chore: upgrade synapse to v1.161.0, MAS to 1.24.0, mautrix-telegram to v0.2609.0, mautrix-signal to v0.2609.0, nginx to 1.31.6; hold bridge DBs at postgres:13-alpine
#5
Recipe upgrade — 2026-09-18 survey pass, extending this evolving upgrade PR (one-PR-per-upgrade policy; never a duplicate). This head is rebased on upstream main tip e91824e — upstream #84's MAINTNANCE.md / renovate.json / README maintainer changes are preserved (the previous head predated them, so the old diff showed them as deletions).
Image bumps (this head vs upstream main 7.3.1+v1.157.1)
service
image
current
new
app
matrixdotorg/synapse
v1.157.1
v1.161.0 (line includes the v1.157.2 security patch)
mas
ghcr.io/element-hq/matrix-authentication-service
1.21.0
1.24.0 (via 1.22.0, 1.23.0)
telegrambridge
dock.mau.dev/mautrix/telegram
v0.2606.0
v0.2609.0 (via v0.2607.0, v0.2608.0)
signalbridge
dock.mau.dev/mautrix/signal
v26.02.2 (= v0.2602.2)
v0.2609.0 — abra blind-spot tag form (display-name v26.02.2 parses > real v0.YYMM.P tags), cross-checked against GitHub releases, pinned in the real upstream tag form
web
nginx
1.31.3
1.31.6 — includes security fix CVE-2026-90439 (via 1.31.4, 1.31.5)
16 advisories fixed in this window: synapse v1.157.2 security release — 11 GHSAs (6 high: ELEMENTSEC-2026-1071/-1520/-1717/-1721/-1729/-1740; 3 moderate: -1714/-1718/-1751; 2 low: -1703/-1760); synapse v1.160.0 dependency refresh (rustls-webpki GHSA-82j2-j2ch-gfr8, pyo3 GHSA-36hh-v3qg-5jq4 + GHSA-chgr-c6px-7xpp); MAS 1.24.0 h2 RUSTSEC-2026-0258; nginx 1.31.6 CVE-2026-90439 (HTTP/3 heap overflow, no CVSS published by vendor). Bridges: none in window.
Operator Action Required
None for the default deployment. Notes for specific setups:
v1.161.0 deprecates matrix_rtc.livekit_service_url (new sibling url) — only LiveKit MatrixRTC setups; this recipe ships no matrix_rtc config, checked.
Bridge DBs HELD at postgres:13-alpine: abra advertises 14/15/16/17/18-alpine but those are MAJOR pg jumps — plain postgres cannot auto-migrate a data dir across majors, so an unattended bump would crash-loop live bridge data (dump/restore first). PG13 is EOL; an attended major bump is advisable for bridge users later, out of scope here.
No config-template changes required (synapse / MAS / bridgev2 config schemas all compatible).
Version label intentionally not bumped in this PR
Recommended release (operator's final publish step after this merges; computes 7.3.2+v1.161.0 from the current 7.3.1 label — same -z shape as the 7.3.0→7.3.1 release):
abra recipe release matrix-synapse -z
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
Recipe upgrade — 2026-09-18 survey pass, extending this evolving upgrade PR (one-PR-per-upgrade policy; never a duplicate). This head is **rebased on upstream main tip `e91824e`** — upstream #84's MAINTNANCE.md / renovate.json / README maintainer changes are preserved (the previous head predated them, so the old diff showed them as deletions).
