chore: upgrade synapse to v1.161.0, MAS to 1.24.0, mautrix-telegram to v0.2609.0, mautrix-signal to v0.2609.0, nginx to 1.31.6; hold bridge DBs at postgres:13-alpine #5

Merged
trav merged 6 commits from upgrade-c04a858 into main 2026-09-21 16:51:39 +00:00
Owner

Recipe upgrade — 2026-09-18 survey pass, extending this evolving upgrade PR (one-PR-per-upgrade policy; never a duplicate). This head is rebased on upstream main tip e91824e — upstream #84's MAINTNANCE.md / renovate.json / README maintainer changes are preserved (the previous head predated them, so the old diff showed them as deletions).

Image bumps (this head vs upstream main 7.3.1+v1.157.1)

service image current new
app matrixdotorg/synapse v1.157.1 v1.161.0 (line includes the v1.157.2 security patch)
mas ghcr.io/element-hq/matrix-authentication-service 1.21.0 1.24.0 (via 1.22.0, 1.23.0)
telegrambridge dock.mau.dev/mautrix/telegram v0.2606.0 v0.2609.0 (via v0.2607.0, v0.2608.0)
signalbridge dock.mau.dev/mautrix/signal v26.02.2 (= v0.2602.2) v0.2609.0 — abra blind-spot tag form (display-name v26.02.2 parses > real v0.YYMM.P tags), cross-checked against GitHub releases, pinned in the real upstream tag form
web nginx 1.31.3 1.31.6 — includes security fix CVE-2026-90439 (via 1.31.4, 1.31.5)

Upstream release notes:

Security content (release notes ∪ deterministic advisory scan)

16 advisories fixed in this window: synapse v1.157.2 security release — 11 GHSAs (6 high: ELEMENTSEC-2026-1071/-1520/-1717/-1721/-1729/-1740; 3 moderate: -1714/-1718/-1751; 2 low: -1703/-1760); synapse v1.160.0 dependency refresh (rustls-webpki GHSA-82j2-j2ch-gfr8, pyo3 GHSA-36hh-v3qg-5jq4 + GHSA-chgr-c6px-7xpp); MAS 1.24.0 h2 RUSTSEC-2026-0258; nginx 1.31.6 CVE-2026-90439 (HTTP/3 heap overflow, no CVSS published by vendor). Bridges: none in window.

Operator Action Required

None for the default deployment. Notes for specific setups:

  • v1.161.0 deprecates matrix_rtc.livekit_service_url (new sibling url) — only LiveKit MatrixRTC setups; this recipe ships no matrix_rtc config, checked.
  • Bridge DBs HELD at postgres:13-alpine: abra advertises 14/15/16/17/18-alpine but those are MAJOR pg jumps — plain postgres cannot auto-migrate a data dir across majors, so an unattended bump would crash-loop live bridge data (dump/restore first). PG13 is EOL; an attended major bump is advisable for bridge users later, out of scope here.
  • No config-template changes required (synapse / MAS / bridgev2 config schemas all compatible).

Version label intentionally not bumped in this PR

Recommended release (operator's final publish step after this merges; computes 7.3.2+v1.161.0 from the current 7.3.1 label — same -z shape as the 7.3.0→7.3.1 release):

