Commit Graph
26180 Commits
Author SHA1 Message Date
Eric Eastwood 2e10fad626 We have enough context from the changelog entry for what MSC4140 is 2026-10-20 09:49:50 -05:00
Eric Eastwood 5df875ae67 Organize MSC4140 things together 2026-10-20 09:48:46 -05:00
Eric Eastwood d38f232372 Link MSC 2026-10-20 09:47:52 -05:00
Eric Eastwood 72c6a2cfb9 1.164.0rc1 2026-10-20 09:47:13 -05:00
Eric Eastwood 7d2e61abbb Correct docs for /redact_status failed_redactions/error (#20380)
Spawning from looking at these docs while looking at this area in
https://github.com/element-hq/synapse/pull/20379
2026-10-19 14:45:46 -05:00
Eric Eastwood cf306fbef6 Fix complete typo in redaction status admin API docs (#20379)
Fix https://github.com/element-hq/synapse/issues/18338
2026-10-19 12:09:02 -05:00
Erik Johnston eff0ecb062 Rust Postgres backend: value mapping and blocking runtime helpers (#19996)
Lays the two foundations the Rust DBAPI2 backend needs before any
connection code: a Python↔Postgres value-mapping layer, and the helpers
that drive async work from sync Python.

  Value mapping:
- `PgValue` — enum that implements `tokio_postgres::types::ToSql`,
encoding into Postgres' binary wire format per the prepared-statement
column type (so a single Python `int` becomes INT2/INT4/INT8 with range
checks).
- `PythonPgFromSql` — the decode counterpart, turning wire bytes back
into Python objects (SQL NULL → `None`).
- Covers int / float / bool / str / bytes / None; lists etc are left to
a follow-up.

  Blocking helpers:

- `block_on` / `block_on_pg_result` / `block_on_next` drive
`tokio-postgres` futures to completion from sync, GIL-holding Python
methods, releasing the GIL for the wait.

Both modules are `pub` for now so not-yet-consumed items don't trip
clippy's `dead_code` lint; later PRs in the stack tighten visibility.
Everything here is unit-tested with no live Postgres server.
2026-10-19 14:16:40 +01:00
7d44c81d5c Fix new state saved with the last local user's leave missing from state_after (#20314)
> [!NOTE]
> This PR will be rebased on `develop` once
https://github.com/element-hq/synapse/pull/20081 is merged

This PR is a follow up to
https://github.com/element-hq/synapse/pull/20081 and is based on its
code.
The scope of that original PR is limited to recovering the leave event
missing from `state_after`.

I noticed that state events from the leave event batch would only be
recovered if they were previously defined.

That made me add a pre-condition to the test: the topic had to be set
first.


https://github.com/element-hq/synapse/blob/bccf1679aed0a5d86de87165c548f8c459758055/tests/handlers/test_sync.py#L1096-L1099

This PR attempts to recover new state events that only appeared first in
the leave batch.

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

---------

Co-authored-by: Fefaine <fefaine@gmail.com>
Co-authored-by: Quentin Gliech <quenting@element.io>
Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
Co-authored-by: Eric Eastwood <erice@element.io>
2026-10-19 09:25:23 +00:00
Paul Chobert 26a92c7111 MSC4140: Reject scheduling a delayed event that the sender could not send at that time (#20266)
## What the MSC says

From MSC4140's [Auth rule
evaluation](https://github.com/matrix-org/matrix-spec-proposals/blob/b7cb09664fed684388ba656459d08cfaf786c1d1/proposals/4140-delayed-events-futures.md#auth-rule-evaluation):

> The server SHOULD also check the event could be sent when it is
scheduled and reject the request if not. In particular, servers SHOULD
check the sender is in the room (or otherwise authorized to send the
event) to avoid storing events for rooms the user is not in.

## This PR

- Checks the event against the room's auth rules as if it were sent now,
and returns the same 403 `M_FORBIDDEN` that `/send` and `/state` would.
- Changes to the sender's own membership are exempt: a join or knock can
be sent from outside the room, which is how this PR reads the MSC's "or
otherwise authorized". They are checked by the auth rules when they are
sent.

Here are a few examples:

| Delayed event | Before | After |
| ----------------------------------------------------------------- |
--------------------------------------- |
---------------------------------------- |
| `m.room.message` from outside the room | 200 `delay_id`, fails at send
time | 403 `M_FORBIDDEN` |
| Kick of another member from outside the room | 200 `delay_id`, fails
at send time | 403 `M_FORBIDDEN` |
| `m.room.name` from a member whose power level is too low | 200
`delay_id`, fails at send time | 403 `M_FORBIDDEN` |
| **Exception**: join of a public room from outside it | 200 `delay_id`,
joins at send time | unchanged |
| Join from outside the room, then a message due after it | both
accepted, message sent once joined | join accepted, message 403
`M_FORBIDDEN` |
2026-10-16 14:38:12 +01:00
dependabot[bot] be306c5a16 Bump go.opentelemetry.io/otel/sdk from 1.43.0 to 1.45.0 in /complement (#20236) 2026-10-16 10:43:40 +00:00
Olivier 'reivilibre 4785f06e0e In legacy sync, lazy-load the memberships of the senders of MSC4354 Sticky Events. (#20362)
Part of: MSC4354 (Sticky Events, Experimental Feature tracking issue
#19409)

When a user is the sender of a sticky event that comes down sync, that
user is now in scope for having their lazy-loaded membership sent down
in sync.

