Update all dependencies

[missingcharacter]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python	action	major	v6 → v7
ghcr.io/element-hq/synapse		minor	v1.155.0 → v1.157.0
traefik (source)		patch	v3.7.6 → v3.7.8

---

Release Notes

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in #​1338
• Remove the pip-install input by @​gowridurgad in #​1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in #​1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in #​1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in #​1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in #​1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in #​1337

New Contributors

• @​lmvysakh made their first contribution in #​1335
• @​philip-gai made their first contribution in #​1337

Full Changelog: actions/setup-python@v6...v7.0.0

v7

Compare Source

element-hq/synapse (ghcr.io/element-hq/synapse)

v1.157.0

Compare Source

Synapse 1.157.0 (2026-07-21)

No significant changes since 1.157.0rc1.

Synapse 1.157.0rc1 (2026-07-14)

Features

• MSC4140: Cancellable delayed events: Limit how many delayed events a user may have scheduled at once. (#​19539)
• Support MSC4446 for moving fully read markers backwards. Contributed by @​SpiritCroc @​ Beeper. (#​19663)
• Add before and after time filters to the 'Redact events of a user' Admin API. (#​19802)
• Updated experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#​19808)
• Add an exclude_rooms_from_presence configuration option to stop presence being routed between users solely because they share one of the listed rooms. (#​19935)

Bugfixes

• MSC4140: Cancellable delayed events: Update error responses to match their format in the current draft of the MSC. (#​19539)
• Lock Sliding Sync connections when inserting lazy members, to prevent repeated deadlocks. (#​19826)
• Fix the flag_existing_quarantined_media background update skipping some quarantined remote media. Introduced in v1.152.0. (#​19901)
• Fix a bug introduced in Synapse v1.150.0 where reactivating a deactivated and erased user did not restore their profile, breaking login, name changes, and invitations.
  Contributed by @​m4us1ne. (#​19902)
• Fix a regression where application services that opted into ephemeral events using the legacy de.sorunome.msc2409.push_ephemeral registration flag stopped receiving ephemeral events (including to-device messages used for encryption). Introduced in v1.156.0. (#​19928)
• Fix a bug causing device list pruning to skip some rows when the transaction gets retried. (#​19947)
• Fix presence states being shown to clients forever after presence is disabled, by marking any previously only users as offline. (#​19948)
• Fix SYNAPSE_ASYNC_IO_REACTOR=1 on Python 3.14. (#​19949)

Deprecations and Removals

• Remove support for experimental MSC3861 auth delegation, in favour of the stable Matrix Authentication Service integration support. See the upgrade notes. (#​19895)

Internal Changes

• Port the synchronous core of client event serialization to Rust. (#​19837, #​19922)
• Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool). (#​19871, #​19879)
• Allow Rust code to have database access via Python database connection pool. (#​19878)
• Add golangci-lint to CI. (#​19888)
• Remove wall-clock dependency of test_redact_messages_all_rooms test, as this caused flakiness. (#​19890)
• Change the MSC3814 dehydrated device /events endpoint from POST to GET. (#​19896)
• Change the MSC3814 dehydrated device /events endpoint paging to match spec conventions. (#​19897)
• Fix storage type mismatches where values were bound with a type that didn't match their database column. (#​19911)
• Speed up deletion of old sliding sync connections by adding an index. (#​19912)
• Add note to 3PID email token request unit tests that the endpoint being tested can have an expected, artificial delay of up to 1s. (#​19916)
• Add an index to sliding_sync_connection_lazy_members to speed up deleting old sliding sync connection positions. (#​19923)
• Fix test_lock_contention being flaky when running against PostgreSQL by budgeting CPU time rather than wall-clock time. (#​19929)
• Fix Complement test flake when restarting Synapse workers (cross-test pollution caused by nginx upstreams being temporarily unavailable). (#​19936)
• Add clean deploy FIXME note for TestOIDCProviderUnavailable (problem tracked by #​19937). (#​19938)
• Minor presence performance improvements for large servers. (#​19939)
• Reduce replication traffic caused by presence. (#​19941)
• Add last_active_granularity, sync_online_timeout and idle_timeout options to the presence config section to allow tuning the presence state machine timers. (#​19942)

v1.156.0

Compare Source

Synapse 1.156.0 (2026-07-07)

No significant changes since 1.156.0rc1.

