Newsfile

WIP
2024-06-13 13:57:32 +01:00 · 2024-06-13 13:56:53 +01:00
204 changed files with 2852 additions and 19848 deletions
@@ -2,4 +2,4 @@
 (using a matrix.org account if necessary). We do not use GitHub issues for
 support.

-**If you want to report a security issue** please see https://element.io/security/security-disclosure-policy
+**If you want to report a security issue** please see https://matrix.org/security-disclosure-policy/
@@ -7,7 +7,7 @@ body:
        **THIS IS NOT A SUPPORT CHANNEL!**
        **IF YOU HAVE SUPPORT QUESTIONS ABOUT RUNNING OR CONFIGURING YOUR OWN HOME SERVER**, please ask in **[#synapse:matrix.org](https://matrix.to/#/#synapse:matrix.org)** (using a matrix.org account if necessary).

-        If you want to report a security issue, please see https://element.io/security/security-disclosure-policy
+        If you want to report a security issue, please see https://matrix.org/security-disclosure-policy/

        This is a bug report form. By following the instructions below and completing the sections with your information, you will help the us to get all the necessary data to fix your issue.

@@ -72,7 +72,7 @@ jobs:

      - name: Build and push all platforms
        id: build-and-push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v5
        with:
          push: true
          labels: |
@@ -14,7 +14,7 @@ jobs:
      # There's a 'download artifact' action, but it hasn't been updated for the workflow_run action
      # (https://github.com/actions/download-artifact/issues/60) so instead we get this mess:
      - name: 📥 Download artifact
-        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
+        uses: dawidd6/action-download-artifact@deb3bb83256a78589fef6a7b942e5f2573ad7c13 # v5
        with:
          workflow: docs-pr.yaml
          run_id: ${{ github.event.workflow_run.id }}
@@ -102,7 +102,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        os: [ubuntu-20.04, macos-12]
+        os: [ubuntu-20.04, macos-11]
        arch: [x86_64, aarch64]
        # is_pr is a flag used to exclude certain jobs from the matrix on PRs.
        # It is not read by the rest of the workflow.
@@ -112,9 +112,9 @@ jobs:
        exclude:
          # Don't build macos wheels on PR CI.
          - is_pr: true
-            os: "macos-12"
+            os: "macos-11"
          # Don't build aarch64 wheels on mac.
-          - os: "macos-12"
+          - os: "macos-11"
            arch: aarch64
          # Don't build aarch64 wheels on PR CI.
          - is_pr: true
@@ -130,7 +130,7 @@ jobs:
          python-version: "3.x"

      - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==2.19.1
+        run: python -m pip install cibuildwheel==2.16.2

      - name: Set up QEMU to emulate aarch64
        if: matrix.arch == 'aarch64'
@@ -21,7 +21,6 @@ jobs:
      trial: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.trial }}
      integration: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.integration }}
      linting: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.linting }}
-      linting_readme: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.linting_readme }}
    steps:
    - uses: dorny/paths-filter@v3
      id: filter
@@ -74,9 +73,6 @@ jobs:
            - 'poetry.lock'
            - '.github/workflows/tests.yml'

-          linting_readme:
-            - 'README.rst'
-
  check-sampleconfig:
    runs-on: ubuntu-latest
    needs: changes
@@ -139,7 +135,7 @@ jobs:

      - name: Semantic checks (ruff)
        # --quiet suppresses the update check.
-        run: poetry run ruff check --quiet .
+        run: poetry run ruff --quiet .

  lint-mypy:
    runs-on: ubuntu-latest
@@ -273,20 +269,6 @@ jobs:

      - run: cargo fmt --check

-  # This is to detect issues with the rst file, which can otherwise cause issues
-  # when uploading packages to PyPi.
-  lint-readme:
-    runs-on: ubuntu-latest
-    needs: changes
-    if: ${{ needs.changes.outputs.linting_readme == 'true' }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.x"
-      - run: "pip install rstcheck"
-      - run: "rstcheck --report-level=WARNING README.rst"
-
  # Dummy step to gate other tests on without repeating the whole list
  linting-done:
    if: ${{ !cancelled() }} # Run this even if prior jobs were skipped
@@ -302,10 +284,9 @@ jobs:
      - lint-clippy
      - lint-clippy-nightly
      - lint-rustfmt
-      - lint-readme
    runs-on: ubuntu-latest
    steps:
-      - uses: matrix-org/done-action@v3
+      - uses: matrix-org/done-action@v2
        with:
          needs: ${{ toJSON(needs) }}

@@ -320,7 +301,6 @@ jobs:
            lint-clippy
            lint-clippy-nightly
            lint-rustfmt
-            lint-readme


  calculate-test-jobs:
@@ -499,9 +479,6 @@ jobs:
      volumes:
        - ${{ github.workspace }}:/src
      env:
-        # If this is a pull request to a release branch, use that branch as default branch for sytest, else use develop
-        # This works because the release script always create a branch on the sytest repo with the same name as the release branch
-        SYTEST_DEFAULT_BRANCH: ${{ startsWith(github.base_ref, 'release-') && github.base_ref || 'develop' }}
        SYTEST_BRANCH: ${{ github.head_ref }}
        POSTGRES: ${{ matrix.job.postgres && 1}}
        MULTI_POSTGRES: ${{ (matrix.job.postgres == 'multi-postgres') || '' }}
@@ -737,7 +714,7 @@ jobs:
      - linting-done
    runs-on: ubuntu-latest
    steps:
-      - uses: matrix-org/done-action@v3
+      - uses: matrix-org/done-action@v2
        with:
          needs: ${{ toJSON(needs) }}

@@ -1,272 +1,3 @@
-# Synapse 1.112.0rc1 (2024-07-23)
-
-### Features
-
- Add to-device extension support to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17416](https://github.com/element-hq/synapse/issues/17416))
- Populate `name`/`avatar` fields in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17418](https://github.com/element-hq/synapse/issues/17418))
- Populate `heroes` and room summary fields (`joined_count`, `invited_count`) in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17419](https://github.com/element-hq/synapse/issues/17419))
- Populate `is_dm` room field in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17429](https://github.com/element-hq/synapse/issues/17429))
- Add room subscriptions to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17432](https://github.com/element-hq/synapse/issues/17432))
- Prepare for authenticated media freeze. ([\#17433](https://github.com/element-hq/synapse/issues/17433))
- Add E2EE extension support to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17454](https://github.com/element-hq/synapse/issues/17454))
-
-### Bugfixes
-
- Add configurable option to always include offline users in presence sync results. Contributed by @Michael-Hollister. ([\#17231](https://github.com/element-hq/synapse/issues/17231))
- Fix bug in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint when using room type filters and the user has one or more remote invites. ([\#17434](https://github.com/element-hq/synapse/issues/17434))
- Order `heroes` by `stream_ordering` as the Matrix specification states (applies to `/sync`). ([\#17435](https://github.com/element-hq/synapse/issues/17435))
- Fix rare bug where `/sync` would break for a user when using workers with multiple stream writers. ([\#17438](https://github.com/element-hq/synapse/issues/17438))
-
-### Improved Documentation
-
- Update the readme image to have a white background, so that it is readable in dark mode. ([\#17387](https://github.com/element-hq/synapse/issues/17387))
- Add Red Hat Enterprise Linux and Rocky Linux 8 and 9 installation instructions. ([\#17423](https://github.com/element-hq/synapse/issues/17423))
- Improve documentation for the [`default_power_level_content_override`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#default_power_level_content_override) config option. ([\#17451](https://github.com/element-hq/synapse/issues/17451))
-
-### Internal Changes
-
- Make sure we always use the right logic for enabling the media repo. ([\#17424](https://github.com/element-hq/synapse/issues/17424))
- Fix argument documentation for method `RateLimiter.record_action`. ([\#17426](https://github.com/element-hq/synapse/issues/17426))
- Reduce volume of 'Waiting for current token' logs, which were introduced in v1.109.0. ([\#17428](https://github.com/element-hq/synapse/issues/17428))
- Limit concurrent remote downloads to 6 per IP address, and decrement remote downloads without a content-length from the ratelimiter after the download is complete. ([\#17439](https://github.com/element-hq/synapse/issues/17439))
- Remove unnecessary call to resume producing in fake channel. ([\#17449](https://github.com/element-hq/synapse/issues/17449))
- Update experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint to bump room when it is created. ([\#17453](https://github.com/element-hq/synapse/issues/17453))
- Speed up generating sliding sync responses. ([\#17458](https://github.com/element-hq/synapse/issues/17458))
- Add cache to `get_rooms_for_local_user_where_membership_is` to speed up sliding sync. ([\#17460](https://github.com/element-hq/synapse/issues/17460))
- Speed up fetching room keys from backup. ([\#17461](https://github.com/element-hq/synapse/issues/17461))
- Speed up sorting of the room list in sliding sync. ([\#17468](https://github.com/element-hq/synapse/issues/17468))
- Implement handling of `$ME` as a state key in sliding sync. ([\#17469](https://github.com/element-hq/synapse/issues/17469))
-
-
-
-### Updates to locked dependencies
-
-* Bump bytes from 1.6.0 to 1.6.1. ([\#17441](https://github.com/element-hq/synapse/issues/17441))
-* Bump hiredis from 2.3.2 to 3.0.0. ([\#17464](https://github.com/element-hq/synapse/issues/17464))
-* Bump jsonschema from 4.22.0 to 4.23.0. ([\#17444](https://github.com/element-hq/synapse/issues/17444))
-* Bump matrix-org/done-action from 2 to 3. ([\#17440](https://github.com/element-hq/synapse/issues/17440))
-* Bump mypy from 1.9.0 to 1.10.1. ([\#17445](https://github.com/element-hq/synapse/issues/17445))
-* Bump pyopenssl from 24.1.0 to 24.2.1. ([\#17465](https://github.com/element-hq/synapse/issues/17465))
-* Bump ruff from 0.5.0 to 0.5.4. ([\#17466](https://github.com/element-hq/synapse/issues/17466))
-* Bump sentry-sdk from 2.6.0 to 2.8.0. ([\#17456](https://github.com/element-hq/synapse/issues/17456))
-* Bump sentry-sdk from 2.8.0 to 2.10.0. ([\#17467](https://github.com/element-hq/synapse/issues/17467))
-* Bump setuptools from 67.6.0 to 70.0.0. ([\#17448](https://github.com/element-hq/synapse/issues/17448))
-* Bump twine from 5.1.0 to 5.1.1. ([\#17443](https://github.com/element-hq/synapse/issues/17443))
-* Bump types-jsonschema from 4.22.0.20240610 to 4.23.0.20240712. ([\#17446](https://github.com/element-hq/synapse/issues/17446))
-* Bump ulid from 1.1.2 to 1.1.3. ([\#17442](https://github.com/element-hq/synapse/issues/17442))
-* Bump zipp from 3.15.0 to 3.19.1. ([\#17427](https://github.com/element-hq/synapse/issues/17427))
-
-# Synapse 1.111.0 (2024-07-16)
-
-No significant changes since 1.111.0rc2.
-
-
-
-
-# Synapse 1.111.0rc2 (2024-07-10)
-
-### Bugfixes
-
- Fix bug where using `synapse.app.media_repository` worker configuration would break the new media endpoints. ([\#17420](https://github.com/element-hq/synapse/issues/17420))
-
-### Improved Documentation
-
- Document the new federation media worker endpoints in the [upgrade notes](https://element-hq.github.io/synapse/v1.111/upgrade.html) and [worker docs](https://element-hq.github.io/synapse/v1.111/workers.html). ([\#17421](https://github.com/element-hq/synapse/issues/17421))
-
-### Internal Changes
-
- Route authenticated federation media requests to media repository workers in Complement tests. ([\#17422](https://github.com/element-hq/synapse/issues/17422))
-
-
-
-
-# Synapse 1.111.0rc1 (2024-07-09)
-
-### Features
-
- Add `rooms` data to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17320](https://github.com/element-hq/synapse/issues/17320))
- Add `room_types`/`not_room_types` filtering to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17337](https://github.com/element-hq/synapse/issues/17337))
- Return "required state" in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17342](https://github.com/element-hq/synapse/issues/17342))
- Support [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md) by adding [`_matrix/client/v1/media/download`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediadownloadservernamemediaid) endpoint. ([\#17365](https://github.com/element-hq/synapse/issues/17365))
- Support [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/rav/authentication-for-media/proposals/3916-authentication-for-media.md)
-  by adding [`_matrix/client/v1/media/thumbnail`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediathumbnailservernamemediaid), [`_matrix/federation/v1/media/thumbnail`](https://spec.matrix.org/v1.11/server-server-api/#get_matrixfederationv1mediathumbnailmediaid) endpoints and stabilizing the
-  remaining [`_matrix/client/v1/media`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediaconfig) endpoints. ([\#17388](https://github.com/element-hq/synapse/issues/17388))
- Add `rooms.bump_stamp` for easier client-side sorting in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17395](https://github.com/element-hq/synapse/issues/17395))
- Forget all of a user's rooms upon deactivation, preventing local room purges from being blocked on deactivated users. ([\#17400](https://github.com/element-hq/synapse/issues/17400))
- Declare support for [Matrix 1.11](https://matrix.org/blog/2024/06/20/matrix-v1.11-release/). ([\#17403](https://github.com/element-hq/synapse/issues/17403))
- [MSC3861](https://github.com/matrix-org/matrix-spec-proposals/pull/3861): allow overriding the introspection endpoint. ([\#17406](https://github.com/element-hq/synapse/issues/17406))
-
-### Bugfixes
-
- Fix rare race which caused no new to-device messages to be received from remote server. ([\#17362](https://github.com/element-hq/synapse/issues/17362))
- Fix bug in experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint when using an old database. ([\#17398](https://github.com/element-hq/synapse/issues/17398))
-
-### Improved Documentation
-
- Clarify that `url_preview_url_blacklist` is a usability feature. ([\#17356](https://github.com/element-hq/synapse/issues/17356))
- Fix broken links in README. ([\#17379](https://github.com/element-hq/synapse/issues/17379))
- Clarify that changelog content *and file extension* need to match in order for entries to merge. ([\#17399](https://github.com/element-hq/synapse/issues/17399))
-
-### Internal Changes
-
- Make the release script create a release branch for Complement as well. ([\#17318](https://github.com/element-hq/synapse/issues/17318))
- Fix uploading packages to PyPi. ([\#17363](https://github.com/element-hq/synapse/issues/17363))
- Add CI check for the README. ([\#17367](https://github.com/element-hq/synapse/issues/17367))
- Fix linting errors from new `ruff` version. ([\#17381](https://github.com/element-hq/synapse/issues/17381), [\#17411](https://github.com/element-hq/synapse/issues/17411))
- Fix building debian packages on non-clean checkouts. ([\#17390](https://github.com/element-hq/synapse/issues/17390))
- Finish up work to allow per-user feature flags. ([\#17392](https://github.com/element-hq/synapse/issues/17392), [\#17410](https://github.com/element-hq/synapse/issues/17410))
- Allow enabling sliding sync per-user. ([\#17393](https://github.com/element-hq/synapse/issues/17393))
-
-
-
-### Updates to locked dependencies
-
-* Bump certifi from 2023.7.22 to 2024.7.4. ([\#17404](https://github.com/element-hq/synapse/issues/17404))
-* Bump cryptography from 42.0.7 to 42.0.8. ([\#17382](https://github.com/element-hq/synapse/issues/17382))
-* Bump ijson from 3.2.3 to 3.3.0. ([\#17413](https://github.com/element-hq/synapse/issues/17413))
-* Bump log from 0.4.21 to 0.4.22. ([\#17384](https://github.com/element-hq/synapse/issues/17384))
-* Bump mypy-zope from 1.0.4 to 1.0.5. ([\#17414](https://github.com/element-hq/synapse/issues/17414))
-* Bump pillow from 10.3.0 to 10.4.0. ([\#17412](https://github.com/element-hq/synapse/issues/17412))
-* Bump pydantic from 2.7.1 to 2.8.2. ([\#17415](https://github.com/element-hq/synapse/issues/17415))
-* Bump ruff from 0.3.7 to 0.5.0. ([\#17381](https://github.com/element-hq/synapse/issues/17381))
-* Bump serde from 1.0.203 to 1.0.204. ([\#17409](https://github.com/element-hq/synapse/issues/17409))
-* Bump serde_json from 1.0.117 to 1.0.120. ([\#17385](https://github.com/element-hq/synapse/issues/17385), [\#17408](https://github.com/element-hq/synapse/issues/17408))
-* Bump types-setuptools from 69.5.0.20240423 to 70.1.0.20240627. ([\#17380](https://github.com/element-hq/synapse/issues/17380))
-
-# Synapse 1.110.0 (2024-07-03)
-
-No significant changes since 1.110.0rc3.
-
-
-
-
-# Synapse 1.110.0rc3 (2024-07-02)
-
-### Bugfixes
-
- Fix bug where `/sync` requests could get blocked indefinitely after an upgrade from Synapse versions before v1.109.0. ([\#17386](https://github.com/element-hq/synapse/issues/17386), [\#17391](https://github.com/element-hq/synapse/issues/17391))
-
-### Internal Changes
-
- Limit size of presence EDUs to 50 entries. ([\#17371](https://github.com/element-hq/synapse/issues/17371))
- Fix building debian package for debian sid. ([\#17389](https://github.com/element-hq/synapse/issues/17389))
-
-
-
-
-# Synapse 1.110.0rc2 (2024-06-26)
-
-### Internal Changes
-
- Fix uploading packages to PyPi. ([\#17363](https://github.com/element-hq/synapse/issues/17363))
-
-
-
-
-# Synapse 1.110.0rc1 (2024-06-26)
-
-### Features
-
- Add initial implementation of an experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17187](https://github.com/element-hq/synapse/issues/17187))
- Add experimental support for [MSC3823](https://github.com/matrix-org/matrix-spec-proposals/pull/3823) - Account suspension. ([\#17255](https://github.com/element-hq/synapse/issues/17255))
- Improve ratelimiting in Synapse. ([\#17256](https://github.com/element-hq/synapse/issues/17256))
- Add support for the unstable [MSC4151](https://github.com/matrix-org/matrix-spec-proposals/pull/4151) report room API. ([\#17270](https://github.com/element-hq/synapse/issues/17270), [\#17296](https://github.com/element-hq/synapse/issues/17296))
- Filter for public and empty rooms added to Admin-API [List Room API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#list-room-api). ([\#17276](https://github.com/element-hq/synapse/issues/17276))
- Add `is_dm` filtering to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17277](https://github.com/element-hq/synapse/issues/17277))
- Add `is_encrypted` filtering to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17281](https://github.com/element-hq/synapse/issues/17281))
- Include user membership in events served to clients, per [MSC4115](https://github.com/matrix-org/matrix-spec-proposals/pull/4115). ([\#17282](https://github.com/element-hq/synapse/issues/17282))
- Do not require user-interactive authentication for uploading cross-signing keys for the first time, per [MSC3967](https://github.com/matrix-org/matrix-spec-proposals/pull/3967). ([\#17284](https://github.com/element-hq/synapse/issues/17284))
- Add `stream_ordering` sort to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17293](https://github.com/element-hq/synapse/issues/17293))
- `register_new_matrix_user` now supports a --password-file flag, which
-  is useful for scripting. ([\#17294](https://github.com/element-hq/synapse/issues/17294))
- `register_new_matrix_user` now supports a --exists-ok flag to allow registration of users that already exist in the database.
-  This is useful for scripts that bootstrap user accounts with initial passwords. ([\#17304](https://github.com/element-hq/synapse/issues/17304))
- Add support for via query parameter from [MSC4156](https://github.com/matrix-org/matrix-spec-proposals/pull/4156). ([\#17322](https://github.com/element-hq/synapse/issues/17322))
- Add `is_invite` filtering to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17335](https://github.com/element-hq/synapse/issues/17335))
- Support [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md) by adding a federation /download endpoint. ([\#17350](https://github.com/element-hq/synapse/issues/17350))
-
-### Bugfixes
-
- Fix searching for users with their exact localpart whose ID includes a hyphen. ([\#17254](https://github.com/element-hq/synapse/issues/17254))
- Fix wrong retention policy being used when filtering events. ([\#17272](https://github.com/element-hq/synapse/issues/17272))
- Fix bug where OTKs were not always included in `/sync` response when using workers. ([\#17275](https://github.com/element-hq/synapse/issues/17275))
- Fix a long-standing bug where an invalid 'from' parameter to [`/notifications`](https://spec.matrix.org/v1.10/client-server-api/#get_matrixclientv3notifications) would result in an Internal Server Error. ([\#17283](https://github.com/element-hq/synapse/issues/17283))
- Fix edge case in `/sync` returning the wrong the state when using sharded event persisters. ([\#17295](https://github.com/element-hq/synapse/issues/17295))
- Add initial implementation of an experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17301](https://github.com/element-hq/synapse/issues/17301))
- Fix email notification subject when invited to a space. ([\#17336](https://github.com/element-hq/synapse/issues/17336))
-
-### Improved Documentation
-
- Add missing quotes for example for `exclude_rooms_from_sync`. ([\#17308](https://github.com/element-hq/synapse/issues/17308))
- Update header in the README to visually fix the the auto-generated table of contents. ([\#17329](https://github.com/element-hq/synapse/issues/17329))
- Fix stale references to the Foundation's Security Disclosure Policy. ([\#17341](https://github.com/element-hq/synapse/issues/17341))
- Add default values for `rc_invites.per_issuer` to docs. ([\#17347](https://github.com/element-hq/synapse/issues/17347))
- Fix an error in the docs for `search_all_users` parameter under `user_directory`. ([\#17348](https://github.com/element-hq/synapse/issues/17348))
-
-### Internal Changes
-
- Remove unused `expire_access_token` option in the Synapse Docker config file. Contributed by @AaronDewes. ([\#17198](https://github.com/element-hq/synapse/issues/17198))
- Use fully-qualified `PersistedEventPosition` when returning `RoomsForUser` to facilitate proper comparisons and `RoomStreamToken` generation. ([\#17265](https://github.com/element-hq/synapse/issues/17265))
- Add debug logging for when room keys are uploaded, including whether they are replacing other room keys. ([\#17266](https://github.com/element-hq/synapse/issues/17266))
- Handle OTK uploads off master. ([\#17271](https://github.com/element-hq/synapse/issues/17271))
- Don't try and resync devices for remote users whose servers are marked as down. ([\#17273](https://github.com/element-hq/synapse/issues/17273))
- Re-organize Pydantic models and types used in handlers. ([\#17279](https://github.com/element-hq/synapse/issues/17279))
- Expose the worker instance that persisted the event on `event.internal_metadata.instance_name`. ([\#17300](https://github.com/element-hq/synapse/issues/17300))
- Update the README with Element branding, improve headers and fix the #synapse:matrix.org support room link rendering. ([\#17324](https://github.com/element-hq/synapse/issues/17324))
- Change path of the experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync implementation to `/org.matrix.simplified_msc3575/sync` since our simplified API is slightly incompatible with what's in the current MSC. ([\#17331](https://github.com/element-hq/synapse/issues/17331))
- Handle device lists notifications for large accounts more efficiently in worker mode. ([\#17333](https://github.com/element-hq/synapse/issues/17333), [\#17358](https://github.com/element-hq/synapse/issues/17358))
- Do not block event sending/receiving while calculating large event auth chains. ([\#17338](https://github.com/element-hq/synapse/issues/17338))
- Tidy up `parse_integer` docs and call sites to reflect the fact that they require non-negative integers by default, and bring `parse_integer_from_args` default in alignment. Contributed by Denis Kasak (@dkasak). ([\#17339](https://github.com/element-hq/synapse/issues/17339))
-
-
-
-### Updates to locked dependencies
-
-* Bump authlib from 1.3.0 to 1.3.1. ([\#17343](https://github.com/element-hq/synapse/issues/17343))
-* Bump dawidd6/action-download-artifact from 3.1.4 to 5. ([\#17289](https://github.com/element-hq/synapse/issues/17289))
-* Bump dawidd6/action-download-artifact from 5 to 6. ([\#17313](https://github.com/element-hq/synapse/issues/17313))
-* Bump docker/build-push-action from 5 to 6. ([\#17312](https://github.com/element-hq/synapse/issues/17312))
-* Bump jinja2 from 3.1.3 to 3.1.4. ([\#17287](https://github.com/element-hq/synapse/issues/17287))
-* Bump lazy_static from 1.4.0 to 1.5.0. ([\#17355](https://github.com/element-hq/synapse/issues/17355))
-* Bump msgpack from 1.0.7 to 1.0.8. ([\#17317](https://github.com/element-hq/synapse/issues/17317))
-* Bump netaddr from 1.2.1 to 1.3.0. ([\#17353](https://github.com/element-hq/synapse/issues/17353))
-* Bump packaging from 24.0 to 24.1. ([\#17352](https://github.com/element-hq/synapse/issues/17352))
-* Bump phonenumbers from 8.13.37 to 8.13.39. ([\#17315](https://github.com/element-hq/synapse/issues/17315))
-* Bump regex from 1.10.4 to 1.10.5. ([\#17290](https://github.com/element-hq/synapse/issues/17290))
-* Bump requests from 2.31.0 to 2.32.2. ([\#17345](https://github.com/element-hq/synapse/issues/17345))
-* Bump sentry-sdk from 2.1.1 to 2.3.1. ([\#17263](https://github.com/element-hq/synapse/issues/17263))
-* Bump sentry-sdk from 2.3.1 to 2.6.0. ([\#17351](https://github.com/element-hq/synapse/issues/17351))
-* Bump tornado from 6.4 to 6.4.1. ([\#17344](https://github.com/element-hq/synapse/issues/17344))
-* Bump mypy from 1.8.0 to 1.9.0. ([\#17297](https://github.com/element-hq/synapse/issues/17297))
-* Bump types-jsonschema from 4.21.0.20240311 to 4.22.0.20240610. ([\#17288](https://github.com/element-hq/synapse/issues/17288))
-* Bump types-netaddr from 1.2.0.20240219 to 1.3.0.20240530. ([\#17314](https://github.com/element-hq/synapse/issues/17314))
-* Bump types-pillow from 10.2.0.20240423 to 10.2.0.20240520. ([\#17285](https://github.com/element-hq/synapse/issues/17285))
-* Bump types-pyyaml from 6.0.12.12 to 6.0.12.20240311. ([\#17316](https://github.com/element-hq/synapse/issues/17316))
-* Bump typing-extensions from 4.11.0 to 4.12.2. ([\#17354](https://github.com/element-hq/synapse/issues/17354))
-* Bump urllib3 from 2.0.7 to 2.2.2. ([\#17346](https://github.com/element-hq/synapse/issues/17346))
-
-# Synapse 1.109.0 (2024-06-18)
-
-### Internal Changes
-
- Fix the building of binary wheels for macOS by switching to macOS 12 CI runners. ([\#17319](https://github.com/element-hq/synapse/issues/17319))
-
-
-
-
-# Synapse 1.109.0rc3 (2024-06-17)
-
-### Bugfixes
-
- When rolling back to a previous Synapse version and then forwards again to this release, don't require server operators to manually run SQL. ([\#17305](https://github.com/element-hq/synapse/issues/17305), [\#17309](https://github.com/element-hq/synapse/issues/17309))
-
-### Internal Changes
-
- Use the release branch for sytest in release-branch PRs. ([\#17306](https://github.com/element-hq/synapse/issues/17306))
-
-
-
-
 # Synapse 1.109.0rc2 (2024-06-11)