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-15 20:26:51 +01:00
Andrew Morgan 98735bc6db Remove remaining references to lxml python dependency, which is no longer required (#20356) 2026-10-15 12:54:54 +00:00
542554c093 MSC4242: State DAGs (inbound joins) (#20194)
Process inbound requests to join a state DAG room.

Split out from https://github.com/element-hq/synapse/pull/19425

Part of a series of 5x PRs to land the federation part of MSC4242
(https://github.com/element-hq/synapse/pull/19718,
https://github.com/element-hq/synapse/pull/20127,
https://github.com/element-hq/synapse/pull/20133, inbound-joins (this
PR), inbound-pulls).

Has some Complement tests:
```
PASS TestMSC4242JoinLeaveRejoinPublicRoom 9.19s
PASS TestMSC4242JoinPublicRoomWithRejectedStateDAGEvents 0.88s
```

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

---------

Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
Co-authored-by: Eric Eastwood <erice@element.io>
2026-10-15 13:17:08 +01:00
Olivier 'reivilibre b9b74e8892 Catch up historical MSC4354 Sticky Events to remote homeservers that are newly joining the room. (#20337)
Part of: MSC4354 (Experimental Feature tracking issue #19409)

Follows: #20165 (Sticky Event federation backlog + catch-up
transactions)


The MSC says that we need to tell a newly-joining server about all of
our sticky events (yes, even the ones before the server joined the
room).
This PR introduces the mechanism, building on the 'Sticky Event backlog'
mechanism introduced in #20165, to make that happen.

Most of the logic is taken from the original Sticky Events PR #18968,
but the Sticky Event backlog system did not exist back then.
(The benefit of having the persistent Sticky Event backlog is that we
don't need to rely on the federation senders not crashing to make sure
we get around to sending the Sticky Events out.)

- Add NEW_SERVER_JOINED replication command. (This is a cross-worker
'wake-up call' to check for a sticky event backlog)
We send it when persisting a state change that causes a new server to be
in the room.
We handle it by waking up federation senders for the destination,
including checking the sticky event backlog tables.

- When a server newly joins a room, we insert a sticky event backlog row
for that server, if there are any Sticky Events needing to be sent.

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-15 09:53:02 +01:00
Olivier 'reivilibreandAndrew Morgan 1423a29f93 Reject null profile field values (following an optional clause in the specification), in order to avoid clients accidentally harming interoperability. (#20153)
Depends on: https://github.com/matrix-org/complement/pull/914

`displayname` and `avatar_url` already did not permit nulls, seemingly
from #8223.

The specification at v1.15 does not permit `null` for those fields
either, so this seems consistent with historical specification.

This only changes behaviour for 'custom' fields.

---------

Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
2026-10-15 09:52:28 +01:00
Olivier 'reivilibre e86eb378af Require a strictly positive stickiness duration for MSC4354 Sticky Events. (#20350)
Part of: MSC4354 (Sticky Events, Experimental Feature tracking issue
#19409)

Since a zero value would be meaningless, don't accept it.

Spawns from
https://github.com/matrix-org/matrix-spec-proposals/pull/4354#discussion_r4211703962

- MSC4354 Sticky Events: only strictly positive durations are valid

  MSC clarified in

https://github.com/matrix-org/matrix-spec-proposals/commit/2d1c3d646aae3738680f8a9a0ccb38b2d941a45f
  to require strict positivity!

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-15 09:51:56 +01:00
Olivier 'reivilibre 64689d45f4 Fix Sliding Sync considering a displayname/avatar change to mean the room was newly-joined (#20339)
Follows: #18375

This bugfix is a prerequisite for MSC4354 (Sticky Events, Experimental
Feature tracking issue #19409) changes.

- Add a failing test for join->join being newly_joined

- Fix the join->join transition being treated as a new join

  (when prev_events didn't coincidentally mask the problem)

  Rationale:

  `event_edges` / `prev_events` does NOT link a membership event
  to its previous state.
  (It could even be someone else's membership!)
In most real-world cases, this would generate a `prev_membership` of
NULL
  for every normal membership change.

