From 4a15ec41b028ec4162229bb1491f06e550e95b33 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 14:41:23 +0000 Subject: [PATCH 1/4] Bump log from 0.4.33 to 0.4.34 in the patches group (#20195) Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6062122c15..13228a5542 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -750,9 +750,9 @@ checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956" [[package]] name = "log" -version = "0.4.33" +version = "0.4.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" +checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6" [[package]] name = "lru-slab" From ca02ad7cca32d02809fce03d5c940c07c45c1379 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 15:09:54 +0000 Subject: [PATCH 2/4] Bump gitpython from 3.1.58 to 3.1.59 (#20199) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.58 to 3.1.59.
Release notes

Sourced from gitpython's releases.

3.1.59 - Security

What's Changed

Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.58...3.1.59

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gitpython&package-manager=pip&previous-version=3.1.58&new-version=3.1.59)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/element-hq/synapse/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/poetry.lock b/poetry.lock index 508379acd5..572cd5d195 100644 --- a/poetry.lock +++ b/poetry.lock @@ -583,14 +583,14 @@ smmap = ">=3.0.1,<6" [[package]] name = "gitpython" -version = "3.1.58" +version = "3.1.62" description = "GitPython is a Python library used to interact with Git repositories" optional = false python-versions = ">=3.7" groups = ["dev"] files = [ - {file = "gitpython-3.1.58-py3-none-any.whl", hash = "sha256:d331e722577f0fd7fc1f857419b3ecc07af66282b933d2a4d95f84a042fdd50f"}, - {file = "gitpython-3.1.58.tar.gz", hash = "sha256:621416df10ef3fd0e19fabf9172ddeed0fa704d353d04f194eec56a625a95b22"}, + {file = "gitpython-3.1.62-py3-none-any.whl", hash = "sha256:7002251225e10e29d2e1f49e6532613fe5d5d9f0b6f1f02997a52b38fe56899e"}, + {file = "gitpython-3.1.62.tar.gz", hash = "sha256:1791de66309bc0c7cfca40bf8d2e3de7ca091cbf94e6051be1ad0722c61062af"}, ] [package.dependencies] From c69d7eeb592dec24816a96365508eaeb16204c0b Mon Sep 17 00:00:00 2001 From: Ben Banfield-Zanin Date: Thu, 10 Sep 2026 13:50:42 +0100 Subject: [PATCH 3/4] Document MAS admin APIs as being workerisable (#20209) ### Pull Request Checklist Replacement for https://github.com/element-hq/synapse/pull/19752 as that has bit-rotted with https://github.com/element-hq/synapse/pull/19895 being merged. `/_synapse/mas` is mounted on a worker on matrix.org and can be seen to be workerisable via * https://github.com/element-hq/synapse/blob/v1.160.0/synapse/app/generic_worker.py#L202 * https://github.com/element-hq/synapse/blob/v1.160.0/synapse/rest/synapse/client/__init__.py#L71 * https://github.com/element-hq/synapse/blob/v1.160.0/synapse/rest/synapse/mas/__init__.py#L46-L71 * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters)) --- changelog.d/20209.doc | 1 + docs/workers.md | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 changelog.d/20209.doc diff --git a/changelog.d/20209.doc b/changelog.d/20209.doc new file mode 100644 index 0000000000..cfee70c67c --- /dev/null +++ b/changelog.d/20209.doc @@ -0,0 +1 @@ +Document the paths that can be handled on workers with stabilised delegated authentication. diff --git a/docs/workers.md b/docs/workers.md index 8959becea6..5914b9d1cb 100644 --- a/docs/workers.md +++ b/docs/workers.md @@ -291,6 +291,9 @@ information. # Unstable MSC4140 support ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events(/.*/restart)?$ + # Stabilised Delegated Authentication support (`matrix_authentication_service.enabled: true`) + ^/_synapse/mas/ + Additionally, the following REST endpoints can be handled for GET requests: # Push rules requests @@ -315,7 +318,7 @@ for the room are in flight: Additionally, the following endpoints should be included if Synapse is configured to use SSO (you only need to include the ones for whichever SSO provider you're -using): +using) and delegated authentication isn't enabled: # for all SSO providers ^/_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect From f7cd91f6b0dc5e771ef01caf1680c4ab3a572fcc Mon Sep 17 00:00:00 2001 From: Ben Banfield-Zanin Date: Thu, 10 Sep 2026 17:25:24 +0100 Subject: [PATCH 4/4] Document that the new get single delayed event endpoint is workerisable (#20210) ### Pull Request Checklist Missed off of https://github.com/element-hq/synapse/pull/19926/changes IMO. My reading of https://github.com/element-hq/synapse/blob/v1.161.0rc1/synapse/rest/client/delayed_events.py is that the new endpoint (pattern `r"/org\.matrix\.msc4140/delayed_events/(?P[^/]+)$"` is workerisable) given how `register_servlets` flows. However given `UpdateDelayedEventServlet` covers the same pattern but for `POST` requests, this should go in the `GET` only part of the documentation. * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters)) --- changelog.d/20210.doc | 1 + docs/workers.md | 3 +++ 2 files changed, 4 insertions(+) create mode 100644 changelog.d/20210.doc diff --git a/changelog.d/20210.doc b/changelog.d/20210.doc new file mode 100644 index 0000000000..3b0f828036 --- /dev/null +++ b/changelog.d/20210.doc @@ -0,0 +1 @@ +Document the endpoint for getting a single delayed event is workerisable. diff --git a/docs/workers.md b/docs/workers.md index 5914b9d1cb..5587ba9c6d 100644 --- a/docs/workers.md +++ b/docs/workers.md @@ -309,6 +309,9 @@ Additionally, the following REST endpoints can be handled for GET requests: # Admin API requests ^/_synapse/admin/v2/users/[^/]+$ + # Unstable MSC4140 support + ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events/[^/]+$ + Pagination requests can also be handled, but all requests for a given room must be routed to the same instance. Additionally, care must be taken to ensure that the purge history admin API is not used while pagination requests