v1.115.0rc1

Synapse 1.115.0rc1 (2024-09-10)

Features

• Improve cross-signing upload when using MSC3861 to use a custom UIA flow stage, with web fallback support. (#17509)

Bugfixes

• Return 400 M_BAD_JSON upon attempting to complete various room actions with a non-local user ID and unknown room ID, rather than an internal server error. (#17607)
• Fix authenticated media responses using a wrong limit when following redirects over federation. (#17626)
• Fix bug where we returned the wrong bump_stamp for invites in sliding sync response, causing incorrect ordering of invites in the room list. (#17674)

Improved Documentation

• Clarify that the admin api resource is only loaded on the main process and not workers. (#17590)
• Fixed typo in saml2_config config example. (#17594)

Deprecations and Removals

• Stabilise MSC4156 by removing the msc4156_enabled config setting and defaulting it to true. (#17650)

Internal Changes

• Update MSC3861 implementation: load the issuer and account management URLs from OIDC discovery. (#17407)
• Pre-populate room data used in experimental MSC3575 Sliding Sync /sync endpoint for quick filtering/sorting. (#17512, #17632, #17633, #17634, #17635, #17636, #17641, #17654, #17673)
• Store sliding sync per-connection state in the database. (#17599, #17631)
• Make the sliding sync PerConnectionState class immutable. (#17600)
• Replace isort and black with ruff. (#17620, #17643)
• Sliding Sync: Split up get_room_membership_for_user_at_to_token. (#17629)
• Use new database tables for sliding sync. (#17630, #17649)
• Prevent duplicate tags being added to Sliding Sync traces. (#17655)
• Get bump_stamp from new sliding sync tables which should be faster. (#17658)
• Speed up incremental Sliding Sync requests by avoiding extra work. (#17665)
• Small performance improvement in speeding up sliding sync. (#17666, #17670, #17672)
• Speed up sliding sync by reducing number of database calls. (#17684)
• Speed up sync by pulling out fewer events from the database. (#17688)

Updates to locked dependencies

• Bump authlib from 1.3.1 to 1.3.2. (#17679)
• Bump idna from 3.7 to 3.8. (#17682)
• Bump ruff from 0.6.2 to 0.6.4. (#17680)
• Bump towncrier from 24.7.1 to 24.8.0. (#17645)
• Bump twisted from 24.7.0rc1 to 24.7.0. (#17647)
• Bump types-pillow from 10.2.0.20240520 to 10.2.0.20240822. (#17644)
• Bump types-psycopg2 from 2.9.21.20240417 to 2.9.21.20240819. (#17646)
• Bump types-setuptools from 71.1.0.20240818 to 74.1.0.20240907. (#17681)

v1.114.0

Synapse 1.114.0 (2024-09-02)

This release enables support for MSC4186 — Simplified Sliding Sync. This allows using the upcoming releases of the Element X mobile apps without having to run a Sliding Sync Proxy.

Features

• Enable native sliding sync support (MSC3575 and MSC4186) by default. (#17648)

Synapse 1.114.0rc3 (2024-08-30)

Bugfixes

• Fix regression in v1.114.0rc2 that caused workers to fail to start. (#17626)

Synapse 1.114.0rc2 (2024-08-30)

Features

• Improve cross-signing upload when using MSC3861 to use a custom UIA flow stage, with web fallback support. (#17509)
• Make hash_password script accept password input from stdin. (#17608)

Bugfixes

• Fix hierarchy returning 403 when room is accessible through federation. Contributed by Krishan (@kfiven). (#17194)
• Fix content-length on federation /thumbnail responses. (#17532)
• Fix authenticated media responses using a wrong limit when following redirects over federation. (#17543)

Internal Changes

• MSC3861: load the issuer and account management URLs from OIDC discovery. (#17407)
• Refactor sliding sync class into multiple files. (#17595)
• Store sliding sync per-connection state in the database. (#17599)
• Make the sliding sync PerConnectionState class immutable. (#17600)
• Add support to @tag_args for standalone functions. (#17604)
• Speed up incremental syncs in sliding sync by adding some more caching. (#17606)
• Always return the user's own read receipts in sliding sync. (#17617)
• Replace isort and black with ruff. (#17620)
• Refactor sliding sync code to move room list logic out into a separate class. (#17622)