  It appears as though the author intended some kind of 'previous state'
  relationship, but if you fix the first branch of the `UNION` query
  to use `current_state_delta_stream` for this (which is the source of
  state transitions), then it looks very redundant with the second
  branch.

It looks like the real reason we want to use the snapshots table is for
  out-of-band memberships (outlier memberships).
  So we continue using that for those, but ONLY for those.

  The `SUSPICIOUS` if block is removed because it appears to have been
papering over this issue by deduplicating the spurious `NULL` ->
non-null transitions,
but when you remove those duplicates at the source, it causes more
trouble
  because it doesn't know that what it's 'deduplicating' is actually the
  same membership transition.
This means if you join, then out-of-band leave (e.g. last member on the
server
to leave), that room would appear in `newly_joined` on a new initial
sync.
  (Tests did in fact catch this, too.)

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-15 09:48:51 +01:00
Eric Eastwood 0635bf67ba Merge branch 'master' into develop 2026-10-14 10:25:27 -05:00
Eric Eastwood 193cf9466f 1.163.0 v1.163.0 2026-10-14 09:22:00 -05:00
Eric Eastwood 2c52f9820e Constrain txredisapi version to avoid incompatible breaking changes in txredisapi@1.6.0 (#20354)
Fix https://github.com/element-hq/synapse/issues/20347

See
https://github.com/element-hq/synapse/issues/20347#issuecomment-6154861014
for more details.

Caused by the latest release of `txredisapi@1.6.0` (2026-10-09) which included https://github.com/IlyaSkriblovsky/txredisapi/pull/162

> May break compatibility with some specific user code because of inheritance changes.

And in the changelog:

> ### Incompatible changes
> 
> - Connections are maintained by
>   `twisted.application.internet.ClientService` now, and `RedisFactory` is no
>   longer a `ReconnectingClientFactory`. Code connecting a factory on its own
>   with `reactor.connectTCP()` or `twisted.application.internet.TCPClient` has
>   to use `factory.startConnecting(endpoint)` instead - see `examples/subscriber.py`
> 
> - `factory.continueTrying = False` is replaced by `factory.stopTrying()`;
>   `retry()`, `resetDelay()` and `delay` are gone. `maxDelay`, `initialDelay`,
>   `factor` and `jitter` still configure the backoff and are used by the new
>   `RedisFactory.retryDelay()`
> 
> - `SentinelConnectionFactory.try_to_connect()` is gone: the address of the
>   master or of a slave is discovered by the endpoint before every attempt.
>   Subclasses overriding `try_to_connect()`, `clientConnectionFailed()` or
>   `clientConnectionLost()` have no effect anymore
>
> [...]
>
> *-- [`IlyaSkriblovsky/txredisapi` -> *Release 1.6.0 (2026-10-09)*](https://github.com/IlyaSkriblovsky/txredisapi/blob/f844759b8aabc689eb87bf300ed3c675b84c3608/CHANGELOG.md#L31-L35)*




### Testing strategy

1. Check out the PR: `git checkout
madlittlemods/20347-txredisapi-constraint`
 1. Install into a fresh scratch venv:
     ```shell
    rm -rf /tmp/venv && python3 -m venv /tmp/venv
    /tmp/venv/bin/pip install '.[all]'
/tmp/venv/bin/pip show txredisapi | grep Version # expect 1.5.0 with
this PR
    ```
 1. One-time setup: make a homeserver config with Redis enabled:
    ```shell
    mkdir -p /tmp/hs && cd /tmp/hs
/tmp/venv/bin/python -m synapse.app.homeserver --server-name repro.test
\
        -c homeserver.yaml --generate-config --report-stats=no
printf '\nredis:\n enabled: true\n host: localhost\n' >> homeserver.yaml
    cd -
    ```
- On my machine, I also have to remove the IPv6 bind for `::1`, so `sed
-i '/^ - ::1$/d' /tmp/hs/homeserver.yaml`
1. Run Synapse: `/tmp/venv/bin/python -P -m synapse.app.homeserver -c
/tmp/hs/homeserver.yaml`
- It should run successfully with this PR. You can also check
`/tmp/hs/homeserver.log` for logs.

Repeat these steps on `develop` to see the original failure described in
https://github.com/element-hq/synapse/issues/20347 (`AttributeError:
'super' object has no attribute 'startedConnecting'. Did you mean:
'startConnecting'?`)
2026-10-14 08:47:40 -05:00
Paul Chobert d773067277 MSC4140: authenticate the delayed event management endpoints and allow guests (#20257) 2026-10-13 16:24:30 +00:00
Olivier 'reivilibre 636c6a3812 Stop reading from event_edges.is_state to prepare for dropping it. (#20069)
Gets one step further in the job started by
https://github.com/matrix-org/synapse/pull/12893

Part of: https://github.com/element-hq/synapse/issues/20026

## Manual testing strategy

Unfortunately it's quite difficult to actually trigger this.

