Famedly release/v1.162

.dockerignore

@@ -1,7 +1,7 @@
 # ignore everything by default
 *
 
-# things to include
+# Things to include
 !docker
 !synapse
 !rust
@@ -12,6 +12,7 @@
 !Cargo.toml
 !build_rust.py
 
+# Things to re-ignore
 rust/target
 synapse/*.so
 

.github/workflows/complement_tests.yml

@@ -160,6 +160,10 @@ jobs:
         run: cat /tmp/gotest-complement.log | gotestfmt -hide "successful-downloads,successful-tests,empty-packages"
 
       - name: Run in-repo Complement Tests
+        # Always run as long as we attempted to run the original Complement tests.
+        # This lets us get a status report on the in-repo tests, even if the
+        # standard Complement test suite fails.
+        if: always() && steps.run_complement_tests.outcome != 'skipped'
         id: run_in_repo_complement_tests
         # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
         #     are underpowered and don't like running tons of Synapse instances at once.

.github/workflows/docs-pr.yaml

@@ -13,6 +13,8 @@ on:
       - book.toml
       - .github/workflows/docs-pr.yaml
       - scripts-dev/schema_versions.py
+      # If the docs' python dependencies change, rebuild the book and test links.
+      - pyproject.toml
 
 jobs:
   pages:
@@ -29,19 +31,21 @@ jobs:
         with:
           mdbook-version: "0.5.2"
 
-      - name: Setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      # Building the book requires running the `scripts-dev/schema_versions.py`
+      # script first, which has some python dependencies.
+      - name: Setup Poetry
+        uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
-          python-version: "3.x"
-
-      - run: "pip install 'packaging>=20.0' 'GitPython>=3.1.20'"
+          install-project: "false"
+          groups: "docs"
+          poetry-version: "2.4.1"
 
       - name: Build the documentation
         # mdbook will only create an index.html if we're including docs/README.md in SUMMARY.md.
         # However, we're using docs/README.md for other purposes and need to pick a new page
         # as the default. Let's opt for the welcome page instead.
         run: |
-          mdbook build
+          poetry run mdbook build
           cp book/welcome_and_overview.html book/index.html
 
       - name: Upload Artifact
@@ -63,6 +67,15 @@ jobs:
         with:
           mdbook-version: "0.5.2"
 
+      # Building the book requires running the `scripts-dev/schema_versions.py`
+      # script first, which has some python dependencies.
+      - name: Setup Poetry
+        uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        with:
+          install-project: "false"
+          groups: "docs"
+          poetry-version: "2.4.1"
+
       - name: Setup htmltest
         run: |
           wget https://github.com/wjdp/htmltest/releases/download/v0.17.0/htmltest_0.17.0_linux_amd64.tar.gz
@@ -72,7 +85,7 @@ jobs:
       - name: Test links with htmltest
         run: |
           # Build the book with `./` as the site URL (to make checks on 404.html possible)
-          MDBOOK_OUTPUT__HTML__SITE_URL="./" mdbook build
+          MDBOOK_OUTPUT__HTML__SITE_URL="./" poetry run mdbook build
 
           # Delete the contents of the print.html file, as it can raise false
           # positives during link checking.

.github/workflows/docs.yaml

@@ -75,19 +75,21 @@ jobs:
       - name: Set version of docs
         run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
 
-      - name: Setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      # Building the book requires running the `scripts-dev/schema_versions.py`
+      # script first, which has some python dependencies.
+      - name: Setup Poetry
+        uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
-          python-version: "3.x"
-
-      - run: "pip install 'packaging>=20.0' 'GitPython>=3.1.20'"
+          install-project: "false"
+          groups: "docs"
+          poetry-version: "2.4.1"
 
       - name: Build the documentation
         # mdbook will only create an index.html if we're including docs/README.md in SUMMARY.md.
         # However, we're using docs/README.md for other purposes and need to pick a new page
         # as the default. Let's opt for the welcome page instead.
         run: |
-          mdbook build
+          poetry run mdbook build
           cp book/welcome_and_overview.html book/index.html
 
       - name: Prepare and publish schema files

.github/workflows/famedly-tests.yml

@@ -26,7 +26,7 @@ jobs:
       - uses: matrix-org/setup-python-poetry@v2
         with:
           python-version: "3.13"
-          poetry-version: "2.2.1"
+          poetry-version: "2.4.1"
           extras: "all"
       - run: poetry run scripts-dev/generate_sample_config.sh --check
       - run: poetry run scripts-dev/config-lint.sh
@@ -62,7 +62,7 @@ jobs:
       - name: Setup Poetry
         uses: matrix-org/setup-python-poetry@v2
         with:
-          poetry-version: "2.2.1"
+          poetry-version: "2.4.1"
           python-version: "3.13"
           install-project: "false"
 