 ### Bugfixes
@@ -67,9 +67,9 @@ checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"

 [[package]]
 name = "bytes"
-version = "1.6.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a12916984aab3fa6e39d655a33e09c0071eb36d6ab3aea5c2d78551f1df6d952"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"

 [[package]]
 name = "cfg-if"
@@ -212,9 +212,9 @@ dependencies = [

 [[package]]
 name = "lazy_static"
-version = "1.5.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
@@ -234,9 +234,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"

 [[package]]
 name = "memchr"
@@ -485,18 +485,18 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.204"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.204"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -505,9 +505,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.120"
+version = "1.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
+checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
 dependencies = [
 "itoa",
 "ryu",
@@ -597,9 +597,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"

 [[package]]
 name = "ulid"
-version = "1.1.3"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f903f293d11f31c0c29e4148f6dc0d033a7f80cebc0282bea147611667d289"
+checksum = "34778c17965aa2a08913b57e1f34db9b4a63f5de31768b55bf20d2795f921259"
 dependencies = [
 "getrandom",
 "rand",
@@ -1,34 +1,21 @@
-.. image:: ./docs/element_logo_white_bg.svg
-   :height: 60px
+=========================================================================
+Synapse |support| |development| |documentation| |license| |pypi| |python|
+=========================================================================

-**Element Synapse - Matrix homeserver implementation**
+Synapse is an open-source `Matrix <https://matrix.org/>`_ homeserver written and
+maintained by the Matrix.org Foundation. We began rapid development in 2014,
+reaching v1.0.0 in 2019. Development on Synapse and the Matrix protocol itself continues
+in earnest today.

-|support| |development| |documentation| |license| |pypi| |python|
-
-Synapse is an open source `Matrix <https://matrix.org>`__ homeserver
-implementation, written and maintained by `Element <https://element.io>`_.
-`Matrix <https://github.com/matrix-org>`__ is the open standard for
-secure and interoperable real time communications. You can directly run
-and manage the source code in this repository, available under an AGPL
-license. There is no support provided from Element unless you have a
-subscription.
-
-Subscription alternative
-========================
-
-Alternatively, for those that need an enterprise-ready solution, Element
-Server Suite (ESS) is `available as a subscription <https://element.io/pricing>`_.
-ESS builds on Synapse to offer a complete Matrix-based backend including the full
-`Admin Console product <https://element.io/enterprise-functionality/admin-console>`_,
-giving admins the power to easily manage an organization-wide
-deployment. It includes advanced identity management, auditing,
-moderation and data retention options as well as Long Term Support and
-SLAs. ESS can be used to support any Matrix-based frontend client.
+Briefly, Matrix is an open standard for communications on the internet, supporting
+federation, encryption and VoIP. Matrix.org has more to say about the `goals of the
+Matrix project <https://matrix.org/docs/guides/introduction>`_, and the `formal specification
+<https://spec.matrix.org/>`_ describes the technical details.

 .. contents::

-🛠️ Installing and configuration
-===============================
+Installing and configuration
+============================

 The Synapse documentation describes `how to install Synapse <https://element-hq.github.io/synapse/latest/setup/installation.html>`_. We recommend using
 `Docker images <https://element-hq.github.io/synapse/latest/setup/installation.html#docker-images-and-ansible-playbooks>`_ or `Debian packages from Matrix.org
@@ -118,8 +105,8 @@ Following this advice ensures that even if an XSS is found in Synapse, the
 impact to other applications will be minimal.


-🧪 Testing a new installation
-=============================
+Testing a new installation
+==========================

 The easiest way to try out your new Synapse installation is by connecting to it
 from a web client.
@@ -172,20 +159,8 @@ the form of::
 As when logging in, you will need to specify a "Custom server".  Specify your
 desired ``localpart`` in the 'User name' box.

-🎯 Troubleshooting and support
-==============================
-
-🚀 Professional support
-----------------------
-
-Enterprise quality support for Synapse including SLAs is available as part of an
-`Element Server Suite (ESS) <https://element.io/pricing>`_ subscription.
-
-If you are an existing ESS subscriber then you can raise a `support request <https://ems.element.io/support>`_
-and access the `knowledge base <https://ems-docs.element.io>`_.
-
-🤝 Community support
--------------------
+Troubleshooting and support
+===========================

 The `Admin FAQ <https://element-hq.github.io/synapse/latest/usage/administration/admin_faq.html>`_
 includes tips on dealing with some common problems. For more details, see
@@ -201,8 +176,8 @@ issues for support requests, only for bug reports and feature requests.
 .. |docs| replace:: ``docs``
 .. _docs: docs

-🪪 Identity Servers
-===================
+Identity Servers
+================

 Identity servers have the job of mapping email addresses and other 3rd Party
 IDs (3PIDs) to Matrix user IDs, as well as verifying the ownership of 3PIDs
@@ -231,8 +206,8 @@ an email address with your account, or send an invite to another user via their
 email address.


-🛠️ Development
-==============
+Development
+===========

 We welcome contributions to Synapse from the community!
 The best place to get started is our
@@ -250,8 +225,8 @@ Alongside all that, join our developer community on Matrix:
 `#synapse-dev:matrix.org <https://matrix.to/#/#synapse-dev:matrix.org>`_, featuring real humans!


-.. |support| image:: https://img.shields.io/badge/matrix-community%20support-success
-  :alt: (get community support in #synapse:matrix.org)
+.. |support| image:: https://img.shields.io/matrix/synapse:matrix.org?label=support&logo=matrix
+  :alt: (get support on #synapse:matrix.org)
  :target: https://matrix.to/#/#synapse:matrix.org

 .. |development| image:: https://img.shields.io/matrix/synapse-dev:matrix.org?label=development&logo=matrix
@@ -0,0 +1,2 @@
+Support [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/rav/authentication-for-media/proposals/3916-authentication-for-media.md)
+by adding a federation /download endpoint (#17172).
@@ -0,0 +1 @@
+Add initial implementation of an experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint.
@@ -0,0 +1 @@
+Fix searching for users with their exact localpart whose ID includes a hyphen.
@@ -0,0 +1 @@
+ Improve ratelimiting in Synapse (#17256).
@@ -0,0 +1 @@
+Use fully-qualified `PersistedEventPosition` when returning `RoomsForUser` to facilitate proper comparisons and `RoomStreamToken` generation.
@@ -0,0 +1 @@
+Add debug logging for when room keys are uploaded, including whether they are replacing other room keys.
@@ -0,0 +1 @@
+Add support for the unstable [MSC4151](https://github.com/matrix-org/matrix-spec-proposals/pull/4151) report room API.
@@ -0,0 +1 @@
+Handle OTK uploads off master.
@@ -0,0 +1 @@
+Fix wrong retention policy being used when filtering events.
@@ -0,0 +1 @@
+Don't try and resync devices for remote users whose servers are marked as down.
@@ -0,0 +1 @@
+Fix bug where OTKs were not always included in `/sync` response when using workers.
@@ -0,0 +1 @@
+Re-organize Pydantic models and types used in handlers.
@@ -0,0 +1 @@
+IGNORE.
@@ -1 +0,0 @@
-Track which rooms have been sent to clients in the experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint.
@@ -1 +0,0 @@
-Change sliding sync to use their own token format in preparation for storing per-connection state.
@@ -1 +0,0 @@
-Update the [`allowed_local_3pids`](https://element-hq.github.io/synapse/v1.112/usage/configuration/config_documentation.html#allowed_local_3pids) config option's msisdn address to a working example.
@@ -1 +0,0 @@
-Add Account Data extension support to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint.
@@ -1 +0,0 @@
-Ensure we don't send down negative `bump_stamp` in experimental sliding sync endpoint.
@@ -1 +0,0 @@
-Do not send down empty room entries down experimental sliding sync endpoint.
@@ -1 +0,0 @@
-Refactor Sliding Sync tests to better utilize the `SlidingSyncBase`.
@@ -1 +0,0 @@
-Refactor Sliding Sync tests to better utilize the `SlidingSyncBase`.
@@ -1 +0,0 @@
-Fix a bug introduced in v1.110.0 which caused `/keys/query` to return incomplete results, leading to high network activity and CPU usage on Matrix clients.
@@ -1 +0,0 @@
-Add some opentracing tags and logging to the experimental sliding sync implementation.
@@ -1 +0,0 @@
-Handle requests for more events in a room when using experimental sliding sync.
@@ -1,64 +1,3 @@
-matrix-synapse-py3 (1.112.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.112.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 23 Jul 2024 08:58:55 -0600
-
-matrix-synapse-py3 (1.111.0) stable; urgency=medium
-
-  * New Synapse release 1.111.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 16 Jul 2024 12:42:46 +0200
-
-matrix-synapse-py3 (1.111.0~rc2) stable; urgency=medium
-
-  * New synapse release 1.111.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 10 Jul 2024 08:46:54 +0000
-
-matrix-synapse-py3 (1.111.0~rc1) stable; urgency=medium
-
-  * New synapse release 1.111.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 09 Jul 2024 09:49:25 +0000
-
-matrix-synapse-py3 (1.110.0) stable; urgency=medium
-
-  * New Synapse release 1.110.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 03 Jul 2024 09:08:59 -0600
-
-matrix-synapse-py3 (1.110.0~rc3) stable; urgency=medium
-
-  * New Synapse release 1.110.0rc3.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 02 Jul 2024 08:28:56 -0600
-
-matrix-synapse-py3 (1.110.0~rc2) stable; urgency=medium
-
-  * New Synapse release 1.110.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 26 Jun 2024 18:14:48 +0200
-
-matrix-synapse-py3 (1.110.0~rc1) stable; urgency=medium
-
-  * `register_new_matrix_user` now supports a --password-file and a --exists-ok flag.
-  * New Synapse release 1.110.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 26 Jun 2024 14:07:56 +0200
-
-matrix-synapse-py3 (1.109.0) stable; urgency=medium
-
-  * New synapse release 1.109.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 18 Jun 2024 09:45:15 +0000
-
-matrix-synapse-py3 (1.109.0~rc3) stable; urgency=medium
-
-  * New synapse release 1.109.0rc3.
-
- -- Synapse Packaging team <packages@matrix.org>  Mon, 17 Jun 2024 12:05:24 +0000
-
 matrix-synapse-py3 (1.109.0~rc2) stable; urgency=medium

  * New synapse release 1.109.0rc2.
@@ -31,12 +31,8 @@ A sample YAML file accepted by `register_new_matrix_user` is described below:
    Local part of the new user. Will prompt if omitted.

