Log message:
chat/matrix-synapse: Update to 1.120.2

This is a security patch release.

This patch release fixes multiple security vulnerabilities, some affecting all \ 
prior versions of Synapse. Server administrators are encouraged to update \ 
Synapse as soon as possible. We are not aware of these vulnerabilities being \ 
exploited in the wild.

Administrators who are unable to update Synapse may use the workarounds \ 
described in the linked GitHub Security Advisory below.
Security advisory

The following issues are fixed in 1.120.1.

    GHSA-rfq8-j7rh-8hf2 / CVE-2024-52805 (high): Unsupported content types can \ 
lead to memory exhaustion

    Synapse instances which have a high max_upload_size and which don't have a \ 
reverse proxy in front of them that would otherwise limit upload size are \ 
affected.

    Fixed by 4b7154c58501b4bf5e1c2d6c11ebef96529f2fdf.

    GHSA-f3r3-h2mq-hx2h / CVE-2024-52815 (high): Malicious invites via \ 
federation can break a user's sync

    Fixed by d82e1ed357b7ee21dff83d06cba7a67840cfd464.

    GHSA-vp6v-whfm-rv3g / CVE-2024-53863 (high): Synapse can be forced to \ 
thumbnail unexpected file formats, invoking potentially untrustworthy decoders

    Synapse instances can disable dynamic thumbnailing by setting \ 
dynamic_thumbnails to false in the configuration file.

    Fixed by b64a4e5fbbbf119b6c65aedf0d999b4237d55503.

    GHSA-56w4-5538-8v8h / CVE-2024-53867 (moderate): The Sliding Sync feature on \ 
Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state \ 
changes to users no longer in a room

    Non-state events, like messages, are unaffected.

    Synapse instances can disable the Sliding Sync feature by setting \ 
experimental_features.msc3575_enabled to false in the configuration file.

    Fixed by 4daa533e82f345ce87b9495d31781af570ba3ead.

Additionally, we disclose the following vulnerabilities, both have been fixed in \ 
Synapse 1.106.0:

    GHSA-4mhg-xv73-xq2x / CVE-2024-37302 (high): Denial of service through media \ 
disk space consumption

    GHSA-gjgr-7834-rhxr / CVE-2024-37303 (moderate): Unauthenticated writes to \ 
the media repository allow planting of problematic content

Log message:
chat/matrix-synapse: Update to 1.20.0

Upstream NEWS:

Synapse 1.120.0 (2024-11-26)

This release enables the enforcement of authenticated media by default, with \ 
exemptions for media that is already present in the
homeserver's media store.

Most homeservers operating in the public federation will not be impacted by this \ 
change, given that
the large homeserver matrix.org enabled this in September 2024 and therefore \ 
most clients and servers
will already have updated as a result.

Some server administrators may still wish to disable this enforcement for the \ 
time being, in the interest of compatibility with older clients
and older federated homeservers.
See the upgrade notes for more information.

Synapse 1.119.0 (2024-11-13)

    Support MSC4151's stable report room API. (#17374)
    Add experimental support for MSC4222 (Adding state_after to sync v2). (#17888)

Synapse 1.118.0 (2024-10-29)

    Added the display_name_claim option to the JWT configuration. This option \ 
allows specifying the claim key that contains the user's display name in the JWT \ 
payload. (#17708)
    Implement MSC4210: Remove legacy mentions. Contributed by @tulir @ Beeper. \ 
(#17783)

Synapse 1.117.0 (2024-10-15)

    Add config option redis.password_path. (#17717)

Synapse 1.116.0 (2024-10-01)

    Add implementation of restricting who can overwrite a state event as \ 
proposed by MSC3757. (#17513)

Synapse 1.115.0 (2024-09-17)

    Improve cross-signing upload when using MSC3861 to use a custom UIA flow \ 
stage, with web fallback support. (#17509)

Log message:
chat/matrix-synapse: Move .orig remediation to post-install

After giving up on fighting poetry to make it not install .orig files
and thus put them in the wheel built during the build stage, change to
removing the .orig files in destdir after the install target.

No change to binary package, but now mkpatches should be ok even after
make package.

Log message:
chat/matrix-synapse: Add comments related to workaround

  - add upstream bugtracker URL for patch to avoid use of Twisted private API

  - expand comment about the build system bug of installing fooorig,
    and leave a note that it should be changed to happen later.
    However, with the target as pre-install, the orig files are
    mysteriously still installed.

