Upgraded LXC 151 from 1.157.1 to 1.157.2 (packages.matrix.org, Trixie), a
security release fixing 11 advisories (6 High / 3 Moderate / 2 Low; no CVE IDs
assigned). Applies to us: most High-severity issues need open federation (we
federate) and two call out untrusted local users.
Pure apt bump — no upgrade.md notes for v1.157.2, no schema migration,
Python/PostgreSQL minimums unchanged, homeserver.yaml preserved via
--force-confold. Clean restart (NRestarts=0), version endpoint reports 1.157.2,
no errors, federation healthy.
Note: 1.157.2 adds an OPTIONAL push_rules.limits config block (safe defaults)
for the push-rule-exhaustion advisory — captured for later tuning, not required.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Upgraded LXC 151 from 1.156.0 to 1.157.1 (packages.matrix.org, Trixie).
The host was found on 1.156.0 despite this README recording 1.155.0 — an
intermediate upgrade had gone unlogged. Corrected the infra and Tech Stack
tables and noted the drift so future upgrades verify with dpkg rather than
trusting the docs.
Not a security release (no CVEs in range; the last were fixed in 1.152.1),
but 1.157.0 fixes an application-service ephemeral-events regression shipped
in 1.156.0, which affects hookshot. No schema-version bump (94 -> 94) and the
three new background updates completed immediately. Our experimental_features
block (MatrixRTC/Element Call MSCs) is unaffected by 1.157.0's removal of
msc3861, which we do not use; it was preserved via --force-confold.
Also adds a Synapse upgrade runbook — the repo had no documented procedure or
automation for this at all, so the two prior upgrades were done out-of-band.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude