Skip to content

Update all dependencies - #28

Open
missingcharacter wants to merge 1 commit into
mainfrom
renovate/all
Open

Update all dependencies#28
missingcharacter wants to merge 1 commit into
mainfrom
renovate/all

Conversation

@missingcharacter

@missingcharacter missingcharacter commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/setup-python action major v6 → v7
docker.io/caddy (source) patch 2.11.4-alpine → 2.11.7-alpine
docker.io/postgres (source) minor 18.4-alpine3.24 → 18.6-alpine3.24
ghcr.io/element-hq/synapse minor v1.155.0 → v1.162.0
ghcr.io/umami-software/umami minor 3.2.0 → 3.4.0
postgres (source) minor 18.4-alpine3.24 → 18.6-alpine3.24
traefik (source) patch v3.7.6 → v3.7.13
vaultwarden/server minor 1.36.0-alpine → 1.37.4-alpine

Release Notes

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

What's Changed

Enhancements
Bug Fix
Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

element-hq/synapse (ghcr.io/element-hq/synapse)

v1.162.0

Compare Source

Changelog: https://github.com/element-hq/synapse/blob/release-v1.162/CHANGES.md

v1.161.0

Compare Source

Changelog: https://github.com/element-hq/synapse/blob/release-v1.161/CHANGES.md

v1.160.0

Compare Source

Changelog: https://github.com/element-hq/synapse/blob/release-v1.160/CHANGES.md

v1.159.0

Compare Source

Changelog: https://github.com/element-hq/synapse/blob/release-v1.159/CHANGES.md

v1.158.0

Compare Source

Changelog: https://github.com/element-hq/synapse/blob/release-v1.158/CHANGES.md

v1.157.2

Compare Source

Synapse 1.157.2 (2026-07-28)

This security release addresses several vulnerabilities.

Please upgrade when you can, particularly if your homeserver participates in open federation
and/or has untrusted local users.

Security Fixes

High severity:

Moderate severity:

Low severity:

v1.157.1

Compare Source

Synapse 1.157.1 (2026-07-22)

Bugfixes

  • Fix config regression around falsy experimental_features no longer being accepted. (#​19987)

v1.157.0

Compare Source

Synapse 1.157.0 (2026-07-21)

No significant changes since 1.157.0rc1.

Synapse 1.157.0rc1 (2026-07-14)

Features

Bugfixes

  • MSC4140: Cancellable delayed events: Update error responses to match their format in the current draft of the MSC. (#​19539)
  • Lock Sliding Sync connections when inserting lazy members, to prevent repeated deadlocks. (#​19826)
  • Fix the flag_existing_quarantined_media background update skipping some quarantined remote media. Introduced in v1.152.0. (#​19901)
  • Fix a bug introduced in Synapse v1.150.0 where reactivating a deactivated and erased user did not restore their profile, breaking login, name changes, and invitations.
    Contributed by @​m4us1ne. (#​19902)
  • Fix a regression where application services that opted into ephemeral events using the legacy de.sorunome.msc2409.push_ephemeral registration flag stopped receiving ephemeral events (including to-device messages used for encryption). Introduced in v1.156.0. (#​19928)
  • Fix a bug causing device list pruning to skip some rows when the transaction gets retried. (#​19947)
  • Fix presence states being shown to clients forever after presence is disabled, by marking any previously only users as offline. (#​19948)
  • Fix SYNAPSE_ASYNC_IO_REACTOR=1 on Python 3.14. (#​19949)

Deprecations and Removals

  • Remove support for experimental MSC3861 auth delegation, in favour of the stable Matrix Authentication Service integration support. See the upgrade notes. (#​19895)

Internal Changes

  • Port the synchronous core of client event serialization to Rust. (#​19837, #​19922)
  • Update HomeserverTestCase.get_success(...) and friends to drive async Rust (Tokio runtime/thread pool). (#​19871, #​19879)
  • Allow Rust code to have database access via Python database connection pool. (#​19878)
  • Add golangci-lint to CI. (#​19888)
  • Remove wall-clock dependency of test_redact_messages_all_rooms test, as this caused flakiness. (#​19890)
  • Change the MSC3814 dehydrated device /events endpoint from POST to GET. (#​19896)
  • Change the MSC3814 dehydrated device /events endpoint paging to match spec conventions. (#​19897)
  • Fix storage type mismatches where values were bound with a type that didn't match their database column. (#​19911)
  • Speed up deletion of old sliding sync connections by adding an index. (#​19912)
  • Add note to 3PID email token request unit tests that the endpoint being tested can have an expected, artificial delay of up to 1s. (#​19916)
  • Add an index to sliding_sync_connection_lazy_members to speed up deleting old sliding sync connection positions. (#​19923)
  • Fix test_lock_contention being flaky when running against PostgreSQL by budgeting CPU time rather than wall-clock time. (#​19929)
  • Fix Complement test flake when restarting Synapse workers (cross-test pollution caused by nginx upstreams being temporarily unavailable). (#​19936)
  • Add clean deploy FIXME note for TestOIDCProviderUnavailable (problem tracked by #​19937). (#​19938)
  • Minor presence performance improvements for large servers. (#​19939)
  • Reduce replication traffic caused by presence. (#​19941)
  • Add last_active_granularity, sync_online_timeout and idle_timeout options to the presence config section to allow tuning the presence state machine timers. (#​19942)

v1.156.0

Compare Source

Synapse 1.156.0 (2026-07-07)

No significant changes since 1.156.0rc1.

