Synapse 1.12.0 is here.

The most important reason to upgrade to 1.12.0 is that it contains performance improvements to boost the efficiency of state resolution in room versions greater than v1 (#7095).

It also contains an implementation of (MSC2432) designed to limit room alias abuse. The MSC contains the full details, but in short admins now have more control over aliases as they appear on their local server.

There is also plenty of ground work for our master process sharding project. Nothing that can be used today unfortunately, but expect big improvements for worker based deployments over the coming weeks.

Please pay special attention to the security advisory in the changelog, TL;DR make sure your installation is using Twisted 20.3.0.

Also, note that once Synapse 1.13.0 is released, the default branch will change to being develop rather than master. Again more details follow in the changelog.

Get the new release from github or any of the sources mentioned at https://github.com/matrix-org/synapse/blob/master/INSTALL.md.

Changelog since Synapse 1.11.1

Synapse 1.12.0 (2020-03-23)

No significant changes since 1.12.0rc1.

Debian packages and Docker images are rebuilt using the latest versions of dependency libraries, including Twisted 20.3.0. Please see security advisory below.

Security advisory

Synapse may be vulnerable to request-smuggling attacks when it is used with a reverse-proxy. The vulnerabilities are fixed in Twisted 20.3.0, and are described in CVE-2020-10108 and CVE-2020-10109. For a good introduction to this class of request-smuggling attacks, see https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn.

We are not aware of these vulnerabilities being exploited in the wild, and do not believe that they are exploitable with current versions of any reverse proxies. Nevertheless, we recommend that all Synapse administrators ensure that they have the latest versions of the Twisted library to ensure that their installation remains secure.

• Administrators using the matrix.org Docker image or the Debian/Ubuntu packages from matrix.org should ensure that they have version 1.12.0 installed: these images include Twisted 20.3.0.
• Administrators who have installed Synapse from source should upgrade Twisted within their virtualenv by running:

  <path_to_virtualenv>/bin/pip install 'Twisted>=20.3.0'
  

• Administrators who have installed Synapse from distribution packages should consult the information from their distributions.

The matrix.org Synapse instance was not vulnerable to these vulnerabilities.

Advance notice of change to the default git branch for Synapse

Currently, the default git branch for Synapse is master, which tracks the latest release.

After the release of Synapse 1.13.0, we intend to change this default to develop, which is the development tip. This is more consistent with common practice and modern git usage.

Although we try to keep develop in a stable state, there may be occasions where regressions creep in. Developers and distributors who have scripts which run builds using the default branch of Synapse should therefore consider pinning their scripts to master.

Synapse 1.12.0rc1 (2020-03-19)

Features

• Changes related to room alias management (MSC2432):
  • Publishing/removing a room from the room directory now requires the user to have a power level capable of modifying the canonical alias, instead of the room aliases. (#6965)
  • Validate the alt_aliases property of canonical alias events. (#6971)
  • Users with a power level sufficient to modify the canonical alias of a room can now delete room aliases. (#6986)
  • Implement updated authorization rules and redaction rules for aliases events, from MSC2261 and MSC2432. (#7037)
  • Stop sending m.room.aliases events during room creation and upgrade. (#6941)
  • Synapse no longer uses room alias events to calculate room names for push notifications. (#6966)
  • The room list endpoint no longer returns a list of aliases. (#6970)
  • Remove special handling of aliases events from MSC2260 added in v1.10.0rc1. (#7034)
• Expose the synctl, hash_password and generate_config commands in the snapcraft package. Contributed by @devec0. (#6315)
• Check that server_name is correctly set before running database updates. (#6982)
• Break down monthly active users by appservice_id and emit via Prometheus. (#7030)
• Render a configurable and comprehensible error page if something goes wrong during the SAML2 authentication process. (#7058, #7067)
• Add an optional parameter to control whether other sessions are logged out when a user's password is modified. (#7085)
• Add prometheus metrics for the number of active pushers. (#7103, #7106)
• Improve performance when making HTTPS requests to sygnal, sydent, etc, by sharing the SSL context object between connections. (#7094)

Bugfixes

• When a user's profile is updated via the admin API, also generate a displayname/avatar update for that user in each room. (#6572)
• Fix a couple of bugs in email configuration handling. (#6962)
• Fix an issue affecting worker-based deployments where replication would stop working, necessitating a full restart, after joining a large room. (#6967)
• Fix duplicate key error which was logged when rejoining a room over federation. (#6968)
• Prevent user from setting 'deactivated' to anything other than a bool on the v2 PUT /users Admin API. (#6990)
• Fix py35-old CI by using native tox package. (#7018)
• Fix a bug causing org.matrix.dummy_event to be included in responses from /sync. (#7035)
• Fix a bug that renders UTF-8 text files incorrectly when loaded from media. Contributed by @TheStranjer. (#7044)
• Fix a bug that would cause Synapse to respond with an error about event visibility if a client tried to request the state of a room at a given token. (#7066)
• Repair a data-corruption issue which was introduced in Synapse 1.10, and fixed in Synapse 1.11, and which could cause /sync to return with 404 errors about missing events and unknown rooms. (#7070)
• Fix a bug causing account validity renewal emails to be sent even if the feature is turned off in some cases. (#7074)

Improved Documentation

• Updated CentOS8 install instructions. Contributed by Richard Kellner. (#6925)
• Fix POSTGRES_INITDB_ARGS in the contrib/docker/docker-compose.yml example docker-compose configuration. (#6984)
• Change date in https://github.com/matrix-org/synapse/blob/master/INSTALL.md for last date of getting TLS certificates to November 2019. (#7015)
• Document that the fallback auth endpoints must be routed to the same worker node as the register endpoints. (#7048)

Deprecations and Removals

• Remove the unused query_auth federation endpoint per MSC2451. (#7026)

Internal Changes

• Add type hints to logging/context.py. (#6309)
• Add some clarifications to README.md in the database schema directory. (#6615)
• Refactoring work in preparation for changing the event redaction algorithm. (#6874, #6875, #6983, #7003)
• Improve performance of v2 state resolution for large rooms. (#6952, #7095)
• Reduce time spent doing GC, by freezing objects on startup. (#6953)
• Minor performance fixes to get_auth_chain_ids. (#6954)
• Don't record remote cross-signing keys in the devices table. (#6956)
• Use flake8-comprehensions to enforce good hygiene of list/set/dict comprehensions. (#6957)
• Merge worker apps together. (#6964, #7002, #7055, #7104)
• Remove redundant store_room call from FederationHandler._process_received_pdu. (#6979)
• Update warning for incorrect database collation/ctype to include link to documentation. (#6985)
• Add some type annotations to the database storage classes. (#6987)
• Port synapse.handlers.presence to async/await. (#6991, #7019)
• Add some type annotations to the federation base & client classes. (#6995)
• Port synapse.rest.keys to async/await. (#7020)
• Add a type check to is_verified when processing room keys. (#7045)
• Add type annotations and comments to the auth handler. (#7063)