NFCI; this is a comment-only change (plus distinfo for the new comments)

Log message:
Fix chat/matrix-synapse with newer Twisted

Log message:
*: clean-up after python38 removal

Log message:
Update chat/matrix-synapse to 1.112.0

# Synapse 1.112.0 (2024-07-30)

This security release is to update our locked dependency on Twisted to \ 
24.7.0rc1, which includes a security fix for [CVE-2024-41671 / \ 
GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, \ 
again](https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7).

Note that this security fix is also available as **Synapse 1.111.1**, which does \ 
not include the rest of the changes in Synapse 1.112.0.

This issue means that, if multiple HTTP requests are pipelined in the same TCP \ 
connection, Synapse can send responses to the wrong HTTP request.
If a reverse proxy was configured to use HTTP pipelining, this could result in \ 
responses being sent to the wrong user, severely harming confidentiality.

With that said, despite being a high severity issue, **we consider it unlikely \ 
that Synapse installations will be affected**.
The use of HTTP pipelining in this fashion would cause worse performance for \ 
clients (request-response latencies would be increased as users' responses would \ 
be artificially blocked behind other users' slow requests). Further, Nginx and \ 
Haproxy, two common reverse proxies, do not appear to support configuring their \ 
upstreams to use HTTP pipelining and thus would not be affected. For both of \ 
these reasons, we consider it unlikely that a Synapse deployment would be set up \ 
in such a configuration.

Despite that, we cannot rule out that some installations may exist with this \ 
unusual setup and so we are releasing this security update today.

**pip users:** Note that by default, upgrading Synapse using pip will not \ 
automatically upgrade Twisted. **Please manually install the new version of \ 
Twisted** using `pip install Twisted==24.7.0rc1`. Note also that even the \ 
`--upgrade-strategy=eager` flag to `pip install -U matrix-synapse` will not \ 
upgrade Twisted to a patched version because it is only a release candidate at \ 
this time.

### Internal Changes

- Upgrade locked dependency on Twisted to 24.7.0rc1. \ 
([\#17502](https://github.com/element-hq/synapse/issues/17502))

# Synapse 1.112.0rc1 (2024-07-23)

Please note that this release candidate does not include the security dependency \ 
update
included in version 1.111.1 as this version was released before 1.111.1.
The same security fix can be found in the full release of 1.112.0.

### Features

- Add to-device extension support to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17416](https://github.com/element-hq/synapse/issues/17416))
- Populate `name`/`avatar` fields in experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17418](https://github.com/element-hq/synapse/issues/17418))
- Populate `heroes` and room summary fields (`joined_count`, `invited_count`) in \ 
experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17419](https://github.com/element-hq/synapse/issues/17419))
- Populate `is_dm` room field in experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17429](https://github.com/element-hq/synapse/issues/17429))
- Add room subscriptions to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17432](https://github.com/element-hq/synapse/issues/17432))
- Prepare for authenticated media freeze. \ 
([\#17433](https://github.com/element-hq/synapse/issues/17433))
- Add E2EE extension support to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17454](https://github.com/element-hq/synapse/issues/17454))

### Bugfixes

- Add configurable option to always include offline users in presence sync \ 
results. Contributed by @Michael-Hollister. \ 
([\#17231](https://github.com/element-hq/synapse/issues/17231))
- Fix bug in experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint when using room type filters and the user has one or more \ 
remote invites. ([\#17434](https://github.com/element-hq/synapse/issues/17434))
- Order `heroes` by `stream_ordering` as the Matrix specification states \ 
(applies to `/sync`). \ 
([\#17435](https://github.com/element-hq/synapse/issues/17435))
- Fix rare bug where `/sync` would break for a user when using workers with \ 
multiple stream writers. \ 
([\#17438](https://github.com/element-hq/synapse/issues/17438))

### Improved Documentation

- Update the readme image to have a white background, so that it is readable in \ 
dark mode. ([\#17387](https://github.com/element-hq/synapse/issues/17387))
- Add Red Hat Enterprise Linux and Rocky Linux 8 and 9 installation \ 
instructions. ([\#17423](https://github.com/element-hq/synapse/issues/17423))
- Improve documentation for the \ 
[`default_power_level_content_override`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#default_power_level_content_override) \ 
config option. ([\#17451](https://github.com/element-hq/synapse/issues/17451))

