v1.150.0

Synapse 1.150.0 (2026-03-24)

No significant changes since 1.150.0rc1.

Upgrade notes

Please read the upgrade notes as this release includes a few changes that may affect your deployment.

Synapse 1.150.0rc1 (2026-03-17)

Features

• Add experimental support for the MSC4370 Federation API GET /extremities endpoint. (#19314)
• MSC4140: Cancellable delayed events: When persisting a delayed event to the timeline, include its delay_id in the event's unsigned section in /sync responses to the event sender. (#19479)
• Expose MSC4354 Sticky Events over the legacy (v3) /sync API. (#19487)
• When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. (#19554)

Bugfixes

• Fix Build and push complement image CI job pointing to non-existent image. (#19523)
• Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. (#19542)

Improved Documentation

• In the Admin API documentation, always express path parameters as /<param> instead of as /$param. (#19307)
• Update docs to clarify outbound_federation_restricted_to can also be used with the Secure Border Gateway (SBG). (#19517)
• Unify Complement developer docs. (#19518)

Internal Changes

• Put membership updates in a background resumable task when changing the avatar or the display name. (#19311)
• Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). (#19476)
• Migrate dev dependencies to PEP 735 dependency groups. (#19490)
• Remove the optional systemd-python dependency and the systemd extra on the synapse package. (#19491)
• Avoid re-computing the event ID when cloning events. (#19527)
• Allow caching of the /versions and /auth_metadata public endpoints. (#19530)
• Add a few labels to the number groupings in the Processed request logs. (#19548)

v1.150.0rc1

Synapse 1.150.0rc1 (2026-03-17)

Features

• Add experimental support for the MSC4370 Federation API GET /extremities endpoint. (#19314)
• MSC4140: Cancellable delayed events: When persisting a delayed event to the timeline, include its delay_id in the event's unsigned section in /sync responses to the event sender. (#19479)
• Expose MSC4354 Sticky Events over the legacy (v3) /sync API. (#19487)
• When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. (#19554)

Bugfixes

• Fix Build and push complement image CI job pointing to non-existent image. (#19523)
• Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. (#19542)

Improved Documentation

• In the Admin API documentation, always express path parameters as /<param> instead of as /$param. (#19307)
• Update docs to clarify outbound_federation_restricted_to can also be used with the Secure Border Gateway (SBG). (#19517)
• Unify Complement developer docs. (#19518)

Internal Changes

• Put membership updates in a background resumable task when changing the avatar or the display name. (#19311)
• Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). (#19476)
• Migrate dev dependencies to PEP 735 dependency groups. (#19490)
• Remove the optional systemd-python dependency and the systemd extra on the synapse package. (#19491)
• Avoid re-computing the event ID when cloning events. (#19527)
• Allow caching of the /versions and /auth_metadata public endpoints. (#19530)
• Add a few labels to the number groupings in the Processed request logs. (#19548)

v1.149.1

Synapse 1.149.1 (2026-03-11)

Internal Changes

• Bump matrix-synapse-ldap3 to 0.4.0 to support setuptools>=82.0.0. Fixes #19541. (#19543)

v1.149.0

Synapse 1.149.0 (2026-03-10)

No significant changes since 1.149.0rc1.

Synapse 1.149.0rc1 (2026-03-03)

Features

• Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#19127)
• Add stable support for MSC4380 invite blocking. (#19431)

Bugfixes

• Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#18518)
• Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#19460)

Internal Changes

• Add log to explain when and why we freeze objects in the garbage collector. (#19440)
• Better instrument JoinRoomAliasServlet with tracing. (#19461)
• Fix Complement CI not running against the code from our PRs. (#19475)
• Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#19480)
• Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#19486)
• Add a log line when we delete devices. Contributed by @bradtgmurray @ Beeper. (#19496)
• Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#19498)
• Cancel long-running sync requests if the client has gone away. (#19499)
• Try and reduce reactor tick times when under heavy load. (#19507)
• Simplify Rust HTTP client response streaming and limiting. (#19510)
• Replace deprecated collection import locations with current locations. (#19515)
• Bump most locked Python dependencies to their latest versions. (#19519)

v1.149.0rc1

Synapse 1.149.0rc1 (2026-03-03)

