+			return Err!(Request(BadJson("PDU does not reference the room create event")));
 		}
 
 		let prev_events = expect_event_id_array(pdu_json, "prev_events")?;

src/web/pages/account/mod.rs

@@ -155,7 +155,7 @@ async fn get_account_deeplink(
 				));
 			};
 
-			format!("device/{device_id}/remove")
+			format!("device/{device_id}/delete")
 		},
 		| AccountManagementAction::DeviceView => {
 			let Some(device_id) = query.device_id else {