  * `-p`, `--password`:
-    New password for user. Will prompt if this option and `--password-file` are omitted.
-    Supplying the password on the command line is not recommended.
-
-  * `--password-file`:
-    File containing the new password for user. If set, overrides `--password`.
-    This is a more secure alternative to specifying the password on the command line.
+    New password for user. Will prompt if omitted. Supplying the password
+    on the command line is not recommended. Use the STDIN instead.

  * `-a`, `--admin`:
    Register new user as an admin. Will prompt if omitted.
@@ -48,9 +44,6 @@ A sample YAML file accepted by `register_new_matrix_user` is described below:
    Shared secret as defined in server config file. This is an optional
    parameter as it can be also supplied via the YAML file.

-  * `--exists-ok`:
-    Do not fail if the user already exists. The user account will be not updated in this case.
-
  * `server_url`:
    URL of the home server. Defaults to 'https://localhost:8448'.

@@ -5,7 +5,7 @@ _Description: Name of the server:
 servers via federation. This is normally the public hostname of the
 server running synapse, but can be different if you set up delegation.
 Please refer to the delegation documentation in this case:
- https://element-hq.github.io/synapse/latest/delegate.html.
+ https://github.com/element-hq/synapse/blob/master/docs/delegate.md.

 Template: matrix-synapse/report-stats
 Type: boolean
@@ -27,7 +27,7 @@ ARG PYTHON_VERSION=3.11
 ###
 # We hardcode the use of Debian bookworm here because this could change upstream
 # and other Dockerfiles used for testing are expecting bookworm.
-FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm AS requirements
+FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm as requirements

 # RUN --mount is specific to buildkit and is documented at
 # https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/syntax.md#build-mounts-run---mount.
@@ -87,7 +87,7 @@ RUN if [ -z "$TEST_ONLY_IGNORE_POETRY_LOCKFILE" ]; then \
 ###
 ### Stage 1: builder
 ###
-FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm AS builder
+FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm as builder

 # install the OS build deps
 RUN \
@@ -24,7 +24,7 @@ ARG distro=""
 # https://launchpad.net/~jyrki-pulliainen/+archive/ubuntu/dh-virtualenv, but
 # it's not obviously easier to use that than to build our own.)

-FROM docker.io/library/${distro} AS builder
+FROM docker.io/library/${distro} as builder

 RUN apt-get update -qq -o Acquire::Languages=none
 RUN env DEBIAN_FRONTEND=noninteractive apt-get install \
@@ -73,8 +73,6 @@ RUN apt-get update -qq -o Acquire::Languages=none \
    curl \
    debhelper \
    devscripts \
-    # Required for building cffi from source.
-    libffi-dev \
    libsystemd-dev \
    lsb-release \
    pkg-config \
@@ -11,9 +11,6 @@ DIST=$(cut -d ':' -f2 <<< "${distro:?}")
 cp -aT /synapse/source /synapse/build
 cd /synapse/build

-# Delete any existing `.so` files to ensure a clean build.
-rm -f /synapse/build/synapse/*.so
-
 # if this is a prerelease, set the Section accordingly.
 #
 # When the package is later added to the package repo, reprepro will use the
@@ -105,6 +105,8 @@ experimental_features:
  # Expose a room summary for public rooms
  msc3266_enabled: true

+  msc4115_membership_on_events: true
+
 server_notices:
  system_mxid_localpart: _server
  system_mxid_display_name: "Server Alert"
@@ -176,6 +176,7 @@ app_service_config_files:
 {% endif %}

 macaroon_secret_key: "{{ SYNAPSE_MACAROON_SECRET_KEY }}"
+expire_access_token: False

 ## Signing Keys ##

@@ -117,7 +117,7 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
    },
    "media_repository": {
        "app": "synapse.app.generic_worker",
-        "listener_resources": ["media", "client"],
+        "listener_resources": ["media"],
        "endpoint_patterns": [
            "^/_matrix/media/",
            "^/_synapse/admin/v1/purge_media_cache$",
@@ -125,8 +125,6 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
            "^/_synapse/admin/v1/user/.*/media.*$",
            "^/_synapse/admin/v1/media/.*$",
            "^/_synapse/admin/v1/quarantine_media/.*$",
-            "^/_matrix/client/v1/media/.*$",
-            "^/_matrix/federation/v1/media/.*$",
        ],
        # The first configured media worker will run the media background jobs
        "shared_extra_conf": {
@@ -1,17 +1,21 @@
 # Experimental Features API

 This API allows a server administrator to enable or disable some experimental features on a per-user
-basis. The currently supported features are:
- [MSC3881](https://github.com/matrix-org/matrix-spec-proposals/pull/3881): enable remotely toggling push notifications
-for another client
- [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575): enable experimental sliding sync support
+basis. The currently supported features are: 
+- [MSC3026](https://github.com/matrix-org/matrix-spec-proposals/pull/3026): busy 
+presence state enabled
+- [MSC3881](https://github.com/matrix-org/matrix-spec-proposals/pull/3881): enable remotely toggling push notifications 
+for another client 
+- [MSC3967](https://github.com/matrix-org/matrix-spec-proposals/pull/3967): do not require
+UIA when first uploading cross-signing keys. 
+

 To use it, you will need to authenticate by providing an `access_token`
 for a server admin: see [Admin API](../usage/administration/admin_api/).

 ## Enabling/Disabling Features

-This API allows a server administrator to enable experimental features for a given user. The request must
+This API allows a server administrator to enable experimental features for a given user. The request must 
 provide a body containing the user id and listing the features to enable/disable in the following format:
 ```json
 {
@@ -31,7 +35,7 @@ PUT /_synapse/admin/v1/experimental_features/<user_id>
 ```

 ## Listing Enabled Features
-
+ 
 To list which features are enabled/disabled for a given user send a request to the following API:

 ```
@@ -48,4 +52,4 @@ user like so:
      "msc3967": false
   }
 }
-```
+```
@@ -36,10 +36,6 @@ The following query parameters are available:
  - the room's name,
  - the local part of the room's canonical alias, or
  - the complete (local and server part) room's id (case sensitive).
-* `public_rooms` - Optional flag to filter public rooms. If `true`, only public rooms are queried. If `false`, public rooms are excluded from
-  the query. When the flag is absent (the default), **both** public and non-public rooms are included in the search results.
-* `empty_rooms` - Optional flag to filter empty rooms. A room is empty if joined_members is zero. If `true`, only empty rooms are queried. If `false`, empty rooms are excluded from
-  the query. When the flag is absent (the default), **both** empty and non-empty rooms are included in the search results.

  Defaults to no filtering.

@@ -449,9 +449,9 @@ For example, a fix in PR #1234 would have its changelog entry in
 > The security levels of Florbs are now validated when received
 > via the `/federation/florb` endpoint. Contributed by Jane Matrix.

-If there are multiple pull requests involved in a single bugfix/feature/etc, then the
-content for each `changelog.d` file and file extension should be the same. Towncrier
-will merge the matching files together into a single changelog entry when we come to
+If there are multiple pull requests involved in a single bugfix/feature/etc,
+then the content for each `changelog.d` file should be the same. Towncrier will
+merge the matching files together into a single changelog entry when we come to
 release.

 ### How do I know what to call the changelog file before I create the PR?
@@ -1,94 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   width="41.440346mm"
-   height="10.383124mm"
-   viewBox="0 0 41.440346 10.383125"
-   version="1.1"
-   id="svg1"
-   xml:space="preserve"
-   sodipodi:docname="element_logo_white_bg.svg"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:svg="http://www.w3.org/2000/svg"><sodipodi:namedview
-     id="namedview1"
-     pagecolor="#ffffff"
-     bordercolor="#000000"
-     borderopacity="0.25"
-     inkscape:showpageshadow="2"
-     inkscape:pageopacity="0.0"
-     inkscape:pagecheckerboard="0"
-     inkscape:deskcolor="#d1d1d1"
-     inkscape:document-units="mm"
-     showgrid="false"
-     inkscape:export-bgcolor="#ffffffff" /><defs
-     id="defs1" /><g
-     id="layer1"
-     transform="translate(-84.803844,-143.2075)"
-     inkscape:export-filename="element_logo_white_bg.svg"
-     inkscape:export-xdpi="96"
-     inkscape:export-ydpi="96"><g
-       style="fill:none"
-       id="g1"
-       transform="matrix(0.26458333,0,0,0.26458333,85.841658,144.26667)"><rect
-         style="display:inline;fill:#ffffff;fill-opacity:1;stroke:#ffffff;stroke-width:1.31041;stroke-dasharray:none;stroke-opacity:1"
-         id="rect20"
-         width="155.31451"
-         height="37.932892"
-         x="-3.2672384"
-         y="-3.3479743"
-         rx="3.3718522"
-         ry="3.7915266"
-         transform="translate(-2.1259843e-6)"
-         inkscape:label="rect20"
-         inkscape:export-filename="rect20.svg"
-         inkscape:export-xdpi="96"
-         inkscape:export-ydpi="96" /><path
-         fill-rule="evenodd"
-         clip-rule="evenodd"
-         d="M 16,32 C 24.8366,32 32,24.8366 32,16 32,7.16344 24.8366,0 16,0 7.16344,0 0,7.16344 0,16 0,24.8366 7.16344,32 16,32 Z"
-         fill="#0dbd8b"
-         id="path1" /><path
-         fill-rule="evenodd"
-         clip-rule="evenodd"
-         d="m 13.0756,7.455 c 0,-0.64584 0.5247,-1.1694 1.1719,-1.1694 4.3864,0 7.9423,3.54853 7.9423,7.9259 0,0.6458 -0.5246,1.1694 -1.1718,1.1694 -0.6472,0 -1.1719,-0.5236 -1.1719,-1.1694 0,-3.0857 -2.5066,-5.58711 -5.5986,-5.58711 -0.6472,0 -1.1719,-0.52355 -1.1719,-1.16939 z"
-         fill="#ffffff"
-         id="path2" /><path
-         fill-rule="evenodd"
-         clip-rule="evenodd"
-         d="m 24.5424,13.042 c 0.6472,0 1.1719,0.5235 1.1719,1.1694 0,4.3773 -3.5559,7.9258 -7.9424,7.9258 -0.6472,0 -1.1718,-0.5235 -1.1718,-1.1693 0,-0.6459 0.5246,-1.1694 1.1718,-1.1694 3.0921,0 5.5987,-2.5015 5.5987,-5.5871 0,-0.6459 0.5247,-1.1694 1.1718,-1.1694 z"
-         fill="#ffffff"
-         id="path3" /><path
-         fill-rule="evenodd"
-         clip-rule="evenodd"
-         d="m 18.9446,24.5446 c 0,0.6459 -0.5247,1.1694 -1.1718,1.1694 -4.3865,0 -7.94239,-3.5485 -7.94239,-7.9258 0,-0.6459 0.52469,-1.1694 1.17179,-1.1694 0.6472,0 1.1719,0.5235 1.1719,1.1694 0,3.0856 2.5066,5.587 5.5987,5.587 0.6471,0 1.1718,0.5236 1.1718,1.1694 z"
-         fill="#ffffff"
-         id="path4" /><path
-         fill-rule="evenodd"
-         clip-rule="evenodd"
-         d="m 7.45823,18.9576 c -0.64718,0 -1.17183,-0.5235 -1.17183,-1.1694 0,-4.3773 3.55591,-7.92581 7.9423,-7.92581 0.6472,0 1.1719,0.52351 1.1719,1.16941 0,0.6458 -0.5247,1.1694 -1.1719,1.1694 -3.092,0 -5.59864,2.5014 -5.59864,5.587 0,0.6459 -0.52465,1.1694 -1.17183,1.1694 z"
-         fill="#ffffff"
-         id="path5" /><path
-         d="M 56.2856,18.1428 H 44.9998 c 0.1334,1.181 0.5619,2.1238 1.2858,2.8286 0.7238,0.6857 1.6761,1.0286 2.8571,1.0286 0.7809,0 1.4857,-0.1905 2.1143,-0.5715 0.6286,-0.3809 1.0762,-0.8952 1.3428,-1.5428 h 3.4286 c -0.4571,1.5047 -1.3143,2.7238 -2.5714,3.6571 -1.2381,0.9143 -2.7048,1.3715 -4.4,1.3715 -2.2095,0 -4,-0.7334 -5.3714,-2.2 -1.3524,-1.4667 -2.0286,-3.3239 -2.0286,-5.5715 0,-2.1905 0.6857,-4.0285 2.0571,-5.5143 1.3715,-1.4857 3.1429,-2.22853 5.3143,-2.22853 2.1714,0 3.9238,0.73333 5.2572,2.20003 1.3523,1.4476 2.0285,3.2762 2.0285,5.4857 z m -7.2572,-5.9714 c -1.0667,0 -1.9524,0.3143 -2.6571,0.9429 -0.7048,0.6285 -1.1429,1.4666 -1.3143,2.5142 h 7.8857 c -0.1524,-1.0476 -0.5714,-1.8857 -1.2571,-2.5142 -0.6858,-0.6286 -1.5715,-0.9429 -2.6572,-0.9429 z"
-         fill="#000000"
-         id="path6" /><path
-         d="M 58.6539,20.1428 V 3.14282 h 3.4 V 20.2 c 0,0.7619 0.419,1.1428 1.2571,1.1428 l 0.6,-0.0285 v 3.2285 c -0.3238,0.0572 -0.6667,0.0857 -1.0286,0.0857 -1.4666,0 -2.5428,-0.3714 -3.2285,-1.1142 -0.6667,-0.7429 -1,-1.8667 -1,-3.3715 z"
-         fill="#000000"
-         id="path7" /><path
-         d="M 79.7454,18.1428 H 68.4597 c 0.1333,1.181 0.5619,2.1238 1.2857,2.8286 0.7238,0.6857 1.6762,1.0286 2.8571,1.0286 0.781,0 1.4857,-0.1905 2.1143,-0.5715 0.6286,-0.3809 1.0762,-0.8952 1.3429,-1.5428 h 3.4285 c -0.4571,1.5047 -1.3143,2.7238 -2.5714,3.6571 -1.2381,0.9143 -2.7048,1.3715 -4.4,1.3715 -2.2095,0 -4,-0.7334 -5.3714,-2.2 -1.3524,-1.4667 -2.0286,-3.3239 -2.0286,-5.5715 0,-2.1905 0.6857,-4.0285 2.0571,-5.5143 1.3715,-1.4857 3.1429,-2.22853 5.3143,-2.22853 2.1715,0 3.9238,0.73333 5.2572,2.20003 1.3524,1.4476 2.0285,3.2762 2.0285,5.4857 z m -7.2572,-5.9714 c -1.0666,0 -1.9524,0.3143 -2.6571,0.9429 -0.7048,0.6285 -1.1429,1.4666 -1.3143,2.5142 h 7.8857 c -0.1524,-1.0476 -0.5714,-1.8857 -1.2571,-2.5142 -0.6857,-0.6286 -1.5715,-0.9429 -2.6572,-0.9429 z"
-         fill="#000000"
-         id="path8" /><path
-         d="m 95.0851,16.0571 v 8.5143 h -3.4 v -8.8857 c 0,-2.2476 -0.9333,-3.3714 -2.8,-3.3714 -1.0095,0 -1.819,0.3238 -2.4286,0.9714 -0.5904,0.6476 -0.8857,1.5333 -0.8857,2.6571 v 8.6286 h -3.4 V 9.74282 h 3.1429 v 1.97148 c 0.3619,-0.6667 0.9143,-1.2191 1.6571,-1.6572 0.7429,-0.43809 1.6667,-0.65713 2.7714,-0.65713 2.0572,0 3.5429,0.78093 4.4572,2.34283 1.2571,-1.5619 2.9333,-2.34283 5.0286,-2.34283 1.733,0 3.067,0.54285 4,1.62853 0.933,1.0667 1.4,2.4762 1.4,4.2286 v 9.3143 h -3.4 v -8.8857 c 0,-2.2476 -0.933,-3.3714 -2.8,-3.3714 -1.0286,0 -1.8477,0.3333 -2.4572,1 -0.5905,0.6476 -0.8857,1.5619 -0.8857,2.7428 z"
-         fill="#000000"
-         id="path9" /><path
-         d="m 121.537,18.1428 h -11.286 c 0.133,1.181 0.562,2.1238 1.286,2.8286 0.723,0.6857 1.676,1.0286 2.857,1.0286 0.781,0 1.486,-0.1905 2.114,-0.5715 0.629,-0.3809 1.076,-0.8952 1.343,-1.5428 h 3.429 c -0.458,1.5047 -1.315,2.7238 -2.572,3.6571 -1.238,0.9143 -2.705,1.3715 -4.4,1.3715 -2.209,0 -4,-0.7334 -5.371,-2.2 -1.353,-1.4667 -2.029,-3.3239 -2.029,-5.5715 0,-2.1905 0.686,-4.0285 2.057,-5.5143 1.372,-1.4857 3.143,-2.22853 5.315,-2.22853 2.171,0 3.923,0.73333 5.257,2.20003 1.352,1.4476 2.028,3.2762 2.028,5.4857 z m -7.257,-5.9714 c -1.067,0 -1.953,0.3143 -2.658,0.9429 -0.704,0.6285 -1.142,1.4666 -1.314,2.5142 h 7.886 c -0.153,-1.0476 -0.572,-1.8857 -1.257,-2.5142 -0.686,-0.6286 -1.572,-0.9429 -2.657,-0.9429 z"
-         fill="#000000"
-         id="path10" /><path
-         d="m 127.105,9.74282 v 1.97148 c 0.343,-0.6477 0.905,-1.1905 1.686,-1.6286 0.8,-0.45716 1.762,-0.68573 2.885,-0.68573 1.753,0 3.105,0.53333 4.058,1.60003 0.971,1.0666 1.457,2.4857 1.457,4.2571 v 9.3143 h -3.4 v -8.8857 c 0,-1.0476 -0.248,-1.8667 -0.743,-2.4572 -0.476,-0.6095 -1.21,-0.9142 -2.2,-0.9142 -1.086,0 -1.943,0.3238 -2.572,0.9714 -0.609,0.6476 -0.914,1.5428 -0.914,2.6857 v 8.6 h -3.4 V 9.74282 Z"
-         fill="#000000"
-         id="path11" /><path
-         d="m 147.12,21.5428 v 2.9429 c -0.419,0.1143 -1.009,0.1714 -1.771,0.1714 -2.895,0 -4.343,-1.4571 -4.343,-4.3714 v -7.8286 h -2.257 V 9.74282 h 2.257 V 5.88568 h 3.4 v 3.85714 h 2.772 v 2.71428 h -2.772 v 7.4857 c 0,1.1619 0.552,1.7429 1.657,1.7429 z"
-         fill="#000000"
-         id="path12" /></g></g></svg>
@@ -255,3 +255,13 @@ however extreme care must be taken to avoid database corruption.

 Note that the above may fail with an error about duplicate rows if corruption
 has already occurred, and such duplicate rows will need to be manually removed.
+
+### Fixing inconsistent sequences error
+
+Synapse uses Postgres sequences to generate IDs for various tables. A sequence
+and associated table can get out of sync if, for example, Synapse has been
+downgraded and then upgraded again.
+
+To fix the issue shut down Synapse (including any and all workers) and run the
+SQL command included in the error message. Once done Synapse should start
+successfully.
@@ -67,7 +67,7 @@ in Synapse can be deactivated.
 **NOTE**: This has an impact on security and is for testing purposes only!

 To deactivate the certificate validation, the following setting must be added to
-your [homeserver.yaml](../usage/configuration/homeserver_sample_config.md).
+your [homserver.yaml](../usage/configuration/homeserver_sample_config.md).

