From c3adef6578f3d6b0d61f53b9c72c41ba879404c0 Mon Sep 17 00:00:00 2001 From: Bardi Harborow Date: Thu, 22 Oct 2026 11:29:23 +1100 Subject: [PATCH 1/3] security: update certifi to 2026.10.19 (#20387) Updates `certifi` to 2026.10.19 to address [GHSA-6q48-6c7w-9gw2](https://github.com/advisories/GHSA-6q48-6c7w-9gw2). certifi before 2026.10.19 bundles `emSign ECC Root CA - G3`, which chains to the compromised eMudhra intermediate CAs. This only affects TLS connections made by the Sentry SDK when `sentry` is configured, as `sentry_sdk`'s transport is the only runtime user of certifi. Federation and Synapse's other outbound HTTP requests use the system trust store via `platformTrust()`. Python advisory: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 --------- Signed-off-by: Bardi Harborow --- changelog.d/20387.misc | 1 + poetry.lock | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) create mode 100644 changelog.d/20387.misc diff --git a/changelog.d/20387.misc b/changelog.d/20387.misc new file mode 100644 index 0000000000..12270904f9 --- /dev/null +++ b/changelog.d/20387.misc @@ -0,0 +1 @@ +Update `certifi` to `2026.10.19` to address [GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2). This only affects TLS connections made by the Sentry SDK when `sentry` is configured, SAML, and a couple utility scripts; federation and Synapse's other outbound HTTP requests use the system trust store. diff --git a/poetry.lock b/poetry.lock index 2649e2450d..9342f4318d 100644 --- a/poetry.lock +++ b/poetry.lock @@ -205,14 +205,14 @@ files = [ [[package]] name = "certifi" -version = "2026.2.25" +version = "2026.10.19" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.7" groups = ["main", "dev"] files = [ - {file = "certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa"}, - {file = "certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7"}, + {file = "certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"}, + {file = "certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"}, ] [[package]] From 3f2bef9429f01b06d2417c42a3f240035e4b55fa Mon Sep 17 00:00:00 2001 From: Eric Eastwood Date: Thu, 22 Oct 2026 09:49:50 -0500 Subject: [PATCH 2/3] Update `rustls-webpki` to distrust eMudhra Intermediate certificates (#20392) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `rustls-webpki` releasenotes: https://github.com/rustls/webpki/releases/tag/v%2F0.103.16 Part of https://github.com/element-hq/backend-internal/issues/306 Related to https://github.com/element-hq/synapse/pull/20387 We already use the system CA store when making requests in our Rust code (using the [`rustls-tls-native-roots`](https://github.com/element-hq/synapse/blob/7c85c80033ea5c3ca3851f3dab1d0397b94d5183/rust/Cargo.toml#L61) ([docs](https://docs.rs/reqwest/0.12.28/reqwest/#optional-features)) feature with `reqwest`). For a system that already has a patched system CA store, bumping `rustls-webpki` is simply extra protection as it actively blocks those untrusted certs. For an unpatched system CA store, this provides a stop-gap. ### Dev notes ```shell $ cargo tree --invert rustls-webpki rustls-webpki v0.103.16 └── rustls v0.23.45 ├── hyper-rustls v0.27.7 │ └── reqwest v0.12.28 │ └── synapse v0.1.0 (/home/eric/Documents/github/element/synapse/rust) ├── reqwest v0.12.28 (*) └── tokio-rustls v0.26.2 ├── hyper-rustls v0.27.7 (*) └── reqwest v0.12.28 (*) ``` --- Cargo.lock | 4 ++-- changelog.d/20392.misc | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 changelog.d/20392.misc diff --git a/Cargo.lock b/Cargo.lock index a609527b59..99ce53d6d2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1201,9 +1201,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.14" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", diff --git a/changelog.d/20392.misc b/changelog.d/20392.misc new file mode 100644 index 0000000000..b068bdb0ec --- /dev/null +++ b/changelog.d/20392.misc @@ -0,0 +1 @@ +Bump `rustls-webpki` to `0.103.16` to actively distrust [compromised eMudhra intermediate CA certificates](https://emudhra.we-have-a-problem.com/). From 56913c3d7187704538b7c7d34ee56bd14d6db2bf Mon Sep 17 00:00:00 2001 From: Eric Eastwood Date: Thu, 22 Oct 2026 14:01:36 -0500 Subject: [PATCH 3/3] 1.163.1 --- CHANGES.md | 10 ++++++++++ changelog.d/20387.misc | 1 - changelog.d/20392.misc | 1 - debian/changelog | 6 ++++++ pyproject.toml | 2 +- 5 files changed, 17 insertions(+), 3 deletions(-) delete mode 100644 changelog.d/20387.misc delete mode 100644 changelog.d/20392.misc diff --git a/CHANGES.md b/CHANGES.md index f4f498ea93..d9c19dfab0 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,13 @@ +# Synapse 1.163.1 (2026-10-22) + +## Internal Changes + +- Update `certifi` to `2026.10.19` to address [GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2). This only affects TLS connections made by the Sentry SDK when `sentry` is configured, SAML, and a couple utility scripts; federation and Synapse's other outbound HTTP requests use the system trust store. ([\#20387](https://github.com/element-hq/synapse/issues/20387)) +- Bump `rustls-webpki` to `0.103.16` to actively distrust [compromised eMudhra intermediate CA certificates](https://emudhra.we-have-a-problem.com/). ([\#20392](https://github.com/element-hq/synapse/issues/20392)) + + + + # Synapse 1.163.0 (2026-10-14) ## Bugfixes diff --git a/changelog.d/20387.misc b/changelog.d/20387.misc deleted file mode 100644 index 12270904f9..0000000000 --- a/changelog.d/20387.misc +++ /dev/null @@ -1 +0,0 @@ -Update `certifi` to `2026.10.19` to address [GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2). This only affects TLS connections made by the Sentry SDK when `sentry` is configured, SAML, and a couple utility scripts; federation and Synapse's other outbound HTTP requests use the system trust store. diff --git a/changelog.d/20392.misc b/changelog.d/20392.misc deleted file mode 100644 index b068bdb0ec..0000000000 --- a/changelog.d/20392.misc +++ /dev/null @@ -1 +0,0 @@ -Bump `rustls-webpki` to `0.103.16` to actively distrust [compromised eMudhra intermediate CA certificates](https://emudhra.we-have-a-problem.com/). diff --git a/debian/changelog b/debian/changelog index 0552032bce..728206359d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +matrix-synapse-py3 (1.163.1) stable; urgency=medium + + * New synapse release 1.163.1. + + -- Synapse Packaging team Thu, 22 Oct 2026 19:01:11 +0000 + matrix-synapse-py3 (1.163.0) stable; urgency=medium * New synapse release 1.163.0. diff --git a/pyproject.toml b/pyproject.toml index bbb27a8507..308a550eed 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "matrix-synapse" -version = "1.163.0" +version = "1.163.1" description = "Homeserver for the Matrix decentralised comms protocol" readme = "README.rst" authors = [