@@ -93,7 +93,7 @@ jobs:
           # To make CI green, err towards caution and install the project.
           install-project: "true"
           python-version: "3.13"
-          poetry-version: "2.2.1"
+          poetry-version: "2.4.1"
 
       # Cribbed from
       # https://github.com/AustinScola/mypy-cache-github-action/blob/85ea4f2972abed39b33bd02c36e341b28ca59213/src/restore.ts#L10-L17
@@ -223,7 +223,7 @@ jobs:
       - uses: matrix-org/setup-python-poetry@v2
         with:
           python-version: ${{ matrix.job.python-version }}
-          poetry-version: "2.2.1"
+          poetry-version: "2.4.1"
           extras: ${{ matrix.job.extras }}
       - name: Await PostgreSQL
         if: ${{ matrix.job.postgres-version }}
@@ -336,7 +336,7 @@ jobs:
       # `poetry` is used in `complement.sh`
       - uses: matrix-org/setup-python-poetry@v2
         with:
-          poetry-version: "2.2.1"
+          poetry-version: "2.4.1"
           # Matches the `path` where we checkout Synapse above
           working-directory: "synapse"
 

.github/workflows/schema_diff.yml

@@ -1,4 +1,4 @@
-name: Schema Diff
+name: Schema Diff  # If this is changed, need to update `schema_diff_comment.yml` as well
 
 on:
   pull_request:
@@ -95,9 +95,34 @@ jobs:
           echo "⚠️ Schema diff generation failed. See job logs for details." \
             > "${{ runner.temp }}/schema_diff.md"
 
+      # Post a comment.
+      #
+      # For same-repo PRs, we can do this directly and we are done.
       - name: Post sticky PR comment
         uses: marocchino/sticky-pull-request-comment@3d7b8546315c63df45a03981d50a43ec19237f80 # v3
-        if: always()
+        # Only run for same-repo PRs
+        if: always() && github.event.pull_request.head.repo.full_name == github.repository
         with:
           header: schema-diff
           path: ${{ runner.temp }}/schema_diff.md
+
+      # For PRs from forks, we only have a read-only `GITHUB_TOKEN` here and need to work around
+      # by triggering a `workflow_run` onto the main repo.
+      #
+      # We upload an artifact and the `schema_diff_comment.yml` workflow will be triggered
+      # on the main repo by this workflow exiting.
+      - name: Save PR number for forked PRs
+        # Only run for fork PRs
+        if: always() && github.event.pull_request.head.repo.full_name != github.repository
+        run: echo "${{ github.event.pull_request.number }}" > "${{ runner.temp }}/pr_number"
+
+      - name: Upload schema diff artifact for forked PRs
+        # Only run for fork PRs
+        if: always() && github.event.pull_request.head.repo.full_name != github.repository
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: schema-diff
+          path: |
+            ${{ runner.temp }}/schema_diff.md
+            ${{ runner.temp }}/pr_number
+          retention-days: 1

.github/workflows/schema_diff_comment.yml

@@ -0,0 +1,71 @@
+name: Post schema diff comment for forked PRs
+
+# The "Schema Diff" workflow can't post a PR comment for PRs from forks,
+# since GITHUB_TOKEN is downgraded to read-only in that context. Instead it
+# uploads the diff (and PR number) as an artifact, which we pick up here and
+# post as a comment.
+#
+# This workflow runs in the context of the main repository, so its
+# `GITHUB_TOKEN` can have write access.
+# The downloaded artifact comes from an untrusted fork though, so it must only
+# ever be treated as inert comment text, never executed.
+# The PR number it carries is likewise untrusted: we cross-check it against the trusted
+# `workflow_run` event before posting, so a fork PR can't point the comment
+# at some other PR or issue.
+on:
+  workflow_run:
+    workflows: ["Schema Diff"]
+    types: [completed]
+
+# DANGER: Due to untrusted input and untrusted triggers,
+# think very carefully before expanding the permissions
+permissions:
+  # To read the artifacts from the `schema_diff.yml` run
+  actions: read
+  # To post a comment to the PR
+  pull-requests: write
+
+jobs:
+  comment:
+    name: Post schema diff comment
+    runs-on: ubuntu-latest
+    # Only run when triggered by a pull request and only on a PR from a fork
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name != github.repository && github.event.workflow_run.conclusion != 'cancelled'
+    steps:
+      - name: Download schema diff artifact
+        id: download
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: schema-diff
+          path: schema-diff
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # The artifact (including the PR number) comes from an untrusted fork.
+      # Cross-check the number against the trusted workflow_run event before
+      # posting, so a fork PR cannot target another PR or issue.
+      - name: Verify PR matches the run that produced the artifact
+        id: verify
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # No checkout in this job, so tell gh which repo to talk to.
+          GH_REPO: ${{ github.repository }}
+          EXPECTED_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          EXPECTED_HEAD_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
+        run: |
+          pr_number="$(cat schema-diff/pr_number)"
+          read -r pr_branch pr_head_repo < <(
+            gh api "repos/{owner}/{repo}/pulls/$pr_number" --jq '.head.ref + " " + .head.repo.full_name'
+          )
+          if [ "$pr_branch" != "$EXPECTED_BRANCH" ] || [ "$pr_head_repo" != "$EXPECTED_HEAD_REPO" ]; then
+            echo "::error::Artifact PR $pr_number does not match the triggering run; refusing to post a comment"
+            exit 1
+          fi
+          echo "number=$pr_number" >> "$GITHUB_OUTPUT"
+
+      - name: Post sticky PR comment
+        uses: marocchino/sticky-pull-request-comment@3d7b8546315c63df45a03981d50a43ec19237f80 # v3
+        with:
+          header: schema-diff
+          number_force: ${{ steps.verify.outputs.number }}
+          path: schema-diff/schema_diff.md