You need to:

- check out an old full_schema, e.g. 54 which was present when `v1.62.0`
was released
- remove the version 72 `full_schema`, as it already has the background
update applied
- remove some deltas that are broken when upgrading across such a large
version gap (!) https://github.com/element-hq/synapse/issues/20070
- then run any trial test with Postgres enabled to prove that the
database schema applies

```
git checkout v1.62.0 -- synapse/storage/schema/state/full_schemas/54                
git checkout v1.62.0 -- synapse/storage/schema/main/full_schemas/54                                                                                                
git checkout v1.62.0 -- synapse/storage/schema/common/full_schemas/54
rm -r synapse/storage/schema/*/full_schemas/72
rm synapse/storage/schema/main/delta/58/10_pushrules_enabled_delete_obsolete.sql
rm synapse/storage/schema/main/delta/79/04_mitigate_stream_ordering_update_race.py
rm synapse/storage/schema/main/delta/56/redaction_censor3_fix_update.sql.postgres
rm synapse/storage/schema/main/delta/60/01recreate_stream_ordering.sql.postgres
SYNAPSE_TEST_LOG_LEVEL=DEBUG SYNAPSE_POSTGRES=1 poetry run trial tests.handlers.test_sliding_sync.ComputeInterestedRoomsTestCase_new.test_no_joins_after_to_token
```

As light validation, I purposefully inserted a SQL error into the query
to check that it is caught by the above testing strategy.

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-13 11:56:10 +01:00
Paul Chobert 766f057305 Stop forwarding non compliant user ids (#20338)
Closes #20116

> [!NOTE]
> This PR Follows #20115 which already implemented this for
`m.device_list_update`

> User IDs with localparts containing characters outside the range
U+0021 to U+007E, or with
> an empty localpart, are considered non-compliant. For current room
versions, servers must
> still accept events using such user IDs over federation; however they
SHOULD NOT forward
> such user IDs to clients when referenced outside the context of an
event. For example,
> device list updates from non-compliant user IDs would be dropped by
the receiving server.
>
> — [Spec
1.19](https://spec.matrix.org/v1.19/appendices/#historical-user-ids)

This PR prevents from forwarding non compliant user ids for the
following events:

- `m.signing_key_update` 8c3c35e95d
- `m.presence` 26a8dfe862
- `m.typing` 1110cf2d73
- `m.receipt` 9e2da8b0a6
- `m.direct_to_device` 9541232a30
2026-10-13 11:10:48 +01:00
Richard van der Hoff 52f053abef Remove support for unstable MSC2965 (#20143)
These things are not needed now that MSC2965 has stabilised. In any
case, they
should never have been exposed without a config flag in the first place.
2026-10-12 16:43:38 +00:00
Will Hunt c52121d4b4 Add m.preview_url capability (Stabilise MSC4452) (#20298)
For https://github.com/element-hq/synapse/issues/19719

MSC4452 is now merged, so the stable capability can be made visible.
I've kept in the unstable flag in order to transition away at a later
date.

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [ ] Pull request is based on the develop branch
* [ ] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [ ] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
2026-10-12 14:40:44 +01:00
Will Hunt 91020a9518 Short-circuit push rule evaluation when only one user is in a room (#20315)
This speeds up the /createRoom calls a tiny bit by not checking the
senders push rules.

This helps speed up a lot of test runs in Element Web which 
runs a lot of tests in one-person rooms (and creates a heck of a lot of rooms)
2026-10-12 11:56:27 +01:00
40acb97022 MSC4140: drop delayed state interference (#19495)
No longer cancel a user's delayed state events by a more recent state
event sent from a different user. This behaviour has been delegated to
an "alternative" in the delayed event MSC for some time now, and is not
known to be used by any module other than experimental iterations of
MatrixRTC.