 ```yaml
 use_insecure_ssl_client_just_for_testing_do_not_use: true
@@ -309,62 +309,7 @@ sudo dnf install libtiff-devel libjpeg-devel libzip-devel freetype-devel \
                 libwebp-devel libxml2-devel libxslt-devel libpq-devel \
                 python3-virtualenv libffi-devel openssl-devel python3-devel \
                 libicu-devel
-sudo dnf group install "Development Tools"
-```
-
-##### Red Hat Enterprise Linux / Rocky Linux
-
-*Note: The term "RHEL" below refers to both Red Hat Enterprise Linux and Rocky Linux. The distributions are 1:1 binary compatible.*
-
-It's recommended to use the latest Python versions. 
-
-RHEL 8 in particular ships with Python 3.6 by default which is EOL and therefore no longer supported by Synapse. RHEL 9 ship with Python 3.9 which is still supported by the Python core team as of this writing. However, newer Python versions provide significant performance improvements and they're available in official distributions' repositories. Therefore it's recommended to use them.
-
-Python 3.11 and 3.12 are available for both RHEL 8 and 9.
-
-These commands should be run as root user.
-
-RHEL 8
-```bash
-# Enable PowerTools repository
-dnf config-manager --set-enabled powertools
-```
-RHEL 9
-```bash
-# Enable CodeReady Linux Builder repository
-crb enable
-```
-
-Install new version of Python. You only need one of these:
-```bash
-# Python 3.11
-dnf install python3.11 python3.11-devel
-```
-```bash
-# Python 3.12
-dnf install python3.12 python3.12-devel
-```
-Finally, install common prerequisites
-```bash
-dnf install libicu libicu-devel libpq5 libpq5-devel lz4 pkgconf 
-dnf group install "Development Tools"
-```
-###### Using venv module instead of virtualenv command
-
-It's recommended to use Python venv module directly rather than the virtualenv command.
-* On RHEL 9, virtualenv is only available on [EPEL](https://docs.fedoraproject.org/en-US/epel/).
-* On RHEL 8, virtualenv is based on Python 3.6. It does not support creating 3.11/3.12 virtual environments.
-
-Here's an example of creating Python 3.12 virtual environment and installing Synapse from PyPI. 
-
-```bash
-mkdir -p ~/synapse
-# To use Python 3.11, simply use the command "python3.11" instead.
-python3.12 -m venv ~/synapse/env
-source ~/synapse/env/bin/activate
-pip install --upgrade pip
-pip install --upgrade setuptools
-pip install matrix-synapse
+sudo dnf groupinstall "Development Tools"
 ```

 ##### macOS
@@ -117,20 +117,6 @@ each upgrade are complete before moving on to the next upgrade, to avoid
 stacking them up. You can monitor the currently running background updates with
 [the Admin API](usage/administration/admin_api/background_updates.html#status).

-# Upgrading to v1.111.0
-
-## New worker endpoints for authenticated client and federation media
-
-[Media repository workers](./workers.md#synapseappmedia_repository) handling
-Media APIs can now handle the following endpoint patterns:
-
-```
-^/_matrix/client/v1/media/.*$
-^/_matrix/federation/v1/media/.*$
-```
-
-Please update your reverse proxy configuration.
-
 # Upgrading to v1.106.0

 ## Minimum supported Rust version
@@ -246,7 +246,6 @@ Example configuration:
 ```yaml
 presence:
  enabled: false
-  include_offline_users_on_sync: false
 ```

 `enabled` can also be set to a special value of "untracked" which ignores updates
@@ -255,10 +254,6 @@ received via clients and federation, while still accepting updates from the

 *The "untracked" option was added in Synapse 1.96.0.*

-When clients perform an initial or `full_state` sync, presence results for offline users are
-not included by default. Setting `include_offline_users_on_sync` to `true` will always include
-offline users in the results. Defaults to false.
-
 ---
 ### `require_auth_for_profile_requests`

@@ -1764,9 +1759,8 @@ rc_3pid_validation:
 ### `rc_invites`

 This option sets ratelimiting how often invites can be sent in a room or to a
-specific user. `per_room` defaults to `per_second: 0.3`, `burst_count: 10`,
-`per_user` defaults to `per_second: 0.003`, `burst_count: 5`, and `per_issuer` 
-defaults to `per_second: 0.3`, `burst_count: 10`.
+specific user. `per_room` defaults to `per_second: 0.3`, `burst_count: 10` and
+`per_user` defaults to `per_second: 0.003`, `burst_count: 5`.

 Client requests that invite user(s) when [creating a
 room](https://spec.matrix.org/v1.2/client-server-api/#post_matrixclientv3createroom)
@@ -1868,18 +1862,6 @@ federation_rr_transactions_per_room_per_second: 40
 ## Media Store
 Config options related to Synapse's media store.

---
-### `enable_authenticated_media`
-
-When set to true, all subsequent media uploads will be marked as authenticated, and will not be available over legacy
-unauthenticated media endpoints (`/_matrix/media/(r0|v3|v1)/download` and `/_matrix/media/(r0|v3|v1)/thumbnail`) - requests for authenticated media over these endpoints will result in a 404. All media, including authenticated media, will be available over the authenticated media endpoints `_matrix/client/v1/media/download` and `_matrix/client/v1/media/thumbnail`. Media uploaded prior to setting this option to true will still be available over the legacy endpoints. Note if the setting is switched to false
-after enabling, media marked as authenticated will be available over legacy endpoints. Defaults to false, but
-this will change to true in a future Synapse release.
-
-Example configuration:
-```yaml
-enable_authenticated_media: true
-```
 ---
 ### `enable_media_repo`

@@ -1993,10 +1975,9 @@ This will not prevent the listed domains from accessing media themselves.
 It simply prevents users on this server from downloading media originating
 from the listed servers.

-This will have no effect on media originating from the local server. This only
-affects media downloaded from other Matrix servers, to control URL previews see
-[`url_preview_ip_range_blacklist`](#url_preview_ip_range_blacklist) or
-[`url_preview_url_blacklist`](#url_preview_url_blacklist).
+This will have no effect on media originating from the local server.
+This only affects media downloaded from other Matrix servers, to
+block domains from URL previews see [`url_preview_url_blacklist`](#url_preview_url_blacklist).

 Defaults to an empty list (nothing blocked).

@@ -2148,14 +2129,12 @@ url_preview_ip_range_whitelist:
 ---
 ### `url_preview_url_blacklist`

-Optional list of URL matches that the URL preview spider is denied from
-accessing.  This is a usability feature, not a security one. You should use
-`url_preview_ip_range_blacklist` in preference to this, otherwise someone could
-define a public DNS entry that points to a private IP address and circumvent
-the blacklist. Applications that perform redirects or serve different content
-when detecting that Synapse is accessing them can also bypass the blacklist.
-This is more useful if you know there is an entire shape of URL that you know
-that you do not want Synapse to preview.
+Optional list of URL matches that the URL preview spider is
+denied from accessing.  You should use `url_preview_ip_range_blacklist`
+in preference to this, otherwise someone could define a public DNS
+entry that points to a private IP address and circumvent the blacklist.
+This is more useful if you know there is an entire shape of URL that
+you know that will never want synapse to try to spider.

 Each list entry is a dictionary of url component attributes as returned
 by urlparse.urlsplit as applied to the absolute form of the URL.  See
@@ -2386,7 +2365,7 @@ enable_registration_without_verification: true
 ---
 ### `registrations_require_3pid`

-If this is set, users must provide all of the specified types of [3PID](https://spec.matrix.org/latest/appendices/#3pid-types) when registering an account.
+If this is set, users must provide all of the specified types of 3PID when registering an account.

 Note that [`enable_registration`](#enable_registration) must also be set to allow account registration.

@@ -2411,9 +2390,6 @@ disable_msisdn_registration: true

 Mandate that users are only allowed to associate certain formats of
 3PIDs with accounts on this server, as specified by the `medium` and `pattern` sub-options.
-`pattern` is a [Perl-like regular expression](https://docs.python.org/3/library/re.html#module-re).
-
-More information about 3PIDs, allowed `medium` types and their `address` syntax can be found [in the Matrix spec](https://spec.matrix.org/latest/appendices/#3pid-types).

 Example configuration:
 ```yaml
@@ -2423,7 +2399,7 @@ allowed_local_3pids:
  - medium: email
    pattern: '^[^@]+@vector\.im$'
  - medium: msisdn
-    pattern: '^44\d{10}$'
+    pattern: '\+44'
 ```
 ---
 ### `enable_3pid_lookup`
@@ -2742,7 +2718,7 @@ Example configuration:
 session_lifetime: 24h
 ```
 ---
-### `refreshable_access_token_lifetime`
+### `refresh_access_token_lifetime`

 Time that an access token remains valid for, if the session is using refresh tokens.