## Image bumps (this head vs upstream main `7.3.1+v1.157.1`)
| service | image | current | new |
|---|---|---|---|
| app | matrixdotorg/synapse | v1.157.1 | **v1.161.0** (line includes the v1.157.2 security patch) |
| mas | ghcr.io/element-hq/matrix-authentication-service | 1.21.0 | **1.24.0** (via 1.22.0, 1.23.0) |
| telegrambridge | dock.mau.dev/mautrix/telegram | v0.2606.0 | **v0.2609.0** (via v0.2607.0, v0.2608.0) |
| signalbridge | dock.mau.dev/mautrix/signal | v26.02.2 (= v0.2602.2) | **v0.2609.0** — abra blind-spot tag form (display-name `v26.02.2` parses > real `v0.YYMM.P` tags), cross-checked against GitHub releases, pinned in the real upstream tag form |
| web | nginx | 1.31.3 | **1.31.6** — includes security fix CVE-2026-90439 (via 1.31.4, 1.31.5) |
**Upstream release notes:**
- app synapse v1.157.1→v1.161.0: https://github.com/element-hq/synapse/releases (special upgrade notes: https://github.com/element-hq/synapse/blob/release-v1.161/docs/upgrade.md)
- mas 1.21.0→1.24.0: https://github.com/element-hq/matrix-authentication-service/releases
- telegrambridge v0.2606.0→v0.2609.0: https://github.com/mautrix/telegram/releases
- signalbridge v26.02.2→v0.2609.0: https://github.com/mautrix/signal/releases
- web nginx 1.31.3→1.31.6: https://nginx.org/en/CHANGES
## Security content (release notes ∪ deterministic advisory scan)
**16 advisories fixed in this window:** synapse v1.157.2 security release — 11 GHSAs (6 high: ELEMENTSEC-2026-1071/-1520/-1717/-1721/-1729/-1740; 3 moderate: -1714/-1718/-1751; 2 low: -1703/-1760); synapse v1.160.0 dependency refresh (rustls-webpki GHSA-82j2-j2ch-gfr8, pyo3 GHSA-36hh-v3qg-5jq4 + GHSA-chgr-c6px-7xpp); MAS 1.24.0 `h2` RUSTSEC-2026-0258; nginx 1.31.6 CVE-2026-90439 (HTTP/3 heap overflow, no CVSS published by vendor). Bridges: none in window.
## Operator Action Required
**None for the default deployment.** Notes for specific setups:
- v1.161.0 deprecates `matrix_rtc.livekit_service_url` (new sibling `url`) — only LiveKit MatrixRTC setups; this recipe ships no `matrix_rtc` config, checked.
- **Bridge DBs HELD at `postgres:13-alpine`**: abra advertises 14/15/16/17/18-alpine but those are MAJOR pg jumps — plain `postgres` cannot auto-migrate a data dir across majors, so an unattended bump would crash-loop live bridge data (dump/restore first). PG13 is EOL; an attended major bump is advisable for bridge users later, out of scope here.
- No config-template changes required (synapse / MAS / bridgev2 config schemas all compatible).
## Version label intentionally not bumped in this PR
Recommended release (operator's final publish step after this merges; computes `7.3.2+v1.161.0` from the current `7.3.1` label — same `-z` shape as the 7.3.0→7.3.1 release):
abra recipe release matrix-synapse -z
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
autonomic-bot
requested review from trav 2026-06-23 01:55:39 +00:00
autonomic-bot
requested review from notplants 2026-06-23 01:55:39 +00:00
autonomic-bot
changed title from chore: upgrade synapse v1.156.0, MAS 1.20.0 to chore: upgrade synapse v1.157.1, MAS 1.21.0, bridges v0.2607.0, nginx 1.31.32026-07-24 09:46:08 +00:00
autonomic-bot
changed title from chore: upgrade synapse v1.157.1, MAS 1.21.0, bridges v0.2607.0, nginx 1.31.3 to chore: upgrade synapse to v1.157.2, mautrix-telegram to v0.2607.02026-08-04 05:18:19 +00:00
Note: posted via the Drone-direct workaround (ccci-bridge is dropping !testme triggers — stale gitea-bot swarm secret, HTTP 401). Verdict reflected manually.
<!-- cc-ci:testme -->
**cc-ci !testme verdict: GREEN**
Drone build: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1196 (build #1196, event=custom)
Full cold suite: install, upgrade, backup, restore, custom — all passed.
