Commit Graph

25727 Commits

Author SHA1 Message Date
Eric Eastwood 22f4f2004f Updated comment 2026-05-04 18:24:39 -05:00
Eric Eastwood 336b686300 Fix test lints 2026-05-04 17:58:44 -05:00
Eric Eastwood a088aa8089 Sanitize invite_room_state received over federation 2026-05-04 17:54:06 -05:00
Eric Eastwood f96c0086f7 Invite event should be stripped when included in invite_state 2026-05-04 16:03:57 -05:00
Eric Eastwood 3464ec8894 Use get_stripped_room_state_ids_from_event_context 2026-05-01 19:53:45 -05:00
Eric Eastwood e0eb224cfa Iteration that uses current state 2026-05-01 19:37:35 -05:00
Eric Eastwood 6026aaa9fd Non-working: Use full PDU's for invite_room_state in federation 2026-05-01 19:16:25 -05:00
Eric Eastwood 7f2512076a Merge branch 'develop' into madlittlemods/remove-flawed-msc4311-partial-implementation 2026-05-01 18:23:10 -05:00
Eric Eastwood 6100f6e4f7 Backfill from nearby points past pagination token (#19611)
The juicy details and explanation are in the diff itself.

Split out from https://github.com/element-hq/synapse/pull/18873 in order
to fix paginating from
[MSC3871](https://github.com/matrix-org/matrix-spec-proposals/pull/3871)
gap tokens actually backfilling history. To be clear, this is a good
change to make outside of the
[MSC3871](https://github.com/matrix-org/matrix-spec-proposals/pull/3871)
use case. For example (as the new Complement test shows), fixes a
problem where if you try to paginate `/messages` from tokens returned by
`/context`, we could fail to backfill anything new and hide away
history.

Also fixes https://github.com/matrix-org/complement/pull/853
2026-05-01 11:42:00 -05:00
dependabot[bot] 697ef33dcb Bump gitpython from 3.1.46 to 3.1.47 (#19731)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-01 09:38:32 +00:00
dependabot[bot] b8d7324373 Bump the minor-and-patches group across 1 directory with 3 updates (#19736)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-01 09:22:27 +00:00
Noah Markert 2e7019ebc8 Expose tombstone status in room details (#19737)
Exposes `tombstoned` and `replacement_room` in room details on admin API
endpoint `GET /_synapse/admin/v1/rooms/<room_id>`. Resolves #18347
2026-04-30 13:37:40 +01:00
dependabot[bot] 8fc23aa665 Bump pillow from 12.1.1 to 12.2.0 (#19686) 2026-04-29 20:16:11 +01:00
Olivier 'reivilibre c376cdd2ee Configure Dependabot to only update Python dependencies in the lockfile. (#19743)
See:
- https://github.com/element-hq/synapse/pull/19742
- https://github.com/element-hq/synapse/pull/19686

(etc)

Documentation
https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy--

We were considering `lockfile-only` but it sounds like
`increase-if-necessary` would increase the upper bound for us, if we had
one. Let's try it.

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-04-29 18:17:53 +01:00
Oleg Girko ed3cafdb73 Partially revert "Bump authlib from 1.6.9 to 1.6.11 (#19703)" (#19742)
The original commit should only have changed the lockfile.

This reverts commit bdb1cf7416 (from
https://github.com/element-hq/synapse/pull/19703).

---------

Co-authored-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-04-29 18:03:58 +01:00
Erik Johnston 76b4fdceed Add a canonical JSON impl (#19739)
This comes from
https://github.com/erikjohnston/rust-signed-json/blob/main/src/json.rs.
We need to be able to serialise canonical JSON in Rust to be able to
calculate event IDs once we port the event class to Rust.

We could instead make the above a properly published crate, but feels
easier to pull it into Synapse utils.
2026-04-28 17:46:03 +01:00
Olivier 'reivilibre 5e7cbfe4ae Merge branch 'master' into develop 2026-04-28 17:16:24 +01:00
Olivier 'reivilibre 16863c87d5 Changelog tweaks v1.152.0 2026-04-28 13:45:53 +01:00
Olivier 'reivilibre fa52c62a89 1.152.0 2026-04-28 11:47:16 +01:00
FrenchGithubUser 449b1a4234 MSC4311: invites and knocks should contain the create event (#19722)
Part of MSC4311: invites and knocks should contain the create event
(stripped state for the client API)

Part of https://github.com/element-hq/synapse/issues/19414
2026-04-27 14:04:07 -05:00
dependabot[bot] 2e9d6f7f35 Bump attrs from 25.4.0 to 26.1.0 (#19684) 2026-04-27 11:38:23 +01:00
dependabot[bot] 811e69b6cd Bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 in /complement (#19728) 2026-04-27 11:37:05 +01:00
Devon Hudson 3a26806818 Ignore received EDUs if origin server in room ACL (MSC4163) (#18475)
Implements: [MSC4163: Make ACLs apply to
EDUs](https://github.com/matrix-org/matrix-spec-proposals/pull/4163)

