This release includes 1 breaking change for platform teams planning a safe upgrade.
Published 5d
Communication & Email
✓ No known CVEs patched
✓ No known CVEs patched in this version
Affected surfaces
auth
Summary
AI summaryBroad release touches Internal Changes, Bugfixes, Synapse 1.157.0rc1, and https://github.com/element-hq/synapse/issues/19539.
Full changelog
Synapse 1.157.0 (2026-07-21)
No significant changes since 1.157.0rc1.
Synapse 1.157.0rc1 (2026-07-14)
Features
- MSC4140: Cancellable delayed events: Limit how many delayed events a user may have scheduled at once. (#19539)
- Support MSC4446 for moving fully read markers backwards. Contributed by @SpiritCroc @ Beeper. (#19663)
- Add before and after time filters to the 'Redact events of a user' Admin API. (#19802)
- Updated experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#19808)
- Add an
exclude_rooms_from_presenceconfiguration option to stop presence being routed between users solely because they share one of the listed rooms. (#19935)
Bugfixes
- MSC4140: Cancellable delayed events: Update error responses to match their format in the current draft of the MSC. (#19539)
- Lock Sliding Sync connections when inserting lazy members, to prevent repeated deadlocks. (#19826)
- Fix the
flag_existing_quarantined_mediabackground update skipping some quarantined remote media. Introduced in v1.152.0. (#19901) - Fix a bug introduced in Synapse v1.150.0 where reactivating a deactivated and erased user did not restore their profile, breaking login, name changes, and invitations.
Contributed by @m4us1ne. (#19902) - Fix a regression where application services that opted into ephemeral events using the legacy
de.sorunome.msc2409.push_ephemeralregistration flag stopped receiving ephemeral events (including to-device messages used for encryption). Introduced in v1.156.0. (#19928) - Fix a bug causing device list pruning to skip some rows when the transaction gets retried. (#19947)
- Fix presence states being shown to clients forever after presence is disabled, by marking any previously only users as offline. (#19948)
- Fix
SYNAPSE_ASYNC_IO_REACTOR=1on Python 3.14. (#19949)
Deprecations and Removals
- Remove support for experimental MSC3861 auth delegation, in favour of the stable Matrix Authentication Service integration support. See the upgrade notes. (#19895)
Internal Changes
- Port the synchronous core of client event serialization to Rust. (#19837, #19922)
- Update
HomeserverTestCase.get_success(...)and friends to drive async Rust (Tokio runtime/thread pool). (#19871, #19879) - Allow Rust code to have database access via Python database connection pool. (#19878)
- Add
golangci-lintto CI. (#19888) - Remove wall-clock dependency of
test_redact_messages_all_roomstest, as this caused flakiness. (#19890) - Change the MSC3814 dehydrated device
/eventsendpoint fromPOSTtoGET. (#19896) - Change the MSC3814 dehydrated device
/eventsendpoint paging to match spec conventions. (#19897) - Fix storage type mismatches where values were bound with a type that didn't match their database column. (#19911)
- Speed up deletion of old sliding sync connections by adding an index. (#19912)
- Add note to 3PID email token request unit tests that the endpoint being tested can have an expected, artificial delay of up to 1s. (#19916)
- Add an index to
sliding_sync_connection_lazy_membersto speed up deleting old sliding sync connection positions. (#19923) - Fix
test_lock_contentionbeing flaky when running against PostgreSQL by budgeting CPU time rather than wall-clock time. (#19929) - Fix Complement test flake when restarting Synapse workers (cross-test pollution caused by nginx upstreams being temporarily unavailable). (#19936)
- Add clean deploy
FIXMEnote forTestOIDCProviderUnavailable(problem tracked by #19937). (#19938) - Minor presence performance improvements for large servers. (#19939)
- Reduce replication traffic caused by presence. (#19941)
- Add
last_active_granularity,sync_online_timeoutandidle_timeoutoptions to thepresenceconfig section to allow tuning the presence state machine timers. (#19942)
Breaking Changes
- Removed support for experimental MSC3861 auth delegation
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]