See also: https://github.com/matrix-org/complement/pull/845

Opens: https://github.com/element-hq/synapse/issues/20311

---------

Co-authored-by: Olivier 'reivilibre' <olivier@librepush.net>
Co-authored-by: Paul Chobert <paul@chobert.fr>
2026-10-12 10:33:13 +01:00
dependabot[bot] c0805eabb1 Bump rustls from 0.23.31 to 0.23.45 (#20317)
Bumps [rustls](https://github.com/rustls/rustls) from 0.23.31 to
0.23.45.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rustls/rustls/commit/2976d90fd1c2db6b518700dd101b714069cfcb17"><code>2976d90</code></a>
Prepare 0.23.45</li>
<li><a
href="https://github.com/rustls/rustls/commit/f9d4ee92b20da535ef5982ffcaf6f62385f79641"><code>f9d4ee9</code></a>
Handshake &quot;alignment&quot; check covers previously-received
messages</li>
<li><a
href="https://github.com/rustls/rustls/commit/c4e92e8c9ee29ca3f552d4938efa73680c179179"><code>c4e92e8</code></a>
Keep data needed for HRR processing together</li>
<li><a
href="https://github.com/rustls/rustls/commit/e553a7a70f99cad4722f06b32cc37857008a7d3f"><code>e553a7a</code></a>
server: TLS1.2 is not available after a HRR</li>
<li><a
href="https://github.com/rustls/rustls/commit/5dff9da73798253d8d35909dd8548db522cd973c"><code>5dff9da</code></a>
Test whether server negotiates TLS1.2 after HRR</li>
<li><a
href="https://github.com/rustls/rustls/commit/185a063b5fe1e9698c589d8be6a83d67224b95a1"><code>185a063</code></a>
reject a second ClientHello that changes the cipher suite</li>
<li><a
href="https://github.com/rustls/rustls/commit/9fafe6dd0c15ea6e47399e94b2c6b647861f874b"><code>9fafe6d</code></a>
reject a second ClientHello that drops pre_shared_key</li>
<li><a
href="https://github.com/rustls/rustls/commit/1b42c5f78e8e826d6afa72ce0ead3e3a4e624d79"><code>1b42c5f</code></a>
providers: zeroize private key DER</li>
<li><a
href="https://github.com/rustls/rustls/commit/64ad386785c718c74262b79e6893813db381adfe"><code>64ad386</code></a>
Bump version to 0.23.44</li>
<li><a
href="https://github.com/rustls/rustls/commit/1efbf662ed79d1392c542c0822805a818d232ac0"><code>1efbf66</code></a>
bogo: remove PostQuantum setup</li>
<li>Additional commits viewable in <a
href="https://github.com/rustls/rustls/compare/v/0.23.31...v/0.23.45">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rustls&package-manager=cargo&previous-version=0.23.31&new-version=0.23.45)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/element-hq/synapse/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-09 15:02:11 +00:00
MANI K 5e78aad7d7 Default request token errors to privacy-preserving responses (#20243)
## Summary

- default `request_token_inhibit_3pid_errors` to `true` to prevent
account enumeration
- document the new default and the explicit opt-out
- add an upgrade note and regression coverage for the default

Fixes #18415.
2026-10-09 13:26:31 +01:00
Olivier 'reivilibre 93368c7eb8 Prevent MSC4354 Sticky Events being sticky when they were redacted in the same persistence batch. (#20322)
Part of: MSC4354
Part of: #19641
Follows: #20232 (which applies already-persisted redactions to Sticky
Events being persisted)


In some cases we batch events together during persistence.

If one of the events in the batch is a redaction of another event, we
should apply it, which provides the same benefit as #20232 (namely: we
avoid potentially dodgy event content being persisted & the event
naturally loses its stickiness
so is not written to `sticky_events`)

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-09 12:30:58 +01:00
Olivier 'reivilibre 36f3e1df4b Apply the MSC4354 Sticky Events history visibility exemptions on all client-server endpoints. (#20295)
Part of: MSC4354 (Experimental Feature tracking issue:
https://github.com/element-hq/synapse/issues/19409)

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-09 11:15:36 +01:00
kruthikiran2007 07ecd8b497 Condense Pydantic validation error messages in client API responses (#20321)
Fixes #20309.

For endpoints that validate the request body with Pydantic, a validation
failure put Pydantic's raw verbose error text into the `error` field of
the standard error response, e.g.:

```json
{
  "errcode": "M_MISSING_PARAM",
  "error": "1 validation error for PutBody\\nroom_id\\n  Field required [type=missing, input_value={}, input_type=dict]\\n    For further information visit https://errors.pydantic.dev/2.12/v/missing"
}
```

This leaks internal details clients cannot act upon (model class names,
raw input values, pydantic.dev URLs). This PR adds a
`_format_pydantic_error` helper in `synapse/http/servlet.py` that builds
a short client-friendly message from the structured
`ValidationError.errors()` data instead of `str(e)`:

- `{}` against a model requiring `room_id` -> `Missing required field
'room_id'.`
- `{"room_id": 123}` -> `'room_id': Input should be a valid string.`
- nested models use dotted paths, e.g. `Missing required field
'put.room_id'.`
- multiple errors are joined: `Missing required field 'name'; Missing
required field 'put'.`

The `errcode` selection logic (`M_MISSING_PARAM` / `M_INVALID_PARAM` /
`M_BAD_JSON`) is unchanged.
2026-10-09 09:40:32 +01:00
Paul Chobert ff1b6570b0 Advertise support for Matrix v1.17 (#20334)
Synapse now implements every item in the Matrix v1.17 changelog #19415,
it can advertise `v1.17`.

