chore(deps): update ghcr.io/element-hq/synapse docker tag to v1.151.0

[small-hack-renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/element-hq/synapse	minor	v1.145.0 → v1.151.0

---

Release Notes

element-hq/synapse (ghcr.io/element-hq/synapse)

v1.151.0

Compare Source

Synapse 1.151.0 (2026-04-07)

Bugfixes

• Fix KNOWN_ROOM_VERSIONS.__contains__ raising TypeError for non-string keys, which could cause /sync to fail for rooms with a NULL room version in the database. Bug introduced in #​19589 as part of v1.151.0rc1. (#​19649)

Synapse 1.151.0rc1 (2026-03-31)

Features

• Add stable support for MSC4284 Policy Servers. (#​19503)
• Update and stabilize support for MSC2666: Get rooms in common with another user. Contributed by @​tulir @​ Beeper. (#​19511)
• Updated experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#​19573)
• Stabilize room_version and encryption fields in the space/room /hierarchy API (part of MSC3266). (#​19576)
• Introduce a configuration option to allow using HTTP/2 over plaintext when Synapse connects to Matrix Authentication Service. (#​19586)

Bugfixes

• Fix MSC4284 Policy Servers implementation to skip signing org.matrix.msc4284.policy and m.room.policy state events. (#​19503)
• Correctly apply MSC4284 Policy Server signatures to events when the sender and policy server have the same server name. (#​19503)
• Allow Synapse to start up even when discovery fails for an OpenID Connect provider. (#​19509)
• Fix quarantine media admin APIs sometimes returning inaccurate counts for remote media. (#​19559)
• Fix Build and push complement image CI job not having poetry available for the Complement runner script. (#​19578)
• Increase timeout for policy server requests to avoid repeated requests for checking media. (#​19629)

Deprecations and Removals

• Remove support for MSC3852: Expose user agent information on Device as the MSC was closed. (#​19430)

Internal Changes

• Fix small comment typo in config output from the demo/start.sh script. (#​19538)
• Add MSC3820 comment context to RoomVersion attributes. (#​19577)
• Remove redacted_because from internal unsigned. (#​19581)
• Prevent sending registration emails if registration is disabled. (#​19585)
• Port RoomVersion to Rust. (#​19589)
• Only show failing Complement tests in the formatted output in CI. (#​19590)
• Ensure old Complement test files are removed when downloading a Complement checkout via ./scripts-dev/complement.sh. (#​19592)
• Update HomeserverTestCase.pump() docstring to demystify behavior (Twisted reactor/clock). (#​19602)
• Deprecate HomeserverTestCase.pump() in favor of more direct HomeserverTestCase.reactor.advance(...) usage. (#​19602)
• Lower the Postgres database statement_timeout to 10m (previously 1h). (#​19604)

v1.150.0

Compare Source

Synapse 1.150.0 (2026-03-24)

No significant changes since 1.150.0rc1.

Upgrade notes

Please read the upgrade notes as this release includes a few changes that may affect your deployment.

Synapse 1.150.0rc1 (2026-03-17)

Features

• Add experimental support for the MSC4370 Federation API GET /extremities endpoint. (#​19314)
• MSC4140: Cancellable delayed events: When persisting a delayed event to the timeline, include its delay_id in the event's unsigned section in /sync responses to the event sender. (#​19479)
• Expose MSC4354 Sticky Events over the legacy (v3) /sync API. (#​19487)
• When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. (#​19554)

Bugfixes

• Fix Build and push complement image CI job pointing to non-existent image. (#​19523)
• Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. (#​19542)

Improved Documentation

• In the Admin API documentation, always express path parameters as /<param> instead of as /$param. (#​19307)
• Update docs to clarify outbound_federation_restricted_to can also be used with the Secure Border Gateway (SBG). (#​19517)
• Unify Complement developer docs. (#​19518)

Internal Changes

• Put membership updates in a background resumable task when changing the avatar or the display name. (#​19311)
• Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). (#​19476)
• Migrate dev dependencies to PEP 735 dependency groups. (#​19490)
• Remove the optional systemd-python dependency and the systemd extra on the synapse package. (#​19491)
• Avoid re-computing the event ID when cloning events. (#​19527)
• Allow caching of the /versions and /auth_metadata public endpoints. (#​19530)
• Add a few labels to the number groupings in the Processed request logs. (#​19548)

v1.149.1

Compare Source

Synapse 1.149.1 (2026-03-11)

Internal Changes

• Bump matrix-synapse-ldap3 to 0.4.0 to support setuptools>=82.0.0. Fixes #​19541. (#​19543)

v1.149.0

Compare Source

Synapse 1.149.0 (2026-03-10)

No significant changes since 1.149.0rc1.

Synapse 1.149.0rc1 (2026-03-03)

Features

• Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#​19127)
• Add stable support for MSC4380 invite blocking. (#​19431)

Bugfixes

• Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#​18518)
• Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#​19460)

Internal Changes

• Add log to explain when and why we freeze objects in the garbage collector. (#​19440)
• Better instrument JoinRoomAliasServlet with tracing. (#​19461)
• Fix Complement CI not running against the code from our PRs. (#​19475)
• Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#​19480)
• Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#​19486)
• Add a log line when we delete devices. Contributed by @​bradtgmurray @​ Beeper. (#​19496)
• Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#​19498)
• Cancel long-running sync requests if the client has gone away. (#​19499)
• Try and reduce reactor tick times when under heavy load. (#​19507)
• Simplify Rust HTTP client response streaming and limiting. (#​19510)
• Replace deprecated collection import locations with current locations. (#​19515)
• Bump most locked Python dependencies to their latest versions. (#​19519)

v1.148.0

Compare Source

Synapse 1.148.0 (2026-02-24)

No significant changes since 1.148.0rc1.