CHANGES.md

@@ -1,3 +1,61 @@
+# Synapse 1.162.0 (2026-09-29)
+
+No significant changes since 1.162.0rc1.
+
+## Famedly additions for v1.162.0_1
+
+- chore: update CI poetry version to 2.4.1 (Soyoung Kim)
+
+# Synapse 1.162.0rc1 (2026-09-22)
+
+## Features
+
+- Raise default room version to "12". Contributed by @jason-famedly @famedly. ([\#20130](https://github.com/element-hq/synapse/issues/20130))
+- Limit the number of end-to-end encryption one-time keys stored per device to 500 per algorithm, rejecting uploads which would exceed the limit with a `400 Bad Request`. ([\#20162](https://github.com/element-hq/synapse/issues/20162))
+- Add support for configuring a `username` for Redis connections, for Redis 6+ ACL authentication. ([\#20187](https://github.com/element-hq/synapse/issues/20187))
+- Add a rate limit on the client profile lookup endpoints, configurable via `rc_profile`. ([\#20218](https://github.com/element-hq/synapse/issues/20218))
+
+## Bugfixes
+
+- Fix flawed [MSC4311](https://github.com/matrix-org/matrix-spec-proposals/pull/4311) partial implementation introduced in Synapse v1.136.0 for invites/knocks: client-side API's like `/sync` use [stripped state events](https://spec.matrix.org/v1.18/client-server-api/#stripped-state) and we now send full PDUs on the federation-side. To allow some time for the ecosystem to adapt and support MSC4311, Synapse will only apply strict validation when receiving invites/knocks after 2027-06-01. ([\#19723](https://github.com/element-hq/synapse/issues/19723))
+- Allow the third party rules callback `check_event_allowed()` to work with [MSC4291](https://github.com/matrix-org/matrix-spec-proposals/pull/4291) rooms. Contributed by @famedly. ([\#19768](https://github.com/element-hq/synapse/issues/19768))
+- Improve server concurrency by opening local media thumbnails asynchronously. Contributed by @guillemo12. ([\#20100](https://github.com/element-hq/synapse/issues/20100))
+- Drop incoming federation device list updates from non-compliant (grandfathered historical) user IDs, so that such user IDs are not forwarded to clients outside the context of an event, as per [the spec](https://spec.matrix.org/v1.14/appendices/#historical-user-ids). ([\#20115](https://github.com/element-hq/synapse/issues/20115))
+- Stop treating unset display names and avatar URLs as profile fields with a `null` value. ([\#20145](https://github.com/element-hq/synapse/issues/20145))
+- Return `allowed_room_ids` in the client [`GET /_matrix/client/v1/rooms/{roomId}/hierarchy`](https://spec.matrix.org/v1.19/client-server-api/#get_matrixclientv1roomsroomidhierarchy) response, as required since Matrix 1.15. ([\#20154](https://github.com/element-hq/synapse/issues/20154))
+- Fix state events being omitted from the [MSC4222](https://github.com/matrix-org/matrix-spec-proposals/pull/4222) `state_after` sync response when the client's `since` token falls inside an event persistence batch, as could happen on worker deployments. ([\#20171](https://github.com/element-hq/synapse/issues/20171))
+- Return the stable `M_UNKNOWN_DEVICE` error code, added in Matrix 1.17, instead of its unstable [MSC4326](https://github.com/matrix-org/matrix-spec-proposals/pull/4326)-prefixed identifier. ([\#20181](https://github.com/element-hq/synapse/issues/20181))
+- Fix slow recursive `/relations` requests in large rooms by joining events inside the recursive query. ([\#20182](https://github.com/element-hq/synapse/issues/20182))
+- Fix a bug introduced in Synapse 1.135.0 where fetching an unset `displayname` or `avatar_url` via `GET /_matrix/client/v3/profile/{userId}/{field}` returned the field with a `null` value instead of an empty object. ([\#20200](https://github.com/element-hq/synapse/issues/20200))