@@ -3830,8 +3806,7 @@ This setting defines options related to the user directory.
 This option has the following sub-options:
 * `enabled`:  Defines whether users can search the user directory. If false then
   empty responses are returned to all queries. Defaults to true.
-* `search_all_users`: Defines whether to search all users visible to your homeserver at the time the search is performed.
-   If set to true, will return all users known to the homeserver matching the search query.
+* `search_all_users`: Defines whether to search all users visible to your HS at the time the search is performed. If set to true, will return all users who share a room with the user from the homeserver.
   If false, search results will only contain users
    visible in public rooms and users sharing a room with the requester.
    Defaults to false.
@@ -4154,38 +4129,6 @@ default_power_level_content_override:
   trusted_private_chat: null
   public_chat: null
 ```
-
-The default power levels for each preset are:
-```yaml
-"m.room.name": 50
-"m.room.power_levels": 100
-"m.room.history_visibility": 100
-"m.room.canonical_alias": 50
-"m.room.avatar": 50
-"m.room.tombstone": 100
-"m.room.server_acl": 100
-"m.room.encryption": 100
-```
-
-So a complete example where the default power-levels for a preset are maintained
-but the power level for a new key is set is:
-```yaml
-default_power_level_content_override:
-   private_chat:
-    events:
-      "com.example.foo": 0
-      "m.room.name": 50
-      "m.room.power_levels": 100
-      "m.room.history_visibility": 100
-      "m.room.canonical_alias": 50
-      "m.room.avatar": 50
-      "m.room.tombstone": 100
-      "m.room.server_acl": 100
-      "m.room.encryption": 100
-   trusted_private_chat: null
-   public_chat: null
-```
-
 ---
 ### `forget_rooms_on_leave`

@@ -4207,7 +4150,7 @@ By default, no room is excluded.
 Example configuration:
 ```yaml
 exclude_rooms_from_sync:
-    - "!foo:example.com"
+    - !foo:example.com
 ```

 ---
@@ -62,6 +62,6 @@ following documentation:

 ## Reporting a security vulnerability

-If you've found a security issue in Synapse or any other Element project,
-please report it to us in accordance with our [Security Disclosure
-Policy](https://element.io/security/security-disclosure-policy). Thank you!
+If you've found a security issue in Synapse or any other Matrix.org Foundation
+project, please report it to us in accordance with our [Security Disclosure
+Policy](https://www.matrix.org/security-disclosure-policy/). Thank you!
@@ -739,8 +739,6 @@ An example for a federation sender instance:
 Handles the media repository. It can handle all endpoints starting with:

    /_matrix/media/
-    /_matrix/client/v1/media/
-    /_matrix/federation/v1/media/

 ... and the following regular expressions matching media-specific administration APIs:

@@ -96,6 +96,3 @@ ignore_missing_imports = True
 # https://github.com/twisted/treq/pull/366
 [mypy-treq.*]
 ignore_missing_imports = True
-
-[mypy-multipart.*]
-ignore_missing_imports = True
@@ -43,7 +43,6 @@ target-version = ['py38', 'py39', 'py310', 'py311']
 [tool.ruff]
 line-length = 88

-[tool.ruff.lint]
 # See https://beta.ruff.rs/docs/rules/#error-e
 # for error codes. The ones we ignore are:
 #  E501: Line too long (black enforces this for us)
@@ -97,7 +96,7 @@ module-name = "synapse.synapse_rust"

 [tool.poetry]
 name = "matrix-synapse"
-version = "1.112.0rc1"
+version = "1.109.0rc2"
 description = "Homeserver for the Matrix decentralised comms protocol"
 authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
 license = "AGPL-3.0-or-later"
@@ -201,8 +200,8 @@ netaddr = ">=0.7.18"
 # add a lower bound to the Jinja2 dependency.
 Jinja2 = ">=3.0"
 bleach = ">=1.4.3"
-# We use `assert_never`, which were added in `typing-extensions` 4.1.
-typing-extensions = ">=4.1"
+# We use `Self`, which were added in `typing-extensions` 4.0.
+typing-extensions = ">=4.0"
 # We enforce that we have a `cryptography` version that bundles an `openssl`
 # with the latest security patches.
 cryptography = ">=3.4.7"
@@ -225,8 +224,6 @@ pydantic = ">=1.7.4, <3"
 # needed.
 setuptools_rust = ">=1.3"

-# This is used for parsing multipart responses
-python-multipart = ">=0.0.9"

 # Optional Dependencies
 # ---------------------
@@ -322,7 +319,7 @@ all = [
 # This helps prevents merge conflicts when running a batch of dependabot updates.
 isort = ">=5.10.1"
 black = ">=22.7.0"
-ruff = "0.5.5"
+ruff = "0.3.7"
 # Type checking only works with the pydantic.v1 compat module from pydantic v2
 pydantic = "^2"

@@ -204,8 +204,6 @@ pub struct EventInternalMetadata {
    /// The stream ordering of this event. None, until it has been persisted.
    #[pyo3(get, set)]
    stream_ordering: Option<NonZeroI64>,
-    #[pyo3(get, set)]
-    instance_name: Option<String>,

    /// whether this event is an outlier (ie, whether we have the state at that
    /// point in the DAG)
@@ -234,7 +232,6 @@ impl EventInternalMetadata {
        Ok(EventInternalMetadata {
            data,
            stream_ordering: None,
-            instance_name: None,
            outlier: false,
        })
    }
@@ -223,6 +223,7 @@ test_packages=(
    ./tests/msc3930
    ./tests/msc3902
    ./tests/msc3967
+    ./tests/msc4115
 )

 # Enable dirty runs, so tests will reuse the same container where possible.
@@ -112,7 +112,7 @@ python3 -m black "${files[@]}"

 # Catch any common programming mistakes in Python code.
 # --quiet suppresses the update check.
-ruff check --quiet --fix "${files[@]}"
+ruff --quiet --fix "${files[@]}"

 # Catch any common programming mistakes in Rust code.
 #
@@ -70,7 +70,6 @@ def cli() -> None:
            pip install -e .[dev]

      - A checkout of the sytest repository at ../sytest
-      - A checkout of the complement repository at ../complement

    Then to use:

@@ -113,12 +112,10 @@ def _prepare() -> None:
    # Make sure we're in a git repo.
    synapse_repo = get_repo_and_check_clean_checkout()
    sytest_repo = get_repo_and_check_clean_checkout("../sytest", "sytest")
-    complement_repo = get_repo_and_check_clean_checkout("../complement", "complement")

    click.secho("Updating Synapse and Sytest git repos...")
    synapse_repo.remote().fetch()
    sytest_repo.remote().fetch()
-    complement_repo.remote().fetch()

    # Get the current version and AST from root Synapse module.
    current_version = get_package_version()
@@ -211,15 +208,7 @@ def _prepare() -> None:
            "Which branch should the release be based on?", default=default
        )

-        for repo_name, repo in {
-            "synapse": synapse_repo,
-            "sytest": sytest_repo,
-            "complement": complement_repo,
-        }.items():
-            # Special case for Complement: `develop` maps to `main`
-            if repo_name == "complement" and branch_name == "develop":
-                branch_name = "main"
-
+        for repo_name, repo in {"synapse": synapse_repo, "sytest": sytest_repo}.items():
            base_branch = find_ref(repo, branch_name)
            if not base_branch:
                print(f"Could not find base branch {branch_name} for {repo_name}!")
@@ -242,12 +231,6 @@ def _prepare() -> None:
        if click.confirm("Push new SyTest branch?", default=True):
            sytest_repo.git.push("-u", sytest_repo.remote().name, release_branch_name)

-        # Same for Complement
-        if click.confirm("Push new Complement branch?", default=True):
-            complement_repo.git.push(
-                "-u", complement_repo.remote().name, release_branch_name
-            )
-
    # Switch to the release branch and ensure it's up to date.
    synapse_repo.git.checkout(release_branch_name)
    update_branch(synapse_repo)
@@ -647,9 +630,6 @@ def _merge_back() -> None:
    else:
        # Full release
        sytest_repo = get_repo_and_check_clean_checkout("../sytest", "sytest")
-        complement_repo = get_repo_and_check_clean_checkout(
-            "../complement", "complement"
-        )

        if click.confirm(f"Merge {branch_name} → master?", default=True):
            _merge_into(synapse_repo, branch_name, "master")
@@ -663,9 +643,6 @@ def _merge_back() -> None:
        if click.confirm("On SyTest, merge master → develop?", default=True):
            _merge_into(sytest_repo, "master", "develop")

-        if click.confirm(f"On Complement, merge {branch_name} → main?", default=True):
-            _merge_into(complement_repo, branch_name, "main")
-

@cli.command()
 def announce() -> None:
@@ -44,7 +44,7 @@ logger = logging.getLogger("generate_workers_map")


 class MockHomeserver(HomeServer):
-    DATASTORE_CLASS = DataStore
+    DATASTORE_CLASS = DataStore  # type: ignore

    def __init__(self, config: HomeServerConfig, worker_app: Optional[str]) -> None:
        super().__init__(config.server.server_name, config=config)
@@ -52,7 +52,6 @@ def request_registration(
    user_type: Optional[str] = None,
    _print: Callable[[str], None] = print,
    exit: Callable[[int], None] = sys.exit,
-    exists_ok: bool = False,
 ) -> None:
    url = "%s/_synapse/admin/v1/register" % (server_location.rstrip("/"),)

@@ -98,10 +97,6 @@ def request_registration(
    r = requests.post(url, json=data)

    if r.status_code != 200:
-        response = r.json()
-        if exists_ok and response["errcode"] == "M_USER_IN_USE":
-            _print("User already exists. Skipping.")
-            return
        _print("ERROR! Received %d %s" % (r.status_code, r.reason))
        if 400 <= r.status_code < 500:
            try:
@@ -120,7 +115,6 @@ def register_new_user(
    shared_secret: str,
    admin: Optional[bool],
    user_type: Optional[str],
-    exists_ok: bool = False,
 ) -> None:
    if not user:
        try:
@@ -160,13 +154,7 @@ def register_new_user(
            admin = False

    request_registration(
-        user,
-        password,
-        server_location,
-        shared_secret,
-        bool(admin),
-        user_type,
-        exists_ok=exists_ok,
+        user, password, server_location, shared_secret, bool(admin), user_type
    )


@@ -186,22 +174,10 @@ def main() -> None:
        help="Local part of the new user. Will prompt if omitted.",
    )
    parser.add_argument(
-        "--exists-ok",
-        action="store_true",
-        help="Do not fail if user already exists.",
-    )
-    password_group = parser.add_mutually_exclusive_group()
-    password_group.add_argument(
        "-p",
        "--password",
        default=None,
-        help="New password for user. Will prompt for a password if "
-        "this flag and `--password-file` are both omitted.",
-    )
-    password_group.add_argument(
-        "--password-file",
-        default=None,
-        help="File containing the new password for user. If set, will override `--password`.",
+        help="New password for user. Will prompt if omitted.",
    )
    parser.add_argument(
        "-t",
@@ -209,7 +185,6 @@ def main() -> None:
        default=None,
        help="User type as specified in synapse.api.constants.UserTypes",
    )
-
    admin_group = parser.add_mutually_exclusive_group()
    admin_group.add_argument(
        "-a",
@@ -272,11 +247,6 @@ def main() -> None:
            print(_NO_SHARED_SECRET_OPTS_ERROR, file=sys.stderr)
            sys.exit(1)

-    if args.password_file:
-        password = _read_file(args.password_file, "password-file").strip()
-    else:
-        password = args.password
-
    if args.server_url:
        server_url = args.server_url
    elif config is not None:
@@ -300,13 +270,7 @@ def main() -> None:
        admin = args.admin

    register_new_user(
-        args.user,
-        password,
-        server_url,
-        secret,
-        admin,
-        args.user_type,
-        exists_ok=args.exists_ok,
+        args.user, args.password, server_url, secret, admin, args.user_type
    )


@@ -119,19 +119,18 @@ BOOLEAN_COLUMNS = {
    "e2e_room_keys": ["is_verified"],
    "event_edges": ["is_state"],
    "events": ["processed", "outlier", "contains_url"],
-    "local_media_repository": ["safe_from_quarantine", "authenticated"],
-    "per_user_experimental_features": ["enabled"],
+    "local_media_repository": ["safe_from_quarantine"],
    "presence_list": ["accepted"],
    "presence_stream": ["currently_active"],
    "public_room_list_stream": ["visibility"],
    "pushers": ["enabled"],
    "redactions": ["have_censored"],
-    "remote_media_cache": ["authenticated"],
    "room_stats_state": ["is_federatable"],
    "rooms": ["is_public", "has_auth_chain_index"],
    "users": ["shadow_banned", "approved", "locked", "suspended"],
    "un_partial_stated_event_stream": ["rejection_status_changed"],
    "users_who_share_rooms": ["share_private"],
+    "per_user_experimental_features": ["enabled"],
 }


@@ -41,7 +41,7 @@ logger = logging.getLogger("update_database")


 class MockHomeserver(HomeServer):
-    DATASTORE_CLASS = DataStore
+    DATASTORE_CLASS = DataStore  # type: ignore [assignment]

    def __init__(self, config: HomeServerConfig):
        super().__init__(
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import Optional, Tuple

 from typing_extensions import Protocol

@@ -28,9 +28,6 @@ from synapse.appservice import ApplicationService
 from synapse.http.site import SynapseRequest
 from synapse.types import Requester

-if TYPE_CHECKING:
-    from synapse.rest.admin.experimental_features import ExperimentalFeature
-
 # guests always get this device id.
 GUEST_DEVICE_ID = "guest_device"

@@ -90,19 +87,6 @@ class Auth(Protocol):
            AuthError if access is denied for the user in the access token
        """

-    async def get_user_by_req_experimental_feature(
-        self,
-        request: SynapseRequest,
-        feature: "ExperimentalFeature",
-        allow_guest: bool = False,
-        allow_expired: bool = False,
-        allow_locked: bool = False,
-    ) -> Requester:
-        """Like `get_user_by_req`, except also checks if the user has access to
-        the experimental feature. If they don't returns a 404 unrecognized
-        request.
-        """
-
    async def validate_appservice_can_control_user_id(
        self, app_service: ApplicationService, user_id: str
    ) -> None:
@@ -28,7 +28,6 @@ from synapse.api.errors import (
    Codes,
    InvalidClientTokenError,
    MissingClientTokenError,
-    UnrecognizedRequestError,
 )
 from synapse.http.site import SynapseRequest
 from synapse.logging.opentracing import active_span, force_tracing, start_active_span
@@ -39,10 +38,8 @@ from . import GUEST_DEVICE_ID
 from .base import BaseAuth

 if TYPE_CHECKING:
-    from synapse.rest.admin.experimental_features import ExperimentalFeature
    from synapse.server import HomeServer

-
 logger = logging.getLogger(__name__)


@@ -109,32 +106,6 @@ class InternalAuth(BaseAuth):
                    parent_span.set_tag("appservice_id", requester.app_service.id)
            return requester

-    async def get_user_by_req_experimental_feature(
-        self,
-        request: SynapseRequest,
-        feature: "ExperimentalFeature",
-        allow_guest: bool = False,
-        allow_expired: bool = False,
-        allow_locked: bool = False,
-    ) -> Requester:
-        try:
-            requester = await self.get_user_by_req(
-                request,
-                allow_guest=allow_guest,
-                allow_expired=allow_expired,
-                allow_locked=allow_locked,
-            )
-            if await self.store.is_feature_enabled(requester.user.to_string(), feature):
-                return requester
-
-            raise UnrecognizedRequestError(code=404)
-        except (AuthError, InvalidClientTokenError):
-            if feature.is_globally_enabled(self.hs.config):
-                # If its globally enabled then return the auth error
-                raise
-
-            raise UnrecognizedRequestError(code=404)
-
    @cancellable
    async def _wrapped_get_user_by_req(
        self,
@@ -40,7 +40,6 @@ from synapse.api.errors import (
    OAuthInsufficientScopeError,
    StoreError,
    SynapseError,
-    UnrecognizedRequestError,
 )
 from synapse.http.site import SynapseRequest
 from synapse.logging.context import make_deferred_yieldable
@@ -49,7 +48,6 @@ from synapse.util import json_decoder
 from synapse.util.caches.cached_call import RetryOnExceptionCachedCall

 if TYPE_CHECKING:
-    from synapse.rest.admin.experimental_features import ExperimentalFeature
    from synapse.server import HomeServer

 logger = logging.getLogger(__name__)
@@ -145,18 +143,6 @@ class MSC3861DelegatedAuth(BaseAuth):
        # metadata.validate_introspection_endpoint()
        return metadata

-    async def _introspection_endpoint(self) -> str:
-        """
-        Returns the introspection endpoint of the issuer
-
-        It uses the config option if set, otherwise it will use OIDC discovery to get it
-        """
-        if self._config.introspection_endpoint is not None:
-            return self._config.introspection_endpoint
-
-        metadata = await self._load_metadata()
-        return metadata.get("introspection_endpoint")
-
    async def _introspect_token(self, token: str) -> IntrospectionToken:
        """
        Send a token to the introspection endpoint and returns the introspection response
@@ -173,7 +159,8 @@ class MSC3861DelegatedAuth(BaseAuth):
        Returns:
            The introspection response
        """
-        introspection_endpoint = await self._introspection_endpoint()
+        metadata = await self._issuer_metadata.get()
+        introspection_endpoint = metadata.get("introspection_endpoint")
        raw_headers: Dict[str, str] = {
            "Content-Type": "application/x-www-form-urlencoded",
            "User-Agent": str(self._http_client.user_agent, "utf-8"),
@@ -258,32 +245,6 @@ class MSC3861DelegatedAuth(BaseAuth):

        return requester

-    async def get_user_by_req_experimental_feature(
-        self,
-        request: SynapseRequest,
-        feature: "ExperimentalFeature",
-        allow_guest: bool = False,
-        allow_expired: bool = False,
-        allow_locked: bool = False,
-    ) -> Requester:
-        try:
-            requester = await self.get_user_by_req(
-                request,
-                allow_guest=allow_guest,
-                allow_expired=allow_expired,
-                allow_locked=allow_locked,
-            )
-            if await self.store.is_feature_enabled(requester.user.to_string(), feature):
-                return requester
-
-            raise UnrecognizedRequestError(code=404)
-        except (AuthError, InvalidClientTokenError):
-            if feature.is_globally_enabled(self.hs.config):
-                # If its globally enabled then return the auth error
-                raise
-
-            raise UnrecognizedRequestError(code=404)
-
    async def get_user_by_access_token(
        self,
        token: str,
@@ -50,7 +50,7 @@ class Membership:
    KNOCK: Final = "knock"
    LEAVE: Final = "leave"
    BAN: Final = "ban"
-    LIST: Final = frozenset((INVITE, JOIN, KNOCK, LEAVE, BAN))
+    LIST: Final = {INVITE, JOIN, KNOCK, LEAVE, BAN}


 class PresenceState:
@@ -128,13 +128,9 @@ class EventTypes:
    SpaceParent: Final = "m.space.parent"

    Reaction: Final = "m.reaction"
-    Sticker: Final = "m.sticker"
-    LiveLocationShareStart: Final = "m.beacon_info"

    CallInvite: Final = "m.call.invite"

-    PollStart: Final = "m.poll.start"
-

 class ToDeviceEventTypes:
    RoomKeyRequest: Final = "m.room_key_request"
@@ -242,7 +238,7 @@ class EventUnsignedContentFields:
    """Fields found inside the 'unsigned' data on events"""

    # Requesting user's membership, per MSC4115
-    MEMBERSHIP: Final = "membership"
+    MSC4115_MEMBERSHIP: Final = "io.element.msc4115.membership"


 class RoomTypes:
@@ -130,8 +130,7 @@ class Ratelimiter:
                Overrides the value set during instantiation if set.
            burst_count: How many actions that can be performed before being limited.
                Overrides the value set during instantiation if set.
-            update: Whether to count this check as performing the action. If the action
-                cannot be performed, the user's action count is not incremented at all.
+            update: Whether to count this check as performing the action
            n_actions: The number of times the user wants to do this action. If the user
                cannot do all of the actions, the user's action count is not incremented
                at all.
@@ -236,8 +235,9 @@ class Ratelimiter:
            requester: The requester that is doing the action, if any.
            key: An arbitrary key used to classify an action. Defaults to the
                requester's user ID.
-            n_actions: The number of times the user performed the action. May be negative
-                to "refund" the rate limit.
+            n_actions: The number of times the user wants to do this action. If the user
+                cannot do all of the actions, the user's action count is not incremented
+                at all.
            _time_now_s: The current time. Optional, defaults to the current time according
                to self.clock. Only used by tests.
        """
@@ -110,7 +110,7 @@ class AdminCmdStore(


 class AdminCmdServer(HomeServer):
-    DATASTORE_CLASS = AdminCmdStore
+    DATASTORE_CLASS = AdminCmdStore  # type: ignore


 async def export_data_command(hs: HomeServer, args: argparse.Namespace) -> None:
@@ -74,9 +74,6 @@ from synapse.storage.databases.main.event_push_actions import (
    EventPushActionsWorkerStore,
 )
 from synapse.storage.databases.main.events_worker import EventsWorkerStore
-from synapse.storage.databases.main.experimental_features import (
-    ExperimentalFeaturesStore,
-)
 from synapse.storage.databases.main.filtering import FilteringWorkerStore
 from synapse.storage.databases.main.keys import KeyStore