_Note: posted via the Drone-direct workaround (ccci-bridge is dropping !testme triggers — stale gitea-bot swarm secret, HTTP 401). Verdict reflected manually._
autonomic-bot
changed title from chore: upgrade synapse to v1.157.2, mautrix-telegram to v0.2607.0 to chore: upgrade synapse to v1.158.0 + mas 1.22.02026-08-07 04:36:41 +00:00
autonomic-bot
changed title from chore: upgrade synapse to v1.158.0 + mas 1.22.0 to chore: upgrade synapse v1.158.0, MAS 1.22.0, mautrix-telegram v0.2607.02026-08-15 20:09:37 +00:00
Head f6d5fff = synapse v1.158.0 + MAS 1.22.0 + mautrix-telegram v0.2607.0, postgres bridge DBs held at 13-alpine. This exact commit was verified !testme GREEN earlier (Drone #1276). The latest !testme (Drone #1279) is RED due to infra flakiness — Drone clone-step failed instantly under high host load (load avg ~7; box running build loops concurrently), not a recipe regression.
Note: a leaked recipe-upgrade subagent briefly pushed a postgres 13→16-alpine bump onto this branch (commit 9d92988, unverified); that has been reverted — the branch is back on the verified-green f6d5fff head with postgres held. A major postgres bump (13→14/16/18) is deferred to operator review (deliberate hold for the unattended weekly run). Nothing merged.
## Status note (cc-ci weekly upgrader, 2026-08-15)
Head `f6d5fff` = synapse **v1.158.0** + MAS **1.22.0** + mautrix-telegram **v0.2607.0**, **postgres bridge DBs held at 13-alpine**. This exact commit was verified !testme **GREEN** earlier (Drone #1276). The latest !testme (Drone #1279) is **RED due to infra flakiness** — Drone clone-step failed instantly under high host load (load avg ~7; box running build loops concurrently), not a recipe regression.
Note: a leaked recipe-upgrade subagent briefly pushed a postgres 13→16-alpine bump onto this branch (commit 9d92988, unverified); that has been reverted — the branch is back on the verified-green `f6d5fff` head with postgres held. A major postgres bump (13→14/16/18) is deferred to operator review (deliberate hold for the unattended weekly run). Nothing merged.
autonomic-bot
changed title from chore: upgrade synapse v1.158.0, MAS 1.22.0, mautrix-telegram v0.2607.0 to chore: upgrade synapse to v1.158.0, MAS to 1.22.0, mautrix-telegram to v0.2607.02026-08-15 20:32:31 +00:00
(summary card unavailable — see the run for details.)full logs · dashboard
<!-- cc-ci:testme -->
🌻 **cc-ci** — `matrix-synapse` @ `e7fe14c0` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1282
_(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1282) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot
changed title from chore: upgrade synapse to v1.158.0, MAS to 1.22.0, mautrix-telegram to v0.2607.0 to chore: upgrade synapse to v1.159.0, MAS to 1.23.0, mautrix-telegram to v0.2608.0, nginx to 1.31.42026-08-21 03:23:06 +00:00
(summary card unavailable — see the run for details.)full logs · dashboard
<!-- cc-ci:testme -->
🌻 **cc-ci** — `matrix-synapse` @ `a201710a` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1298
_(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1298) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot
changed title from chore: upgrade synapse to v1.159.0, MAS to 1.23.0, mautrix-telegram to v0.2608.0, nginx to 1.31.4 to chore: upgrade synapse to v1.160.0, MAS to 1.24.0, nginx to 1.31.52026-09-04 03:04:22 +00:00
(summary card unavailable — see the run for details.)full logs · dashboard
<!-- cc-ci:testme -->
🌻 **cc-ci** — `matrix-synapse` @ `24475d2b` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1321
