release: Famedly Synapse v1.160.0_1

.ci/scripts/schema_diff.py

@@ -33,6 +33,12 @@ def run_make_full_schema(output_dir: Path) -> None:
         sys.exit(1)
 
     cmd: list[str] = [
+        # Use faketime here for schema deltas that are wall-clock sensitive under SQLite
+        # We must only use faketime at this level because freezing the clock
+        # seems to cause `poetry install` to hang when recompiling our Rust module
+        "faketime",
+        "-f",
+        "2001-05-25 12:42:42",
         "poetry",
         "run",
         str(MAKE_FULL_SCHEMA_SCRIPT),
@@ -193,7 +199,7 @@ def main() -> None:
             # Refresh dependencies
             print("Installing dependencies for base commit...", file=sys.stderr)
             subprocess.run(
-                ["poetry", "install", "--no-root", "--extras", "postgres"],
+                ["poetry", "install", "--extras", "postgres"],
                 cwd=REPO_ROOT,
                 check=True,
                 # Poetry install is noisy, so pipe its stdout to stderr

.github/workflows/schema_diff.yml

@@ -30,6 +30,8 @@ jobs:
       - name: Start postgres with a faked clock
         background: true
         id: postgres
+        # Use faketime here for schema deltas that are wall-clock sensitive under Postgres
+        # For SQLite, faketime is used when invoking `make_full_schema.sh` within the script
         run: |
           # Build a docker image with faketime
           mkdir /tmp/postgres-faketime
@@ -58,8 +60,8 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install PostgreSQL client
-        run: sudo apt-get -qq install postgresql-client
+      - name: Install PostgreSQL client and faketime
+        run: sudo apt-get -qq install postgresql-client faketime
 
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:

CHANGES.md

@@ -1,3 +1,53 @@
+# Synapse 1.160.0 (2026-09-02)
+
+No significant changes since 1.160.0rc2.
+
+
+
+
+# Synapse 1.160.0rc2 (2026-08-31)
+
+## Bugfixes
+
+- Fix sending custom profile field removals to legacy sync clients when the field is deleted using the profile field delete endpoint. ([\#20147](https://github.com/element-hq/synapse/issues/20147))
+
+
+
+# Synapse 1.160.0rc1 (2026-08-25)
+
+## Features
+
+- Add experimental support for [MSC4502](https://github.com/matrix-org/matrix-spec-proposals/pull/4502): Targeted and unrestricted room member queries. ([\#19974](https://github.com/element-hq/synapse/issues/19974))
+- Add optional support for [MSC4262: Profile Updates for Sliding Sync](https://github.com/matrix-org/matrix-spec-proposals/pull/4262).
+  Currently defaults to disabled, and is limited to local users only for the sync results. ([\#20003](https://github.com/element-hq/synapse/issues/20003))
+- Allow specifying multiple `action_name` and `status` query parameters when listing scheduled tasks via the admin API. ([\#20067](https://github.com/element-hq/synapse/issues/20067))
+
+## Bugfixes
+
+- Fix a bug where stream positions (presence, to-device message, etc.) could stop being sent to clients if a request was cancelled while a write was allocating a stream ID. Contributed by @FrenchGithubUser @Famedly. ([\#20090](https://github.com/element-hq/synapse/issues/20090))
+- Thumbnail WebP images that use transparency as PNG rather than JPEG, to preserve transparency during thumbnailing. Contributed by @catfromplan9. ([\#20094](https://github.com/element-hq/synapse/issues/20094))
+- Fix sync stream not being woken up when a user updates a profile field without belonging to any rooms. ([\#20135](https://github.com/element-hq/synapse/issues/20135))
+
+## Improved Documentation
+
+- Document lighttpd reverse proxy configuration example. Contributed by JaxLUG from the Jacksonville Linux Users Group Inc.. ([\#19875](https://github.com/element-hq/synapse/issues/19875))
+- Fix the documentation on the `federation_domain_whitelist` config option. ([\#20089](https://github.com/element-hq/synapse/issues/20089))
+
+## Internal Changes
+
+- Update release script to check more often for actions being completed so you don't have to wait around as much. ([\#20093](https://github.com/element-hq/synapse/issues/20093))
+- Speed up the conversion of device list changes into outbound federation pokes, and add a metric for how far behind the conversion is. ([\#20098](https://github.com/element-hq/synapse/issues/20098))
+- Fix the schema diff CI not using `faketime` for SQLite. ([\#20099](https://github.com/element-hq/synapse/issues/20099))
+- Fix the schema diff CI breaking when the Rust module was changed. ([\#20117](https://github.com/element-hq/synapse/issues/20117), [\#20129](https://github.com/element-hq/synapse/issues/20129))
+- Reduce database CPU usage when marking device list changes as sent over federation. ([\#20120](https://github.com/element-hq/synapse/issues/20120))
+- Fix cache `__len__` of Sliding Sync `PerConnectionState` ignoring account data entries. ([\#20124](https://github.com/element-hq/synapse/issues/20124))
+- Update Synapse repo link in inconsistent stream error. ([\#20128](https://github.com/element-hq/synapse/issues/20128))
+- Update rustls-webpki to address [GHSA-82j2-j2ch-gfr8](https://github.com/advisories/GHSA-82j2-j2ch-gfr8). ([\#20131](https://github.com/element-hq/synapse/issues/20131))
+- Update pyo3 to address [GHSA-36hh-v3qg-5jq4](https://github.com/advisories/GHSA-36hh-v3qg-5jq4) and [GHSA-chgr-c6px-7xpp](https://github.com/advisories/GHSA-chgr-c6px-7xpp). ([\#20131](https://github.com/element-hq/synapse/issues/20131))
+
+
+
+
 # Synapse 1.159.0 (2026-08-18)
 
