recipe-maintainers/matrix-synapse
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: upgrade synapse to v1.163.0, MAS to 1.27.0, nginx to 1.31.7 #7

Closed
autonomic-bot wants to merge 4 commits from upgrade-358b376 into main
pull from: upgrade-358b376
merge into: :main
Conversation 8 Commits 4 Files Changed 2
+3 -3
autonomic-bot commented 2026-09-21 18:38:50 +00:00
Owner
Copy Link
Copy Source

Recipe upgrade — matrix-synapse (extends PR #7)

This extends the existing upgrade PR (branch upgrade-358b376) with today's delta: synapse
v1.162.0 → v1.163.0, MAS 1.24.0 → 1.27.0 and nginx 1.31.6 → 1.31.7. Since the last run,
true upstream published synapse v1.162.0 itself (recipe 7.4.0+v1.162.0), so this PR now carries
the MAS + nginx + next-synapse work. One evolving upgrade PR; no second PR was opened.

Image tag table

service image current (upstream main) new (PR head)
app matrixdotorg/synapse v1.162.0 v1.163.0
mas ghcr.io/element-hq/matrix-authentication-service 1.24.0 1.27.0
web nginx 1.31.6 1.31.7
signalbridge dock.mau.dev/mautrix/signal v0.2609.0 v0.2609.0 (held — v26.02.2 is a downgrade, see below)
telegrambridge dock.mau.dev/mautrix/telegram v0.2609.0 v0.2609.0 (current)
discordbridge halfshot/matrix-appservice-discord v1.0.0 v1.0.0 (current)
admin awesometechnologies/synapse-admin 0.11.4 0.11.4 (current)
db pgautoupgrade/pgautoupgrade 18-alpine 18-alpine (current)
signaldb / telegramdb / discorddb postgres 13-alpine 13-alpine (held deliberately; 14–18 are majors, not in-place-safe)

Diff: 3 lines — compose.yml synapse v1.162.0→v1.163.0 and nginx 1.31.6→1.31.7;
compose.mas.yml MAS 1.24.0→1.27.0.

Upstream release notes

Held

  • mautrix/signal v26.02.2: display form of tag v0.2602.2 (02 Mar 2026); GitHub [Latest] is
    v26.09 (v0.2609.0, 16 Sep 2026) — already pinned. abra parses v26.02.2 as (26,02,2) >
    v0.2609.0 as (0,2609,0) and mis-reports a downgrade as an upgrade. Held at v0.2609.0.
  • bridge-DB postgres 13-alpine: 13→14/15/16/17/18 are major jumps; the bridge DBs use plain
    postgres (not pgautoupgrade), so they need manual dump/restore. Held.

Operator Action Required

None. MAS is an optional overlay; base deployments only receive the synapse + nginx bumps. No
config/secrets/DB changes. All DB migrations (synapse, MAS) auto-run on startup.

Verification

  • Advisory scan (deterministic): 5 CVEs fixed by this upgrade (all nginx 1.31.7 security fixes;
    CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205). Note: all 8
    GitHub Advisories API sources FAILED on this host (no GITHUB_TOKEN; anonymous 60/hr rate limit),
    so that scan is incomplete and the release-note reading leads — it found no additional CVEs.
  • Live dev deploy on cc-ci (MAS overlay enabled, --chaos): all 4 services 1/1; synapse reports
    {"server":{"name":"Synapse","version":"1.163.0"}}; MAS 1.27.0 ran its DB migrations and
    LISTENING on [::]:8080 (/health 200); nginx 1.31.7 serves. Torn down afterwards (0 stacks /
    0 volumes / 0 secrets). Then !testme on this PR.