_(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1321) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot
changed title from chore: upgrade synapse to v1.160.0, MAS to 1.24.0, nginx to 1.31.5 to chore: upgrade synapse to v1.160.0, MAS to 1.24.0, mautrix-telegram to v0.2608.0, mautrix-signal to v0.2608.0, nginx to 1.31.5; hold bridge DBs at postgres:13-alpine2026-09-11 05:14:50 +00:00
autonomic-bot
changed title from chore: upgrade synapse to v1.160.0, MAS to 1.24.0, mautrix-telegram to v0.2608.0, mautrix-signal to v0.2608.0, nginx to 1.31.5; hold bridge DBs at postgres:13-alpine to chore: upgrade synapse to v1.161.0, MAS to 1.24.0, mautrix-telegram to v0.2609.0, mautrix-signal to v0.2609.0, nginx to 1.31.6; hold bridge DBs at postgres:13-alpine2026-09-18 07:29:07 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Recipe upgrade — 2026-09-18 survey pass, extending this evolving upgrade PR (one-PR-per-upgrade policy; never a duplicate). This head is rebased on upstream main tip
e91824e— upstream #84's MAINTNANCE.md / renovate.json / README maintainer changes are preserved (the previous head predated them, so the old diff showed them as deletions).Image bumps (this head vs upstream main
7.3.1+v1.157.1)v26.02.2parses > realv0.YYMM.Ptags), cross-checked against GitHub releases, pinned in the real upstream tag formUpstream release notes:
Security content (release notes ∪ deterministic advisory scan)
16 advisories fixed in this window: synapse v1.157.2 security release — 11 GHSAs (6 high: ELEMENTSEC-2026-1071/-1520/-1717/-1721/-1729/-1740; 3 moderate: -1714/-1718/-1751; 2 low: -1703/-1760); synapse v1.160.0 dependency refresh (rustls-webpki GHSA-82j2-j2ch-gfr8, pyo3 GHSA-36hh-v3qg-5jq4 + GHSA-chgr-c6px-7xpp); MAS 1.24.0
h2RUSTSEC-2026-0258; nginx 1.31.6 CVE-2026-90439 (HTTP/3 heap overflow, no CVSS published by vendor). Bridges: none in window.Operator Action Required
None for the default deployment. Notes for specific setups:
matrix_rtc.livekit_service_url(new siblingurl) — only LiveKit MatrixRTC setups; this recipe ships nomatrix_rtcconfig, checked.postgres:13-alpine: abra advertises 14/15/16/17/18-alpine but those are MAJOR pg jumps — plainpostgrescannot auto-migrate a data dir across majors, so an unattended bump would crash-loop live bridge data (dump/restore first). PG13 is EOL; an attended major bump is advisable for bridge users later, out of scope here.Version label intentionally not bumped in this PR
Recommended release (operator's final publish step after this merges; computes
7.3.2+v1.161.0from the current7.3.1label — same-zshape as the 7.3.0→7.3.1 release):abra recipe release matrix-synapse -z
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
matrix-synapse@c04a8583✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
matrix-synapse@c04a8583✅ passedfull logs · dashboard
chore: upgrade bridges + bridge DBsto chore: upgrade synapse v1.156.0, MAS 1.20.0!testme
🌻 cc-ci —
matrix-synapse@8b8609e5✅ passedfull logs · dashboard
chore: upgrade synapse v1.156.0, MAS 1.20.0to chore: upgrade synapse v1.157.1, MAS 1.21.0, bridges v0.2607.0, nginx 1.31.3!testme
🌻 cc-ci —
matrix-synapse@5ad1781b✅ passedfull logs · dashboard
chore: upgrade synapse v1.157.1, MAS 1.21.0, bridges v0.2607.0, nginx 1.31.3to chore: upgrade synapse to v1.157.2, mautrix-telegram to v0.2607.0cc-ci !testme verdict: GREEN
Drone build: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1196 (build #1196, event=custom)
Full cold suite: install, upgrade, backup, restore, custom — all passed.