 No significant changes since 1.159.0rc1.

debian/changelog

@@ -1,3 +1,21 @@
+matrix-synapse-py3 (1.160.0) stable; urgency=medium
+
+  * New synapse release 1.160.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Wed, 02 Sep 2026 21:22:51 +0000
+
+matrix-synapse-py3 (1.160.0~rc2) stable; urgency=medium
+
+  * New synapse release 1.160.0rc2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Mon, 31 Aug 2026 22:25:15 +0000
+
+matrix-synapse-py3 (1.160.0~rc1) stable; urgency=medium
+
+  * New synapse release 1.160.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 25 Aug 2026 16:17:54 +0000
+
 matrix-synapse-py3 (1.159.0) stable; urgency=medium
 
   * New synapse release 1.159.0.

docker/complement/conf/workers-shared-extra.yaml.j2

@@ -15,7 +15,7 @@ enable_registration_without_verification: true
 bcrypt_rounds: 4
 url_preview_enabled: true
 url_preview_ip_range_blacklist: []
-# MSC4429 Profile updates down legacy /sync
+# MSC4429 and MSC4262 Profile updates down sync
 include_profile_updates_in_sync: true
 
 ## Registration ##

docs/admin_api/scheduled_tasks.md

@@ -31,8 +31,10 @@ It returns a JSON body like the following:
 **Query parameters:**
 
 * `action_name`: string - Is optional. Returns only the scheduled tasks with the given action name.
+  May be given multiple times to return tasks matching any of the given action names.
 * `resource_id`: string - Is optional. Returns only the scheduled tasks with the given resource id.
-* `status`: string - Is optional. Returns only the scheduled tasks matching the given status, one of
+* `status`: string - Is optional. Returns only the scheduled tasks matching the given status.
+  May be given multiple times to return tasks matching any of the given statuses. The status must be one of
     - "scheduled" - Task is scheduled but not active
     - "active" - Task is active and probably running, and if not will be run on next scheduler loop run
     - "complete" - Task has completed successfully