+- Add support for un-soft-failing [MSC4354 Sticky Events](https://github.com/matrix-org/matrix-spec-proposals/pull/4354) when room state changes, making federation support more reliable. ([\#20204](https://github.com/element-hq/synapse/issues/20204))
+
+## Improved Documentation
+
+- Document the paths that can be handled on workers with stabilised delegated authentication. ([\#20209](https://github.com/element-hq/synapse/issues/20209))
+- Document the endpoint for getting a single delayed event is workerisable. ([\#20210](https://github.com/element-hq/synapse/issues/20210))
+- Fix small warnings in documentation building tooling output. ([\#20217](https://github.com/element-hq/synapse/issues/20217))
+- Replace the stale minimum `poetry` version in the contributing docs with a pointer to the minimum defined in `pyproject.toml`. ([\#20219](https://github.com/element-hq/synapse/issues/20219))
+- Added docs regarding firewall configuration. Contributed by @HarisDotParis. ([\#20225](https://github.com/element-hq/synapse/issues/20225))
+
+## Internal Changes
+
+- Port the logcontext machinery (`LoggingContext`, `ContextResourceUsage` and the current-context storage) to Rust. ([\#19979](https://github.com/element-hq/synapse/issues/19979))
+- Refactor the Rust code to have a single place to store per-homeserver state. ([\#20011](https://github.com/element-hq/synapse/issues/20011))
+- Add a `synapse_storage_stream_current_position` metric, reporting each stream's current position as each worker process sees it. ([\#20097](https://github.com/element-hq/synapse/issues/20097))
+- Add HTTP serving functions for future [MSC4242](https://github.com/matrix-org/matrix-spec-proposals/pull/4242) work. ([\#20133](https://github.com/element-hq/synapse/issues/20133))
+- Add a cache for looking up individual pieces of current room state. ([\#20160](https://github.com/element-hq/synapse/issues/20160))
+- Run the in-repo Complement test suite in CI, even when the standard Complement suite fails. ([\#20161](https://github.com/element-hq/synapse/issues/20161))
+- Refactor the federation transmission code to delineate transaction preparation and completion. ([\#20166](https://github.com/element-hq/synapse/issues/20166))
+- Add a cache to state resolution keyed off the conflicted events. ([\#20185](https://github.com/element-hq/synapse/issues/20185))
+- Improve the rendering of the set inequality errors produced by `assertEqual` in the tests. ([\#20193](https://github.com/element-hq/synapse/issues/20193))
+- Fix `/room_summary` returning stale `join_rules`. Contributed by @famedly. ([\#20205](https://github.com/element-hq/synapse/issues/20205))
+- Fix the `Schema Diff` CI check failing to post a comment on pull requests from forks. ([\#20207](https://github.com/element-hq/synapse/issues/20207))
+- Move documentation building python dependencies into `pyproject.toml` under a new `docs` dependency group. ([\#20216](https://github.com/element-hq/synapse/issues/20216))
+- Align comments in `.dockerignore` with what we have in the private Synapse Pro branch. ([\#20224](https://github.com/element-hq/synapse/issues/20224))
+
+
+
+
 # Synapse 1.161.0 (2026-09-15)
 
 No significant changes since 1.161.0rc1.

debian/changelog

@@ -1,3 +1,15 @@
+matrix-synapse-py3 (1.162.0) stable; urgency=medium
+
+  * New synapse release 1.162.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 29 Sep 2026 16:15:16 +0000
+
+matrix-synapse-py3 (1.162.0~rc1) stable; urgency=medium
+
+  * New synapse release 1.162.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 22 Sep 2026 18:51:00 +0000
+
 matrix-synapse-py3 (1.161.0) stable; urgency=medium
 
   * New synapse release 1.161.0.

demo/start.sh

@@ -151,6 +151,9 @@ for port in 8080 8081 8082; do
 			rc_user_directory:
 			  per_second: 1000
 			  burst_count: 1000
+			rc_profile:
+			  per_second: 1000
+			  burst_count: 1000
 			RC
 			)
             echo "${ratelimiting}" >> "$port.config"