 from synapse.storage.databases.main.lock import LockStore
@@ -158,7 +155,6 @@ class GenericWorkerStore(
    LockStore,
    SessionStore,
    TaskSchedulerWorkerStore,
-    ExperimentalFeaturesStore,
 ):
    # Properties that multiple storage classes define. Tell mypy what the
    # expected type is.
@@ -167,7 +163,7 @@ class GenericWorkerStore(


 class GenericWorkerServer(HomeServer):
-    DATASTORE_CLASS = GenericWorkerStore
+    DATASTORE_CLASS = GenericWorkerStore  # type: ignore

    def _listen_http(self, listener_config: ListenerConfig) -> None:
        assert listener_config.http_options is not None
@@ -81,7 +81,7 @@ def gz_wrap(r: Resource) -> Resource:


 class SynapseHomeServer(HomeServer):
-    DATASTORE_CLASS = DataStore
+    DATASTORE_CLASS = DataStore  # type: ignore

    def _listener_http(
        self,
@@ -217,7 +217,7 @@ class SynapseHomeServer(HomeServer):
            )

        if name in ["media", "federation", "client"]:
-            if self.config.media.can_load_media_repo:
+            if self.config.server.enable_media_repo:
                media_repo = self.get_media_repository_resource()
                resources.update(
                    {
@@ -140,12 +140,6 @@ class MSC3861:
                ("experimental", "msc3861", "client_auth_method"),
            )

-    introspection_endpoint: Optional[str] = attr.ib(
-        default=None,
-        validator=attr.validators.optional(attr.validators.instance_of(str)),
-    )
-    """The URL of the introspection endpoint used to validate access tokens."""
-
    account_management_url: Optional[str] = attr.ib(
        default=None,
        validator=attr.validators.optional(attr.validators.instance_of(str)),
@@ -399,6 +393,9 @@ class ExperimentalConfig(Config):
        # MSC3391: Removing account data.
        self.msc3391_enabled = experimental.get("msc3391_enabled", False)

+        # MSC3967: Do not require UIA when first uploading cross signing keys
+        self.msc3967_enabled = experimental.get("msc3967_enabled", False)
+
        # MSC3861: Matrix architecture change to delegate authentication via OIDC
        try:
            self.msc3861 = MSC3861(**experimental.get("msc3861", {}))
@@ -439,12 +436,13 @@ class ExperimentalConfig(Config):
                ("experimental", "msc4108_delegation_endpoint"),
            )

-        self.msc3823_account_suspension = experimental.get(
-            "msc3823_account_suspension", False
+        self.msc4115_membership_on_events = experimental.get(
+            "msc4115_membership_on_events", False
+        )
+
+        self.msc3916_authenticated_media_enabled = experimental.get(
+            "msc3916_authenticated_media_enabled", False
        )

        # MSC4151: Report room API (Client-Server API)
        self.msc4151_enabled: bool = experimental.get("msc4151_enabled", False)
-
-        # MSC4156: Migrate server_name to via
-        self.msc4156_enabled: bool = experimental.get("msc4156_enabled", False)
@@ -126,7 +126,7 @@ class ContentRepositoryConfig(Config):
        # Only enable the media repo if either the media repo is enabled or the
        # current worker app is the media repo.
        if (
-            config.get("enable_media_repo", True) is False
+            self.root.server.enable_media_repo is False
            and config.get("worker_app") != "synapse.app.media_repository"
        ):
            self.can_load_media_repo = False
@@ -272,10 +272,6 @@ class ContentRepositoryConfig(Config):
                remote_media_lifetime
            )

-        self.enable_authenticated_media = config.get(
-            "enable_authenticated_media", False
-        )
-
    def generate_config_section(self, data_dir_path: str, **kwargs: Any) -> str:
        assert data_dir_path is not None
        media_store = os.path.join(data_dir_path, "media_store")
@@ -384,11 +384,6 @@ class ServerConfig(Config):
        # Whether to internally track presence, requires that presence is enabled,
        self.track_presence = self.presence_enabled and presence_enabled != "untracked"

-        # Determines if presence results for offline users are included on initial/full sync
-        self.presence_include_offline_users_on_sync = presence_config.get(
-            "include_offline_users_on_sync", False
-        )
-
        # Custom presence router module
        # This is the legacy way of configuring it (the config should now be put in the modules section)
        self.presence_router_module_class = None
@@ -400,6 +395,12 @@ class ServerConfig(Config):
                self.presence_router_config,
            ) = load_module(presence_router_config, ("presence", "presence_router"))

+        # whether to enable the media repository endpoints. This should be set
+        # to false if the media repository is running as a separate endpoint;
+        # doing so ensures that we will not run cache cleanup jobs on the
+        # master, potentially causing inconsistency.
+        self.enable_media_repo = config.get("enable_media_repo", True)
+
        # Whether to require authentication to retrieve profile data (avatars,
        # display names) of other users through the client API.
        self.require_auth_for_profile_requests = config.get(
@@ -90,7 +90,6 @@ def prune_event(event: EventBase) -> EventBase:
    pruned_event.internal_metadata.stream_ordering = (
        event.internal_metadata.stream_ordering
    )
-    pruned_event.internal_metadata.instance_name = event.internal_metadata.instance_name
    pruned_event.internal_metadata.outlier = event.internal_metadata.outlier

    # Mark the event as redacted
@@ -117,7 +116,6 @@ def clone_event(event: EventBase) -> EventBase:
    new_event.internal_metadata.stream_ordering = (
        event.internal_metadata.stream_ordering
    )
-    new_event.internal_metadata.instance_name = event.internal_metadata.instance_name
    new_event.internal_metadata.outlier = event.internal_metadata.outlier

    return new_event
@@ -836,21 +834,3 @@ def maybe_upsert_event_field(
            del container[key]

    return upsert_okay
-
-
-def strip_event(event: EventBase) -> JsonDict:
-    """
-    Used for "stripped state" events which provide a simplified view of the state of a
-    room intended to help a potential joiner identify the room (relevant when the user
-    is invited or knocked).
-
-    Stripped state events can only have the `sender`, `type`, `state_key` and `content`
-    properties present.
-    """
-
-    return {
-        "type": event.type,
-        "state_key": event.state_key,
-        "content": event.content,
-        "sender": event.sender,
-    }
@@ -1871,52 +1871,6 @@ class FederationClient(FederationBase):

        return filtered_statuses, filtered_failures

-    async def federation_download_media(
-        self,
-        destination: str,
-        media_id: str,
-        output_stream: BinaryIO,
-        max_size: int,
-        max_timeout_ms: int,
-        download_ratelimiter: Ratelimiter,
-        ip_address: str,
-    ) -> Union[
-        Tuple[int, Dict[bytes, List[bytes]], bytes],
-        Tuple[int, Dict[bytes, List[bytes]]],
-    ]:
-        try:
-            return await self.transport_layer.federation_download_media(
-                destination,
-                media_id,
-                output_stream=output_stream,
-                max_size=max_size,
-                max_timeout_ms=max_timeout_ms,
-                download_ratelimiter=download_ratelimiter,
-                ip_address=ip_address,
-            )
-        except HttpResponseException as e:
-            # If an error is received that is due to an unrecognised endpoint,
-            # fallback to the _matrix/media/v3/download endpoint. Otherwise, consider it a legitimate error
-            # and raise.
-            if not is_unknown_endpoint(e):
-                raise
-
-        logger.debug(
-            "Couldn't download media %s/%s over _matrix/federation/v1/media/download, falling back to _matrix/media/v3/download path",
-            destination,
-            media_id,
-        )
-
-        return await self.transport_layer.download_media_v3(
-            destination,
-            media_id,
-            output_stream=output_stream,
-            max_size=max_size,
-            max_timeout_ms=max_timeout_ms,
-            download_ratelimiter=download_ratelimiter,
-            ip_address=ip_address,
-        )
-
    async def download_media(
        self,
        destination: str,
@@ -1345,6 +1345,7 @@ class FederationServer(FederationBase):
        Raises:
            AuthError if the server does not match the ACL
        """
+        # Test.
        server_acl_evaluator = (
            await self._storage_controllers.state.get_server_acl_for_room(room_id)
        )
@@ -21,7 +21,6 @@
 #
 import datetime
 import logging
-from collections import OrderedDict
 from types import TracebackType
 from typing import TYPE_CHECKING, Dict, Hashable, Iterable, List, Optional, Tuple, Type

@@ -69,10 +68,6 @@ sent_edus_by_type = Counter(
 # If the retry interval is larger than this then we enter "catchup" mode
 CATCHUP_RETRY_INTERVAL = 60 * 60 * 1000

-# Limit how many presence states we add to each presence EDU, to ensure that
-# they are bounded in size.
-MAX_PRESENCE_STATES_PER_EDU = 50
-

 class PerDestinationQueue:
    """
@@ -149,7 +144,7 @@ class PerDestinationQueue:

        # Map of user_id -> UserPresenceState of pending presence to be sent to this
        # destination
-        self._pending_presence: OrderedDict[str, UserPresenceState] = OrderedDict()
+        self._pending_presence: Dict[str, UserPresenceState] = {}

        # List of room_id -> receipt_type -> user_id -> receipt_dict,
        #
@@ -338,11 +333,12 @@ class PerDestinationQueue:
                    # not caught up yet
                    return

+            pending_pdus = []
            while True:
                self._new_data_to_send = False

                async with _TransactionQueueManager(self) as (
-                    pending_pdus,  # noqa: F811
+                    pending_pdus,
                    pending_edus,
                ):
                    if not pending_pdus and not pending_edus:
@@ -403,7 +399,7 @@ class PerDestinationQueue:
                # through another mechanism, because this is all volatile!
                self._pending_edus = []
                self._pending_edus_keyed = {}
-                self._pending_presence.clear()
+                self._pending_presence = {}
                self._pending_receipt_edus = []

                self._start_catching_up()
@@ -725,26 +721,22 @@ class _TransactionQueueManager:

        # Add presence EDU.
        if self.queue._pending_presence:
-            # Only send max 50 presence entries in the EDU, to bound the amount
-            # of data we're sending.
-            presence_to_add: List[JsonDict] = []
-            while (
-                self.queue._pending_presence
-                and len(presence_to_add) < MAX_PRESENCE_STATES_PER_EDU
-            ):
-                _, presence = self.queue._pending_presence.popitem(last=False)
-                presence_to_add.append(
-                    format_user_presence_state(presence, self.queue._clock.time_msec())
-                )
-
            pending_edus.append(
                Edu(
                    origin=self.queue._server_name,
                    destination=self.queue._destination,
                    edu_type=EduTypes.PRESENCE,
-                    content={"push": presence_to_add},
+                    content={
+                        "push": [
+                            format_user_presence_state(
+                                presence, self.queue._clock.time_msec()
+                            )
+                            for presence in self.queue._pending_presence.values()
+                        ]
+                    },
                )
            )
+            self.queue._pending_presence = {}

        # Add read receipt EDUs.
        pending_edus.extend(self.queue._get_receipt_edus(force_flush=False, limit=5))
@@ -824,6 +824,7 @@ class TransportLayerClient:
        ip_address: str,
    ) -> Tuple[int, Dict[bytes, List[bytes]]]:
        path = f"/_matrix/media/r0/download/{destination}/{media_id}"
+
        return await self.client.get_file(
            destination,
            path,
@@ -851,6 +852,7 @@ class TransportLayerClient:
        ip_address: str,
    ) -> Tuple[int, Dict[bytes, List[bytes]]]:
        path = f"/_matrix/media/v3/download/{destination}/{media_id}"
+
        return await self.client.get_file(
            destination,
            path,
@@ -871,29 +873,6 @@ class TransportLayerClient:
            ip_address=ip_address,
        )

-    async def federation_download_media(
-        self,
-        destination: str,
-        media_id: str,
-        output_stream: BinaryIO,
-        max_size: int,
-        max_timeout_ms: int,
-        download_ratelimiter: Ratelimiter,
-        ip_address: str,
-    ) -> Tuple[int, Dict[bytes, List[bytes]], bytes]:
-        path = f"/_matrix/federation/v1/media/download/{media_id}"
-        return await self.client.federation_get_file(
-            destination,
-            path,
-            output_stream=output_stream,
-            max_size=max_size,
-            args={
-                "timeout_ms": str(max_timeout_ms),
-            },
-            download_ratelimiter=download_ratelimiter,
-            ip_address=ip_address,
-        )
-

 def _create_path(federation_prefix: str, path: str, *args: str) -> str:
    """
@@ -19,6 +19,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
+import inspect
 import logging
 from typing import TYPE_CHECKING, Dict, Iterable, List, Optional, Tuple, Type

@@ -32,9 +33,8 @@ from synapse.federation.transport.server._base import (
 from synapse.federation.transport.server.federation import (
    FEDERATION_SERVLET_CLASSES,
    FederationAccountStatusServlet,
-    FederationMediaDownloadServlet,
-    FederationMediaThumbnailServlet,
    FederationUnstableClientKeysClaimServlet,
+    FederationUnstableMediaDownloadServlet,
 )
 from synapse.http.server import HttpServer, JsonResource
 from synapse.http.servlet import (
@@ -317,11 +317,26 @@ def register_servlets(
            ):
                continue

-            if (
-                servletclass == FederationMediaDownloadServlet
-                or servletclass == FederationMediaThumbnailServlet
-            ):
-                if not hs.config.media.can_load_media_repo:
+            if servletclass == FederationUnstableMediaDownloadServlet:
+                if (
+                    not hs.config.server.enable_media_repo
+                    or not hs.config.experimental.msc3916_authenticated_media_enabled
+                ):
+                    continue
+
+                # don't load the endpoint if the storage provider is incompatible
+                media_repo = hs.get_media_repository()
+                load_download_endpoint = True
+                for provider in media_repo.media_storage.storage_providers:
+                    signature = inspect.signature(provider.backend.fetch)
+                    if "federation" not in signature.parameters:
+                        logger.warning(
+                            f"Federation media `/download` endpoint will not be enabled as storage provider {provider.backend} is not compatible with this endpoint."
+                        )
+                        load_download_endpoint = False
+                        break
+
+                if not load_download_endpoint:
                    continue

            servletclass(
@@ -362,9 +362,7 @@ class BaseFederationServlet:
                                return None
                            if (
                                func.__self__.__class__.__name__  # type: ignore
-                                == "FederationMediaDownloadServlet"
-                                or func.__self__.__class__.__name__  # type: ignore
-                                == "FederationMediaThumbnailServlet"
+                                == "FederationUnstableMediaDownloadServlet"
                            ):
                                response = await func(
                                    origin, content, request, *args, **kwargs
@@ -376,9 +374,7 @@ class BaseFederationServlet:
                    else:
                        if (
                            func.__self__.__class__.__name__  # type: ignore
-                            == "FederationMediaDownloadServlet"
-                            or func.__self__.__class__.__name__  # type: ignore
-                            == "FederationMediaThumbnailServlet"
+                            == "FederationUnstableMediaDownloadServlet"
                        ):
                            response = await func(
                                origin, content, request, *args, **kwargs
@@ -46,13 +46,11 @@ from synapse.http.servlet import (
    parse_boolean_from_args,
    parse_integer,
    parse_integer_from_args,
-    parse_string,
    parse_string_from_args,
    parse_strings_from_args,
 )
 from synapse.http.site import SynapseRequest
 from synapse.media._base import DEFAULT_MAX_TIMEOUT_MS, MAXIMUM_ALLOWED_MAX_TIMEOUT_MS
-from synapse.media.thumbnailer import ThumbnailProvider
 from synapse.types import JsonDict
 from synapse.util import SYNAPSE_VERSION
 from synapse.util.ratelimitutils import FederationRateLimiter
@@ -792,14 +790,15 @@ class FederationAccountStatusServlet(BaseFederationServerServlet):
        return 200, {"account_statuses": statuses, "failures": failures}


-class FederationMediaDownloadServlet(BaseFederationServerServlet):
+class FederationUnstableMediaDownloadServlet(BaseFederationServerServlet):
    """
    Implementation of new federation media `/download` endpoint outlined in MSC3916. Returns
-    a multipart/mixed response consisting of a JSON object and the requested media
+    a multipart/form-data response consisting of a JSON object and the requested media
    item. This endpoint only returns local media.
    """

    PATH = "/media/download/(?P<media_id>[^/]*)"
+    PREFIX = FEDERATION_UNSTABLE_PREFIX + "/org.matrix.msc3916"
    RATELIMIT = True

    def __init__(
@@ -828,59 +827,6 @@ class FederationMediaDownloadServlet(BaseFederationServerServlet):
        )


-class FederationMediaThumbnailServlet(BaseFederationServerServlet):
-    """
-    Implementation of new federation media `/thumbnail` endpoint outlined in MSC3916. Returns
-    a multipart/mixed response consisting of a JSON object and the requested media
-    item. This endpoint only returns local media.
-    """
-
-    PATH = "/media/thumbnail/(?P<media_id>[^/]*)"
-    RATELIMIT = True
-
-    def __init__(
-        self,
-        hs: "HomeServer",
-        ratelimiter: FederationRateLimiter,
-        authenticator: Authenticator,
-        server_name: str,
-    ):
-        super().__init__(hs, authenticator, ratelimiter, server_name)
-        self.media_repo = self.hs.get_media_repository()
-        self.dynamic_thumbnails = hs.config.media.dynamic_thumbnails
-        self.thumbnail_provider = ThumbnailProvider(
-            hs, self.media_repo, self.media_repo.media_storage
-        )
-
-    async def on_GET(
-        self,
-        origin: Optional[str],
-        content: Literal[None],
-        request: SynapseRequest,
-        media_id: str,
-    ) -> None:
-
-        width = parse_integer(request, "width", required=True)
-        height = parse_integer(request, "height", required=True)
-        method = parse_string(request, "method", "scale")
-        # TODO Parse the Accept header to get an prioritised list of thumbnail types.
-        m_type = "image/png"
-        max_timeout_ms = parse_integer(
-            request, "timeout_ms", default=DEFAULT_MAX_TIMEOUT_MS
-        )
-        max_timeout_ms = min(max_timeout_ms, MAXIMUM_ALLOWED_MAX_TIMEOUT_MS)
-
-        if self.dynamic_thumbnails:
-            await self.thumbnail_provider.select_or_generate_local_thumbnail(
-                request, media_id, width, height, method, m_type, max_timeout_ms, True
-            )
-        else:
-            await self.thumbnail_provider.respond_local_thumbnail(
-                request, media_id, width, height, method, m_type, max_timeout_ms, True
-            )
-        self.media_repo.mark_recently_accessed(None, media_id)
-
-
 FEDERATION_SERVLET_CLASSES: Tuple[Type[BaseFederationServlet], ...] = (
    FederationSendServlet,
    FederationEventServlet,
@@ -912,6 +858,5 @@ FEDERATION_SERVLET_CLASSES: Tuple[Type[BaseFederationServlet], ...] = (
    FederationV1SendKnockServlet,
    FederationMakeKnockServlet,
    FederationAccountStatusServlet,
-    FederationMediaDownloadServlet,
-    FederationMediaThumbnailServlet,
+    FederationUnstableMediaDownloadServlet,
 )
@@ -42,6 +42,7 @@ class AdminHandler:
        self._device_handler = hs.get_device_handler()
        self._storage_controllers = hs.get_storage_controllers()
        self._state_storage_controller = self._storage_controllers.state
+        self._hs_config = hs.config
        self._msc3866_enabled = hs.config.experimental.msc3866.enabled

    async def get_whois(self, user: UserID) -> JsonMapping:
@@ -214,6 +215,7 @@ class AdminHandler:
                    self._storage_controllers,
                    user_id,
                    events,
+                    msc4115_membership_on_events=self._hs_config.experimental.msc4115_membership_on_events,
                )

                writer.write_events(room_id, events)
@@ -283,10 +283,6 @@ class DeactivateAccountHandler:
                    ratelimit=False,
                    require_consent=False,
                )
-
-                # Mark the room forgotten too, because they won't be able to do this
-                # for us. This may lead to the room being purged eventually.