docs/reverse_proxy.md

@@ -4,8 +4,10 @@ It is recommended to put a reverse proxy such as
 [nginx](https://nginx.org/en/docs/http/ngx_http_proxy_module.html),
 [Apache](https://httpd.apache.org/docs/current/mod/mod_proxy_http.html),
 [Caddy](https://caddyserver.com/docs/quick-starts/reverse-proxy),
-[HAProxy](https://www.haproxy.org/) or
-[relayd](https://man.openbsd.org/relayd.8) in front of Synapse.
+[HAProxy](https://www.haproxy.org/),
+[relayd](https://man.openbsd.org/relayd.8) or
+[lighttpd](https://www.lighttpd.net/)
+in front of Synapse.
 This has the advantage of being able to expose the default HTTPS port (443) to Matrix
 clients without requiring Synapse to bind to a privileged port (port numbers less than
 1024), avoiding the need for `CAP_NET_BIND_SERVICE` or running as root.
@@ -312,6 +314,88 @@ relay "matrix_federation" {
 }
 ```
 
+### lighttpd
+```conf
+server.modules = (
+    "mod_rewrite",
+    "mod_redirect",
+    "mod_access",
+    "mod_setenv",
+    "mod_openssl",
+    "mod_proxy",
+    "mod_accesslog"
+)
+
+server.username      = "lighttpd"
+server.groupname     = "lighttpd"
+
+# We set this to "disable" and use IPv6 `[::]` explicitly below,
+# in order to listen on all incoming IPv6 addresses.
+#
+# If you only want to listen on specific IPv6 addresses, set this
+# to "enable" and specify said addresses below.
+server.use-ipv6 = "disable"
+
+ssl.pemfile = "/etc/lighttpd/cert+privkey.pem"
+ssl.ca-file = "/etc/lighttpd/fullchain.pem"
+
+# redirect HTTP traffic to HTTPS, same for IPv6 below
+$SERVER["socket"] == "0.0.0.0:80" {
+    url.redirect = (
+        "" => "https://${url.authority.noport}${url.path}${qsa}"
+    )
+}
+$SERVER["socket"] == "0.0.0.0:443" { ssl.engine = "enable" }
+$SERVER["socket"] == "0.0.0.0:8448" { ssl.engine = "enable" }
+$SERVER["socket"] == "[::]:80" {
+    url.redirect = (
+        "" => "https://${url.authority.noport}${url.path}${qsa}"
+    )
+}
+$SERVER["socket"] == "[::]:443" { ssl.engine = "enable" }
+$SERVER["socket"] == "[::]:8448" {  ssl.engine = "enable" }
+
+
+
+# both lighttpd and synapse need permissions for socket r/w
+$HTTP["url"] =~ "(/_matrix|_synapse/admin|/_synapse/client)" {
+    proxy.balance = "hash"
+    proxy.server = ( 
+        "" => ( 
+            "backend-socket" => (
+                "host" => "/var/lib/synapse/main_public.sock",
+                "port" => 0
+            )
+        )
+    )
+    proxy.forwarded = (
+        "for" => 1,
+        "proto" => 1,
+        "host" => 1,
+    )
+}
+# protect admin access IPv6 ULA only
+$HTTP["remoteip"] !="fd00::/8" {
+    $HTTP["url"] =~ "^/_synapse/admin/" {
+        url.access-deny = ( "" )
+    }
+}
+```
+
+[Delegation](delegate.md) example:
+```conf
+url.rewrite-once = (
+    "^/\.well-known/matrix/client$" => "/.well-known/matrix/client.json",
+    "^/\.well-known/matrix/server$" => "/.well-known/matrix/server.json"
+)
+
+# This condition intentionally matches the post-rewrite URLs.
+$HTTP["url"] =~ "^/\.well-known/matrix/(client|server)\.json$" {
+    mimetype.assign = ( ".json" => "application/json" )
+    setenv.set-response-header = ( "Access-Control-Allow-Origin" => "*" )
+}
+```
+
 
 ## Health check endpoint
 

docs/usage/configuration/config_documentation.md

@@ -373,7 +373,7 @@ include_profile_data_on_invite: false
 ### `include_profile_updates_in_sync`
 
 *(boolean)* Use this option to include updates of other users' profiles in sync responses, for users who share rooms.
-Requires an [MSC4429](https://github.com/matrix-org/matrix-spec-proposals/pull/4429) compatible client, and is currently limited to legacy sync and local users only.
+For legacy sync clients, requires [MSC4429](https://github.com/matrix-org/matrix-spec-proposals/pull/4429) compatibility. For sliding sync clients, requires [MSC4262](https://github.com/matrix-org/matrix-spec-proposals/pull/4262) compatibility. Note, profile updates via sync are currently limited to local users only.
 This feature is under development and should be used with caution on busy servers or servers which depend on `limit_profile_requests_to_users_who_share_rooms` for ensuring profile information doesn't leak across rooms. Defaults to `false`.
 
 Example configuration:
@@ -1321,11 +1321,10 @@ Options related to federation.
 ---
 ### `federation_domain_whitelist`
 
-*(array)* Restrict federation to the given whitelist of domains. N.B. we recommend also firewalling your federation listener to limit inbound federation traffic as early as possible, rather than relying purely on this application-layer restriction. If not specified, the default is to whitelist everything.
-
-Note: this does not stop a server from joining rooms that servers not on the whitelist are in. As such, this option is really only useful to establish a "private federation", where a group of servers all whitelist each other and have the same whitelist.
-
-Defaults to `[]`.
+*(array)* Restrict federation to the given whitelist of domains. N.B. we recommend also firewalling your federation listener to limit inbound federation traffic as early as possible, rather than relying purely on this application-layer restriction.
+If specified as an empty list (`[]`), federation will be denied with all servers. Specifying an empty list (`[]`) here is the recommended way of disabling federation.
+If not specified, the default is to allow federation with all servers.
+Note: this does not stop a server from joining rooms that servers not on the whitelist are in. As such, this option is really only useful to establish a "private federation", where a group of servers all whitelist each other and have the same whitelist. There is no default for this option.
 
 Example configuration:
 ```yaml

