Releases

Synapse 1.47.0 is out now!

NOTE: We anticipate publishing a security release, Synapse 1.47.1, on the coming Tuesday, the 23rd of November.

Synapse 1.47.1 will contain a fix for a high severity issue.

Synapse 1.47.0 features additions to the admin and module APIs, a plethora of fixes for long-standing bugs, and a raft of internal improvements. Server administrators should note that this release removes a deprecated API for deleting a room and deprecates a module callback. Consult the upgrade notes for more details.

New admin and module APIs

Administrators can now search for rooms by their ID or alias. We hope this will be particularly useful for projects like synapse-admin! We've also exposed an API to allow admins to control Synapse's background updates. And while it's not strictly an API change, there's a small patch which makes it easier for homeservers to redirect matrix traffic to port 443.

Authors of pluggable modules have some new toys to play with. There's a way to listen for new events; a means to retrieve room state and the ability to edit a user's membership of a room.

Bug Fixes and Refactors

We fixed a variety of different bugs in this release, many of which were long-standing. It's good to see them dealt with! Worth mentioning in particular:

• Improvements to the handling of the device_inbox table, which trim redundant data to reduce database bloat.
• Fixes related to restarting workers, to ensure a more reliable upgrade process.
• Fix being unable to join certain v1 rooms, e.g. #NextCloud:matrix.org, whose state contained floating point numbers.
• Fix serialisation and duplication errors when sending ephemeral events to application services.

Additionally, work continues on improving type-checking coverage, both in Synapse and in Sygnal.

Sydent 2.5.1

This week also saw the release of Sydent 2.5.1, the reference implementation of a Matrix Identity Server. This is a minor release which mainly tidies up error handling to reduce the amount of noise in logs. It should also make it easier for us to diagnose some outstanding bugs which remain to be squashed.

Everything Else

In the background, we're still working away at implementing MSC3440 to facilitate threading. Early tests are promising. We're also exploring MSC2775 as a means to speed up room joins. Both will be long term projects that should hopefully reap major rewards for the Matrix ecosystem. Lastly, there's support for MSC3228 to allow identity servers to provide bespoke invites to spaces. We mentioned this last time in Sydent release notes; now we've got support for it on the Synapse side.

Please see the Synapse Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including Dirk Klimpel, JohannesKleine, l00ptr, Nick Barrett, rogersheu, Samuel Philipp, Skyler Mäntysaari and Sumner Evans.

Hey all,

Once again it's been a little while since we've done a spec release (sorry; we're aiming for quarterly releases from here on out), but this time we have some pretty big news: we've got an all-new spec platform and a new versioning scheme. The new spec platform has been needed for a long time to make better sense of what Matrix is, and as part of getting that out the door we reduced the number of "Matrix versions" to just one.

Huge thanks to Will Bamberg for building it out for us, anoa for working out the deployment details, and everyone for testing it all. They talk at length about what this specification even is and about the platform itself on Matrix Live S6E19. It's the single greatest improvement to the spec we've seen to date.

The new versioning scheme presents the whole specification as a single document, making it easier to check compatibility between implementations and the spec itself. Previously, a grid would have to be drawn to show whether Server-Server r0.1.4 is compatible with Client-Server r0.6.1 - while obvious at release time, the historical context gets lost quite easily. Now, with a single version number, the entire specification is compatible across a single version number: servers implementing Matrix 1.1 will be compatible with clients implementing v1.1, and vice versa. For the specification itself, this means we no longer have to carefully point and update links between the APIs, as they'll instead be versioned together.

Changing the versioning of the specification does have an impact on the Client-Server API in particular, however. You may have noticed that Client-Server APIs are currently versioned at "r0". By removing rX.Y.Z versioning, all of the endpoints suddenly don't have a version to reference. All endpoints across the specification are now versioned individually to allow for breaking changes at the endpoint level. They no longer require the whole specification to be listed as a breaking change: a v1 endpoint can get additions/changes which are backwards compatible, but if we need to change format (for example) then it'll get bumped up to v2, leaving v1 in its last known state.

For the Client-Server API, a slight complication is that v1 and v2 (alpha) are already versions familiar to those that have been around for a while - to avoid confusing those people, existing Client-Server API endpoints will start at v3. New endpoints introduced after v1.1 will start at v1 instead.