Part of #18118 to declare support for Matrix v1.13

Complement PR: ~~https://github.com/matrix-org/complement/pull/783~~ ->
https://github.com/matrix-org/complement/pull/862


---------

Co-authored-by: Eric Eastwood <erice@element.io>
Co-authored-by: Quentin Gliech <quenting@element.io>
2026-04-24 19:31:44 -05:00
Eric Eastwood 22e1643359 Add warning about known problems when configuring use_frozen_dicts (#19711)
Known problems: https://github.com/element-hq/synapse/issues/18117

As a follow-up, we should consider removing this config option
altogether. It's "expensive" and claims to "prevent bugs" but actually
introduces a whole new class of bugs. It could be re-introduced with a
more holistic solution to the typing. Or a completely new approach (safe
mode that blows up when someone mutates the event content, always make
deep clones when handing out references, etc)

The `use_frozen_dict` config option was there [since
inception](https://github.com/element-hq/synapse/commit/a7b65bdedf512f646a3ca2478fb96a914856de35)
but was only recently
[documented](https://github.com/element-hq/synapse/pull/18122) for
completeness sake.
2026-04-24 12:00:13 -05:00
Erik Johnston ae242fd11d Do not mutate power levels on upgrade to v12 room (#19727)
When upgrading a room to v12, we accidentally ended up mutating the
content of the old power level. Since we cache events, this meant any
future usage of the old power level event would see the wrong content
(until it dropped from the cache).

This meant that the creator of the new room would not be able to perform
admin actions on the old room. Any federation requests for the event
would fail the hash checks, since the content had been changed.

All in all, quite a nasty bug.
2026-04-24 16:36:35 +00:00
dependabot[bot] 107029da92 Bump the minor-and-patches group across 1 directory with 2 updates (#19710)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-24 10:35:00 +00:00
dasha-uwu 7fc937bac0 Stabilize MSC3266, support stable room_summary endpoint (#19720)
MSC3266 is merged in v1.15, let's stabilize it as part of #18731

1. Add support for the stable `/_matrix/client/v1/room_summary/`
endpoint, keeping both unstable endpoints for compat
2. Remove the experimental `msc3266_enabled` flag
2026-04-24 11:33:08 +01:00
dependabot[bot] a6b53209c3 Bump rustls-webpki from 0.103.10 to 0.103.13 (#19717)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-24 10:24:01 +00:00
Benjamin Bouvier 2691d0b8b1 Send a SSS response immediately if the config has changed and there are new results to sync (#19714)
This fixes the bug described in #19713 (and double-checked against the
SDK integration test, which now passes with this change). A sync
response must be returned immediately if a room subscription
configuration change caused a new non-empty response (checked with `if
response` in the code) to be produced.

Fixes #19713.
Fixes #18844.

---------

Co-authored-by: Erik Johnston <erik@matrix.org>
2026-04-24 10:18:05 +00:00
dependabot[bot] 213b5a0e4d Bump python-multipart from 0.0.22 to 0.0.26 (#19700)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Morgan <andrew@amorgan.xyz>
2026-04-24 09:04:36 +00:00
Eric Eastwood 43a11f5a50 Add changelog 2026-04-23 12:29:51 -05:00
Eric Eastwood bdfeb90e6e Client side API's should still use stripped events with MSC4311 2026-04-23 12:18:04 -05:00
Jason Little 93e0497fc3 Avoid a M_FORBIDDEN response when a user tries to erase their account and profile updates are disabled (#19398)
Currently synapse returns `M_FORBIDDEN` when trying to use the account
deactivation API, if the server admin disabled displayname changes. This
is undesirable, since it prevents GDPR erasure without admin
interaction. The admin API seems to work fine though. This also only
seems to affect the deactivate API, when the erase flag is true.

Relevant endpoint:
https://spec.matrix.org/latest/client-server-api/#post_matrixclientv3accountdeactivate

This change only removes the checked for condition that the displayname
and profile avatar are allowed to be changed per the configuration
setting. If a user is deleting themselves, why is that denied?

There did not seem to be a basic test for this endpoint that checks the
`erase` usage, so that was added as well as checking the above mentioned
behavior.
2026-04-23 17:04:48 +01:00
Olivier 'reivilibre 613cb4df1c Pruning data is a feature v1.152.0rc1 2026-04-22 12:09:35 +01:00
Olivier 'reivilibre 2e0905e4c4 fixup! 1.152.0rc1 (3rd try) 2026-04-22 12:08:19 +01:00
Olivier 'reivilibre b07a7cc285 1.152.0rc1 (3rd try) 2026-04-22 12:05:39 +01:00
Olivier 'reivilibre fbaff67e1b Merge branch 'develop' into release-v1.152 2026-04-22 12:01:44 +01:00
Erik Johnston c8ce96f504 Reinstate removed EventBase methods (#19712)
Both `__getitem__` and `.user_id` were removed in #19680 to simplify the
event class. However, `EventBase` is exposed to modules who might also
make use of those methods, so let's reinstate them (but otherwise not
reinstate the usage of them in the code).
2026-04-22 11:43:59 +01:00
Erik Johnston 3cdae2e278 Fix race in new pruning of device lists tables. (#19709)
Follows on from #19473.