abra recipe release matrix-synapse -z

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Recipe upgrade — 2026-09-18 survey pass, extending this evolving upgrade PR (one-PR-per-upgrade policy; never a duplicate). This head is **rebased on upstream main tip `e91824e`** — upstream #84's MAINTNANCE.md / renovate.json / README maintainer changes are preserved (the previous head predated them, so the old diff showed them as deletions). ## Image bumps (this head vs upstream main `7.3.1+v1.157.1`) | service | image | current | new | |---|---|---|---| | app | matrixdotorg/synapse | v1.157.1 | **v1.161.0** (line includes the v1.157.2 security patch) | | mas | ghcr.io/element-hq/matrix-authentication-service | 1.21.0 | **1.24.0** (via 1.22.0, 1.23.0) | | telegrambridge | dock.mau.dev/mautrix/telegram | v0.2606.0 | **v0.2609.0** (via v0.2607.0, v0.2608.0) | | signalbridge | dock.mau.dev/mautrix/signal | v26.02.2 (= v0.2602.2) | **v0.2609.0** — abra blind-spot tag form (display-name `v26.02.2` parses > real `v0.YYMM.P` tags), cross-checked against GitHub releases, pinned in the real upstream tag form | | web | nginx | 1.31.3 | **1.31.6** — includes security fix CVE-2026-90439 (via 1.31.4, 1.31.5) | **Upstream release notes:** - app synapse v1.157.1→v1.161.0: https://github.com/element-hq/synapse/releases (special upgrade notes: https://github.com/element-hq/synapse/blob/release-v1.161/docs/upgrade.md) - mas 1.21.0→1.24.0: https://github.com/element-hq/matrix-authentication-service/releases - telegrambridge v0.2606.0→v0.2609.0: https://github.com/mautrix/telegram/releases - signalbridge v26.02.2→v0.2609.0: https://github.com/mautrix/signal/releases - web nginx 1.31.3→1.31.6: https://nginx.org/en/CHANGES ## Security content (release notes ∪ deterministic advisory scan) **16 advisories fixed in this window:** synapse v1.157.2 security release — 11 GHSAs (6 high: ELEMENTSEC-2026-1071/-1520/-1717/-1721/-1729/-1740; 3 moderate: -1714/-1718/-1751; 2 low: -1703/-1760); synapse v1.160.0 dependency refresh (rustls-webpki GHSA-82j2-j2ch-gfr8, pyo3 GHSA-36hh-v3qg-5jq4 + GHSA-chgr-c6px-7xpp); MAS 1.24.0 `h2` RUSTSEC-2026-0258; nginx 1.31.6 CVE-2026-90439 (HTTP/3 heap overflow, no CVSS published by vendor). Bridges: none in window. ## Operator Action Required **None for the default deployment.** Notes for specific setups: - v1.161.0 deprecates `matrix_rtc.livekit_service_url` (new sibling `url`) — only LiveKit MatrixRTC setups; this recipe ships no `matrix_rtc` config, checked. - **Bridge DBs HELD at `postgres:13-alpine`**: abra advertises 14/15/16/17/18-alpine but those are MAJOR pg jumps — plain `postgres` cannot auto-migrate a data dir across majors, so an unattended bump would crash-loop live bridge data (dump/restore first). PG13 is EOL; an attended major bump is advisable for bridge users later, out of scope here. - No config-template changes required (synapse / MAS / bridgev2 config schemas all compatible). ## Version label intentionally not bumped in this PR Recommended release (operator's final publish step after this merges; computes `7.3.2+v1.161.0` from the current `7.3.1` label — same `-z` shape as the 7.3.0→7.3.1 release): abra recipe release matrix-synapse -z Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot requested review from trav 2026-06-23 01:55:39 +00:00
autonomic-bot requested review from notplants 2026-06-23 01:55:39 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ c04a8583 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `c04a8583` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/955/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/955) [![level](https://ci.commoninternet.net/runs/955/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/955) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/955) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ c04a8583 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `c04a8583` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/966/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/966) [![level](https://ci.commoninternet.net/runs/966/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/966) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/966) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade bridges + bridge DBs to chore: upgrade synapse v1.156.0, MAS 1.20.0 2026-07-13 23:28:25 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ 8b8609e5 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `8b8609e5` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1125/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1125) [![level](https://ci.commoninternet.net/runs/1125/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1125) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1125) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade synapse v1.156.0, MAS 1.20.0 to chore: upgrade synapse v1.157.1, MAS 1.21.0, bridges v0.2607.0, nginx 1.31.3 2026-07-24 09:46:08 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ 5ad1781b ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `5ad1781b` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1142/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1142) [![level](https://ci.commoninternet.net/runs/1142/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1142) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1142) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade synapse v1.157.1, MAS 1.21.0, bridges v0.2607.0, nginx 1.31.3 to chore: upgrade synapse to v1.157.2, mautrix-telegram to v0.2607.0 2026-08-04 05:18:19 +00:00
Author
Owner

cc-ci !testme verdict: GREEN

Drone build: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1196 (build #1196, event=custom)
Full cold suite: install, upgrade, backup, restore, custom — all passed.

Note: posted via the Drone-direct workaround (ccci-bridge is dropping !testme triggers — stale gitea-bot swarm secret, HTTP 401). Verdict reflected manually.

<!-- cc-ci:testme --> **cc-ci !testme verdict: GREEN** Drone build: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1196 (build #1196, event=custom) Full cold suite: install, upgrade, backup, restore, custom — all passed. _Note: posted via the Drone-direct workaround (ccci-bridge is dropping !testme triggers — stale gitea-bot swarm secret, HTTP 401). Verdict reflected manually._
autonomic-bot changed title from chore: upgrade synapse to v1.157.2, mautrix-telegram to v0.2607.0 to chore: upgrade synapse to v1.158.0 + mas 1.22.0 2026-08-07 04:36:41 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ 81a40bcc ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `81a40bcc` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1218/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1218) [![level](https://ci.commoninternet.net/runs/1218/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1218) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1218) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot added 1 commit 2026-08-15 20:09:27 +00:00
autonomic-bot force-pushed upgrade-c04a858 from 81a40bcc65 to f6d5fffa53 2026-08-15 20:09:27 +00:00 Compare
autonomic-bot changed title from chore: upgrade synapse to v1.158.0 + mas 1.22.0 to chore: upgrade synapse v1.158.0, MAS 1.22.0, mautrix-telegram v0.2607.0 2026-08-15 20:09:37 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ f6d5fffa ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1276