It's been well over a year since the last release, which means there's a whole lot of features and changes to cover. Here we'll try to cover the things most clients/servers will have to worry about, but we do still recommend reading through the changelog included below. Overall, 28 MSCs have been merged through this release, but some have had to be excluded in the interest of getting the spec release out there. Many of them are expected to be in the next anticipated release (which should hopefully be next quarter).

Clients: There's a lot of stuff

In Matrix 1.1, client developers get all sorts of new features to play with. Clients which support end-to-end encryption should explore key backups, cross-signing, SSSS, and breaking changes to verification. Quite a lot of this stuff has existed for a while, but has made it into the specification formally now. As an added bonus, the emoji for SAS verification have been translated (contribute here).

Knocking has also landed in the spec (thanks Sorunome for leading the charge on this!), opening up the ability for rooms to optionally allow people to request invites to join. This can be helpful for semi-private rooms where it can be easier to approve/deny requests compared to finding someone's MXID and manually inviting them. This does require a v7 room to work, however.

Thanks again to Sorunome, Message Spoilers have been officially included in Matrix. People can now safely discuss the ending to the latest movie without being banned for spoilers. Though, as a new feature, there's a chance that the spoiler text still gets included in the message: clients should update as soon as possible to avoid their users accidentally getting banned for spoiling the conclusion to the Spaces saga ;)

There's a few other smaller improvements/additions, and of course the regular "various clarifications and bug fixes" to take a look at. For a sample checklist, check out element-web's issue on the subject.

Servers: Knock knock, it's a new room version

Room version 7 has landed, bringing forth the ability for users to knock on rooms (requesting an invite to join). The changes are largely scoped to using the reserved keywords for join rules and membership, and are described through the auth rules. Thankfully, the changes over v6 are minimally invasive so should be quick to implement.

Additionally, the cross-signing bits have been included in the API responses and EDU definitions. Matthew's blog post from last year (it really has been that long...) describes cross-signing and the history of its implementation.

As per usual, there's also various specification errors corrected to aid understanding. Synapse has an exhaustive issue to detail what servers might need to do.

PS: Room versions 8 and 9 are also out there, but will be included in a future spec release.

The full changelog

We haven't mentioned identity servers, bridges, etc in this post but they have changes too! Below is the whole changelog, the entire year and a bit of it. Thank you to everyone who has submitted MSCs, and congratulations on getting them released. If we forgot yours, please mention it in #matrix-spec:matrix.org so we can apologize and correct.

PS: The MSC process is how changes to Matrix are made, and you (yes, you) can propose those changes too. Check out the Matrix Live episode where Matthew talks about how this process works, and how we avoid blocking clients from implementing their proposals behind the relatively slow spec release cycles.

Client-Server API

Breaking Changes

• Document curve25519-hkdf-sha256 key agreement method for SAS verification, and deprecate old method as per MSC2630. (#2687)
• Add m.key.verification.ready and m.key.verification.done to key verification framework as per MSC2366. (#3139)

Deprecations

• Deprecate starting verifications that don't start with m.key.verification.request as per MSC3122. (#3199)

New Endpoints

• Add key backup (/room_keys/*) endpoints as per MSC1219. (#2387, #2639)
• Add POST /keys/device_signing/upload and POST /keys/signatures/upload as per MSC1756. (#2536)
• Add /knock endpoint as per MSC2403. (#3154)
• Add /login/sso/redirect/{idpId} as per MSC2858. (#3163)

Removed Endpoints

• Remove unimplemented m.login.oauth2 and m.login.token user-interactive authentication mechanisms as per MSC2610 and MSC2611. (#2609)