Updates to locked dependencies

• Bump attrs from 23.2.0 to 24.2.0. (#17609)
• Bump cryptography from 42.0.8 to 43.0.0. (#17584)
• Bump phonenumbers from 8.13.43 to 8.13.44. (#17610)
• Bump pygithub from 2.3.0 to 2.4.0. (#17612)
• Bump pyyaml from 6.0.1 to 6.0.2. (#17611)
• Bump sentry-sdk from 2.12.0 to 2.13.0. (#17585)
• Bump serde from 1.0.206 to 1.0.208. (#17581)
• Bump serde from 1.0.208 to 1.0.209. (#17613)
• Bump serde_json from 1.0.124 to 1.0.125. (#17582)
• Bump serde_json from 1.0.125 to 1.0.127. (#17614)
• Bump types-jsonschema from 4.23.0.20240712 to 4.23.0.20240813. (#17583)
• Bump types-setuptools from 71.1.0.20240726 to 71.1.0.20240818. (#17586)

Synapse 1.114.0rc1 (2024-08-20)

Features

• Add a flag to /versions, org.matrix.simplified_msc3575, to indicate whether experimental sliding sync support has been enabled. (#17571)
• Handle changes in timeline_limit in experimental sliding sync. (#17579)
• Correctly track read receipts that should be sent down in experimental sliding sync. (#17575, #17589, #17592)

Bugfixes

• Start handlers for new media endpoints when media resource configured. (#17483)
• Fix timeline ordering (using stream_ordering instead of topological ordering) in experimental MSC3575 Sliding Sync /sync endpoint. (#17510)
• Fix experimental sliding sync implementation to remember any updates in rooms that were not sent down immediately. (#17535)
• Better exclude partially stated rooms if we must await full state in experimental MSC3575 Sliding Sync /sync endpoint. (#17538)
• Handle lower-case http headers in _Mulitpart_Parser_Protocol. (#17545)
• Fix fetching federation signing keys from servers that omit old_verify_keys. Contributed by @tulir @ Beeper. (#17568)
• Fix bug where we would respond with an error when a remote server asked for media that had a length of 0, using the new multipart federation media endpoint. (#17570)

Improved Documentation

• Clarify default behaviour of the
  auto_accept_invites.worker_to_run_on
  option. (#17515)
• Improve docstrings for profile methods. (#17559)

Internal Changes

• Add more tracing to experimental MSC3575 Sliding Sync /sync endpoint. (#17514)
• Fixup comment in sliding sync implementation. (#17531)
• Replace override of deprecated method HTTPAdapter.get_connection with get_connection_with_tls_context. (#17536)
• Fix performance of device lists in /key/changes and sliding sync. (#17537, #17548)
• Bump setuptools from 67.6.0 to 72.1.0. (#17542)
• Add a utility function for generating random event IDs. (#17557)
• Speed up responding to media requests. (#17558, #17561, #17564, #17566, #17567, #17569)
• Test github token before running release script steps. (#17562)
• Reduce log spam of multipart files. (#17563)
• Refactor per-connection state in experimental sliding sync handler. (#17574)
• Add histogram metrics for sliding sync processing time. (#17593)

Updates to locked dependencies

• Bump bytes from 1.6.1 to 1.7.1. (#17526)
• Bump lxml from 5.2.2 to 5.3.0. (#17550)
• Bump phonenumbers from 8.13.42 to 8.13.43. (#17551)
• Bump regex from 1.10.5 to 1.10.6. (#17527)
• Bump sentry-sdk from 2.10.0 to 2.12.0. (#17553)
• Bump serde from 1.0.204 to 1.0.206. (#17556)
• Bump serde_json from 1.0.122 to 1.0.124. (#17555)
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0. (#17549)
• Bump types-pyyaml from 6.0.12.20240311 to 6.0.12.20240808. (#17552)
• Bump types-requests from 2.31.0.20240406 to 2.32.0.20240712. (#17524)

v1.114.0rc3

Synapse 1.114.0rc3 (2024-08-30)

Bugfixes

• Fix regression in v1.114.0rc2 that caused workers to fail to start. (#17626)

v1.114.0rc2

Synapse 1.114.0rc2 (2024-08-30)

Features

• Improve cross-signing upload when using MSC3861 to use a custom UIA flow stage, with web fallback support. (#17509)
• Make hash_password accept password input from stdin. (#17608)

