Support Matrix 1.17

[Johennes]

Following on from #19414.

Matrix Specification v1.17 Changelog

Git commit	https://github.com/matrix-org/matrix-spec/tree/v1.17
Release date	December 18, 2025

Client-Server API

Removed Endpoints

• Remove legacy mentions, as per MSC4210. (#2186)

Backwards Compatible Changes

• Allow application services to masquerade as specific devices belonging to users, as per MSC4326. (#2221)
• Add the m.oauth authentication type for User-Interactive Authentication, as per MSC4312. (#2234)
• Allow application services to manage devices and register users without the legacy authentication API, as per MSC4190. (#2267)

Spec Clarifications

• Push rule IDs are globally unique within their kind. (#2214)
• Don't advertise creator field in description of room creation. (#2215)
• room_id is required for peeking via /_matrix/client/v3/events. (#2216)
• The server-name segment of MXC URIs is sanitised differently from the media-id segment. (#2217)
• Add note to each endpoint that uses capability negotiation. (#2223)
• Additional OpenGraph properties can be present in URL previews. (#2225)
• Clarify the special casing of membership events and redactions in power levels. (#2231)
• M_RESOURCE_LIMIT_EXCEEDED is now listed as a common error code. (#2232)
• Add m.login.terms to enumeration of authentication types. (#2233)
• Clarify how to use state_after ahead of declaring full support for its spec version. (#2240)
• device_one_time_keys_count is only optional if no unclaimed one-time keys exist. (#2245)
• Clarify that servers may choose not to use M_USER_DEACTIVATED at login time, for example for privacy reasons when they can't authenticate deactivated users. (#2246)
• Usage of the event_id_only format for push notifications is not mandatory. (#2255)
• Fix various typos throughout the specification. (#2224, #2227, #2250)

Server-Server API

No significant changes.

Application Service API

Backwards Compatible Changes

• Allow application services to masquerade as specific devices belonging to users, as per MSC4326. (#2221)
• Allow application services to manage devices and register users without the legacy authentication API, as per MSC4190. (#2267)

Spec Clarifications

• Fix JSON formatting in the "Server admin style permissions" examples. (#2213)

Identity Service API

No significant changes.

Push Gateway API

No significant changes.

Room Versions

Spec Clarifications

• In room versions 8 through 12, clarify that "sufficient permission to invite users" on restricted joins also includes being a joined member of the room. (#2220)
• In room versions 3 through 12, clarify that when you have the power to redact, it is possible to redact events that you don't have the power to send. (#2249)

Appendices

No significant changes.

Internal Changes/Tooling

Spec Clarifications

• Swapped icon for X (fka. twitter) to updated logo in footer. (#2219)
• Inline Olm & Megolm specifications. (#2226, #2241, #2242)
• Silence failing redocly-cli rule. (#2238)
• Use NPM Trusted Publishers for publishing @matrix-org/spec to npm. (#2239)
• Add version picker in the navbar. (#2256, #2258, #2259, #2260, #2261, #2264, #2268)
• Add a list of endpoints to the top of each spec page. (#2262)

[TjardL]

Hi, we are currently intending to migrate from matrix 1.11 to 1.17. In the versions.py, only support for matrix 1.12 is declared. However, if we follow your issues tracking the changes for Matrix 1.14, 1.15, 1.16, 1.17, almost all requirements have already been merged. But the issues for the corresponding Matrix support version are still open. We have the question of how far away Synapse actually is from supporting Matrix 1.17, or if it already supports it, but the support is just not declared in the versions.py file.