Backwards Compatible Changes

• Document how clients can advise recipients that it is withholding decryption keys as per MSC2399. (#2399)
• Add cross-signing properties to the response of POST /keys/query as per MSC1756. (#2536)
• Document Secure Secret Storage and Sharing as per MSC1946 and MSC2472. (#2597)
• Add a device_id parameter to login fallback as per MSC2604. (#2709)
• Added a common set of translations for SAS Emoji. (#2728)
• Added support for reason on all membership events and related endpoints as per MSC2367. (#2795)
• Add a 404 M_NOT_FOUND error to push rule endpoints as per MSC2663. (#2796)
• Make reason and score parameters optional in the content reporting API as per MSC2414. (#2807)
• Allow guests to get the list of members for a room as per MSC2689. (#2808)
• Add support for spoilers as per MSC2010 and MSC2557, and color attribute as per MSC2422. (#3098)
• Add <details> and <summary> to the suggested HTML subset as per MSC2184. (#3100)
• Add key verification using in-room messages as per MSC2241. (#3139, #3150)
• Add information about using SSSS for cross-signing and key backup. (#3147)
• Add key verification method using QR codes as per MSC1544. (#3149)
• Document how clients can simplify usage of Secure Secret Storage as per MSC2874. (#3151)
• Add support for knocking, as per MSC2403. (#3154, #3254)
• Multiple SSO providers are possible through m.login.sso as per MSC2858. (#3163)
• Add device_id to /account/whoami response as per MSC2033. (#3166)
• Downgrade identity server discovery failures to FAIL_PROMPT as per MSC2284. (#3169)
• Re-version all endpoints to be v3 as a starting point instead of r0 as per MSC2844. (#3421)

Spec Clarifications

• Fix issues with age and unsigned being shown in the wrong places. (#2591)
• Fix definitions for room version capabilities. (#2592)
• Fix various typos throughout the specification. (#2594, #2599, #2809, #2878, #2885, #2888, #3116, #3339)
• Clarify link to OpenID Connect specification. (#2605)
• Clarify the behaviour of SSO login and UI-Auth. (#2608)
• Remove spurious room_id from /sync examples. (#2629)
• Reorganize information in Push Notifications module for clarity. (#2634)
• Improve consistency and clarity of event schema titles. (#2647)
• Fix schema issues in m.key.verification.accept and secret storage. (#2653)
• Reword "UI Authorization" to "User-Interactive Authentication" to be more clear. (#2667)
• Fix schemas for push rule actions to represent their alternative object form. (#2669)
• Fix usage of highlight tweak for consistency. (#2670)
• Clarify the behaviour of state for /sync with lazy-loading. (#2754)
• Clarify description of m.room.redaction event. (#2814)
• Mark messages as a required JSON body field in PUT /_matrix/client/r0/sendToDevice/{eventType}/{txnId} calls. (#2928)
• Correct examples of client_secret request body parameters so that they do not include invalid characters. (#2985)
• Fix example MXC URI for m.presence. (#3091)
• Clarify that event bodies are untrusted, as per MSC2801. (#3099)
• Fix the maximum event size restriction (65535 bytes -> 65536). (#3127)
• Update Access-Control-Allow-Headers recommendation to fit CORS specification. (#3225)
• Explicitly state that replacement_room is a room ID in m.room.tombstone events. (#3233)
• Clarify that all request bodies are required. (#3238, #3332)
• Add missing titles to some scheams. (#3330)
• Add User-Interactive Authentication fields to cross-signing APIs as per MSC1756. (#3331)
• Mention that a canonical alias event should be added when a room is created with an alias. (#3337)
• Add an 'API conventions' section to the Appendices. (#3350)
• Clarify the documentation around the pagination tokens used by /sync, /rooms/{room_id}/messages, /initialSync, /rooms/{room_id}/initialSync, and /notifications. (#3353)
• Remove the inaccurate 'Pagination' section. (#3366)
• Clarify how redacted_because is meant to work. (#3411)
• Remove extraneous mimetype from EncryptedFile examples, as per MSC2582. (#3412)
• Describe how MSC2844 affects the /versions endpoint. (#3420)
• Fix documentation errors around threepid_creds. (#3471)

Server-Server API

New Endpoints

• Add /make_knock and /send_knock endpoints as per MSC2403. (#3154)

Backwards Compatible Changes

• Add cross-signing information to GET /user/keys and GET /user/devices/{userId}, m.device_list_update EDU, and a new m.signing_key_update EDU as per MSC1756. (#2536)
• Add support for knocking, as per MSC2403. (#3154)

Spec Clarifications

• Specify that GET /_matrix/federation/v1/make_join/{roomId}/{userId} can return a 404 if the room is unknown. (#2688)
• Fix various typos throughout the specification. (#2888, #3116, #3128, #3207)
• Correct the /_matrix/federation/v1/user/devices/{userId} response which actually returns "self_signing_key" instead of "self_signing_keys". (#3312)
• Explain the reasons why <hostname> TLS certificate is needed rather than <delegated_hostname> for SRV delegation. (#3322)
• Tweak the example PDU diagram to better demonstrate situations with multiple prev_events. (#3340)