-                await self._room_member_handler.forget(user, room_id)
            except Exception:
                logger.exception(
                    "Failed to part user %r from room %r: ignoring and continuing",
@@ -39,7 +39,6 @@ from synapse.metrics.background_process_metrics import (
 )
 from synapse.storage.databases.main.client_ips import DeviceLastConnectionInfo
 from synapse.types import (
-    DeviceListUpdates,
    JsonDict,
    JsonMapping,
    ScheduledTask,
@@ -215,7 +214,7 @@ class DeviceWorkerHandler:
    @cancellable
    async def get_user_ids_changed(
        self, user_id: str, from_token: StreamToken
-    ) -> DeviceListUpdates:
+    ) -> JsonDict:
        """Get list of users that have had the devices updated, or have newly
        joined a room, that `user_id` may be interested in.
        """
@@ -342,19 +341,11 @@ class DeviceWorkerHandler:
            possibly_joined = set()
            possibly_left = set()

-        device_list_updates = DeviceListUpdates(
-            changed=possibly_joined,
-            left=possibly_left,
-        )
+        result = {"changed": list(possibly_joined), "left": list(possibly_left)}

-        log_kv(
-            {
-                "changed": device_list_updates.changed,
-                "left": device_list_updates.left,
-            }
-        )
+        log_kv(result)

-        return device_list_updates
+        return result

    async def on_federation_query_user_devices(self, user_id: str) -> JsonDict:
        if not self.hs.is_mine(UserID.from_string(user_id)):
@@ -291,20 +291,13 @@ class E2eKeysHandler:

            # Only try and fetch keys for destinations that are not marked as
            # down.
-            unfiltered_destinations = remote_queries_not_in_cache.keys()
-            filtered_destinations = set(
-                await filter_destinations_by_retry_limiter(
-                    unfiltered_destinations,
-                    self.clock,
-                    self.store,
-                    # Let's give an arbitrary grace period for those hosts that are
-                    # only recently down
-                    retry_due_within_ms=60 * 1000,
-                )
-            )
-            failures.update(
-                (dest, _NOT_READY_FOR_RETRY_FAILURE)
-                for dest in (unfiltered_destinations - filtered_destinations)
+            filtered_destinations = await filter_destinations_by_retry_limiter(
+                remote_queries_not_in_cache.keys(),
+                self.clock,
+                self.store,
+                # Let's give an arbitrary grace period for those hosts that are
+                # only recently down
+                retry_due_within_ms=60 * 1000,
            )

            await concurrently_execute(
@@ -1648,9 +1641,6 @@ def _check_device_signature(
        raise SynapseError(400, "Invalid signature", Codes.INVALID_SIGNATURE)


-_NOT_READY_FOR_RETRY_FAILURE = {"status": 503, "message": "Not ready for retry"}
-
-
 def _exception_to_failure(e: Exception) -> JsonDict:
    if isinstance(e, SynapseError):
        return {"status": e.code, "errcode": e.errcode, "message": str(e)}
@@ -1659,7 +1649,7 @@ def _exception_to_failure(e: Exception) -> JsonDict:
        return {"status": e.code, "message": str(e)}

    if isinstance(e, NotRetryingDestination):
-        return _NOT_READY_FOR_RETRY_FAILURE
+        return {"status": 503, "message": "Not ready for retry"}

    # include ConnectionRefused and other errors
    #
@@ -34,7 +34,7 @@ from synapse.api.errors import (
 from synapse.logging.opentracing import log_kv, trace
 from synapse.storage.databases.main.e2e_room_keys import RoomKey
 from synapse.types import JsonDict
-from synapse.util.async_helpers import ReadWriteLock
+from synapse.util.async_helpers import Linearizer

 if TYPE_CHECKING:
    from synapse.server import HomeServer
@@ -58,7 +58,7 @@ class E2eRoomKeysHandler:
        # clients belonging to a user will receive and try to upload a new session at
        # roughly the same time.  Also used to lock out uploads when the key is being
        # changed.
-        self._upload_lock = ReadWriteLock()
+        self._upload_linearizer = Linearizer("upload_room_keys_lock")

    @trace
    async def get_room_keys(
@@ -89,7 +89,7 @@ class E2eRoomKeysHandler:

        # we deliberately take the lock to get keys so that changing the version
        # works atomically
-        async with self._upload_lock.read(user_id):
+        async with self._upload_linearizer.queue(user_id):
            # make sure the backup version exists
            try:
                await self.store.get_e2e_room_keys_version_info(user_id, version)
@@ -132,7 +132,7 @@ class E2eRoomKeysHandler:
        """

        # lock for consistency with uploading
-        async with self._upload_lock.write(user_id):
+        async with self._upload_linearizer.queue(user_id):
            # make sure the backup version exists
            try:
                version_info = await self.store.get_e2e_room_keys_version_info(
@@ -193,7 +193,7 @@ class E2eRoomKeysHandler:
        # TODO: Validate the JSON to make sure it has the right keys.

        # XXX: perhaps we should use a finer grained lock here?
-        async with self._upload_lock.write(user_id):
+        async with self._upload_linearizer.queue(user_id):
            # Check that the version we're trying to upload is the current version
            try:
                version_info = await self.store.get_e2e_room_keys_version_info(user_id)
@@ -355,7 +355,7 @@ class E2eRoomKeysHandler:
        # TODO: Validate the JSON to make sure it has the right keys.

        # lock everyone out until we've switched version
-        async with self._upload_lock.write(user_id):
+        async with self._upload_linearizer.queue(user_id):
            new_version = await self.store.create_e2e_room_keys_version(
                user_id, version_info
            )
@@ -382,7 +382,7 @@ class E2eRoomKeysHandler:
        }
        """

-        async with self._upload_lock.read(user_id):
+        async with self._upload_linearizer.queue(user_id):
            try:
                res = await self.store.get_e2e_room_keys_version_info(user_id, version)
            except StoreError as e:
@@ -407,7 +407,7 @@ class E2eRoomKeysHandler:
            NotFoundError: if this backup version doesn't exist
        """

-        async with self._upload_lock.write(user_id):
+        async with self._upload_linearizer.queue(user_id):
            try:
                await self.store.delete_e2e_room_keys_version(user_id, version)
            except StoreError as e:
@@ -437,7 +437,7 @@ class E2eRoomKeysHandler:
            raise SynapseError(
                400, "Version in body does not match", Codes.INVALID_PARAM
            )
-        async with self._upload_lock.write(user_id):
+        async with self._upload_linearizer.queue(user_id):
            try:
                old_info = await self.store.get_e2e_room_keys_version_info(
                    user_id, version
@@ -148,6 +148,7 @@ class EventHandler:
    def __init__(self, hs: "HomeServer"):
        self.store = hs.get_datastores().main
        self._storage_controllers = hs.get_storage_controllers()
+        self._config = hs.config

    async def get_event(
        self,
@@ -193,6 +194,7 @@ class EventHandler:
            user.to_string(),
            [event],
            is_peeking=is_peeking,
+            msc4115_membership_on_events=self._config.experimental.msc4115_membership_on_events,
        )

        if not filtered:
@@ -224,6 +224,7 @@ class InitialSyncHandler:
                    self._storage_controllers,
                    user_id,
                    messages,
+                    msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
                )

                start_token = now_token.copy_and_replace(StreamKeyType.ROOM, token)
@@ -382,6 +383,7 @@ class InitialSyncHandler:
            requester.user.to_string(),
            messages,
            is_peeking=is_peeking,
+            msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
        )

        start_token = StreamToken.START.copy_and_replace(StreamKeyType.ROOM, token)
@@ -496,6 +498,7 @@ class InitialSyncHandler:
            requester.user.to_string(),
            messages,
            is_peeking=is_peeking,
+            msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
        )

        start_token = now_token.copy_and_replace(StreamKeyType.ROOM, token)
@@ -201,7 +201,7 @@ class MessageHandler:

        if at_token:
            last_event_id = (
-                await self.store.get_last_event_id_in_room_before_stream_ordering(
+                await self.store.get_last_event_in_room_before_stream_ordering(
                    room_id,
                    end_token=at_token.room_key,
                )
@@ -642,17 +642,6 @@ class EventCreationHandler:
        """
        await self.auth_blocking.check_auth_blocking(requester=requester)

-        if event_dict["type"] == EventTypes.Message:
-            requester_suspended = await self.store.get_user_suspended_status(
-                requester.user.to_string()
-            )
-            if requester_suspended:
-                raise SynapseError(
-                    403,
-                    "Sending messages while account is suspended is not allowed.",
-                    Codes.USER_ACCOUNT_SUSPENDED,
-                )
-
        if event_dict["type"] == EventTypes.Create and event_dict["state_key"] == "":
            room_version_id = event_dict["content"]["room_version"]
            maybe_room_version_obj = KNOWN_ROOM_VERSIONS.get(room_version_id)
@@ -1562,7 +1551,6 @@ class EventCreationHandler:
                    # stream_ordering entry manually (as it was persisted on
                    # another worker).
                    event.internal_metadata.stream_ordering = stream_id
-                    event.internal_metadata.instance_name = writer_instance

                return event

@@ -623,6 +623,7 @@ class PaginationHandler:
                user_id,
                events,
                is_peeking=(member_event_id is None),
+                msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
            )

        # if after the filter applied there are no more events
@@ -95,6 +95,7 @@ class RelationsHandler:
        self._event_handler = hs.get_event_handler()
        self._event_serializer = hs.get_event_client_serializer()
        self._event_creation_handler = hs.get_event_creation_handler()
+        self._config = hs.config

    async def get_relations(
        self,
@@ -163,6 +164,7 @@ class RelationsHandler:
            user_id,
            events,
            is_peeking=(member_event_id is None),
+            msc4115_membership_on_events=self._config.experimental.msc4115_membership_on_events,
        )

        # The relations returned for the requested event do include their
@@ -608,6 +610,7 @@ class RelationsHandler:
            user_id,
            events,
            is_peeking=(member_event_id is None),
+            msc4115_membership_on_events=self._config.experimental.msc4115_membership_on_events,
        )

        aggregations = await self.get_bundled_aggregations(
@@ -1188,8 +1188,6 @@ class RoomCreationHandler:
            )
            events_to_send.append((power_event, power_context))
        else:
-            # Please update the docs for `default_power_level_content_override` when
-            # updating the `events` dict below
            power_level_content: JsonDict = {
                "users": {creator_id: 100},
                "users_default": 0,
@@ -1478,6 +1476,7 @@ class RoomContextHandler:
                user.to_string(),
                events,
                is_peeking=is_peeking,
+                msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
            )

        event = await self.store.get_event(
@@ -483,6 +483,7 @@ class SearchHandler:
            self._storage_controllers,
            user.to_string(),
            filtered_events,
+            msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
        )

        events.sort(key=lambda e: -rank_map[e.event_id])
@@ -584,6 +585,7 @@ class SearchHandler:
                self._storage_controllers,
                user.to_string(),
                filtered_events,
+                msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
            )

            room_events.extend(events)
@@ -671,12 +673,14 @@ class SearchHandler:
                self._storage_controllers,
                user.to_string(),
                res.events_before,
+                msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
            )

            events_after = await filter_events_for_client(
                self._storage_controllers,
                user.to_string(),
                res.events_after,
+                msc4115_membership_on_events=self.hs.config.experimental.msc4115_membership_on_events,
            )

            context: JsonDict = {
@@ -844,6 +844,7 @@ class SyncHandler:
                    sync_config.user.to_string(),
                    recents,
                    always_include_ids=current_state_ids,
+                    msc4115_membership_on_events=self.hs_config.experimental.msc4115_membership_on_events,
                )
                log_kv({"recents_after_visibility_filtering": len(recents)})
            else:
@@ -929,6 +930,7 @@ class SyncHandler:
                    sync_config.user.to_string(),
                    loaded_recents,
                    always_include_ids=current_state_ids,
+                    msc4115_membership_on_events=self.hs_config.experimental.msc4115_membership_on_events,
                )

                loaded_recents = []
@@ -979,6 +981,89 @@ class SyncHandler:
            bundled_aggregations=bundled_aggregations,
        )

+    async def get_state_after_event(
+        self,
+        event_id: str,
+        state_filter: Optional[StateFilter] = None,
+        await_full_state: bool = True,
+    ) -> StateMap[str]:
+        """
+        Get the room state after the given event
+
+        Args:
+            event_id: event of interest
+            state_filter: The state filter used to fetch state from the database.
+            await_full_state: if `True`, will block if we do not yet have complete state
+                at the event and `state_filter` is not satisfied by partial state.
+                Defaults to `True`.
+        """
+        state_ids = await self._state_storage_controller.get_state_ids_for_event(
+            event_id,
+            state_filter=state_filter or StateFilter.all(),
+            await_full_state=await_full_state,
+        )
+
+        # using get_metadata_for_events here (instead of get_event) sidesteps an issue
+        # with redactions: if `event_id` is a redaction event, and we don't have the
+        # original (possibly because it got purged), get_event will refuse to return
+        # the redaction event, which isn't terribly helpful here.
+        #
+        # (To be fair, in that case we could assume it's *not* a state event, and
+        # therefore we don't need to worry about it. But still, it seems cleaner just
+        # to pull the metadata.)
+        m = (await self.store.get_metadata_for_events([event_id]))[event_id]
+        if m.state_key is not None and m.rejection_reason is None:
+            state_ids = dict(state_ids)
+            state_ids[(m.event_type, m.state_key)] = event_id
+
+        return state_ids
+
+    async def get_state_at(
+        self,
+        room_id: str,
+        stream_position: StreamToken,
+        state_filter: Optional[StateFilter] = None,
+        await_full_state: bool = True,
+    ) -> StateMap[str]:
+        """Get the room state at a particular stream position
+
+        Args:
+            room_id: room for which to get state
+            stream_position: point at which to get state
+            state_filter: The state filter used to fetch state from the database.
+            await_full_state: if `True`, will block if we do not yet have complete state
+                at the last event in the room before `stream_position` and
+                `state_filter` is not satisfied by partial state. Defaults to `True`.
+        """
+        # FIXME: This gets the state at the latest event before the stream ordering,
+        # which might not be the same as the "current state" of the room at the time
+        # of the stream token if there were multiple forward extremities at the time.
+        last_event_id = await self.store.get_last_event_in_room_before_stream_ordering(
+            room_id,
+            end_token=stream_position.room_key,
+        )
+
+        if last_event_id:
+            state = await self.get_state_after_event(
+                last_event_id,
+                state_filter=state_filter or StateFilter.all(),
+                await_full_state=await_full_state,
+            )
+
+        else:
+            # no events in this room - so presumably no state
+            state = {}
+
+            # (erikj) This should be rarely hit, but we've had some reports that
+            # we get more state down gappy syncs than we should, so let's add
+            # some logging.
+            logger.info(
+                "Failed to find any events in room %s at %s",
+                room_id,
+                stream_position.room_key,
+            )
+        return state
+
    async def compute_summary(
        self,
        room_id: str,
@@ -1352,7 +1437,7 @@ class SyncHandler:
            await_full_state = True
            lazy_load_members = False

-        state_at_timeline_end = await self._state_storage_controller.get_state_ids_at(
+        state_at_timeline_end = await self.get_state_at(
            room_id,
            stream_position=end_token,
            state_filter=state_filter,
@@ -1436,7 +1521,7 @@ class SyncHandler:
            # We need to make sure the first event in our batch points to the
            # last event in the previous batch.
            last_event_id_prev_batch = (
-                await self.store.get_last_event_id_in_room_before_stream_ordering(
+                await self.store.get_last_event_in_room_before_stream_ordering(
                    room_id,
                    end_token=since_token.room_key,
                )
@@ -1480,13 +1565,11 @@ class SyncHandler:
        else:
            # We can get here if the user has ignored the senders of all
            # the recent events.
-            state_at_timeline_start = (
-                await self._state_storage_controller.get_state_ids_at(
-                    room_id,
-                    stream_position=end_token,
-                    state_filter=state_filter,
-                    await_full_state=await_full_state,
-                )
+            state_at_timeline_start = await self.get_state_at(
+                room_id,
+                stream_position=end_token,
+                state_filter=state_filter,
+                await_full_state=await_full_state,
            )

        if batch.limited:
@@ -1504,14 +1587,14 @@ class SyncHandler:
            # about them).
            state_filter = StateFilter.all()

-        state_at_previous_sync = await self._state_storage_controller.get_state_ids_at(
+        state_at_previous_sync = await self.get_state_at(
            room_id,
            stream_position=since_token,
            state_filter=state_filter,
            await_full_state=await_full_state,
        )

-        state_at_timeline_end = await self._state_storage_controller.get_state_ids_at(
+        state_at_timeline_end = await self.get_state_at(
            room_id,
            stream_position=end_token,
            state_filter=state_filter,
@@ -2270,11 +2353,7 @@ class SyncHandler:
            user=user,
            from_key=presence_key,
            is_guest=sync_config.is_guest,
-            include_offline=(
-                True
-                if self.hs_config.server.presence_include_offline_users_on_sync
-                else include_offline
-            ),
+            include_offline=include_offline,
        )
        assert presence_key
        sync_result_builder.now_token = now_token.copy_and_replace(
@@ -2514,7 +2593,7 @@ class SyncHandler:
                continue

            if room_id in sync_result_builder.joined_room_ids or has_join:
-                old_state_ids = await self._state_storage_controller.get_state_ids_at(
+                old_state_ids = await self.get_state_at(
                    room_id,
                    since_token,
                    state_filter=StateFilter.from_types([(EventTypes.Member, user_id)]),
@@ -2544,14 +2623,12 @@ class SyncHandler:
                    newly_left_rooms.append(room_id)
                else:
                    if not old_state_ids:
-                        old_state_ids = (
-                            await self._state_storage_controller.get_state_ids_at(
-                                room_id,
-                                since_token,
-                                state_filter=StateFilter.from_types(
-                                    [(EventTypes.Member, user_id)]
-                                ),
-                            )
+                        old_state_ids = await self.get_state_at(
+                            room_id,
+                            since_token,
+                            state_filter=StateFilter.from_types(
+                                [(EventTypes.Member, user_id)]
+                            ),
                        )
                        old_mem_ev_id = old_state_ids.get(
                            (EventTypes.Member, user_id), None
@@ -35,8 +35,6 @@ from typing import (
    Union,
 )

-import attr
-import multipart
 import treq
 from canonicaljson import encode_canonical_json