Features

• Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#19127)
• Add stable support for MSC4380 invite blocking. (#19431)

Bugfixes

• Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#18518)
• Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#19460)

Internal Changes

• Add log to explain when and why we freeze objects in the garbage collector. (#19440)
• Better instrument JoinRoomAliasServlet with tracing. (#19461)
• Fix Complement CI not running against the code from our PRs. (#19475)
• Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#19480)
• Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#19486)
• Add a log line when we delete devices. Contributed by @bradtgmurray @ Beeper. (#19496)
• Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#19498)
• Cancel long-running sync requests if the client has gone away. (#19499)
• Try and reduce reactor tick times when under heavy load. (#19507)
• Simplify Rust HTTP client response streaming and limiting. (#19510)
• Replace deprecated collection import locations with current locations. (#19515)
• Bump most locked Python dependencies to their latest versions. (#19519)

v1.148.0

Synapse 1.148.0 (2026-02-24)

No significant changes since 1.148.0rc1.

Synapse 1.148.0rc1 (2026-02-17)

Features

• Support sending and receiving MSC4354 Sticky Event metadata. (#19365)

Improved Documentation

• Fix reference to the experimental_features section of the configuration manual documentation. (#19435)

Deprecations and Removals

• Remove support for MSC3244: Room version capabilities as the MSC was rejected. (#19429)

Internal Changes

• Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. (#19406)
• Push Synapse docker images to Element OCI Registry. (#19420)
• Allow configuring the Rust HTTP client to use HTTP/2 only. (#19457)
• Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. (#19470)

v1.148.0rc1

Synapse 1.148.0rc1 (2026-02-17)

Features

• Support sending and receiving MSC4354 Sticky Event metadata. (#19365)

Improved Documentation

• Fix reference to the experimental_features section of the configuration manual documentation. (#19435)

Deprecations and Removals

• Remove support for MSC3244: Room version capabilities as the MSC was rejected. (#19429)

Internal Changes

• Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. (#19406)
• Push Synapse docker images to Element OCI Registry. (#19420)
• Allow configuring the Rust HTTP client to use HTTP/2 only. (#19457)
• Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. (#19470)

v1.147.1

Synapse 1.147.1 (2026-02-12)

• Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670. (#19459)

v1.147.0

Synapse 1.147.0 (2026-02-10)

No significant changes since 1.147.0rc1.

Synapse 1.147.0rc1 (2026-02-03)

Bugfixes

• Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. (#19416)
• Fix a typo that incorrectly made setuptools_rust a runtime dependency. (#19417)

Internal Changes

• Prune stale entries from sliding_sync_connection_required_state table. (#19306)
• Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). (#19399)
• Update and align Grafana dashboard to use regex matching for job selectors (job=~"$job") so the "all" value works correctly across all panels. (#19400)
• Don't retry joining partial state rooms all at once on startup. (#19402)
• Disallow requests to the health endpoint from containing trailing path characters. (#19405)
• Add notes that new experimental features should have associated tracking issues. (#19410)
• Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to 0.27.0. Contributed by @razvp @ ERCOM. (#19412)

v1.147.0rc1

Synapse 1.147.0rc1 (2026-02-03)

Bugfixes

• Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. (#19416)
• Fix a typo that incorrectly made setuptools_rust a runtime dependency. (#19417)

Internal Changes

• Prune stale entries from sliding_sync_connection_required_state table. (#19306)
• Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). (#19399)
• Update and align Grafana dashboard to use regex matching for job selectors (job=~"$job") so the "all" value works correctly across all panels. (#19400)
• Don't retry joining partial state rooms all at once on startup. (#19402)
• Disallow requests to the health endpoint from containing trailing path characters. (#19405)
• Add notes that new experimental features should have associated tracking issues. (#19410)
• Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to 0.27.0. Contributed by @razvp @ ERCOM. (#19412)