### Internal Changes

- Make sure we always use the right logic for enabling the media repo. \ 
([\#17424](https://github.com/element-hq/synapse/issues/17424))
- Fix argument documentation for method `RateLimiter.record_action`. \ 
([\#17426](https://github.com/element-hq/synapse/issues/17426))
- Reduce volume of 'Waiting for current token' logs, which were introduced in \ 
v1.109.0. ([\#17428](https://github.com/element-hq/synapse/issues/17428))
- Limit concurrent remote downloads to 6 per IP address, and decrement remote \ 
downloads without a content-length from the ratelimiter after the download is \ 
complete. ([\#17439](https://github.com/element-hq/synapse/issues/17439))
- Remove unnecessary call to resume producing in fake channel. \ 
([\#17449](https://github.com/element-hq/synapse/issues/17449))
- Update experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint to bump room when it is created. \ 
([\#17453](https://github.com/element-hq/synapse/issues/17453))
- Speed up generating sliding sync responses. \ 
([\#17458](https://github.com/element-hq/synapse/issues/17458))
- Add cache to `get_rooms_for_local_user_where_membership_is` to speed up \ 
sliding sync. ([\#17460](https://github.com/element-hq/synapse/issues/17460))
- Speed up fetching room keys from backup. \ 
([\#17461](https://github.com/element-hq/synapse/issues/17461))
- Speed up sorting of the room list in sliding sync. \ 
([\#17468](https://github.com/element-hq/synapse/issues/17468))
- Implement handling of `$ME` as a state key in sliding sync. \ 
([\#17469](https://github.com/element-hq/synapse/issues/17469))

### Updates to locked dependencies

* Bump bytes from 1.6.0 to 1.6.1. \ 
([\#17441](https://github.com/element-hq/synapse/issues/17441))
* Bump hiredis from 2.3.2 to 3.0.0. \ 
([\#17464](https://github.com/element-hq/synapse/issues/17464))
* Bump jsonschema from 4.22.0 to 4.23.0. \ 
([\#17444](https://github.com/element-hq/synapse/issues/17444))
* Bump matrix-org/done-action from 2 to 3. \ 
([\#17440](https://github.com/element-hq/synapse/issues/17440))
* Bump mypy from 1.9.0 to 1.10.1. \ 
([\#17445](https://github.com/element-hq/synapse/issues/17445))
* Bump pyopenssl from 24.1.0 to 24.2.1. \ 
([\#17465](https://github.com/element-hq/synapse/issues/17465))
* Bump ruff from 0.5.0 to 0.5.4. \ 
([\#17466](https://github.com/element-hq/synapse/issues/17466))
* Bump sentry-sdk from 2.6.0 to 2.8.0. \ 
([\#17456](https://github.com/element-hq/synapse/issues/17456))
* Bump sentry-sdk from 2.8.0 to 2.10.0. \ 
([\#17467](https://github.com/element-hq/synapse/issues/17467))
* Bump setuptools from 67.6.0 to 70.0.0. \ 
([\#17448](https://github.com/element-hq/synapse/issues/17448))
* Bump twine from 5.1.0 to 5.1.1. \ 
([\#17443](https://github.com/element-hq/synapse/issues/17443))
* Bump types-jsonschema from 4.22.0.20240610 to 4.23.0.20240712. \ 
([\#17446](https://github.com/element-hq/synapse/issues/17446))
* Bump ulid from 1.1.2 to 1.1.3. \ 
([\#17442](https://github.com/element-hq/synapse/issues/17442))
* Bump zipp from 3.15.0 to 3.19.1. \ 
([\#17427](https://github.com/element-hq/synapse/issues/17427))

# Synapse 1.111.0 (2024-07-16)

No significant changes since 1.111.0rc2.