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrix-synapse"
-version = "1.159.0"
+version = "1.160.0"
 description = "Homeserver for the Matrix decentralised comms protocol"
 readme = "README.rst"
 authors = [

rust/Cargo.toml

@@ -31,7 +31,7 @@ http = "1.1.0"
 lazy_static = "1.4.0"
 log = "0.4.17"
 mime = "0.3.17"
-pyo3 = { version = "0.28.3", features = [
+pyo3 = { version = "0.29.0", features = [
     "macros",
     "anyhow",
     "abi3",
@@ -40,8 +40,8 @@ pyo3 = { version = "0.28.3", features = [
     # https://docs.rs/pyo3/latest/pyo3/bytes/index.html
     "bytes",
 ] }
-pyo3-log = "0.13.3"
-pythonize = { version = "0.28.0", features = ["arbitrary_precision"] }
+pyo3-log = "0.13.4"
+pythonize = { version = "0.29.0", features = ["arbitrary_precision"] }
 regex = "1.6.0"
 sha2 = "0.10.8"
 serde = { version = "1.0.144", features = ["derive", "rc"] }

rust/src/config/mod.rs

@@ -74,4 +74,5 @@ pub struct ExperimentalConfig {
     pub msc4491_enabled: bool,
     pub msc4143_enabled: bool,
     pub msc4446_enabled: bool,
+    pub msc4502_enabled: bool,
 }

rust/src/deferred.rs

@@ -141,7 +141,7 @@ pub(crate) async fn run_python_awaitable<F>(
     make_awaitable: F,
 ) -> PyResult<Py<PyAny>>
 where
-    F: for<'py> Fn(Python<'py>) -> PyResult<Bound<'py, PyAny>> + Send + 'static,
+    F: for<'py> Fn(Python<'py>) -> PyResult<Bound<'py, PyAny>> + Send + Sync + 'static,
 {
     // Resolves when the awaitable completes; carries the resolved value or error.
     let (tx, rx) = oneshot::channel::<PyResult<Py<PyAny>>>();