Synapse 1.156.0rc1 (2026-06-30)

Features

• Expose MSC4354 Sticky Events over MSC4186 (Simplified) Sliding Sync. (#​19591)
• Stabilize support for sending ephemeral events to application services, as per MSC2409. Contributed by @​jason-famedly @​ Famedly. (#​19758)
• Include allowed_room_ids in the /summary client-server API response for rooms with restricted join rules, as required by Matrix 1.15.
  Contributed by @​FrenchGithubUser @​Famedly. (#​19762)
• MSC4140: Cancellable delayed events: Allow authentication on delayed event management endpoints (such as /restart) to bypass ratelimits for unauthenticated requests based on the client IP address. (#​19794)
• Add new metric synapse_non_deactivated_user_count which tracks the number of non-deactivated users in the database, split by app_service. (#​19848)
• The GET /_matrix/client/unstable/org.matrix.msc1763/retention/configuration endpoint is now provided when retention
  is enabled and experimental_features.msc1763_enabled is enabled, based on
  MSC1763. (#​19853)
• Add experimental support for MSC4491: Invite reasons in room creation. (#​19874)

Bugfixes

• Provide remote servers a way to find out about an event created during the remote join handshake. Contributed by @​FrenchGithubUser and @​jason-famedly @​ Famedly. (#​19390, #​19855, #​19856)
• Advertise org.matrix.msc4143 in unstable_features when msc4143_enabled is set. (#​19646)
• Fix a long-standing bug where the badge notification count for a room could become permanently inflated if a read receipt was sent before the room's notification counts were first summarised. (#​19785)
• Fix startup listener logging to report the actual bound TCP port, so listeners configured with port 0 no longer log Synapse now listening on TCP port 0. (#​19810)
• Fix notification counts being inflated after a /purge_history when notifications had already been rotated into the summary table. (#​19834)
• Fix /sync caching transient errors for the sync_response_cache_duration. (#​19845)
• Fix local events being deleted by the Purge History admin API despite delete_local_events being set to false, in room versions other than 1 and 2. (#​19850)
• Fix a bug where a user's dehydrated device (MSC3814) was deleted when their device list was synced from Matrix Authentication Service (e.g. upon logging out their last device), breaking offline key delivery. (#​19892)

Improved Documentation

• Update auto_join_rooms config documentation to cover requirements for auto-joining invite-only rooms. (#​19660)
• Add stable endpoint for MSC3266: Room summary API into worker docs. Contributed by @​olmari. (#​19788)
• Tweak wording of Rust crate dependency update policy. (#​19829)
• Fixed the Admin API user endpoint documentation examples to use JSON booleans (true/false) instead of numeric (0/1) values. (#​19847)

Internal Changes

• Make simple_select_one_onecol_txn() more helpful by naming the table of the select - as all other query wrapper functions already did. (#​19869)
• Refactor get_user_which_could_invite logic to reuse get_users_which_can_issue_invite. Contributed by Noah Markert. (#​19732)
• Fix a flaky test (twisted.protocols.amp.TooLong error under trial -jN) caused by an oversized debug log line. (#​19832)
• Upload Complement test logs as CI artifacts instead of printing the raw output to the build log. (#​19840)
• Fix release script considering any workflow completion as successful. (#​19843)
• Force keyword-args for clear default_config(server_name="test") usage in test utilities. (#​19849)
• Add .ruff_cache/ directory to .gitignore. (#​19854)
• Bump poetry in CI from 2.2.1 to 2.4.1. (#​19866, #​19877)
• Split out deferred and tokio_runtime to their own Rust modules. (#​19868)
• Prevent the cargo-test and cargo-bench CI jobs from being skipped, even on PRs that have Rust changes. (#​19883)

containous/traefik (traefik)

v3.7.8

Compare Source

All Commits

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#​13498 @​kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#​13506 @​gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#​13469 @​ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#​13520 @​juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#​13473 @​veenoise)
• [rules] Fix syntax notes in routing rule documentation (#​13501 @​stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#​13518 @​rachana5)

v3.7.8

Compare Source

All Commits

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#​13498 @​kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#​13506 @​gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#​13469 @​ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#​13520 @​juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#​13473 @​veenoise)
• [rules] Fix syntax notes in routing rule documentation (#​13501 @​stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#​13518 @​rachana5)

v3.7.7

Compare Source

All Commits

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#​13498 @​kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#​13506 @​gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#​13469 @​ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#​13520 @​juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#​13473 @​veenoise)
• [rules] Fix syntax notes in routing rule documentation (#​13501 @​stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#​13518 @​rachana5)

v3.7.7

Compare Source

All Commits

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#​13498 @​kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#​13506 @​gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#​13469 @​ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#​13520 @​juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#​13473 @​veenoise)
• [rules] Fix syntax notes in routing rule documentation (#​13501 @​stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#​13518 @​rachana5)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.