# Synapse 1.111.0rc2 (2024-07-10)

### Bugfixes

- Fix bug where using `synapse.app.media_repository` worker configuration would \ 
break the new media endpoints. \ 
([\#17420](https://github.com/element-hq/synapse/issues/17420))

### Improved Documentation

- Document the new federation media worker endpoints in the [upgrade \ 
notes](https://element-hq.github.io/synapse/v1.111/upgrade.html) and [worker \ 
docs](https://element-hq.github.io/synapse/v1.111/workers.html). \ 
([\#17421](https://github.com/element-hq/synapse/issues/17421))

### Internal Changes

- Route authenticated federation media requests to media repository workers in \ 
Complement tests. \ 
([\#17422](https://github.com/element-hq/synapse/issues/17422))

# Synapse 1.111.0rc1 (2024-07-09)

### Features

- Add `rooms` data to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17320](https://github.com/element-hq/synapse/issues/17320))
- Add `room_types`/`not_room_types` filtering to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17337](https://github.com/element-hq/synapse/issues/17337))
- Return "required state" in experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17342](https://github.com/element-hq/synapse/issues/17342))
- Support \ 
[MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md) \ 
by adding \ 
[`_matrix/client/v1/media/download`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediadownloadservernamemediaid) \ 
endpoint. ([\#17365](https://github.com/element-hq/synapse/issues/17365))
- Support \ 
[MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/rav/authentication-for-media/proposals/3916-authentication-for-media.md)
  by adding \ 
[`_matrix/client/v1/media/thumbnail`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediathumbnailservernamemediaid), \ 
[`_matrix/federation/v1/media/thumbnail`](https://spec.matrix.org/v1.11/server-server-api/#get_matrixfederationv1mediathumbnailmediaid) \ 
endpoints and stabilizing the
  remaining \ 
[`_matrix/client/v1/media`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediaconfig) \ 
endpoints. ([\#17388](https://github.com/element-hq/synapse/issues/17388))
- Add `rooms.bump_stamp` for easier client-side sorting in experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17395](https://github.com/element-hq/synapse/issues/17395))
- Forget all of a user's rooms upon deactivation, preventing local room purges \ 
from being blocked on deactivated users. \ 
([\#17400](https://github.com/element-hq/synapse/issues/17400))
- Declare support for [Matrix \ 
1.11](https://matrix.org/blog/2024/06/20/matrix-v1.11-release/). \ 
([\#17403](https://github.com/element-hq/synapse/issues/17403))
- [MSC3861](https://github.com/matrix-org/matrix-spec-proposals/pull/3861): \ 
allow overriding the introspection endpoint. \ 
([\#17406](https://github.com/element-hq/synapse/issues/17406))

### Bugfixes

- Fix rare race which caused no new to-device messages to be received from \ 
remote server. ([\#17362](https://github.com/element-hq/synapse/issues/17362))
- Fix bug in experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint when using an old database. \ 
([\#17398](https://github.com/element-hq/synapse/issues/17398))

### Improved Documentation

- Clarify that `url_preview_url_blacklist` is a usability feature. \ 
([\#17356](https://github.com/element-hq/synapse/issues/17356))
- Fix broken links in README. \ 
([\#17379](https://github.com/element-hq/synapse/issues/17379))
- Clarify that changelog content *and file extension* need to match in order for \ 
entries to merge. \ 
([\#17399](https://github.com/element-hq/synapse/issues/17399))

### Internal Changes

- Make the release script create a release branch for Complement as well. \ 
([\#17318](https://github.com/element-hq/synapse/issues/17318))
- Fix uploading packages to PyPi. \ 
([\#17363](https://github.com/element-hq/synapse/issues/17363))
- Add CI check for the README. \ 
([\#17367](https://github.com/element-hq/synapse/issues/17367))
- Fix linting errors from new `ruff` version. \ 
([\#17381](https://github.com/element-hq/synapse/issues/17381), \ 
[\#17411](https://github.com/element-hq/synapse/issues/17411))
- Fix building debian packages on non-clean checkouts. \ 
([\#17390](https://github.com/element-hq/synapse/issues/17390))
- Finish up work to allow per-user feature flags. \ 
([\#17392](https://github.com/element-hq/synapse/issues/17392), \ 
[\#17410](https://github.com/element-hq/synapse/issues/17410))
- Allow enabling sliding sync per-user. \ 
([\#17393](https://github.com/element-hq/synapse/issues/17393))