Application Service API

Spec Clarifications

• Fix various typos throughout the specification. (#2888)

Identity Service API

New Endpoints

• Add GET /_matrix/identity/versions API as per MSC2320. (#3101)

Removed Endpoints

• The v1 identity service API has been removed in favour of the v2 API, as per MSC2713. (#3170)

Spec Clarifications

• Fix various typos throughout the specification. (#2888)
• Clarify that some identifiers must be case folded prior to processing, as per MSC2265. (#3167, #3176)
• Describe how MSC2844 affects the /versions endpoint. (#3459)

Push Gateway API

Spec Clarifications

• Clarify where to get information about the various parameter values for the notify endpoint. (#2763)

Synapse 1.46.0 is out now and includes support for Ubuntu 21.10: Impish Indri.

This release includes a fix for a performance regression that surfaced in Synapse 1.44.

Progress on Threading

While still disabled by default, we're beginning to land code in Synapse to support threaded discussions in Matrix. In particular, the m.thread event relationship defined in MSC3440 is now implemented behind a configuration flag.

There are still many open questions here, and MSC3440 has not yet been approved to merge into the Matrix spec, but it's a start. Threading is essential to Matrix's continued growth and adoption, and we're excited to provide server-side support to this effort.

Bug Fixes and Refactors

This release is mostly comprised of bug fixes and improvements to static typing. Of note:

• The export-data admin command now works and is tested in CI. This command helps server administrators respond to GDPR Subject Access Requests.
• A weeks-long effort to refactor how Synapse validates the auth_events field of incoming PDUs has concluded, resolving a few corner cases which could incorrectly allow events into the room state which should instead be rejected.
• Further static type hints have been added to Synapse, improving our precise type coverage to 85% of all lines. Currently, 13% of the Python files in synapse/ are skipped during mypy runs. We'd like to cut this in half by the end of the year, as well as increasing overall precise coverage in the codebase.

Sydent 2.5.0

This week also saw the release of Sydent 2.5.0, the reference implementation of a Matrix Identity Server. In addition to fixing bugs, Sydent 2.5.0 passes mypy --strict, uses Jinja2 for templates, and supports the room_type field from MSC3288 to better differentiate between invitations to rooms and invitations to Spaces.

Everything Else

• The Admin API to create or modify accounts now accepts a user_type field, allowing for accounts to be set as belonging to bots or support staff.
• Password auth providers can now be implemented using the new pluggable extension module APIs.

Please see the Synapse Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including aaronraimist, AndrewFerr, dklimpel, and Legogris.

Synapse 1.45.1 is out now! Python 3.10 and PostgreSQL 14 are now tested and supported by Synapse. Support for Python 3.6 and PostgreSQL 9.6 will be removed by the end of the year.

Note: This release may require changes to how media storage providers access your homeserver's configuration. See the Upgrade Notes for more information.

Note: Synapse 1.45.0 was released yesterday and changed how Synapse's monthly active user limits were calculated. Today's release of 1.45.1 reverts that change, but is otherwise identical to 1.45.0.

Support for oEmbed Autodiscovery

Synapse can now automatically discover rich metadata when generating previews of links to sites which support oEmbed.

Before:

After:

Note that URL previews are generated server-side, and thus generally disabled in encrypted rooms to avoid leaking information about message content to your homeserver. You may need to adjust the room's settings to see the new oEmbed previews.

Fixing Stuck Messages

This release of Synapse fixes a race condition which would occasionally prevent your sent events from syncing back down to all of your clients. This caused messages to look like they were stuck at the bottom of the room, waiting to finish sending, even though other users would receive and see them normally.

Improved Privacy for Per-Room Nicknames

Matrix allows users to set their display names to be different things in different rooms. For example, you might use an alias in public rooms, but your real name in rooms shared with friends and family.

To make it easy to initiate conversations with people, each homeserver maintains a user directory with the Matrix ID, display name, and avatar of the users it sees. Previously, this directory would be updated with the most recent profile metadata that Synapse had seen for a user, even if it was only changed in a single room.

As of 1.45, Synapse only uses includes the default display name of local users in its user directory, ignoring room-specific nicknames or avatars. (#5677).