Recommended release after merge (this PR does not bump the version label):
abra recipe release matrix-synapse -y → 7.5.0+v1.163.0

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Recipe upgrade — matrix-synapse (extends PR #7) This **extends** the existing upgrade PR (branch `upgrade-358b376`) with today's delta: **synapse v1.162.0 → v1.163.0**, **MAS 1.24.0 → 1.27.0** and **nginx 1.31.6 → 1.31.7**. Since the last run, true upstream published synapse v1.162.0 itself (recipe `7.4.0+v1.162.0`), so this PR now carries the MAS + nginx + next-synapse work. One evolving upgrade PR; no second PR was opened. ### Image tag table | service | image | current (upstream main) | new (PR head) | |---|---|---|---| | app | matrixdotorg/synapse | v1.162.0 | **v1.163.0** | | mas | ghcr.io/element-hq/matrix-authentication-service | 1.24.0 | **1.27.0** | | web | nginx | 1.31.6 | **1.31.7** | | signalbridge | dock.mau.dev/mautrix/signal | v0.2609.0 | v0.2609.0 (**held** — `v26.02.2` is a downgrade, see below) | | telegrambridge | dock.mau.dev/mautrix/telegram | v0.2609.0 | v0.2609.0 (current) | | discordbridge | halfshot/matrix-appservice-discord | v1.0.0 | v1.0.0 (current) | | admin | awesometechnologies/synapse-admin | 0.11.4 | 0.11.4 (current) | | db | pgautoupgrade/pgautoupgrade | 18-alpine | 18-alpine (current) | | signaldb / telegramdb / discorddb | postgres | 13-alpine | 13-alpine (**held deliberately**; 14–18 are majors, not in-place-safe) | Diff: 3 lines — `compose.yml` synapse `v1.162.0`→`v1.163.0` and nginx `1.31.6`→`1.31.7`; `compose.mas.yml` MAS `1.24.0`→`1.27.0`. ### Upstream release notes - **app v1.162.0 → v1.163.0:** https://github.com/element-hq/synapse/blob/release-v1.163/CHANGES.md - Features: advertise **Matrix v1.14 / v1.15**; catch up **MSC4354 Sticky Events** to remote homeservers; push rules for **MSC4075** (MatrixRTC invites/notifications); configurable `task_scheduler.max_concurrent_tasks`; cancel delayed events on user deactivation. - Bugfixes: read-receipt delivery to appservices, sticky-event sync duplication, lazy-loaded membership in `/sync`, `MSC4311` validation, etc. - Removals: ability to *send* sticky state events (MSC4354 feature removal — no config impact). - Internal: `cryptography` 46.0.7→50.0.1 (CVE-2026-69248/69249/69247 — release notes state none affected Synapse); `Twisted` 25.5→26.4. - **No config removals, no required migration, no operator action.** Automatic DB schema updates on start. - **mas 1.24.0 → 1.27.0:** https://github.com/element-hq/matrix-authentication-service/releases - 1.25.0 (https://github.com/element-hq/matrix-authentication-service/releases/tag/v1.25.0): bugfixes; registration CAPTCHA rendered with React; `M_APPSERVICE_LOGIN_UNSUPPORTED` for appservice login. No breaking config changes. - 1.25.1 (https://github.com/element-hq/matrix-authentication-service/releases/tag/v1.25.1): fix password-registration CAPTCHA rendering. - 1.26.0 (https://github.com/element-hq/matrix-authentication-service/releases/tag/v1.26.0): rate-limit device-code link attempts; MSC4198 `login_hint_types_supported`; **rustls 0.23.45 (RUSTSEC-2026-0285)**. - 1.27.0 (https://github.com/element-hq/matrix-authentication-service/releases/tag/v1.27.0): remember chosen username on social-login registration; bugfixes; dependency bumps. - **No config-schema changes across 1.24→1.27.** DB migrations auto-run on startup. - **web 1.31.6 → 1.31.7:** https://nginx.org/en/CHANGES — **security** release: `alias`+`rewrite` buffer overflow (CVE-2026-15176); string-expression buffer overflow (CVE-2026-93479); HTTP/3 unknown-frame body injection / `client_max_body_size` bypass (CVE-2026-95101); uninitialised TLS session-ticket key rotation (CVE-2026-97629); AIO + SSI use-after-free (CVE-2026-97205). Plus features/bugfixes. No config impact. ### Held - **mautrix/signal `v26.02.2`:** display form of tag `v0.2602.2` (02 Mar 2026); GitHub `[Latest]` is **`v26.09` (`v0.2609.0`, 16 Sep 2026)** — already pinned. abra parses `v26.02.2` as (26,02,2) > `v0.2609.0` as (0,2609,0) and mis-reports a downgrade as an upgrade. Held at `v0.2609.0`. - **bridge-DB postgres 13-alpine:** 13→14/15/16/17/18 are major jumps; the bridge DBs use plain postgres (not pgautoupgrade), so they need manual dump/restore. Held. ### Operator Action Required None. MAS is an optional overlay; base deployments only receive the synapse + nginx bumps. No config/secrets/DB changes. All DB