### Updates to locked dependencies

* Bump certifi from 2023.7.22 to 2024.7.4. \ 
([\#17404](https://github.com/element-hq/synapse/issues/17404))
* Bump cryptography from 42.0.7 to 42.0.8. \ 
([\#17382](https://github.com/element-hq/synapse/issues/17382))
* Bump ijson from 3.2.3 to 3.3.0. \ 
([\#17413](https://github.com/element-hq/synapse/issues/17413))
* Bump log from 0.4.21 to 0.4.22. \ 
([\#17384](https://github.com/element-hq/synapse/issues/17384))
* Bump mypy-zope from 1.0.4 to 1.0.5. \ 
([\#17414](https://github.com/element-hq/synapse/issues/17414))
* Bump pillow from 10.3.0 to 10.4.0. \ 
([\#17412](https://github.com/element-hq/synapse/issues/17412))
* Bump pydantic from 2.7.1 to 2.8.2. \ 
([\#17415](https://github.com/element-hq/synapse/issues/17415))
* Bump ruff from 0.3.7 to 0.5.0. \ 
([\#17381](https://github.com/element-hq/synapse/issues/17381))
* Bump serde from 1.0.203 to 1.0.204. \ 
([\#17409](https://github.com/element-hq/synapse/issues/17409))
* Bump serde_json from 1.0.117 to 1.0.120. \ 
([\#17385](https://github.com/element-hq/synapse/issues/17385), \ 
[\#17408](https://github.com/element-hq/synapse/issues/17408))
* Bump types-setuptools from 69.5.0.20240423 to 70.1.0.20240627. \ 
([\#17380](https://github.com/element-hq/synapse/issues/17380))

# Synapse 1.110.0 (2024-07-03)

No significant changes since 1.110.0rc3.

# Synapse 1.110.0rc3 (2024-07-02)

### Bugfixes

- Fix bug where `/sync` requests could get blocked indefinitely after an upgrade \ 
from Synapse versions before v1.109.0. \ 
([\#17386](https://github.com/element-hq/synapse/issues/17386), \ 
[\#17391](https://github.com/element-hq/synapse/issues/17391))

### Internal Changes

- Limit size of presence EDUs to 50 entries. \ 
([\#17371](https://github.com/element-hq/synapse/issues/17371))
- Fix building debian package for debian sid. \ 
([\#17389](https://github.com/element-hq/synapse/issues/17389))

# Synapse 1.110.0rc2 (2024-06-26)

### Internal Changes

- Fix uploading packages to PyPi. \ 
([\#17363](https://github.com/element-hq/synapse/issues/17363))

# Synapse 1.110.0rc1 (2024-06-26)

### Features

- Add initial implementation of an experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17187](https://github.com/element-hq/synapse/issues/17187))
- Add experimental support for \ 
[MSC3823](https://github.com/matrix-org/matrix-spec-proposals/pull/3823) - \ 
Account suspension. \ 
([\#17255](https://github.com/element-hq/synapse/issues/17255))
- Improve ratelimiting in Synapse. \ 
([\#17256](https://github.com/element-hq/synapse/issues/17256))
- Add support for the unstable \ 
[MSC4151](https://github.com/matrix-org/matrix-spec-proposals/pull/4151) report \ 
room API. ([\#17270](https://github.com/element-hq/synapse/issues/17270), \ 
[\#17296](https://github.com/element-hq/synapse/issues/17296))
- Filter for public and empty rooms added to Admin-API [List Room \ 
API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#list-room-api). \ 
([\#17276](https://github.com/element-hq/synapse/issues/17276))
- Add `is_dm` filtering to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17277](https://github.com/element-hq/synapse/issues/17277))
- Add `is_encrypted` filtering to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17281](https://github.com/element-hq/synapse/issues/17281))
- Include user membership in events served to clients, per \ 
[MSC4115](https://github.com/matrix-org/matrix-spec-proposals/pull/4115). \ 
([\#17282](https://github.com/element-hq/synapse/issues/17282))
- Do not require user-interactive authentication for uploading cross-signing \ 
keys for the first time, per \ 
[MSC3967](https://github.com/matrix-org/matrix-spec-proposals/pull/3967). \ 
([\#17284](https://github.com/element-hq/synapse/issues/17284))
- Add `stream_ordering` sort to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17293](https://github.com/element-hq/synapse/issues/17293))
- `register_new_matrix_user` now supports a --password-file flag, which
  is useful for scripting. \ 
([\#17294](https://github.com/element-hq/synapse/issues/17294))
- `register_new_matrix_user` now supports a --exists-ok flag to allow \ 
registration of users that already exist in the database.
  This is useful for scripts that bootstrap user accounts with initial \ 
passwords. ([\#17304](https://github.com/element-hq/synapse/issues/17304))
- Add support for via query parameter from \ 
[MSC4156](https://github.com/matrix-org/matrix-spec-proposals/pull/4156). \ 
([\#17322](https://github.com/element-hq/synapse/issues/17322))
- Add `is_invite` filtering to experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17335](https://github.com/element-hq/synapse/issues/17335))
- Support \ 
[MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md) \ 
by adding a federation /download endpoint. \ 
([\#17350](https://github.com/element-hq/synapse/issues/17350))