Bugfixes

• Fix hierarchy returning 403 when room is accessible through federation. Contributed by Krishan (@kfiven). (#17194)
• Fix content-length on federation /thumbnail responses. (#17532)
• Fix authenticated media responses using a wrong limit when following redirects over federation. (#17543)

Internal Changes

• MSC3861: load the issuer and account management URLs from OIDC discovery. (#17407)
• Refactor sliding sync class into multiple files. (#17595)
• Store sliding sync per-connection state in the database. (#17599)
• Make the sliding sync PerConnectionState class immutable. (#17600)
• Add support to @tag_args for standalone functions. (#17604)
• Speed up incremental syncs in sliding sync by adding some more caching. (#17606)
• Always return the user's own read receipts in sliding sync. (#17617)
• Replace isort and black with ruff`. (#17620)
• Refactor sliding sync code to move room list logic out into a separate class. (#17622)

Updates to locked dependencies

• Bump attrs from 23.2.0 to 24.2.0. (#17609)
• Bump cryptography from 42.0.8 to 43.0.0. (#17584)
• Bump phonenumbers from 8.13.43 to 8.13.44. (#17610)
• Bump pygithub from 2.3.0 to 2.4.0. (#17612)
• Bump pyyaml from 6.0.1 to 6.0.2. (#17611)
• Bump sentry-sdk from 2.12.0 to 2.13.0. (#17585)
• Bump serde from 1.0.206 to 1.0.208. (#17581)
• Bump serde from 1.0.208 to 1.0.209. (#17613)
• Bump serde_json from 1.0.124 to 1.0.125. (#17582)
• Bump serde_json from 1.0.125 to 1.0.127. (#17614)
• Bump types-jsonschema from 4.23.0.20240712 to 4.23.0.20240813. (#17583)
• Bump types-setuptools from 71.1.0.20240726 to 71.1.0.20240818. (#17586)

v1.114.0rc1

Synapse 1.114.0rc1 (2024-08-20)

Features

• Add a flag to /versions, org.matrix.simplified_msc3575, to indicate whether experimental sliding sync support has been enabled. (#17571)
• Handle changes in timeline_limit in experimental sliding sync. (#17579)
• Correctly track read receipts that should be sent down in experimental sliding sync. (#17575, #17589, #17592)

Bugfixes

• Start handlers for new media endpoints when media resource configured. (#17483)
• Fix timeline ordering (using stream_ordering instead of topological ordering) in experimental MSC3575 Sliding Sync /sync endpoint. (#17510)
• Fix experimental sliding sync implementation to remember any updates in rooms that were not sent down immediately. (#17535)
• Better exclude partially stated rooms if we must await full state in experimental MSC3575 Sliding Sync /sync endpoint. (#17538)
• Handle lower-case http headers in _Mulitpart_Parser_Protocol. (#17545)
• Fix fetching federation signing keys from servers that omit old_verify_keys. Contributed by @tulir @ Beeper. (#17568)
• Fix bug where we would respond with an error when a remote server asked for media that had a length of 0, using the new multipart federation media endpoint. (#17570)

Improved Documentation

• Clarify default behaviour of the
  auto_accept_invites.worker_to_run_on
  option. (#17515)
• Improve docstrings for profile methods. (#17559)

Internal Changes

• Add more tracing to experimental MSC3575 Sliding Sync /sync endpoint. (#17514)
• Fixup comment in sliding sync implementation. (#17531)
• Replace override of deprecated method HTTPAdapter.get_connection with get_connection_with_tls_context. (#17536)
• Fix performance of device lists in /key/changes and sliding sync. (#17537, #17548)
• Bump setuptools from 67.6.0 to 72.1.0. (#17542)
• Add a utility function for generating random event IDs. (#17557)
• Speed up responding to media requests. (#17558, #17561, #17564, #17566, #17567, #17569)
• Test github token before running release script steps. (#17562)
• Reduce log spam of multipart files. (#17563)
• Refactor per-connection state in experimental sliding sync handler. (#17574)
• Add histogram metrics for sliding sync processing time. (#17593)

Updates to locked dependencies

• Bump bytes from 1.6.1 to 1.7.1. (#17526)
• Bump lxml from 5.2.2 to 5.3.0. (#17550)
• Bump phonenumbers from 8.13.42 to 8.13.43. (#17551)
• Bump regex from 1.10.5 to 1.10.6. (#17527)
• Bump sentry-sdk from 2.10.0 to 2.12.0. (#17553)
• Bump serde from 1.0.204 to 1.0.206. (#17556)
• Bump serde_json from 1.0.122 to 1.0.124. (#17555)
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0. (#17549)
• Bump types-pyyaml from 6.0.12.20240311 to 6.0.12.20240808. (#17552)
• Bump types-requests from 2.31.0.20240406 to 2.32.0.20240712. (#17524)

v1.113.0

Synapse 1.113.0 (2024-08-13)

No significant changes since 1.113.0rc1.

