LotusGuild/matrix
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Synapse 1.163.2 (Pillow 13 security update) #41

Merged
jared merged 1 commits from docs/synapse-1.163.2 into main 2026-10-26 19:30:06 -04:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
jared commented 2026-10-26 19:24:05 -04:00
Owner
Copy Link
Copy Source

Upgraded production Synapse (LXC 151) from 1.162.0 to 1.163.2 on 2026-10-26. Owner-approved. The README still said 1.159.0.

Why: 1.163.2 updates Pillow to 13.0.0, which contains security fixes. Synapse uses Pillow to make image thumbnails. We run Python 3.13, which meets Pillow 13's 3.11 minimum.

Pre-checks

  • Upgrade notes: 1.163 refuses to start if limit_profile_requests_to_users_who_share_rooms is on without require_auth_for_profile_requests. Neither is set here.
  • Changelog: nothing else for us to act on. 1.163.1 brings certifi and rustls-webpki; 1.163.0 brings MSC4075 push rules and the removal of sticky state events.
  • Rollback package kept: /var/cache/apt/archives/matrix-synapse-py3_1.162.0+trixie1_amd64.deb.

Upgrade: apt-get install --only-upgrade -o Dpkg::Options::=--force-confold matrix-synapse-py3=1.163.2+trixie1. The config was kept, and the restart took about 16 s.

Verified

  • /_matrix/client/versions and /_matrix/federation/v1/version report 1.163.2.
  • The Matrix federation tester reports FederationOK: true.
  • No ERROR or CRITICAL lines in homeserver.log since the restart.
  • Synapse's own Thumbnailer scales and crops JPEG, PNG, WebP and GIF with Pillow 13.0.0.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

**Upgraded production Synapse (LXC 151) from 1.162.0 to 1.163.2 on 2026-10-26.** Owner-approved. The README still said 1.159.0. **Why:** 1.163.2 updates **Pillow to 13.0.0**, which contains security fixes. Synapse uses Pillow to make image thumbnails. We run Python 3.13, which meets Pillow 13's 3.11 minimum. **Pre-checks** - **Upgrade notes:** 1.163 refuses to start if `limit_profile_requests_to_users_who_share_rooms` is on without `require_auth_for_profile_requests`. Neither is set here. - **Changelog:** nothing else for us to act on. 1.163.1 brings certifi and rustls-webpki; 1.163.0 brings MSC4075 push rules and the removal of sticky state events. - **Rollback package** kept: `/var/cache/apt/archives/matrix-synapse-py3_1.162.0+trixie1_amd64.deb`. **Upgrade:** `apt-get install --only-upgrade -o Dpkg::Options::=--force-confold matrix-synapse-py3=1.163.2+trixie1`. The config was kept, and the restart took about 16 s. **Verified** - `/_matrix/client/versions` and `/_matrix/federation/v1/version` report **1.163.2**. - The Matrix federation tester reports **FederationOK: true**. - No ERROR or CRITICAL lines in `homeserver.log` since the restart. - Synapse's own `Thumbnailer` scales and crops JPEG, PNG, WebP and GIF with Pillow 13.0.0. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared added 1 commit 2026-10-26 19:24:05 -04:00
docs: Synapse 1.163.2 (Pillow 13 security update)
Lint / Shell (shellcheck) (push) Successful in 15s
Details
Lint / JS (eslint) (push) Successful in 14s
Details
Lint / No secrets in webhook configs (push) Successful in 5s
Details
Lint / Landing page is rendered (matrix (push) Successful in 5s
Details
Lint / Python (ruff) (push) Successful in 6s
Details
Lint / Secret scan (gitleaks) (push) Successful in 5s
Details
Lint / Shell (shellcheck) (pull_request) Successful in 7s
Details
Lint / JS (eslint) (pull_request) Successful in 9s
Details
Lint / No secrets in webhook configs (pull_request) Successful in 5s
Details
Lint / Python deps (pip-audit) (push) Successful in 39s
Details
Lint / Landing page is rendered (matrix (pull_request) Successful in 4s
Details
Lint / Python (ruff) (pull_request) Successful in 7s
Details
Lint / Secret scan (gitleaks) (pull_request) Successful in 5s
Details
Lint / Python deps (pip-audit) (pull_request) Successful in 1m1s
Details
8a2867e64b 
Upgraded on LXC 151 on 2026-10-26 from 1.162.0 (the README still said
1.159.0). 1.163.2 brings Pillow 13.0.0 (security fixes in the image
thumbnailer). Upgrade notes checked: the new start-up check for
limit_profile_requests_to_users_who_share_rooms does not apply (unset).
Verified: /versions and federation version report 1.163.2, federation
tester OK, no errors since restart, Synapse thumbnailer works with Pillow 13.
Rollback package kept in /var/cache/apt/archives (1.162.0+trixie1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared merged commit 54bdada04d into main 2026-10-26 19:30:06 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is broken
 ci
CI / workflows
 enhancement
New feature or request
 infra
Infrastructure / runners / servers
 landing
priority: low
priority: medium
security
Security or privacy
 ux
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/matrix#41