Synapse 1.148.0rc1 (2026-02-17)

Features

• Support sending and receiving MSC4354 Sticky Event metadata. (#​19365)

Improved Documentation

• Fix reference to the experimental_features section of the configuration manual documentation. (#​19435)

Deprecations and Removals

• Remove support for MSC3244: Room version capabilities as the MSC was rejected. (#​19429)

Internal Changes

• Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. (#​19406)
• Push Synapse docker images to Element OCI Registry. (#​19420)
• Allow configuring the Rust HTTP client to use HTTP/2 only. (#​19457)
• Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. (#​19470)

v1.147.1

Compare Source

Synapse 1.147.1 (2026-02-12)

• Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670. (#​19459)

v1.147.0

Compare Source

Synapse 1.147.0 (2026-02-10)

No significant changes since 1.147.0rc1.

Synapse 1.147.0rc1 (2026-02-03)

Bugfixes

• Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. (#​19416)
• Fix a typo that incorrectly made setuptools_rust a runtime dependency. (#​19417)

Internal Changes

• Prune stale entries from sliding_sync_connection_required_state table. (#​19306)
• Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). (#​19399)
• Update and align Grafana dashboard to use regex matching for job selectors (job=~"$job") so the "all" value works correctly across all panels. (#​19400)
• Don't retry joining partial state rooms all at once on startup. (#​19402)
• Disallow requests to the health endpoint from containing trailing path characters. (#​19405)
• Add notes that new experimental features should have associated tracking issues. (#​19410)
• Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to 0.27.0. Contributed by @​razvp @​ ERCOM. (#​19412)

v1.146.0

Compare Source

Synapse 1.146.0 (2026-01-27)

No significant changes since 1.146.0rc1.

Deprecations and Removals

• MSC2697 (Dehydrated devices) has been removed, as the MSC is closed. Developers should migrate to MSC3814. (#​19346)
• Support for Ubuntu 25.04 (Plucky Puffin) has been dropped. Synapse no longer builds debian packages for Ubuntu 25.04.

Synapse 1.146.0rc1 (2026-01-20)

Features

• Add a new config option enable_local_media_storage which controls whether media is additionally stored locally when using configured media_storage_providers. Setting this to false allows off-site media storage without a local cache. Contributed by Patrice Brend'amour @​dr.allgood. (#​19204)
• Stabilise support for MSC4312's m.oauth User-Interactive Auth stage for resetting cross-signing identity with the OAuth 2.0 API. The old, unstable name (org.matrix.cross_signing_reset) is now deprecated and will be removed in a future release. (#​19273)
• Refactor Grafana dashboard to use server_name label (instead of instance). (#​19337)

Bugfixes

• Fix joining a restricted v12 room locally when no local room creator is present but local users with sufficient power levels are. Contributed by @​nexy7574. (#​19321)
• Fixed parallel calls to /_matrix/media/v1/create being ratelimited for appservices even if rate_limited: false was set in the registration. Contributed by @​tulir @​ Beeper. (#​19335)
• Fix a bug introduced in 1.61.0 where a user's membership in a room was accidentally ignored when considering access to historical state events in rooms with the "shared" history visibility. Contributed by Lukas Tautz. (#​19353)
• MSC4140: Store the JSON content of scheduled delayed events as text instead of a byte array. This fixes the inability to schedule a delayed event with non-ASCII characters in its content. (#​19360)
• Always rollback database transactions when retrying (avoid orphaned connections). (#​19372)
• Fix InFlightGauge typing to allow upgrading to prometheus_client 0.24. (#​19379)

Updates to the Docker image

• Add Prometheus HTTP service discovery endpoint for easy discovery of all workers when using the docker/Dockerfile-workers image (see the Metrics section of our Docker testing docs). (#​19336)

Improved Documentation

• Remove docs on legacy metric names (no longer in the codebase since 2022-12-06). (#​19341)
• Clarify how the estimated value of room complexity is calculated internally. (#​19384)

Internal Changes

• Add an internal cancel_task API to the task scheduler. (#​19310)
• Tweak docstrings and signatures of auth_types_for_event and get_catchup_room_event_ids. (#​19320)
• Replace usage of deprecated assertEquals with assertEqual in unit test code. (#​19345)
• Drop support for Ubuntu 25.04 'Plucky Puffin', add support for Ubuntu 25.10 'Questing Quokka'. (#​19348)
• Revert "Add an Admin API endpoint for listing quarantined media (#​19268)". (#​19351)
• Bump mdbook from 0.4.17 to 0.5.2 and remove our custom table-of-contents plugin in favour of the new default functionality. (#​19356)
• Replace deprecated usage of PyGitHub's GitRelease.title with .name in release script. (#​19358)
• Update the Element logo in Synapse's README to be an absolute URL, allowing it to render on other sites (such as PyPI). (#​19368)
• Apply minor tweaks to v1.145.0 changelog. (#​19376)
• Update Grafana dashboard syntax to use the latest from importing/exporting with Grafana 12.3.1. (#​19381)
• Warn about skipping reactor metrics when using unknown reactor type. (#​19383)
• Add support for reactor metrics with the ProxiedReactor used in worker Complement tests. (#​19385)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.