Synapse 1.113.0rc1 (2024-08-06)

Features

• Track which rooms have been sent to clients in the experimental MSC3575 Sliding Sync /sync endpoint. (#17447)
• Add Account Data extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17477)
• Add receipts extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17489)
• Add typing notification extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17505)

Bugfixes

• Update experimental MSC3575 Sliding Sync /sync endpoint to handle invite/knock rooms when filtering. (#17450)
• Fix a bug introduced in v1.110.0 which caused /keys/query to return incomplete results, leading to high network activity and CPU usage on Matrix clients. (#17499)

Improved Documentation

• Update the allowed_local_3pids config option's msisdn address to a working example. (#17476)

Internal Changes

• Change sliding sync to use their own token format in preparation for storing per-connection state. (#17452)
• Ensure we don't send down negative bump_stamp in experimental sliding sync endpoint. (#17478)
• Do not send down empty room entries down experimental sliding sync endpoint. (#17479)
• Refactor Sliding Sync tests to better utilize the SlidingSyncBase. (#17481, #17482)
• Add some opentracing tags and logging to the experimental sliding sync implementation. (#17501)
• Split and move Sliding Sync tests so we have some more sane test file sizes. (#17504)
• Update the limited field description in the Sliding Sync response to accurately describe what it actually represents. (#17507)
• Easier to understand timeline assertions in Sliding Sync tests. (#17511)
• Reset the sliding sync connection if we don't recognize the per-connection state position. (#17529)

Updates to locked dependencies

• Bump bcrypt from 4.1.3 to 4.2.0. (#17495)
• Bump black from 24.4.2 to 24.8.0. (#17522)
• Bump phonenumbers from 8.13.39 to 8.13.42. (#17521)
• Bump ruff from 0.5.4 to 0.5.5. (#17494)
• Bump serde_json from 1.0.120 to 1.0.121. (#17493)
• Bump serde_json from 1.0.121 to 1.0.122. (#17525)
• Bump towncrier from 23.11.0 to 24.7.1. (#17523)
• Bump types-pyopenssl from 24.1.0.20240425 to 24.1.0.20240722. (#17496)
• Bump types-setuptools from 70.1.0.20240627 to 71.1.0.20240726. (#17497)

v1.113.0rc1

Synapse 1.113.0rc1 (2024-08-06)

Features

• Track which rooms have been sent to clients in the experimental MSC3575 Sliding Sync /sync endpoint. (#17447)
• Add Account Data extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17477)
• Add receipts extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17489)
• Add typing notification extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17505)

Bugfixes

• Update experimental MSC3575 Sliding Sync /sync endpoint to handle invite/knock rooms when filtering. (#17450)
• Fix a bug introduced in v1.110.0 which caused /keys/query to return incomplete results, leading to high network activity and CPU usage on Matrix clients. (#17499)

Improved Documentation

• Update the allowed_local_3pids config option's msisdn address to a working example. (#17476)

Internal Changes

• Change sliding sync to use their own token format in preparation for storing per-connection state. (#17452)
• Ensure we don't send down negative bump_stamp in experimental sliding sync endpoint. (#17478)
• Do not send down empty room entries down experimental sliding sync endpoint. (#17479)
• Refactor Sliding Sync tests to better utilize the SlidingSyncBase. (#17481, #17482)
• Add some opentracing tags and logging to the experimental sliding sync implementation. (#17501)
• Split and move Sliding Sync tests so we have some more sane test file sizes. (#17504)
• Update the limited field description in the Sliding Sync response to accurately describe what it actually represents. (#17507)
• Easier to understand timeline assertions in Sliding Sync tests. (#17511)
• Reset the sliding sync connection if we don't recognize the per-connection state position. (#17529)

Updates to locked dependencies

• Bump bcrypt from 4.1.3 to 4.2.0. (#17495)
• Bump black from 24.4.2 to 24.8.0. (#17522)
• Bump phonenumbers from 8.13.39 to 8.13.42. (#17521)
• Bump ruff from 0.5.4 to 0.5.5. (#17494)
• Bump serde_json from 1.0.120 to 1.0.121. (#17493)
• Bump serde_json from 1.0.121 to 1.0.122. (#17525)
• Bump towncrier from 23.11.0 to 24.7.1. (#17523)
• Bump types-pyopenssl from 24.1.0.20240425 to 24.1.0.20240722. (#17496)
• Bump types-setuptools from 70.1.0.20240627 to 71.1.0.20240726. (#17497)

v1.112.0

Synapse 1.112.0 (2024-07-30)

This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again.

Note that this security fix is also available as Synapse 1.111.1, which does not include the rest of the changes in Synapse 1.112.0.

This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request.
If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.

With that said, despite being a high severity issue, we consider it unlikely that Synapse installations will be affected.
The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.

Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.

pip users: Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. Please manually install the new version of Twisted using pip install Twisted==24.7.0rc1. Note also that even the --upgrade-strategy=eager flag to pip install -U matrix-synapse will not upgrade Twisted to a patched version because it is only a release candidate at this time.

Internal Changes

• Upgrade locked dependency on Twisted to 24.7.0rc1. (#17502)

Synapse 1.112.0rc1 (2024-07-23)

Please note that this release candidate does not include the security dependency update
included in version 1.111.1 as this version was released before 1.111.1.
The same security fix can be found in the full release of 1.112.0.

Features

• Add to-device extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17416)
• Populate name/avatar fields in experimental MSC3575 Sliding Sync /sync endpoint. (#17418)
• Populate heroes and room summary fields (joined_count, invited_count) in experimental MSC3575 Sliding Sync /sync endpoint. (#17419)
• Populate is_dm room field in experimental MSC3575 Sliding Sync /sync endpoint. (#17429)
• Add room subscriptions to experimental MSC3575 Sliding Sync /sync endpoint. (#17432)
• Prepare for authenticated media freeze. (#17433)
• Add E2EE extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17454)

Bugfixes

• Add configurable option to always include offline users in presence sync results. Contributed by @Michael-Hollister. (#17231)
• Fix bug in experimental MSC3575 Sliding Sync /sync endpoint when using room type filters and the user has one or more remote invites. (#17434)
• Order heroes by stream_ordering as the Matrix specification states (applies to /sync). (#17435)
• Fix rare bug where /sync would break for a user when using workers with multiple stream writers. (#17438)

Improved Documentation

• Update the readme image to have a white background, so that it is readable in dark mode. (#17387)
• Add Red Hat Enterprise Linux and Rocky Linux 8 and 9 installation instructions. (#17423)
• Improve documentation for the default_power_level_content_override config option. (#17451)

Internal Changes

• Make sure we always use the right logic for enabling the media repo. (#17424)
• Fix argument documentation for method RateLimiter.record_action. (#17426)
• Reduce volume of 'Waiting for current token' logs, which were introduced in v1.109.0. (#17428)
• Limit concurrent remote downloads to 6 per IP address, and decrement remote downloads without a content-length from the ratelimiter after the download is complete. (#17439)
• Remove unnecessary call to resume producing in fake channel. (#17449)
• Update experimental MSC3575 Sliding Sync /sync endpoint to bump room when it is created. (#17453)
• Speed up generating sliding sync responses. (#17458)
• Add cache to get_rooms_for_local_user_where_membership_is to speed up sliding sync. (#17460)
• Speed up fetching room keys from backup. (#17461)
• Speed up sorting of the room list in sliding sync. (#17468)
• Implement handling of $ME as a state key in sliding sync. (#17469)

Updates to locked dependencies

• Bump bytes from 1.6.0 to 1.6.1. (#17441)
• Bump hiredis from 2.3.2 to 3.0.0. (#17464)
• Bump jsonschema from 4.22.0 to 4.23.0. (#17444)
• Bump matrix-org/done-action from 2 to 3. (#17440)
• Bump mypy from 1.9.0 to 1.10.1. (#17445)
• Bump pyopenssl from 24.1.0 to 24.2.1. (#17465)
• Bump ruff from 0.5.0 to 0.5.4. (#17466)
• Bump sentry-sdk from 2.6.0 to 2.8.0. (#17456)
• Bump sentry-sdk from 2.8.0 to 2.10.0. (#17467)
• Bump setuptools from 67.6.0 to 70.0.0. (#17448)
• Bump twine from 5.1.0 to 5.1.1. (#17443)
• Bump types-jsonschema from 4.22.0.20240610 to 4.23.0.20240712. (#17446)
• Bump ulid from 1.1.2 to 1.1.3. (#17442)
• Bump zipp from 3.15.0 to 3.19.1. (#17427)

v1.111.1

Synapse 1.111.1 (2024-07-30)

This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again.

