Skip to content

Update all dependencies#25

Open
missingcharacter wants to merge 1 commit intomainfrom
renovate/all
Open

Update all dependencies#25
missingcharacter wants to merge 1 commit intomainfrom
renovate/all

Conversation

@missingcharacter
Copy link
Copy Markdown
Owner

@missingcharacter missingcharacter commented Apr 28, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
ghcr.io/element-hq/synapse minor v1.149.1 → v1.152.0
ghcr.io/umami-software/umami minor 3.0.3 → 3.1.0
traefik patch v3.6.11 → v3.6.15
vaultwarden/server patch 1.35.4-alpine → 1.35.8-alpine

Release Notes

element-hq/synapse (ghcr.io/element-hq/synapse)

v1.152.0

Compare Source

Synapse 1.152.0 (2026-04-28)

No significant changes since 1.152.0rc1.

Configuration changes needed for deployments using workers

For deployments using workers, please note that this version introduces a new quarantined_media_changes stream writer, which may require configuration changes.
Please see the the relevant section in the upgrade notes for details.

Without configuring this new stream writer, only the main process will be able to handle the /media/quarantine admin API endpoints for quarantining media.

Synapse 1.152.0rc1 (2026-04-22)

Features

Bugfixes

  • Reject device_keys: null in the request to POST /_matrix/client/v3/keys/upload, as per the spec. This was temporarily allowed as a workaround for misbehaving clients. (#​19637)
  • Fix database migrations failing on platforms where SQLite is configured with SQLITE_DBCONFIG_DEFENSIVE by default, such as macOS. (#​19690)
  • Fix a bug introduced in v1.145 where a non-admin could bypass admin checks for downloading remote quarantined media. This relied on the media already being previously present on the homeserver. (#​19639)

Improved Documentation

  • Include a workaround for running the unit tests with SQLite under recent versions of MacOS. (#​19615)
  • Fix Docker image link typo in worker docs. (#​19645)
  • Update the developer stream docs for creating a new stream to point out _setup_sequence(...) in portdb. (#​19675)
  • Update the developer stream docs for creating a new stream to highlight places that require documentation updates. (#​19696)

Internal Changes

  • Update CI to use re-usable Complement GitHub CI workflow. (#​19533)
  • Fix docstring for limit argument in _maybe_backfill_inner(...). (#​19630)
  • Document context for why increase timeout for policy server requests. (#​19633)
  • Run lint script to format Complement tests introduced in #​19509. (#​19636)
  • Small simplifications to the events class. (#​19680, #​19712)
  • Introduce spam_checker_spammy internal event metadata. (#​19453)
  • Add a FilteredEvent class that saves us copying events. (#​19640)
  • Convert EventInternalMetadata to use Arc<RwLock<_>>. (#​19669)

v1.151.0

Compare Source

Synapse 1.151.0 (2026-04-07)

Bugfixes

  • Fix KNOWN_ROOM_VERSIONS.__contains__ raising TypeError for non-string keys, which could cause /sync to fail for rooms with a NULL room version in the database. Bug introduced in #​19589 as part of v1.151.0rc1. (#​19649)

Synapse 1.151.0rc1 (2026-03-31)

Features

Bugfixes

  • Fix MSC4284 Policy Servers implementation to skip signing org.matrix.msc4284.policy and m.room.policy state events. (#​19503)
  • Correctly apply MSC4284 Policy Server signatures to events when the sender and policy server have the same server name. (#​19503)
  • Allow Synapse to start up even when discovery fails for an OpenID Connect provider. (#​19509)
  • Fix quarantine media admin APIs sometimes returning inaccurate counts for remote media. (#​19559)
  • Fix Build and push complement image CI job not having poetry available for the Complement runner script. (#​19578)
  • Increase timeout for policy server requests to avoid repeated requests for checking media. (#​19629)

Deprecations and Removals

Internal Changes

  • Fix small comment typo in config output from the demo/start.sh script. (#​19538)
  • Add MSC3820 comment context to RoomVersion attributes. (#​19577)
  • Remove redacted_because from internal unsigned. (#​19581)
  • Prevent sending registration emails if registration is disabled. (#​19585)
  • Port RoomVersion to Rust. (#​19589)
  • Only show failing Complement tests in the formatted output in CI. (#​19590)
  • Ensure old Complement test files are removed when downloading a Complement checkout via ./scripts-dev/complement.sh. (#​19592)
  • Update HomeserverTestCase.pump() docstring to demystify behavior (Twisted reactor/clock). (#​19602)
  • Deprecate HomeserverTestCase.pump() in favor of more direct HomeserverTestCase.reactor.advance(...) usage. (#​19602)
  • Lower the Postgres database statement_timeout to 10m (previously 1h). (#​19604)

v1.150.0

Compare Source

Synapse 1.150.0 (2026-03-24)

No significant changes since 1.150.0rc1.

Upgrade notes

Please read the upgrade notes as this release includes a few changes that may affect your deployment.

Synapse 1.150.0rc1 (2026-03-17)

Features

Bugfixes

  • Fix Build and push complement image CI job pointing to non-existent image. (#​19523)
  • Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. (#​19542)

Improved Documentation

  • In the Admin API documentation, always express path parameters as /<param> instead of as /$param. (#​19307)
  • Update docs to clarify outbound_federation_restricted_to can also be used with the Secure Border Gateway (SBG). (#​19517)
  • Unify Complement developer docs. (#​19518)

Internal Changes

  • Put membership updates in a background resumable task when changing the avatar or the display name. (#​19311)
  • Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). (#​19476)
  • Migrate dev dependencies to PEP 735 dependency groups. (#​19490)
  • Remove the optional systemd-python dependency and the systemd extra on the synapse package. (#​19491)
  • Avoid re-computing the event ID when cloning events. (#​19527)
  • Allow caching of the /versions and /auth_metadata public endpoints. (#​19530)
  • Add a few labels to the number groupings in the Processed request logs. (#​19548)
containous/traefik (traefik)

v3.6.15

Compare Source

All Commits

Bug fixes:

Misc:

v3.6.15

Compare Source

All Commits

Bug fixes:

Misc:

v3.6.14

Compare Source

All Commits

Bug fixes:

Misc:

v3.6.14

Compare Source

All Commits

Bug fixes:

Misc:

v3.6.13

Compare Source

All Commits

Bug fixes:

Documentation:

v3.6.13

Compare Source

All Commits

Bug fixes:

Documentation:

v3.6.12

Compare Source

All Commits

Bug fixes:

Documentation:

v3.6.12

Compare Source

All Commits

Bug fixes:

Documentation:

dani-garcia/vaultwarden (vaultwarden/server)

v1.35.8

Compare Source

What's Changed

Full Changelog: dani-garcia/vaultwarden@1.35.7...1.35.8

v1.35.7

Compare Source

What's Changed

Full Changelog: dani-garcia/vaultwarden@1.35.6...1.35.7

v1.35.6

Compare Source

Notes

The previous release contained an issue where Two Factor Remember Tokens and Recovery Tokens were not accepted at all.
This has been fixed now in this release.

What's Changed

Full Changelog: dani-garcia/vaultwarden@1.35.5...1.35.6

v1.35.5

Compare Source

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment.

Notes

  • The admin templates have changed, please update them if you override these via templates.
  • Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.

What's Changed

New Contributors

Full Changelog: dani-garcia/vaultwarden@1.35.4...1.35.5

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@missingcharacter @renovate-bot