docs: Synapse 1.164.1 #43

Merged

jared merged 1 commits from docs/synapse-1.164.1 into main 2026-10-28 15:05:12 -04:00

Conversation 0 Commits 1 Files Changed 1

+1 -1

jared commented 2026-10-28 15:02:38 -04:00

Owner

Copy Link

Copy Source

Upgraded production Synapse (LXC 151, now on large1) from 1.163.2 to 1.164.1 on 2026-10-28. Owner-approved.

Why: 1.164.1 brings msgpack 1.2.4 (GHSA-j586-36cw-2gc2), on top of 1.164.0. Malformed public room list tokens could exhaust memory, and that endpoint can be reached without signing in.

Checked first

• Upgrade notes: no 1.164 actions required.
• MSC4210 (legacy mention push rules off by default): handled. Lotus already sends m.mentions, and #42 added it for ticket notifications and !roast.
• null profile values (rejected since 1.164.0): not used. Lotus clears pronouns, timezone and decoration with an empty string.
• Rollback package kept: matrix-synapse-py3_1.163.2+trixie1.

Verified

• /versions and the federation version report 1.164.1.
• The federation tester reports OK.
• No ERROR or CRITICAL lines since the restart (about 19 s of downtime), and clients resynced with 200s.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

**Upgraded production Synapse (LXC 151, now on large1) from 1.163.2 to 1.164.1 on 2026-10-28.** Owner-approved. **Why:** 1.164.1 brings **msgpack 1.2.4** (GHSA-j586-36cw-2gc2), on top of 1.164.0. Malformed public room list tokens could exhaust memory, and that endpoint can be reached without signing in. **Checked first** - **Upgrade notes:** no 1.164 actions required. - **MSC4210 (legacy mention push rules off by default):** handled. Lotus already sends `m.mentions`, and #42 added it for ticket notifications and `!roast`. - **`null` profile values (rejected since 1.164.0):** not used. Lotus clears pronouns, timezone and decoration with an empty string. - **Rollback package** kept: `matrix-synapse-py3_1.163.2+trixie1`. **Verified** - `/versions` and the federation version report **1.164.1**. - The federation tester reports **OK**. - No ERROR or CRITICAL lines since the restart (about 19 s of downtime), and clients resynced with 200s. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-28 15:02:39 -04:00

docs: Synapse 1.164.1 ... 6cdac33ca4

Upgraded on LXC 151 (now on large1) on 2026-10-28 from 1.163.2.
1.164.1 brings msgpack 1.2.4 (GHSA-j586-36cw-2gc2: memory exhaustion via
malformed public room list tokens, reachable unauthenticated) on top of
1.164.0. Checked first: no upgrade notes to act on; MSC4210 (legacy mention
push rules off) handled by matrix#42 and Lotus already sending m.mentions;
null profile values not used (Lotus clears with an empty string).
Verified: client and federation versions report 1.164.1, federation tester
OK, no ERROR/CRITICAL since restart, clients resynced (200).
Rollback package kept (1.163.2+trixie1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared scheduled this pull request to auto merge when all checks succeed 2026-10-28 15:02:46 -04:00

jared merged commit 3213f8c41b into main 2026-10-28 15:05:12 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is broken

ci

CI / workflows

enhancement

New feature or request

infra

Infrastructure / runners / servers

landing

priority: low

priority: medium

security

Security or privacy

ux

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/matrix#43