This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request.
If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.

With that said, despite being a high severity issue, we consider it unlikely that Synapse installations will be affected.
The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.

Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.

pip users: Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. Please manually install the new version of Twisted using pip install Twisted==24.7.0rc1. Note also that even the --upgrade-strategy=eager flag to pip install -U matrix-synapse will not upgrade Twisted to a patched version because it is only a release candidate at this time.

Internal Changes

• Upgrade locked dependency on Twisted to 24.7.0rc1. (#17502)

v1.112.0rc1

Synapse 1.112.0rc1 (2024-07-23)

Features

• Add to-device extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17416)
• Populate name/avatar fields in experimental MSC3575 Sliding Sync /sync endpoint. (#17418)
• Populate heroes and room summary fields (joined_count, invited_count) in experimental MSC3575 Sliding Sync /sync endpoint. (#17419)
• Populate is_dm room field in experimental MSC3575 Sliding Sync /sync endpoint. (#17429)
• Add room subscriptions to experimental MSC3575 Sliding Sync /sync endpoint. (#17432)
• Prepare for authenticated media freeze. (#17433)
• Add E2EE extension support to experimental MSC3575 Sliding Sync /sync endpoint. (#17454)

Bugfixes

• Add configurable option to always include offline users in presence sync results. Contributed by @Michael-Hollister. (#17231)
• Fix bug in experimental MSC3575 Sliding Sync /sync endpoint when using room type filters and the user has one or more remote invites. (#17434)
• Order heroes by stream_ordering as the Matrix specification states (applies to /sync). (#17435)
• Fix rare bug where /sync would break for a user when using workers with multiple stream writers. (#17438)

Improved Documentation

• Update the readme image to have a white background, so that it is readable in dark mode. (#17387)
• Add Red Hat Enterprise Linux and Rocky Linux 8 and 9 installation instructions. (#17423)
• Improve documentation for the default_power_level_content_override config option. (#17451)

Internal Changes

• Make sure we always use the right logic for enabling the media repo. (#17424)
• Fix argument documentation for method RateLimiter.record_action. (#17426)
• Reduce volume of 'Waiting for current token' logs, which were introduced in v1.109.0. (#17428)
• Limit concurrent remote downloads to 6 per IP address, and decrement remote downloads without a content-length from the ratelimiter after the download is complete. (#17439)
• Remove unnecessary call to resume producing in fake channel. (#17449)
• Update experimental MSC3575 Sliding Sync /sync endpoint to bump room when it is created. (#17453)
• Speed up generating sliding sync responses. (#17458)
• Add cache to get_rooms_for_local_user_where_membership_is to speed up sliding sync. (#17460)
• Speed up fetching room keys from backup. (#17461)
• Speed up sorting of the room list in sliding sync. (#17468)
• Implement handling of $ME as a state key in sliding sync. (#17469)

Updates to locked dependencies

• Bump bytes from 1.6.0 to 1.6.1. (#17441)
• Bump hiredis from 2.3.2 to 3.0.0. (#17464)
• Bump jsonschema from 4.22.0 to 4.23.0. (#17444)
• Bump matrix-org/done-action from 2 to 3. (#17440)
• Bump mypy from 1.9.0 to 1.10.1. (#17445)
• Bump pyopenssl from 24.1.0 to 24.2.1. (#17465)
• Bump ruff from 0.5.0 to 0.5.4. (#17466)
• Bump sentry-sdk from 2.6.0 to 2.8.0. (#17456)
• Bump sentry-sdk from 2.8.0 to 2.10.0. (#17467)
• Bump setuptools from 67.6.0 to 70.0.0. (#17448)
• Bump twine from 5.1.0 to 5.1.1. (#17443)
• Bump types-jsonschema from 4.22.0.20240610 to 4.23.0.20240712. (#17446)
• Bump ulid from 1.1.2 to 1.1.3. (#17442)
• Bump zipp from 3.15.0 to 3.19.1. (#17427)