### Bugfixes

- Fix searching for users with their exact localpart whose ID includes a hyphen. \ 
([\#17254](https://github.com/element-hq/synapse/issues/17254))
- Fix wrong retention policy being used when filtering events. \ 
([\#17272](https://github.com/element-hq/synapse/issues/17272))
- Fix bug where OTKs were not always included in `/sync` response when using \ 
workers. ([\#17275](https://github.com/element-hq/synapse/issues/17275))
- Fix a long-standing bug where an invalid 'from' parameter to \ 
[`/notifications`](https://spec.matrix.org/v1.10/client-server-api/#get_matrixclientv3notifications) \ 
would result in an Internal Server Error. \ 
([\#17283](https://github.com/element-hq/synapse/issues/17283))
- Fix edge case in `/sync` returning the wrong the state when using sharded \ 
event persisters. \ 
([\#17295](https://github.com/element-hq/synapse/issues/17295))
- Add initial implementation of an experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync `/sync` endpoint. \ 
([\#17301](https://github.com/element-hq/synapse/issues/17301))
- Fix email notification subject when invited to a space. \ 
([\#17336](https://github.com/element-hq/synapse/issues/17336))

### Improved Documentation

- Add missing quotes for example for `exclude_rooms_from_sync`. \ 
([\#17308](https://github.com/element-hq/synapse/issues/17308))
- Update header in the README to visually fix the the auto-generated table of \ 
contents. ([\#17329](https://github.com/element-hq/synapse/issues/17329))
- Fix stale references to the Foundation's Security Disclosure Policy. \ 
([\#17341](https://github.com/element-hq/synapse/issues/17341))
- Add default values for `rc_invites.per_issuer` to docs. \ 
([\#17347](https://github.com/element-hq/synapse/issues/17347))
- Fix an error in the docs for `search_all_users` parameter under \ 
`user_directory`. \ 
([\#17348](https://github.com/element-hq/synapse/issues/17348))

### Internal Changes

- Remove unused `expire_access_token` option in the Synapse Docker config file. \ 
Contributed by @AaronDewes. \ 
([\#17198](https://github.com/element-hq/synapse/issues/17198))
- Use fully-qualified `PersistedEventPosition` when returning `RoomsForUser` to \ 
facilitate proper comparisons and `RoomStreamToken` generation. \ 
([\#17265](https://github.com/element-hq/synapse/issues/17265))
- Add debug logging for when room keys are uploaded, including whether they are \ 
replacing other room keys. \ 
([\#17266](https://github.com/element-hq/synapse/issues/17266))
- Handle OTK uploads off master. \ 
([\#17271](https://github.com/element-hq/synapse/issues/17271))
- Don't try and resync devices for remote users whose servers are marked as \ 
down. ([\#17273](https://github.com/element-hq/synapse/issues/17273))
- Re-organize Pydantic models and types used in handlers. \ 
([\#17279](https://github.com/element-hq/synapse/issues/17279))
- Expose the worker instance that persisted the event on \ 
`event.internal_metadata.instance_name`. \ 
([\#17300](https://github.com/element-hq/synapse/issues/17300))
- Update the README with Element branding, improve headers and fix the \ 
#synapse:matrix.org support room link rendering. \ 
([\#17324](https://github.com/element-hq/synapse/issues/17324))
- Change path of the experimental \ 
[MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding \ 
Sync implementation to `/org.matrix.simplified_msc3575/sync` since our \ 
simplified API is slightly incompatible with what's in the current MSC. \ 
([\#17331](https://github.com/element-hq/synapse/issues/17331))
- Handle device lists notifications for large accounts more efficiently in \ 
worker mode. ([\#17333](https://github.com/element-hq/synapse/issues/17333), \ 
[\#17358](https://github.com/element-hq/synapse/issues/17358))
- Do not block event sending/receiving while calculating large event auth \ 
chains. ([\#17338](https://github.com/element-hq/synapse/issues/17338))
- Tidy up `parse_integer` docs and call sites to reflect the fact that they \ 
require non-negative integers by default, and bring `parse_integer_from_args` \ 
default in alignment. Contributed by Denis Kasak (@dkasak). \ 
([\#17339](https://github.com/element-hq/synapse/issues/17339))