Closes #19415.
2026-10-08 15:28:50 -05:00
Paul Chobert 43c6f7770d Advertise support for Matrix v1.16 (#20333)
Synapse now implements every item in the Matrix v1.16 changelog (all
ticked in #19414), so it can advertise `v1.16`.

Closes #19414.
2026-10-08 11:53:38 -05:00
Quentin Gliech 14118b1280 Document that /auth_metadata can be handled by workers (#20331) 2026-10-08 17:36:57 +02:00
Paul ChobertandEric Eastwood 3c46a10955 Stabilise MSC4222: support the stable use_state_after identifiers on /sync (#20170)
Part of #19414 (Support Matrix 1.16).

⚠️ Before merging, wait for the following PRs to be merged first:
- https://github.com/element-hq/synapse/pull/20081
- https://github.com/element-hq/synapse/pull/20169
- https://github.com/element-hq/synapse/pull/20171

---

Since Matrix 1.16, the
[spec](https://spec.matrix.org/v1.19/client-server-api/#get_matrixclientv3sync)
defines the stable identifiers for
[MSC4222](https://github.com/matrix-org/matrix-spec-proposals/pull/4222):
the `use_state_after` query parameter on `GET /_matrix/client/v3/sync`,
and the `state_after` room response field:

> **`use_state_after`** — `boolean` — Controls whether to receive state
changes between the previous sync and the start of the timeline, or
between the previous sync and the end of the timeline. If this is set to
`true`, servers MUST respond with the state between the previous sync
and the end of the timeline in `state_after` and MUST omit `state`. […]
>
> **`state_after`** — […] Required if `use_state_after` was set to true
in the request, even if it is empty. Added in `v1.16`
>
> — [Matrix
Spec](https://spec.matrix.org/v1.19/client-server-api/#get_matrixclientv3sync)

Synapse so far only implemented the unstable identifiers
(`org.matrix.msc4222.use_state_after` /
`org.matrix.msc4222.state_after`), gated behind the `msc4222_enabled`
experimental flag and the per-user experimental features admin API.

This PR:

- accepts the stable `use_state_after` query parameter, unconditionally,
and responds with the stable `state_after` field. The unstable query
parameter is kept for a transition period; clients opting in with it get
the unstable response field name back, so unstable-era clients see an
unchanged wire format. If both parameters are set, the stable one wins.
- removes the `msc4222_enabled` experimental flag and the `msc4222`
per-user feature from the experimental features admin API, since the
behaviour is no longer gated.

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

---------

Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
2026-10-08 15:14:23 +02:00
694ad6bfa7 Fix leave event missing from state_after on incremental sync (#18793) (#20081)
Fixes https://github.com/element-hq/synapse/issues/18793


When the last local user leaves a room, Synapse clears
`current_state_events` and writes `null` `event_id` entries into the
`current_state_delta_stream`. The incremental sync code for MSC4222's
state_after skipped those `null` deltas entirely, and
`get_current_state_ids` also returned nothing (table already cleared).
Result: clients using `state_after` never learned about the leave.

Fix by falling back to state groups (which are preserved) to look up the
actual state at `end_token` for any cleared state keys.

### Pull Request Checklist

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

---------

Co-authored-by: Paul Chobert <paul@chobert.fr>
Co-authored-by: Quentin Gliech <quenting@element.io>
Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
2026-10-08 15:11:22 +02:00
Jason RobinsonandEric Eastwood e36ce7df9b Filter out MSC4426 User Status profile fields for remote users (#20328)
Several clients, including Element Web/Desktop and Element X, have
already implemented
[MSC4426](https://github.com/matrix-org/matrix-spec-proposals/pull/4426)
User Status profile fields. However, we have only implemented sending
profile fields down sync for local users
([MSC4429](https://github.com/matrix-org/matrix-spec-proposals/pull/4429)/[MSC4262](https://github.com/matrix-org/matrix-spec-proposals/pull/4262)),
since federation support for pushing profile field updates from server
to server has not yet been implemented
([MSC4259](https://github.com/matrix-org/matrix-spec-proposals/pull/4259)).

This has created user confusion. The before mentioned clients use the
profile and/or profile field fetch endpoints to fetch missing profile
information, regardless of the user being local or remote. Since the
sync response isn't delivering these profiles, the client does a
fallback fetch, causing a one time update of the profile information
over federation.

This causes stale data to be cached in the client for the remote user,
which in the case of EW for example is never cleared.

This filtering should be temporary until MSC4259 is implemented and the
remote profile data also syncs via the profile update stream to clients.

I suggest making this not configurable so we don't have to maintain a
configuration property, as hopefully this would only be a case for a few
months at most.