Note: posted via the Drone-direct workaround (ccci-bridge is dropping !testme triggers — stale gitea-bot swarm secret, HTTP 401). Verdict reflected manually.
chore: upgrade synapse to v1.157.2, mautrix-telegram to v0.2607.0to chore: upgrade synapse to v1.158.0 + mas 1.22.0!testme
🌻 cc-ci —
matrix-synapse@81a40bcc✅ passedfull logs · dashboard
81a40bcc65tof6d5fffa53chore: upgrade synapse to v1.158.0 + mas 1.22.0to chore: upgrade synapse v1.158.0, MAS 1.22.0, mautrix-telegram v0.2607.0!testme
🌻 cc-ci —
matrix-synapse@f6d5fffa✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1276(summary card unavailable — see the run for details.) full logs · dashboard
9d92988c0ftof6d5fffa53!testme
🌻 cc-ci —
matrix-synapse@f6d5fffa❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1279(summary card unavailable — see the run for details.) full logs · dashboard
Status note (cc-ci weekly upgrader, 2026-08-15)
Head
f6d5fff= synapse v1.158.0 + MAS 1.22.0 + mautrix-telegram v0.2607.0, postgres bridge DBs held at 13-alpine. This exact commit was verified !testme GREEN earlier (Drone #1276). The latest !testme (Drone #1279) is RED due to infra flakiness — Drone clone-step failed instantly under high host load (load avg ~7; box running build loops concurrently), not a recipe regression.Note: a leaked recipe-upgrade subagent briefly pushed a postgres 13→16-alpine bump onto this branch (commit
9d92988, unverified); that has been reverted — the branch is back on the verified-greenf6d5fffhead with postgres held. A major postgres bump (13→14/16/18) is deferred to operator review (deliberate hold for the unattended weekly run). Nothing merged.chore: upgrade synapse v1.158.0, MAS 1.22.0, mautrix-telegram v0.2607.0to chore: upgrade synapse to v1.158.0, MAS to 1.22.0, mautrix-telegram to v0.2607.0!testme
🌻 cc-ci —
matrix-synapse@f6d5fffa✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1281(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
matrix-synapse@e7fe14c0✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1282(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade synapse to v1.158.0, MAS to 1.22.0, mautrix-telegram to v0.2607.0to chore: upgrade synapse to v1.159.0, MAS to 1.23.0, mautrix-telegram to v0.2608.0, nginx to 1.31.4!testme
🌻 cc-ci —
matrix-synapse@a201710a✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1298(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade synapse to v1.159.0, MAS to 1.23.0, mautrix-telegram to v0.2608.0, nginx to 1.31.4to chore: upgrade synapse to v1.160.0, MAS to 1.24.0, nginx to 1.31.5!testme
🌻 cc-ci —
matrix-synapse@24475d2b✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1321(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade synapse to v1.160.0, MAS to 1.24.0, nginx to 1.31.5to chore: upgrade synapse to v1.160.0, MAS to 1.24.0, mautrix-telegram to v0.2608.0, mautrix-signal to v0.2608.0, nginx to 1.31.5; hold bridge DBs at postgres:13-alpine!testme
🌻 cc-ci —
matrix-synapse@e8e95a51✅ passedfull logs · dashboard
chore: upgrade synapse to v1.160.0, MAS to 1.24.0, mautrix-telegram to v0.2608.0, mautrix-signal to v0.2608.0, nginx to 1.31.5; hold bridge DBs at postgres:13-alpineto chore: upgrade synapse to v1.161.0, MAS to 1.24.0, mautrix-telegram to v0.2609.0, mautrix-signal to v0.2609.0, nginx to 1.31.6; hold bridge DBs at postgres:13-alpine!testme
🌻 cc-ci —
matrix-synapse@0e2cb19b✅ passedfull logs · dashboard
autonomic-bot referenced this pull request2026-09-21 18:38:50 +00:00