migrations (synapse, MAS) auto-run on startup. ### Verification - Advisory scan (deterministic): **5 CVEs fixed by this upgrade** (all nginx 1.31.7 security fixes; CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205). Note: all 8 GitHub Advisories API sources FAILED on this host (no `GITHUB_TOKEN`; anonymous 60/hr rate limit), so that scan is incomplete and the release-note reading leads — it found no additional CVEs. - Live dev deploy on cc-ci (MAS overlay enabled, `--chaos`): all 4 services 1/1; synapse reports `{"server":{"name":"Synapse","version":"1.163.0"}}`; MAS `1.27.0` ran its DB migrations and `LISTENING on [::]:8080` (`/health` 200); nginx `1.31.7` serves. Torn down afterwards (0 stacks / 0 volumes / 0 secrets). Then `!testme` on this PR. Recommended release after merge (this PR does **not** bump the version label): `abra recipe release matrix-synapse -y` → `7.5.0+v1.163.0` Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-09-21 18:38:50 +00:00
chore: upgrade MAS to 1.25.0
cc-ci/testme cc-ci: success
Details
358b3769c7
autonomic-bot requested review from trav 2026-09-21 18:38:50 +00:00
autonomic-bot requested review from notplants 2026-09-21 18:38:50 +00:00
autonomic-bot commented 2026-09-21 18:38:56 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-09-21 18:39:07 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — matrix-synapse @ 358b3769 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `358b3769` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/4/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/4) [![level](https://ci.autonomic.zone/runs/4/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/4) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/4) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: upgrade MAS to 1.25.0 to chore: upgrade MAS to 1.25.1 2026-09-28 21:49:01 +00:00
autonomic-bot added 1 commit 2026-09-28 21:49:02 +00:00
chore: upgrade MAS to 1.25.1
cc-ci/testme cc-ci: success
Details
9960b74fd6
autonomic-bot commented 2026-09-28 21:49:07 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-09-28 21:49:26 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — matrix-synapse @ 9960b74f ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `9960b74f` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/22/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/22) [![level](https://ci.autonomic.zone/runs/22/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/22) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/22) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: upgrade MAS to 1.25.1 to chore: upgrade synapse to v1.162.0, MAS to 1.26.0 2026-10-02 03:32:54 +00:00
autonomic-bot added 1 commit 2026-10-02 03:32:54 +00:00
chore: upgrade synapse to v1.162.0, MAS to 1.26.0
cc-ci/testme cc-ci: success
Details
2565fdd10c
autonomic-bot commented 2026-10-02 03:32:58 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-02 03:33:25 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — matrix-synapse @ 2565fdd1 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `2565fdd1` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/29/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/29) [![level](https://ci.autonomic.zone/runs/29/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/29) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/29) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: upgrade synapse to v1.162.0, MAS to 1.26.0 to chore: upgrade synapse to v1.163.0, MAS to 1.27.0, nginx to 1.31.7 2026-10-16 03:17:13 +00:00
autonomic-bot added 1 commit 2026-10-16 03:17:15 +00:00
chore: upgrade synapse to v1.163.0, MAS to 1.27.0, nginx to 1.31.7
cc-ci/testme cc-ci: success
Details
cf2f987c06
autonomic-bot commented 2026-10-16 03:17:20 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-16 03:17:45 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — matrix-synapse @ cf2f987c ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `matrix-synapse` @ `cf2f987c` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/61/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/61) [![level](https://ci.autonomic.zone/runs/61/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/61) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/61) · [dashboard](https://ci.autonomic.zone/)
notplants closed this pull request 2026-10-19 16:47:36 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/matrix-synapse#7