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

---------

Co-authored-by: Eric Eastwood <madlittlemods@gmail.com>
2026-10-08 10:29:33 +00:00
Olivier 'reivilibre 815d2e0c7d Remove the stickiness of MSC4354 Sticky Events when they are redacted after persistence. (#20323)
Part of: MSC4354
Part of: #19641
Follows: #20232 (redacted before persistence), #20322 (redacted during
persistence)

Original commit schedule, with full messages:

- Add tests for redaction of Sticky Events

- Add `delete_sticky_events_txn`

- Remove stickiness from validly redacted events at persistence


### Dev notes

Overview:

- [`#20232`](https://github.com/element-hq/synapse/pull/20232) (redacted
before persistence)
- [`#20322`](https://github.com/element-hq/synapse/pull/20322) (redacted
during persistence)
- [`#20323`](https://github.com/element-hq/synapse/pull/20323) (redacted
after persistence)

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-08 10:04:08 +01:00
Paul Chobert 42ddc70ea7 Remove the legacy mention push rules by default (#20220)
Part of #19415 (Support Matrix 1.17).

Companion test PRs:
- Complement: https://github.com/matrix-org/complement/pull/920
- Sytest: https://github.com/matrix-org/sytest/pull/1430

**What this does:** `experimental_features.msc4210_enabled` default
value changed `true`
([MSC4210](https://github.com/matrix-org/matrix-spec-proposals/pull/4210)).
The rest of the changes is fixing the tests, making sure test relying en
mentions sends the proper `m.mentions` attribute.

## Migration plan

Element Web has been writing both rule sets together since September
2023
([matrix-react-sdk#11667](https://github.com/matrix-org/matrix-react-sdk/pull/11667),
[element-web@0d367a7c7e](https://github.com/element-hq/element-web/commit/0d367a7c7e)),
so for its users `.m.rule.is_user_mention` and `.m.rule.is_room_mention`
already carry the same customisations as the legacy rules.

<strike>For everyone else, #20215 adds a background update that migrates
the overrides on the legacy rules to the intentional ones.</strike>

## Opt-out

```yaml
experimental_features:
  msc4210_enabled: false
```

---

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
2026-10-08 11:03:30 +02:00
Paul Chobert 46ff03f93a Reject modifying server-default push rules that are not served (#20202)
TLDR: `PUT` on a server-default push rule now applies the same existence
check that `GET` already does. A rule that is not served cannot be
modified.

Synapse ships some server-default push rules behind experimental feature
flags, so the set of server-default rules a user has depends on the
server's configuration. Most flags add rules that only exist while the
flag is on.
[MSC4210](https://github.com/matrix-org/matrix-spec-proposals/pull/4210)
works the other way: it removes the three legacy mention rules while its
flag is on. The flags that change the set are:

- `msc1767_enabled`:
[MSC1767](https://github.com/matrix-org/matrix-spec-proposals/pull/1767)
extensible events rules
- `msc3381_polls_enabled`:
[MSC3381](https://github.com/matrix-org/matrix-spec-proposals/pull/3381)
poll rules
- `msc3664_enabled`:
[MSC3664](https://github.com/matrix-org/matrix-spec-proposals/pull/3664)
reply rule
- `msc4028_push_encrypted_events`:
[MSC4028](https://github.com/matrix-org/matrix-spec-proposals/pull/4028)
encrypted event rule
- `msc4306_enabled`:
[MSC4306](https://github.com/matrix-org/matrix-spec-proposals/pull/4306)
thread subscription rules
- `msc4210_enabled`: removes `.m.rule.contains_display_name`,
`.m.rule.contains_user_name` and `.m.rule.roomnotif`

`GET /pushrules/` only lists the rules that exist for that
configuration. `GET` on a single rule that is not in the set returns
`404 M_NOT_FOUND`. The same set is used to evaluate notifications, and
to build the `m.push_rules` account data in `/sync`.

`PUT .../enabled` and `PUT .../actions` did not use that set. They
accepted any rule ID that Synapse knows about, whether or not the server
currently serves it. Clients could modify a rule the server had just
said did not exist. The request returned `200`, the change was stored,
and it was then ignored. Both endpoints now return `404 M_NOT_FOUND` for
such a rule, as [the spec
requires](https://spec.matrix.org/v1.19/client-server-api/#put_matrixclientv3pushrulesglobalkindruleidenabled)
for a rule that does not exist.

Before (`msc4210_enabled: true`):

```
GET /_matrix/client/v3/pushrules/global/override/.m.rule.roomnotif
  404 {"errcode": "M_NOT_FOUND", "error": "..."}

PUT /_matrix/client/v3/pushrules/global/override/.m.rule.roomnotif/enabled
  {"enabled": false}
  200 {}
```

After:

```
GET /_matrix/client/v3/pushrules/global/override/.m.rule.roomnotif
  404 {"errcode": "M_NOT_FOUND", "error": "..."}

PUT /_matrix/client/v3/pushrules/global/override/.m.rule.roomnotif/enabled
  {"enabled": false}
  404 {"errcode": "M_NOT_FOUND", "error": "Unknown rule"}
```

This is a no-op for default configurations. All of these flags are off
by default, and rules that are served are still modifiable as before.
2026-10-08 08:57:58 +01:00
Paul Chobert a93175ccb5 Skip application services with url: null when notifying them of events (#20273)
ESS deployments of MatrixRTC are going to run `lk-jwt-service` as an
application service so that it can manage delayed events. However,
setting up an application service is particularly inefficient, as
Synapse iterates through all the events of the rooms it covers since
their creation.