### Updates to locked dependencies

* Bump authlib from 1.3.0 to 1.3.1. \ 
([\#17343](https://github.com/element-hq/synapse/issues/17343))
* Bump dawidd6/action-download-artifact from 3.1.4 to 5. \ 
([\#17289](https://github.com/element-hq/synapse/issues/17289))
* Bump dawidd6/action-download-artifact from 5 to 6. \ 
([\#17313](https://github.com/element-hq/synapse/issues/17313))
* Bump docker/build-push-action from 5 to 6. \ 
([\#17312](https://github.com/element-hq/synapse/issues/17312))
* Bump jinja2 from 3.1.3 to 3.1.4. \ 
([\#17287](https://github.com/element-hq/synapse/issues/17287))
* Bump lazy_static from 1.4.0 to 1.5.0. \ 
([\#17355](https://github.com/element-hq/synapse/issues/17355))
* Bump msgpack from 1.0.7 to 1.0.8. \ 
([\#17317](https://github.com/element-hq/synapse/issues/17317))
* Bump netaddr from 1.2.1 to 1.3.0. \ 
([\#17353](https://github.com/element-hq/synapse/issues/17353))
* Bump packaging from 24.0 to 24.1. \ 
([\#17352](https://github.com/element-hq/synapse/issues/17352))
* Bump phonenumbers from 8.13.37 to 8.13.39. \ 
([\#17315](https://github.com/element-hq/synapse/issues/17315))
* Bump regex from 1.10.4 to 1.10.5. \ 
([\#17290](https://github.com/element-hq/synapse/issues/17290))
* Bump requests from 2.31.0 to 2.32.2. \ 
([\#17345](https://github.com/element-hq/synapse/issues/17345))
* Bump sentry-sdk from 2.1.1 to 2.3.1. \ 
([\#17263](https://github.com/element-hq/synapse/issues/17263))
* Bump sentry-sdk from 2.3.1 to 2.6.0. \ 
([\#17351](https://github.com/element-hq/synapse/issues/17351))
* Bump tornado from 6.4 to 6.4.1. \ 
([\#17344](https://github.com/element-hq/synapse/issues/17344))
* Bump mypy from 1.8.0 to 1.9.0. \ 
([\#17297](https://github.com/element-hq/synapse/issues/17297))
* Bump types-jsonschema from 4.21.0.20240311 to 4.22.0.20240610. \ 
([\#17288](https://github.com/element-hq/synapse/issues/17288))
* Bump types-netaddr from 1.2.0.20240219 to 1.3.0.20240530. \ 
([\#17314](https://github.com/element-hq/synapse/issues/17314))
* Bump types-pillow from 10.2.0.20240423 to 10.2.0.20240520. \ 
([\#17285](https://github.com/element-hq/synapse/issues/17285))
* Bump types-pyyaml from 6.0.12.12 to 6.0.12.20240311. \ 
([\#17316](https://github.com/element-hq/synapse/issues/17316))
* Bump typing-extensions from 4.11.0 to 4.12.2. \ 
([\#17354](https://github.com/element-hq/synapse/issues/17354))
* Bump urllib3 from 2.0.7 to 2.2.2. \ 
([\#17346](https://github.com/element-hq/synapse/issues/17346))

Log message:
chat/matrix-synapse: Update to 1.105.1

Synapse 1.105.1 (2024-04-23)
Security advisory

The following issues are fixed in 1.105.1.

    GHSA-3h7q-rfh9-xm4v / CVE-2024-31208 — High Severity

    Weakness in auth chain indexing allows DoS from remote room members through \ 
disk fill and high CPU usage.