docs: Add back binstall with a link to the deps

See RFC 7591 at 3.2.1: "The server responds with an HTTP 201 Created status code [...]"

Fixes a failure in matrix-dart-sdk

.forgejo/actions/timelord/action.yml

@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
+      uses: https://github.com/taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 

.forgejo/workflows/build-nix.yml

@@ -65,7 +65,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           draft: true
           files: binaries/*

.forgejo/workflows/documentation.yml

@@ -32,7 +32,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
 

.forgejo/workflows/element.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "22"
 

.forgejo/workflows/release-image.yml

@@ -218,7 +218,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           draft: true
           files: binaries/*

CONTRIBUTING.md

@@ -26,7 +26,7 @@ ### Pre-commit Checks
 
 
 ```bash
-# Install prek using cargo-binstall
+# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
 cargo binstall prek
 
 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests
 
 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](/development/code_style.md)
+2. Your code follows the [code style guide](docs/development/code_style.mdx)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed

Cargo.lock

@@ -2443,9 +2443,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
  "bytes",
  "futures-core",
@@ -4849,9 +4849,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.41"
+version = "0.23.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
 dependencies = [
  "aws-lc-rs",
  "log",

changelog.d/1984.bugfix

@@ -0,0 +1 @@
+Fix status code for oauth registration. Contributed by @n00byking

changelog.d/1987.bugfix

@@ -0,0 +1 @@
+Exempt m.room.create from auth_events check. Contributed by @eleboucher

src/api/client/oauth/register_client.rs

@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;
 
-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
+	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
 }

src/service/rooms/event_handler/pdu_checks.rs

@@ -6,8 +6,9 @@
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, EventId, OwnedEventId, ServerName, api::error::ErrorKind,
+	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, ServerName,
-	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
+	api::error::ErrorKind, canonical_json::redact, events::StateEventType,
+	room_version_rules::RoomVersionRules,
 };
 
 use crate::rooms::{
@@ -42,12 +43,28 @@ pub fn pdu_format_check_1(
 			return Err!(Request(BadJson("PDU has too many auth events")));
 		}
 
+		// The m.room.create event is the genesis event and has empty auth_events
+		// by definition, so it is exempt from the checks below requiring or
+		// forbidding the create event in auth_events (it cannot reference itself).
+		let Some(event_type) = pdu_json.get("type").and_then(CanonicalJsonValue::as_str) else {
+			return Err!(Request(BadJson("PDU is missing a type")));
+		};
+		let state_key = pdu_json
+			.get("state_key")
+			.and_then(CanonicalJsonValue::as_str);
+
+		let is_create_event = event_type == "m.room.create" && state_key == Some("");
+
+		if !is_create_event {
 			let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
 			if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
 				return Err!(Request(BadJson("PDU references a create event")));
-		} else if event_format.allow_room_create_in_auth_events && !create_event_in_auth_events {
+			} else if event_format.allow_room_create_in_auth_events
+				&& !create_event_in_auth_events
+			{
 				return Err!(Request(BadJson("PDU does not reference the room create event")));
 			}
+		}
 
 		let prev_events = expect_event_id_array(pdu_json, "prev_events")?;
 		if prev_events.len() > 20 {