When an application service is configured with `url: null`, there is no
need to traverse all the events for it, so we can set up such
application services much faster without having to decide what to do for
other application services. Discussions about those are still open:
element-hq/synapse#11629 (see also matrix-org/synapse#1834).


### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
2026-10-08 07:35:37 +00:00
dc1291aa65 MSC4140: add dedicated endpoint for delayed events (#19354)
Use a new, dedicated endpoint for scheduling delayed events. This should
deprecate the `delay` query parameter on the `/send` and `/state`
endpoints.

Co-authored-by: Paul Chobert <paul@chobert.fr>
Co-authored-by: Eric Eastwood <erice@element.io>
2026-10-08 05:02:12 +00:00
2392446370 Fix portdb missing un_partial_stated_room_stream_sequence setup (#20302)
Co-authored-by: Andrew Morgan <andrew@amorgan.xyz>
Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
2026-10-07 15:59:57 +00:00
Olivier 'reivilibreandErik Johnston 85f4b9a2ba Fix the expiry of MSC4354 Sticky Events being reported differently to how the server tracks them. (#20324)
Part of: MSC4354 (Experimental Feature tracking issue #19409)

Follows: #20312 (which plumbs `received_ts` into the `Event` struct,
allowing us to calculate this correctly and sanely)

- When writing to `sticky_events`, we now use the `received_ts` stamped
onto the event to calculate the expiry,
  rather than taking a second clock reading.

- When emitting the `unsigned.sticky_duration_remaining_ms` (currently
called `unsigned.msc4354_sticky_duration_ttl_ms`) field,
we now also use the `received_ts` as a clamp on the start of the
stickiness,
causing us to calculate the same expiry timestamp as the one saved to
`sticky_events`
(**This is a bugfix, as previously we weren't using `received_ts` here
like the MSC requires.**)

- The calculation of the expiry is centralised into the `Event` struct,
which I hope you'll agree is a
  huge sanity improvement.

- We now systematically prevent spammy or rejected events from counting
as sticky.

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
Co-authored-by: Erik Johnston <erikj@element.io>
2026-10-07 16:20:32 +01:00
Will Hunt 63bade4325 Skip running delayed event background job if the room event stream has not advanced. (#20316)
In a similar vein to #20315, this attempts to speed up Synapse when
delayed events aren't in use. Here we skip doing any work if the room
event stream has not advanced.
2026-10-07 14:57:56 +01:00
Hugh Nimmo-SmithandAndrew Morgan 52835fc397 Don't store file on disk after media upload limit failure (#20006)
Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
2026-10-07 12:05:01 +00:00
Erik Johnston 7ae1d987ef Add a per-homeserver clock to the Rust side (#20294)
This is a prerequisite to being able to add caching on the Rust side.
2026-10-07 11:11:08 +01:00
Olivier 'reivilibre 31ca874890 Add received_ts to the in-memory event internal metadata struct. (#20312)
Motivated by work on MSC4354, because the sticky events MSC specs that
`received_ts` is used to calculate the
start of an event's stickiness. (It would therefore be convenient to
have it available as part of event metadata, so an event can expose a
cheap helper method to check if it is sticky.)

This commit adds `received_ts` into the `event.internal_metadata` struct,
alongside `stream_ordering`.

I conceptually treat it as a sibling to `stream_ordering` and populate
it in all the same places where `stream_ordering` is populated.

Because this needs `received_ts` to be added to the HTTP replication
response for event persistence,
I also add a temporary compatibility measure that keeps rolling worker
upgrades working during this
transition.
I intend to remove the compatibility code in the next release.


I have manually tested that
```
SYNAPSE_POSTGRES=1 SYNAPSE_POSTGRES_USER=postgres SYNAPSE_POSTGRES_HOST=localhost SYNAPSE_POSTGRES_PASSWORD=postgres poetry run trial -j 6 tests.replication.test_sharded_event_persister
```
fails only when both the compatibility code is removed and the
`"received_ts"` key is commented out in the response (to omit it).
The compatibility code causes the test to pass even when `"received_ts"`
is commented out.

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
2026-10-06 19:27:46 +01:00
Eric Eastwood be4d86c669 Link MSC4354 v1.163.0rc1 2026-10-06 10:16:52 -05:00