diff --git a/CHANGES.md b/CHANGES.md index b1ca809782..3fc615c65c 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,13 @@ +# Synapse 1.163.1 (2026-10-22) + +## Internal Changes + +- Update `certifi` to `2026.10.19` to address [GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2). This only affects TLS connections made by the Sentry SDK when `sentry` is configured, SAML, and a couple utility scripts; federation and Synapse's other outbound HTTP requests use the system trust store. ([\#20387](https://github.com/element-hq/synapse/issues/20387)) +- Bump `rustls-webpki` to `0.103.16` to actively distrust [compromised eMudhra intermediate CA certificates](https://emudhra.we-have-a-problem.com/). ([\#20392](https://github.com/element-hq/synapse/issues/20392)) + + + + # Synapse 1.164.0rc1 (2026-10-20) ## Features @@ -57,6 +67,7 @@ + # Synapse 1.163.0 (2026-10-14) ## Bugfixes diff --git a/debian/changelog b/debian/changelog index 735acf05cf..84d50511be 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +matrix-synapse-py3 (1.163.1) stable; urgency=medium + + * New synapse release 1.163.1. + + -- Synapse Packaging team Thu, 22 Oct 2026 19:01:11 +0000 + matrix-synapse-py3 (1.164.0~rc1) stable; urgency=medium * Stop preinstalling the unused Python lxml package. diff --git a/pyproject.toml b/pyproject.toml index 23c1e22500..e9da4e0ce0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ version = "1.164.0rc1" description = "Homeserver for the Matrix decentralised comms protocol" readme = "README.rst" authors = [ - { name = "Matrix.org Team and Contributors", email = "packages@matrix.org" } + { name = "Matrix.org Team and Contributors", email = "packages@matrix.org" }, ] requires-python = ">=3.10.0,<4.0.0" license = "AGPL-3.0-or-later OR LicenseRef-Element-Commercial" @@ -105,12 +105,12 @@ dependencies = [ # for these dependencies than the minimum specified by the direct dependency. # We should periodically check to see if these dependencies are still necessary and # remove any that are no longer required. - "cffi>=1.15", # via cryptography - "pynacl>=1.3", # via signedjson - "pyparsing>=2.4", # via packaging - "pyrsistent>=0.18.0", # via jsonschema - "requests>=2.16.0", # 2.16.0+ no longer vendors urllib3, avoiding Python 3.10+ incompatibility - "urllib3>=1.26.5", # via treq; 1.26.5 fixes Python 3.10+ collections.abc compatibility + "cffi>=1.15", # via cryptography + "pynacl>=1.3", # via signedjson + "pyparsing>=2.4", # via packaging + "pyrsistent>=0.18.0", # via jsonschema + "requests>=2.16.0", # 2.16.0+ no longer vendors urllib3, avoiding Python 3.10+ incompatibility + "urllib3>=1.26.5", # via treq; 1.26.5 fixes Python 3.10+ collections.abc compatibility # 5.2 is the current version in Debian oldstable. If we don't care to support that, then 5.4 is # the minimum version from Ubuntu 22.04 and RHEL 9. (as of 2025-12) # When bumping this version to 6.2 or above, refer to https://github.com/element-hq/synapse/pull/19274 @@ -134,7 +134,7 @@ saml2 = [ # However, in order for Synapse to build, Synapse requires a higher minimum version # for these dependencies than the minimum specified by the direct dependency. "defusedxml>=0.7.1", # via pysaml2 - "pytz>=2018.3", # via pysaml2 + "pytz>=2018.3", # via pysaml2 ] oidc = ["authlib>=0.15.1"] url-preview = ["beautifulsoup4>=4.13.0"] @@ -147,8 +147,8 @@ opentracing = [ # These dependencies aren't directly required by Synapse. # However, in order for Synapse to build, Synapse requires a higher minimum version # for these dependencies than the minimum specified by the direct dependency. - "thrift>=0.10", # via jaeger-client - "tornado>=6.0", # via jaeger-client + "thrift>=0.10", # via jaeger-client + "tornado>=6.0", # via jaeger-client ] jwt = ["authlib"] redis = [ @@ -161,7 +161,7 @@ redis = [ "txredisapi>=1.4.12,<1.6.0", # hiredis is not a *strict* dependency, but it makes things much faster. # (if it is not installed, we fall back to slow code.) - "hiredis>=0.3" + "hiredis>=0.3", ] # Required to use experimental `caches.track_memory_usage` config option. cache-memory = ["pympler>=1.0"] @@ -193,9 +193,11 @@ all = [ # sentry "sentry-sdk>=0.7.2", # opentracing - "jaeger-client>=4.2.0", "opentracing>=2.2.0", + "jaeger-client>=4.2.0", + "opentracing>=2.2.0", # redis - "txredisapi>=1.4.12,<1.6.0", "hiredis>=0.3", + "txredisapi>=1.4.12,<1.6.0", + "hiredis>=0.3", # cache-memory # 1.0 added support for python 3.10, our current minimum supported python version "pympler>=1.0", @@ -207,9 +209,9 @@ all = [ # However, in order for Synapse to build, Synapse requires a higher minimum version # for these dependencies than the minimum specified by the direct dependency. "defusedxml>=0.7.1", # via pysaml2 - "pytz>=2018.3", # via pysaml2 - "thrift>=0.10", # via jaeger-client - "tornado>=6.0", # via jaeger-client + "pytz>=2018.3", # via pysaml2 + "thrift>=0.10", # via jaeger-client + "tornado>=6.0", # via jaeger-client ] [project.urls] @@ -313,46 +315,43 @@ dev = [ "sqlglot>=28.0.0", ] # Dependencies for building Synapse's documentation. -docs = [ - "packaging>=20.0", - "GitPython>=3.1.20", -] +docs = ["packaging>=20.0", "GitPython>=3.1.20"] [tool.towncrier] - package = "synapse" - filename = "CHANGES.md" - directory = "changelog.d" - issue_format = "[\\#{issue}](https://github.com/element-hq/synapse/issues/{issue})" +package = "synapse" +filename = "CHANGES.md" +directory = "changelog.d" +issue_format = "[\\#{issue}](https://github.com/element-hq/synapse/issues/{issue})" - [[tool.towncrier.type]] - directory = "feature" - name = "Features" - showcontent = true +[[tool.towncrier.type]] +directory = "feature" +name = "Features" +showcontent = true - [[tool.towncrier.type]] - directory = "bugfix" - name = "Bugfixes" - showcontent = true +[[tool.towncrier.type]] +directory = "bugfix" +name = "Bugfixes" +showcontent = true - [[tool.towncrier.type]] - directory = "docker" - name = "Updates to the Docker image" - showcontent = true +[[tool.towncrier.type]] +directory = "docker" +name = "Updates to the Docker image" +showcontent = true - [[tool.towncrier.type]] - directory = "doc" - name = "Improved Documentation" - showcontent = true +[[tool.towncrier.type]] +directory = "doc" +name = "Improved Documentation" +showcontent = true - [[tool.towncrier.type]] - directory = "removal" - name = "Deprecations and Removals" - showcontent = true +[[tool.towncrier.type]] +directory = "removal" +name = "Deprecations and Removals" +showcontent = true - [[tool.towncrier.type]] - directory = "misc" - name = "Internal Changes" - showcontent = true +[[tool.towncrier.type]] +directory = "misc" +name = "Internal Changes" +showcontent = true [tool.ruff] line-length = 88 @@ -367,11 +366,7 @@ target-version = "py310" # flake8-bugbear compatible checks. Its error codes are described at # https://beta.ruff.rs/docs/rules/#flake8-bugbear-b # B023: Functions defined inside a loop must not use variables redefined in the loop -ignore = [ - "B023", - "E501", - "E731", -] +ignore = ["B023", "E501", "E731"] select = [ # pycodestyle "E", @@ -405,12 +400,20 @@ extend-safe-fixes = [ # pyupgrade rules compatible with Python >= 3.9 "UP006", # Allow ruff to automatically fix trailing spaces within a multi-line string/comment. - "W293" + "W293", ] [tool.ruff.lint.isort] combine-as-imports = true -section-order = ["future", "standard-library", "third-party", "twisted", "first-party", "testing", "local-folder"] +section-order = [ + "future", + "standard-library", + "third-party", + "twisted", + "first-party", + "testing", + "local-folder", +] known-first-party = ["synapse"] [tool.ruff.lint.isort.sections] @@ -456,9 +459,7 @@ include = [ { path = "rust/build.rs", format = "sdist" }, { path = "rust/src/**", format = "sdist" }, ] -exclude = [ - { path = "synapse/*.so", format = "sdist" }, -] +exclude = [{ path = "synapse/*.so", format = "sdist" }] [build-system] # The upper bounds here are defensive, intended to prevent situations like @@ -493,8 +494,8 @@ skip = "cp3??t-* *i686* *macosx*" enable = "pypy" # We need a rust compiler. -before-all = "sh .ci/before_build_wheel.sh" -environment= { PATH = "$PATH:$HOME/.cargo/bin" } +before-all = "sh .ci/before_build_wheel.sh" +environment = { PATH = "$PATH:$HOME/.cargo/bin" } # For some reason if we don't manually clean the build directory we # can end up polluting the next build with a .so that is for the wrong