Internals

This release includes numerous fixes and improvements to Synapse's internals.

• We've added countless static type annotations to Synapse (and related projects like Sydent), giving us greater confidence in its correctness and reducing maintenance costs. Several modules newly have all of their definitions typed, allowing us to require and enforce complete type coverage for all future edits therein.

• This release includes meaningful fixes and improvements to our OpenTracing and logging machinery, helping us better catch and eliminate bugs in Synapse. This work ultimately reduced matrix.org's Sentry event volume by an order of magnitude.

• Magic accessor methods have been removed from Synapse's Config class. Previously, Synapse would interpret references like config.send_federation by attempting to guess a reasonable full path, like config.worker.send_federation. As of Synapse 1.45, the full path must be specified directly. This prevents errors where values could be drawn from unexpected or incorrect sections of the server's configuration.

Everything Else

We'd like to extend a special thanks to Fizzadar from Beeper for improving Synapse's update_synapse_database script (#10954) to allow schema changes to occur while Synapse is running. This is a great step toward reducing the downtime associated with upgrades.

These are just the highlights; please see the Upgrade Notes and Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including AndrewFerr, dklimpel, Fizzadar, lukaslihotzki, and maxkratz.

Synapse 1.44.0 is out now!

Loads of Bug Fixes

This release primarily includes fixes for over a dozen long-standing bugs. For example:

• Messages containing null bytes are now properly indexed for search.
• The Room Search Admin API now allows searching for rooms with non-ascii titles.
• URL preview caches, which are meant to be ephemeral, are no longer mirrored from the local media store into other media providers.

Faster JSON Responses

We now stay within C code while generating large JSON objects for responses, which should be substantially faster than the previous technique, which fell back to Python for encoding.

New Extension Module APIs

Spam checker modules can now use a user_may_create_room_with_invites callback to inspect room creation events which include invitations to users via Matrix or other media (email, etc.).

Additionally, the ModuleApi can now inspect IP and User Agent data, as well as checking whether Rooms and MXIDs are local to the current homeserver.

Everything Else

We've also been busy refactoring. For example:

• Prometheus stats now distinguish between cache evictions due to entries expiring, and cache evictions due to the cache being full.
• The synapse.handlers, synapse.rest, and synapse.storage.databases.state modules are now fully type annotated and checked by mypy, among others.
• The user directory search code was cleaned up in preparation for future fixes.
• Another half dozen pull requests were merged with an aim toward clarifying federated event authentication code (and associated logging).

Lastly, this release has seen considerable work toward supporting MSC2716: Incrementally importing history into existing rooms, along with an update to match the current state of MSC3231: Token authenticated registration.

These are just the highlights; please see the Upgrade Notes and Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including aaronraimist, cvwright, govynnus, Kokokokoka, and tulir.

Synapse 1.43.0 is out now!

Preparing for Spaces

Quite a lot of work has gone into preparing for Spaces to graduate from beta testing. For example, Synapse now:

• Asks clients to prefer room version 9 when creating restricted rooms (#10772), via the API defined in MSC3244: room version capabilities.
• Allows the Spaces Summary APIs to be handled by worker processes.
• Omits rooms with unknown room versions from the Spaces Summary.
• Properly handles upgrades of Spaces to different room versions.

Everything Else

This release of Synapse also:

• Includes initial work toward fully supporting oEmbed for embedding URL previews (#10714, #10759).
• Slightly speeds up room joins over federation (#10754, #10755, #10756, #10780, #10784).
• Somewhat improves service restart times for large Synapse deployments.
• Significantly refactors federation event authentication code for greater clarity (#10744, #10745, #10746, #10771, #10773, #10781).
• Adds further static type hints to various modules.

We've also spent quite a lot of time on SyTest, our integration test suite. In particular, many of the tests made assumptions about event processing which were not correct when targeting a multi-worker Synapse deployment. These flakey tests have plagued our continuous integration pipelines, and are finally being fixed.

These are just the highlights; please see the Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including AndrewFerr, BramvdnHeuvel, and cuttingedge1109.

Synapse 1.42.0 is out now!

This release includes changes that you may need to be aware of before upgrading, such as the removal of two deprecated Admin APIs or a retroactive fix to ensure that email notifications are only sent to addresses which are presently associated with an account. Please see the Upgrade Notes for details.