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `f6d5fffa` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1276 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1276) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot force-pushed upgrade-c04a858 from 9d92988c0f to f6d5fffa53 2026-08-15 20:29:18 +00:00 Compare
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ f6d5fffa ❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1279

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `f6d5fffa` ❌ **failure** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1279 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1279) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

Status note (cc-ci weekly upgrader, 2026-08-15)

Head f6d5fff = synapse v1.158.0 + MAS 1.22.0 + mautrix-telegram v0.2607.0, postgres bridge DBs held at 13-alpine. This exact commit was verified !testme GREEN earlier (Drone #1276). The latest !testme (Drone #1279) is RED due to infra flakiness — Drone clone-step failed instantly under high host load (load avg ~7; box running build loops concurrently), not a recipe regression.

Note: a leaked recipe-upgrade subagent briefly pushed a postgres 13→16-alpine bump onto this branch (commit 9d92988, unverified); that has been reverted — the branch is back on the verified-green f6d5fff head with postgres held. A major postgres bump (13→14/16/18) is deferred to operator review (deliberate hold for the unattended weekly run). Nothing merged.

## Status note (cc-ci weekly upgrader, 2026-08-15) Head `f6d5fff` = synapse **v1.158.0** + MAS **1.22.0** + mautrix-telegram **v0.2607.0**, **postgres bridge DBs held at 13-alpine**. This exact commit was verified !testme **GREEN** earlier (Drone #1276). The latest !testme (Drone #1279) is **RED due to infra flakiness** — Drone clone-step failed instantly under high host load (load avg ~7; box running build loops concurrently), not a recipe regression. Note: a leaked recipe-upgrade subagent briefly pushed a postgres 13→16-alpine bump onto this branch (commit 9d92988, unverified); that has been reverted — the branch is back on the verified-green `f6d5fff` head with postgres held. A major postgres bump (13→14/16/18) is deferred to operator review (deliberate hold for the unattended weekly run). Nothing merged.
autonomic-bot changed title from chore: upgrade synapse v1.158.0, MAS 1.22.0, mautrix-telegram v0.2607.0 to chore: upgrade synapse to v1.158.0, MAS to 1.22.0, mautrix-telegram to v0.2607.0 2026-08-15 20:32:31 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ f6d5fffa ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1281

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `f6d5fffa` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1281 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1281) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot added 1 commit 2026-08-15 20:36:51 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ e7fe14c0 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1282

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `e7fe14c0` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1282 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1282) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade synapse to v1.158.0, MAS to 1.22.0, mautrix-telegram to v0.2607.0 to chore: upgrade synapse to v1.159.0, MAS to 1.23.0, mautrix-telegram to v0.2608.0, nginx to 1.31.4 2026-08-21 03:23:06 +00:00
autonomic-bot added 1 commit 2026-08-21 03:23:08 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ a201710a ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1298

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `a201710a` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1298 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1298) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade synapse to v1.159.0, MAS to 1.23.0, mautrix-telegram to v0.2608.0, nginx to 1.31.4 to chore: upgrade synapse to v1.160.0, MAS to 1.24.0, nginx to 1.31.5 2026-09-04 03:04:22 +00:00
autonomic-bot added 1 commit 2026-09-04 03:04:22 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ 24475d2b ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1321

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `24475d2b` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1321 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1321) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade synapse to v1.160.0, MAS to 1.24.0, nginx to 1.31.5 to chore: upgrade synapse to v1.160.0, MAS to 1.24.0, mautrix-telegram to v0.2608.0, mautrix-signal to v0.2608.0, nginx to 1.31.5; hold bridge DBs at postgres:13-alpine 2026-09-11 05:14:50 +00:00
autonomic-bot added 1 commit 2026-09-11 05:14:52 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ e8e95a51 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `e8e95a51` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1354/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1354) [![level](https://ci.commoninternet.net/runs/1354/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1354) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1354) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade synapse to v1.160.0, MAS to 1.24.0, mautrix-telegram to v0.2608.0, mautrix-signal to v0.2608.0, nginx to 1.31.5; hold bridge DBs at postgres:13-alpine to chore: upgrade synapse to v1.161.0, MAS to 1.24.0, mautrix-telegram to v0.2609.0, mautrix-signal to v0.2609.0, nginx to 1.31.6; hold bridge DBs at postgres:13-alpine 2026-09-18 07:29:07 +00:00
autonomic-bot added 1 commit 2026-09-18 07:29:07 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — matrix-synapse @ 0e2cb19b ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `0e2cb19b` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1371/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1371) [![level](https://ci.commoninternet.net/runs/1371/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1371) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1371) · [dashboard](https://ci.commoninternet.net/)
trav merged commit b75925fbbf into main 2026-09-21 16:51:39 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/matrix-synapse#5