We should be recording where we have deleted up to in the same
transaction as we perform the delete, rather than at the end. This code
only starts deleting rows after a month (and the original PR isn't in a
release yet), so no server should have run into this problem yet.

Also let's log more regularly, as the initial set of deletions will
likely take a long time.
2026-04-21 11:39:39 +01:00
Andrew Morgan a9361c4f51 Bail out if admin_unsafely_bypass_quarantine was used by a non-admin (#19639) 2026-04-17 15:27:41 +00:00
Eric Eastwood 67b4d8e7e3 Add docs for what to document about a new stream (#19696)
Spawning from the follow-up necessary when adding a new stream
(https://github.com/element-hq/synapse/pull/19694)
2026-04-17 09:50:37 -05:00
Erik Johnston 2a8285931e Prune old rows in device_lists_changes_in_room table. (#19473)
Fixes #13043

The usages of the table mostly already correctly handled if we don't
have old entries, as that was needed when we first added the table.

I arbitrarily set the prune time to 30 days. The only use for old
entries is for sync streams that haven't synced since then, and we
should very rarely see sync streams that haven't been used in 30 days.

Reviewable commit-by-commit.

---------

Co-authored-by: Olivier 'reivilibre' <oliverw@element.io>
Co-authored-by: Olivier 'reivilibre' <olivier@librepush.net>
2026-04-17 11:54:22 +01:00
Shay 647fb59190 Add Admin API endpoints to manage user reports (#19657)
Adds [Admin
API](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html)
endpoints to list, fetch and delete user reports from the homeserver.
Follows on from #18120, which added the endpoints to report users.
2026-04-17 11:01:23 +01:00
dependabot[bot] bdb1cf7416 Bump authlib from 1.6.9 to 1.6.11 (#19703) 2026-04-17 10:57:38 +01:00
Kegan Dougal 15c03b9689 MSC4242: State DAGs (CSAPI) (#19424)
This implements [MSC4242: State
DAGs](https://github.com/matrix-org/matrix-spec-proposals/pull/4242),
without support for federation.

A general overview:
 - It adds a new room version and new event type.
 - It adds a new field `calculated_auth_event_ids` to internal metadata.
- It stores the state DAG via new state DAG edges / forward extremities
tables.
 - It adds new auth rules as per the MSC.
- It uses the new `prev_state_events` field instead of
`prev_event_ids()` when doing state resolution.

Complement tests: https://github.com/matrix-org/complement/pull/841

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

---------

Co-authored-by: Eric Eastwood <erice@element.io>
2026-04-16 15:46:47 +00:00
Olivier 'reivilibre 09b48cf060 1.152.0rc1 (retry) 2026-04-16 14:23:45 +01:00
Olivier 'reivilibre 4252efa210 Merge branch 'develop' into release-v1.152 2026-04-16 14:16:46 +01:00
Olivier 'reivilibre 964ca65ebb Support MSC4450: Identity Provider selection for User-Interactive Authentication with Legacy Single Sign-On. (#19693)
Closes: #19688

Part of: MSC4450 whose Experimental Feature tracking issue is #19691


Add an unstable, namespaced `idp_id` query parameter to `fallback/web` \
This allows clients to specify the identity provider they'd like to log
in with for SSO when they have multiple upstream IdPs associated with
their account.

Previously, Synapse would just pick one arbitrarily. But this was
undesirable as you may want to use a different one at that point in
time. When logging in, the user is able to choose when IdP they use -
during UIA (which uses fallback auth mechanism) they should be able to
do the same.

-----

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
Co-authored-by: Andrew Morgan <andrew@amorgan.xyz>
Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
2026-04-16 12:19:28 +01:00
Travis Ralston e1b56313de Add upgrade notes for new quarantined_media_changes stream (#19694)
Fixes https://github.com/element-hq/synapse/issues/19692

Introduced by https://github.com/element-hq/synapse/pull/19558

---------

Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
2026-04-16 10:31:10 +00:00
Erik Johnston 2d015f78ea Convert EventInternalMetadata to use Arc<RwLock<_>> (#19669)
This moves the reference counting from PyO3 into standard Rust types,
allowing the class to be used natively from Rust without needing a
Python runtime.
2026-04-16 10:59:39 +01:00