Room Version 9: A Bugfix for Restricted Rooms

Synapse 1.42 includes support for Room Version 9, which fixes an oversight in the list of event fields which were protected from redaction in Room Version 8's restricted rooms. This makes it possible, in certain circumstances, for a restricted room to degrade into a state where participating servers will disagree about the room's membership.

Because changing a room version's redaction algorithm also changes the way that event IDs are calculated, properly fixing this issue required the creation of a new room version.

To ensure compatibility with existing servers, Synapse 1.42's MSC3244: Room version capabilities hints will continue to ask clients to prefer Room Version 8 when creating restricted rooms and Room Version 6 otherwise. A future release of Synapse will ask clients to prefer Room Version 9 for restricted rooms.

Handling Unknown Rooms

Very rarely, users find themselves in rooms created with unstable or experimental room versions. Then, when Synapse removes support for these versions, bad things happen. The server no longer understands how to interact with that room version, which means you can't interact with that room. And if you can't interact with that room, you can't leave.

In Synapse 1.42, rooms with unknown room versions are no longer returned down /sync. This prevents them from appearing in your client, though you may need to empty your client's cache and re-sync to see any effect.

New MSCs

In addition to Room Version 9 (MSC3375), this release includes:

• An initial implementation of MSC3231: Token authenticated registration, which makes it possible for homeservers to disable user registration while still allowing new accounts to be made by people who know a pre-shared secret.

  This MSC and its implementations were produced as part of a Google Summer of Code (GSoC) project by Callum Brown.

• An updated implementation of MSC2946: Spaces Summary following recent changes to the proposal.

• Support for MSC3283: Expose capabilities for profile actions, which hints to clients whether or not a server allows users to change their display name, avatar, or email address.

Everything Else

In addition to the usual array of improvements to performance, type hints, error messages, and documentation:

• Custom Presence Router modules can now be built using Synapse's new, unified module interface which debuted in Synapse 1.37.
• Code around federation event handling and authentication has been significantly refactored to improve reliability and maintainability, including extracting nearly 1,800 lines of code from the FederationHandler class into a separate FederationEventHandler class.
• Backfilling history and fetching missing events now use the same code paths, reducing the potential for bugs.
• Concurrently fetching the same large set of events (#10703) is now much more efficient, preventing the process hangs which were possible in prior, extreme cases.

These are just the highlights; please see the Upgrade Notes and Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including aaronraimist, dklimpel, govynnus, and HugoDelval.

Today we are releasing Synapse 1.41.1, a security update based on last week's release of Synapse 1.41.0. This release patches two moderate severity issues which could reveal metadata about private rooms:

• GHSA-3x4c-pq33-4w3q / CVE-2021-39164: Enumerating a private room's list of members and their display names.

  If an unauthorized user both knows the Room ID of a private room and that room's history visibility is set to shared, then they may be able to enumerate the room's members, including their display names.

  The unauthorized user must be on the same homeserver as a user who is a member of the target room.

• GHSA-jj53-8fmw-f2w2 / CVE-2021-39163: Disclosing a private room's name, avatar, topic, and number of members.

  If an unauthorized user knows the Room ID of a private room, then its name, avatar, topic, and number of members may be disclosed through Group / Community features.

  The unauthorized user must be on the same homeserver as a user who is a member of the target room, and their homeserver must allow non-administrators to create groups (enable_group_creation in the Synapse configuration; off by default).

Note that in both cases:

• The private room's Room ID must be known to the attacker.
• Another user on the attacker's homeserver must be a legitimate member of the target room.
• The information disclosed is already present in the database and thus legitimately known to the administrators of homeservers participating in the target room.

We'd like to credit 0xkasper for discovering and responsibly disclosing these issues.

This release also fixes a small regression in 1.41.0 (#10709) which broke compatibility with older Twisted versions when Synapse was a configured to send email.

Please update at your earliest convenience.

Synapse 1.41.0 is out now!

NOTE: We anticipate publishing a security release next Tuesday, the 31st of August.

Synapse 1.41.1 will contain fixes for two moderate severity issues.

Synapse 1.41 includes changes to forward proxies, template settings, and media workers which may require your attention. Please see the Upgrade Notes for details.

Also, this release removes support for Ubuntu 20.10 (Groovy Gorilla), which reached End of Life last month. Support for Ubuntu 18.04 LTS (Bionic Beaver) and Ubuntu 21.04 (Hirsute Hippo) will be withdrawn near the end of this year under our platform deprecation policy.