Synapse 1.156.0rc1 (2026-06-30)

Features

Bugfixes

  • Provide remote servers a way to find out about an event created during the remote join handshake. Contributed by @​FrenchGithubUser and @​jason-famedly @​ Famedly. (#​19390, #​19855, #​19856)
  • Advertise org.matrix.msc4143 in unstable_features when msc4143_enabled is set. (#​19646)
  • Fix a long-standing bug where the badge notification count for a room could become permanently inflated if a read receipt was sent before the room's notification counts were first summarised. (#​19785)
  • Fix startup listener logging to report the actual bound TCP port, so listeners configured with port 0 no longer log Synapse now listening on TCP port 0. (#​19810)
  • Fix notification counts being inflated after a /purge_history when notifications had already been rotated into the summary table. (#​19834)
  • Fix /sync caching transient errors for the sync_response_cache_duration. (#​19845)
  • Fix local events being deleted by the Purge History admin API despite delete_local_events being set to false, in room versions other than 1 and 2. (#​19850)
  • Fix a bug where a user's dehydrated device (MSC3814) was deleted when their device list was synced from Matrix Authentication Service (e.g. upon logging out their last device), breaking offline key delivery. (#​19892)

Improved Documentation

  • Update auto_join_rooms config documentation to cover requirements for auto-joining invite-only rooms. (#​19660)
  • Add stable endpoint for MSC3266: Room summary API into worker docs. Contributed by @​olmari. (#​19788)
  • Tweak wording of Rust crate dependency update policy. (#​19829)
  • Fixed the Admin API user endpoint documentation examples to use JSON booleans (true/false) instead of numeric (0/1) values. (#​19847)

Internal Changes

  • Make simple_select_one_onecol_txn() more helpful by naming the table of the select - as all other query wrapper functions already did. (#​19869)
  • Refactor get_user_which_could_invite logic to reuse get_users_which_can_issue_invite. Contributed by Noah Markert. (#​19732)
  • Fix a flaky test (twisted.protocols.amp.TooLong error under trial -jN) caused by an oversized debug log line. (#​19832)
  • Upload Complement test logs as CI artifacts instead of printing the raw output to the build log. (#​19840)
  • Fix release script considering any workflow completion as successful. (#​19843)
  • Force keyword-args for clear default_config(server_name="test") usage in test utilities. (#​19849)
  • Add .ruff_cache/ directory to .gitignore. (#​19854)
  • Bump poetry in CI from 2.2.1 to 2.4.1. (#​19866, #​19877)
  • Split out deferred and tokio_runtime to their own Rust modules. (#​19868)
  • Prevent the cargo-test and cargo-bench CI jobs from being skipped, even on PRs that have Rust changes. (#​19883)
traefik/traefik (traefik)

v3.7.13

Compare Source

All Commits

Bug fixes:

Documentation:

v3.7.12

Compare Source

All Commits

Bug fixes:

Documentation:

v3.7.11

Compare Source

All Commits

Bug fixes:

Documentation:

v3.7.10

Compare Source

All Commits

Bug fixes:

Documentation:

v3.7.9

Compare Source

All Commits

Bug fixes:

Documentation:

  • [k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider (#​13607 @​gndz07)

v3.7.8

Compare Source

All Commits

Bug fixes:

Documentation:

v3.7.7

Compare Source

All Commits

Bug fixes:

Documentation:

dani-garcia/vaultwarden (vaultwarden/server)

v1.37.4

Compare Source

Security Fixes

This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

These are private for now, pending CVE assignment and publishing at a later date.

[!NOTE]
If an organization has Admins you don't fully trust, consider rotating its API key after updating (Admin Console → Settings → Rotate API key). Before this release, Admins could also view the key.

Upgrade notes

  • Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the address of the proxy in front is used for rate limiting and logs.
  • Sends: bw send receive on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients.
  • Feature flags: these flags were removed because no client reads them anymore: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile and cxp-export-mobile. If EXPERIMENTAL_CLIENT_FEATURE_FLAGS still lists one of them, startup logs a warning and saving settings in the admin panel fails until it's removed.
  • Duo: DUO_USE_IFRAME (the deprecated Traditional Prompt) is removed and ignored if set.
  • Custom templates: there's a new email template, email/recover_twofactor, sent after a login with a two-step recovery code.
  • The legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints are removed. No current client uses them.

What's Changed

New Contributors

Full Changelog: dani-garcia/vaultwarden@1.37.3...1.37.4

[v1.37.3](https://

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@missingcharacter
missingcharacter force-pushed the renovate/all branch 3 times, most recently from b2fd28e to 9b3a633 Compare July 21, 2026 23:55
@missingcharacter
missingcharacter force-pushed the renovate/all branch 4 times, most recently from ee9c487 to 2fa1ed1 Compare July 29, 2026 23:59
@missingcharacter
missingcharacter force-pushed the renovate/all branch 2 times, most recently from 2677067 to 34de970 Compare August 5, 2026 00:01
@missingcharacter
missingcharacter force-pushed the renovate/all branch 4 times, most recently from e9ac09f to 3fd706e Compare August 19, 2026 23:21
@missingcharacter
missingcharacter force-pushed the renovate/all branch 3 times, most recently from c73bb73 to 9f8e60d Compare August 27, 2026 04:14
@missingcharacter
missingcharacter force-pushed the renovate/all branch 2 times, most recently from 9a6cfc0 to 6773d8e Compare September 5, 2026 00:37
@missingcharacter
missingcharacter force-pushed the renovate/all branch 3 times, most recently from e1d69c1 to 4a97f10 Compare September 18, 2026 01:01
@missingcharacter
missingcharacter force-pushed the renovate/all branch 3 times, most recently from 0ce77a1 to 34ee8b5 Compare October 5, 2026 21:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@missingcharacter @renovate-bot