Promoting Restricted Rooms

Synapse 1.41 includes experimental support for MSC3244: Room version capabilities, which indicates to clients that they should use Room Version 8 when creating restricted rooms. For example, Element's clients will use the MSC3244 metadata, which is on by default in Synapse 1.41, to determine whether to show end users the UI for creating restricted rooms.

Room Version 6 will remain the default for newly created rooms which do not explicitly request the restricted room capabilities at creation time. This strikes a balance between the broad compatibility of an older default room version, while still making newer features available upon request.

New MSCs

This version of Synapse implements experimental support for:

• MSC3266: Room summary API which provides a simple way to obtain information about a specific room, such as its join rules, room type, etc.
• MSC3288: Add room type in store invite which lets identity servers differentiate between invitations to rooms and invitations to Spaces.
• MSC3244: Room version capabilities as described above.

We've also added pagination to the Spaces Summary API based on updates to MSC2946.

Work towards implementing MSC2716: Incrementally importing history into existing rooms continues, with several related pull requests landing in this release.

More Admin APIs

Synapse now has an Admin APIs to:

• Delete media uploaded by a user from your homeserver's local media storage.
• Edit the external ids associated with a user by Single Sign-On / OpenID Connect providers.
• Check if a username is available, which behaves similarly to the related client-server API in the Matrix Spec, but the Admin API version works even when registration is disabled on a homeserver.

Everything Else

In addition to the usual boosts to performance and reliability like #10119 or #10513, this release includes several notable improvements:

• The /createRoom endpoint can now be handled by workers.
• Synapse can now route outbound federation requests, remote media downloads, and public key fetches through a forward proxy.
• Custom template configuration has now been centralized into a single custom_templates_directory configuration setting.
• Matrix clients which allow users to set a status_msg with their presence will find that Synapse no longer arbitrarily unsets the message when a user goes offline. Instead, each user's status_msg will persist until it is deliberately cleared by their client.
• The extension module API now exposes a function, get_userinfo_by_id, which accepts an MXID and returns a UserInfo object. This should simplify writing extension modules like spam checkers.

These are just the highlights; please see the Upgrade Notes and Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including Bubu, dklimpel, H-Shay, ilmari, Kentokamoto, SimonBrandner, and warricksothr.

Synapse 1.40.0 is out now!

Support for Room Version 8

This release of Synapse includes stable support for Room Version 8! Version 8 codifies a concept of "restricted rooms" which are private rooms joinable only by direct invitation or by being a member of other, designated Spaces / rooms.

This means you can create a Matrix Space for your company, team, or guild, and instead of inviting people to the Space and directly to a bunch of private rooms, you can simply configure your private rooms such that membership in the Space automatically confers access to the private rooms.

This is a major improvement to access control in Matrix, and we can't wait to use it ourselves.

Note that client support for managing restricted rooms is still forthcoming, and you'll want to ensure that your users are on homeservers which support v8 before upgrading existing rooms. To ensure compatibility across federation, the default for newly created rooms remains at v6 for the time being.

Everything Else

A few other items worth calling out:

• Synapse can now optionally recycle PostgreSQL connections after a specified number of transactions (#10440), which may mitigate slow memory leaks in the database. Thanks to GitHub user hifi.
• We have a whole new documentation page explaining Room DAG Concepts like depth, stream ordering, extremities, outliers, and state groups.
• The Admin API for listing accounts now returns a creation_ts property indicating when an account was created. Thanks to work by dklimpel.
• Synapse should better detect character encodings in URL previews thanks to a contribution by srividyut.

In addition to further work towards implementing MSC2716: Incrementally Importing History into Existing Rooms, we've landed support for:

• MSC2033: The /account/whoami endpoint now includes the device_id associated with the access token used to make the request.
• (Experimental) MSC3244: The /_matrix/client/r0/capabilities endpoint may include metadata about which room versions support which capabilities (like knocking on restricted joins).
• (Experimental) MSC2285: Clients may mark messages as read on the server without updating their externally visible read receipts, implemented by SimonBrandner.

These are just the highlights; please see the Release Notes for a complete list of changes in this release.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including dklimpel, hifi, SimonBrandner, and srividyut.