 from netaddr import AddrFormatError, IPAddress, IPSet
@@ -1008,130 +1006,6 @@ class _DiscardBodyWithMaxSizeProtocol(protocol.Protocol):
        self._maybe_fail()


-@attr.s(auto_attribs=True, slots=True)
-class MultipartResponse:
-    """
-    A small class to hold parsed values of a multipart response.
-    """
-
-    json: bytes = b"{}"
-    length: Optional[int] = None
-    content_type: Optional[bytes] = None
-    disposition: Optional[bytes] = None
-    url: Optional[bytes] = None
-
-
-class _MultipartParserProtocol(protocol.Protocol):
-    """
-    Protocol to read and parse a MSC3916 multipart/mixed response
-    """
-
-    transport: Optional[ITCPTransport] = None
-
-    def __init__(
-        self,
-        stream: ByteWriteable,
-        deferred: defer.Deferred,
-        boundary: str,
-        max_length: Optional[int],
-    ) -> None:
-        self.stream = stream
-        self.deferred = deferred
-        self.boundary = boundary
-        self.max_length = max_length
-        self.parser = None
-        self.multipart_response = MultipartResponse()
-        self.has_redirect = False
-        self.in_json = False
-        self.json_done = False
-        self.file_length = 0
-        self.total_length = 0
-        self.in_disposition = False
-        self.in_content_type = False
-
-    def dataReceived(self, incoming_data: bytes) -> None:
-        if self.deferred.called:
-            return
-
-        # we don't have a parser yet, instantiate it
-        if not self.parser:
-
-            def on_header_field(data: bytes, start: int, end: int) -> None:
-                if data[start:end] == b"Location":
-                    self.has_redirect = True
-                if data[start:end] == b"Content-Disposition":
-                    self.in_disposition = True
-                if data[start:end] == b"Content-Type":
-                    self.in_content_type = True
-
-            def on_header_value(data: bytes, start: int, end: int) -> None:
-                # the first header should be content-type for application/json
-                if not self.in_json and not self.json_done:
-                    assert data[start:end] == b"application/json"
-                    self.in_json = True
-                elif self.has_redirect:
-                    self.multipart_response.url = data[start:end]
-                elif self.in_content_type:
-                    self.multipart_response.content_type = data[start:end]
-                    self.in_content_type = False
-                elif self.in_disposition:
-                    self.multipart_response.disposition = data[start:end]
-                    self.in_disposition = False
-
-            def on_part_data(data: bytes, start: int, end: int) -> None:
-                # we've seen json header but haven't written the json data
-                if self.in_json and not self.json_done:
-                    self.multipart_response.json = data[start:end]
-                    self.json_done = True
-                # we have a redirect header rather than a file, and have already captured it
-                elif self.has_redirect:
-                    return
-                # otherwise we are in the file part
-                else:
-                    logger.info("Writing multipart file data to stream")
-                    try:
-                        self.stream.write(data[start:end])
-                    except Exception as e:
-                        logger.warning(
-                            f"Exception encountered writing file data to stream: {e}"
-                        )
-                        self.deferred.errback()
-                    self.file_length += end - start
-
-            callbacks = {
-                "on_header_field": on_header_field,
-                "on_header_value": on_header_value,
-                "on_part_data": on_part_data,
-            }
-            self.parser = multipart.MultipartParser(self.boundary, callbacks)
-
-        self.total_length += len(incoming_data)
-        if self.max_length is not None and self.total_length >= self.max_length:
-            self.deferred.errback(BodyExceededMaxSize())
-            # Close the connection (forcefully) since all the data will get
-            # discarded anyway.
-            assert self.transport is not None
-            self.transport.abortConnection()
-
-        try:
-            self.parser.write(incoming_data)  # type: ignore[attr-defined]
-        except Exception as e:
-            logger.warning(f"Exception writing to multipart parser: {e}")
-            self.deferred.errback()
-            return
-
-    def connectionLost(self, reason: Failure = connectionDone) -> None:
-        # If the maximum size was already exceeded, there's nothing to do.
-        if self.deferred.called:
-            return
-
-        if reason.check(ResponseDone):
-            self.multipart_response.length = self.file_length
-            self.deferred.callback(self.multipart_response)
-        else:
-            self.deferred.errback(reason)
-
-
 class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
    """A protocol which reads body to a stream, erroring if the body exceeds a maximum size."""

@@ -1217,32 +1091,6 @@ def read_body_with_max_size(
    return d


-def read_multipart_response(
-    response: IResponse, stream: ByteWriteable, boundary: str, max_length: Optional[int]
-) -> "defer.Deferred[MultipartResponse]":
-    """
-    Reads a MSC3916 multipart/mixed response and parses it, reading the file part (if it contains one) into
-    the stream passed in and returning a deferred resolving to a MultipartResponse
-
-    Args:
-        response: The HTTP response to read from.
-        stream: The file-object to write to.
-        boundary: the multipart/mixed boundary string
-        max_length: maximum allowable length of the response
-    """
-    d: defer.Deferred[MultipartResponse] = defer.Deferred()
-
-    # If the Content-Length header gives a size larger than the maximum allowed
-    # size, do not bother downloading the body.
-    if max_length is not None and response.length != UNKNOWN_LENGTH:
-        if response.length > max_length:
-            response.deliverBody(_DiscardBodyWithMaxSizeProtocol(d))
-            return d
-
-    response.deliverBody(_MultipartParserProtocol(stream, d, boundary, max_length))
-    return d
-
-
 def encode_query_args(args: Optional[QueryParams]) -> bytes:
    """
    Encodes a map of query arguments to bytes which can be appended to a URL.
@@ -75,11 +75,9 @@ from synapse.http.client import (
    BlocklistingAgentWrapper,
    BodyExceededMaxSize,
    ByteWriteable,
-    SimpleHttpClient,
    _make_scheduler,
    encode_query_args,
    read_body_with_max_size,
-    read_multipart_response,
 )
 from synapse.http.connectproxyclient import BearerProxyCredentials
 from synapse.http.federation.matrix_federation_agent import MatrixFederationAgent
@@ -90,7 +88,7 @@ from synapse.logging.context import make_deferred_yieldable, run_in_background
 from synapse.logging.opentracing import set_tag, start_active_span, tags
 from synapse.types import JsonDict
 from synapse.util import json_decoder
-from synapse.util.async_helpers import AwakenableSleeper, Linearizer, timeout_deferred
+from synapse.util.async_helpers import AwakenableSleeper, timeout_deferred
 from synapse.util.metrics import Measure
 from synapse.util.stringutils import parse_and_validate_server_name

@@ -468,15 +466,6 @@ class MatrixFederationHttpClient:

        self._sleeper = AwakenableSleeper(self.reactor)

-        self._simple_http_client = SimpleHttpClient(
-            hs,
-            ip_blocklist=hs.config.server.federation_ip_range_blocklist,
-            ip_allowlist=hs.config.server.federation_ip_range_allowlist,
-            use_proxy=True,
-        )
-
-        self.remote_download_linearizer = Linearizer("remote_download_linearizer", 6)
-
    def wake_destination(self, destination: str) -> None:
        """Called when the remote server may have come back online."""

@@ -1488,150 +1477,21 @@ class MatrixFederationHttpClient:
        )

        headers = dict(response.headers.getAllRawHeaders())
-        expected_size = response.length

+        expected_size = response.length
+        # if we don't get an expected length then use the max length
        if expected_size == UNKNOWN_LENGTH:
            expected_size = max_size
-        else:
-            if int(expected_size) > max_size:
-                msg = "Requested file is too large > %r bytes" % (max_size,)
-                logger.warning(
-                    "{%s} [%s] %s",
-                    request.txn_id,
-                    request.destination,
-                    msg,
-                )
-                raise SynapseError(HTTPStatus.BAD_GATEWAY, msg, Codes.TOO_LARGE)
+            logger.debug(
+                f"File size unknown, assuming file is max allowable size: {max_size}"
+            )

-            read_body, _ = await download_ratelimiter.can_do_action(
-                requester=None,
-                key=ip_address,
-                n_actions=expected_size,
-            )
-            if not read_body:
-                msg = "Requested file size exceeds ratelimits"
-                logger.warning(
-                    "{%s} [%s] %s",
-                    request.txn_id,
-                    request.destination,
-                    msg,
-                )
-                raise SynapseError(
-                    HTTPStatus.TOO_MANY_REQUESTS, msg, Codes.LIMIT_EXCEEDED
-                )
-
-        try:
-            async with self.remote_download_linearizer.queue(ip_address):
-                # add a byte of headroom to max size as function errs at >=
-                d = read_body_with_max_size(response, output_stream, expected_size + 1)
-                d.addTimeout(self.default_timeout_seconds, self.reactor)
-                length = await make_deferred_yieldable(d)
-        except BodyExceededMaxSize:
-            msg = "Requested file is too large > %r bytes" % (expected_size,)
-            logger.warning(
-                "{%s} [%s] %s",
-                request.txn_id,
-                request.destination,
-                msg,
-            )
-            raise SynapseError(HTTPStatus.BAD_GATEWAY, msg, Codes.TOO_LARGE)
-        except defer.TimeoutError as e:
-            logger.warning(
-                "{%s} [%s] Timed out reading response - %s %s",
-                request.txn_id,
-                request.destination,
-                request.method,
-                request.uri.decode("ascii"),
-            )
-            raise RequestSendFailed(e, can_retry=True) from e
-        except ResponseFailed as e:
-            logger.warning(
-                "{%s} [%s] Failed to read response - %s %s",
-                request.txn_id,
-                request.destination,
-                request.method,
-                request.uri.decode("ascii"),
-            )
-            raise RequestSendFailed(e, can_retry=True) from e
-        except Exception as e:
-            logger.warning(
-                "{%s} [%s] Error reading response: %s",
-                request.txn_id,
-                request.destination,
-                e,
-            )
-            raise
-        logger.info(
-            "{%s} [%s] Completed: %d %s [%d bytes] %s %s",
-            request.txn_id,
-            request.destination,
-            response.code,
-            response.phrase.decode("ascii", errors="replace"),
-            length,
-            request.method,
-            request.uri.decode("ascii"),
+        read_body, _ = await download_ratelimiter.can_do_action(
+            requester=None,
+            key=ip_address,
+            n_actions=expected_size,
        )
-
-        # if we didn't know the length upfront, decrement the actual size from ratelimiter
-        if response.length == UNKNOWN_LENGTH:
-            download_ratelimiter.record_action(
-                requester=None, key=ip_address, n_actions=length
-            )
-
-        return length, headers
-
-    async def federation_get_file(
-        self,
-        destination: str,
-        path: str,
-        output_stream: BinaryIO,
-        download_ratelimiter: Ratelimiter,
-        ip_address: str,
-        max_size: int,
-        args: Optional[QueryParams] = None,
-        retry_on_dns_fail: bool = True,
-        ignore_backoff: bool = False,
-    ) -> Tuple[int, Dict[bytes, List[bytes]], bytes]:
-        """GETs a file from a given homeserver over the federation /download endpoint
-        Args:
-            destination: The remote server to send the HTTP request to.
-            path: The HTTP path to GET.
-            output_stream: File to write the response body to.
-            download_ratelimiter: a ratelimiter to limit remote media downloads, keyed to
-                requester IP
-            ip_address: IP address of the requester
-            max_size: maximum allowable size in bytes of the file
-            args: Optional dictionary used to create the query string.
-            ignore_backoff: true to ignore the historical backoff data
-                and try the request anyway.
-
-        Returns:
-            Resolves to an (int, dict, bytes) tuple of
-            the file length, a dict of the response headers, and the file json
-
-        Raises:
-            HttpResponseException: If we get an HTTP response code >= 300
-                (except 429).
-            NotRetryingDestination: If we are not yet ready to retry this
-                server.
-            FederationDeniedError: If this destination is not on our
-                federation whitelist
-            RequestSendFailed: If there were problems connecting to the
-                remote, due to e.g. DNS failures, connection timeouts etc.
-            SynapseError: If the requested file exceeds ratelimits or the response from the
-            remote server is not a multipart response
-            AssertionError: if the resolved multipart response's length is None
-        """
-        request = MatrixFederationRequest(
-            method="GET", destination=destination, path=path, query=args
-        )
-
-        # check for a minimum balance of 1MiB in ratelimiter before initiating request
-        send_req, _ = await download_ratelimiter.can_do_action(
-            requester=None, key=ip_address, n_actions=1048576, update=False
-        )
-
-        if not send_req:
+        if not read_body:
            msg = "Requested file size exceeds ratelimits"
            logger.warning(
                "{%s} [%s] %s",
@@ -1641,69 +1501,11 @@ class MatrixFederationHttpClient:
            )
            raise SynapseError(HTTPStatus.TOO_MANY_REQUESTS, msg, Codes.LIMIT_EXCEEDED)

-        response = await self._send_request(
-            request,
-            retry_on_dns_fail=retry_on_dns_fail,
-            ignore_backoff=ignore_backoff,
-        )
-
-        headers = dict(response.headers.getAllRawHeaders())
-        expected_size = response.length
-
-        if expected_size == UNKNOWN_LENGTH:
-            expected_size = max_size
-        else:
-            if int(expected_size) > max_size:
-                msg = "Requested file is too large > %r bytes" % (max_size,)
-                logger.warning(
-                    "{%s} [%s] %s",
-                    request.txn_id,
-                    request.destination,
-                    msg,
-                )
-                raise SynapseError(HTTPStatus.BAD_GATEWAY, msg, Codes.TOO_LARGE)
-
-            read_body, _ = await download_ratelimiter.can_do_action(
-                requester=None,
-                key=ip_address,
-                n_actions=expected_size,
-            )
-            if not read_body:
-                msg = "Requested file size exceeds ratelimits"
-                logger.warning(
-                    "{%s} [%s] %s",
-                    request.txn_id,
-                    request.destination,
-                    msg,
-                )
-                raise SynapseError(
-                    HTTPStatus.TOO_MANY_REQUESTS, msg, Codes.LIMIT_EXCEEDED
-                )
-
-        # this should be a multipart/mixed response with the boundary string in the header
        try:
-            raw_content_type = headers.get(b"Content-Type")
-            assert raw_content_type is not None
-            content_type = raw_content_type[0].decode("UTF-8")
-            content_type_parts = content_type.split("boundary=")
-            boundary = content_type_parts[1]
-        except Exception:
-            msg = "Remote response is malformed: expected Content-Type of multipart/mixed with a boundary present."
-            logger.warning(
-                "{%s} [%s] %s",
-                request.txn_id,
-                request.destination,
-                msg,
-            )
-            raise SynapseError(HTTPStatus.BAD_GATEWAY, msg)
-
-        try:
-            async with self.remote_download_linearizer.queue(ip_address):
-                # add a byte of headroom to max size as `_MultipartParserProtocol.dataReceived` errs at >=
-                deferred = read_multipart_response(
-                    response, output_stream, boundary, expected_size + 1
-                )
-                deferred.addTimeout(self.default_timeout_seconds, self.reactor)
+            # add a byte of headroom to max size as function errs at >=
+            d = read_body_with_max_size(response, output_stream, expected_size + 1)
+            d.addTimeout(self.default_timeout_seconds, self.reactor)
+            length = await make_deferred_yieldable(d)
        except BodyExceededMaxSize:
            msg = "Requested file is too large > %r bytes" % (expected_size,)
            logger.warning(
@@ -1739,27 +1541,6 @@ class MatrixFederationHttpClient:
                e,
            )
            raise
-
-        multipart_response = await make_deferred_yieldable(deferred)
-        if not multipart_response.url:
-            assert multipart_response.length is not None
-            length = multipart_response.length
-            headers[b"Content-Type"] = [multipart_response.content_type]
-            headers[b"Content-Disposition"] = [multipart_response.disposition]
-
-        # the response contained a redirect url to download the file from
-        else:
-            str_url = multipart_response.url.decode("utf-8")
-            logger.info(
-                "{%s} [%s] File download redirected, now downloading from: %s",
-                request.txn_id,
-                request.destination,
-                str_url,
-            )
-            length, headers, _, _ = await self._simple_http_client.get_file(
-                str_url, output_stream, expected_size
-            )
-
        logger.info(
            "{%s} [%s] Completed: %d %s [%d bytes] %s %s",
            request.txn_id,
@@ -1770,14 +1551,7 @@ class MatrixFederationHttpClient:
            request.method,
            request.uri.decode("ascii"),
        )
-
-        # if we didn't know the length upfront, decrement the actual size from ratelimiter
-        if response.length == UNKNOWN_LENGTH:
-            download_ratelimiter.record_action(
-                requester=None, key=ip_address, n_actions=length
-            )
-
-        return length, headers, multipart_response.json
+        return length, headers


 def _flatten_response_never_received(e: BaseException) -> str:
@@ -119,15 +119,14 @@ def parse_integer(
        default: value to use if the parameter is absent, defaults to None.
        required: whether to raise a 400 SynapseError if the parameter is absent,
            defaults to False.
-        negative: whether to allow negative integers, defaults to False (disallowing
-            negatives).
+        negative: whether to allow negative integers, defaults to True.
    Returns:
        An int value or the default.

    Raises:
        SynapseError: if the parameter is absent and required, if the
            parameter is present and not an integer, or if the
-            parameter is illegitimately negative.
+            parameter is illegitimate negative.
    """
    args: Mapping[bytes, Sequence[bytes]] = request.args  # type: ignore
    return parse_integer_from_args(args, name, default, required, negative)
@@ -165,7 +164,7 @@ def parse_integer_from_args(
    name: str,
    default: Optional[int] = None,
    required: bool = False,
-    negative: bool = False,
+    negative: bool = True,
 ) -> Optional[int]:
    """Parse an integer parameter from the request string

@@ -175,8 +174,7 @@ def parse_integer_from_args(
        default: value to use if the parameter is absent, defaults to None.
        required: whether to raise a 400 SynapseError if the parameter is absent,
            defaults to False.
-        negative: whether to allow negative integers, defaults to False (disallowing
-            negatives).
+        negative: whether to allow negative integers, defaults to True.

    Returns:
        An int value or the default.
@@ -184,7 +182,7 @@ def parse_integer_from_args(
    Raises:
        SynapseError: if the parameter is absent and required, if the
            parameter is present and not an integer, or if the
-            parameter is illegitimately negative.
+            parameter is illegitimate negative.
    """
    name_bytes = name.encode("ascii")

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Erik Johnston	d69b3b4c9f	Newsfile	2024-06-13 13:57:32 +01:00
Erik Johnston	e60b6cc533	WIP	2024-06-13 13:56:53 +01:00
				`@@ -0,0 +1 @@`
				Add initial implementation of an experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint.
				`@@ -0,0 +1 @@`
				`Fix searching for users with their exact localpart whose ID includes a hyphen.`
				`@@ -0,0 +1 @@`
				Use fully-qualified `PersistedEventPosition` when returning `RoomsForUser` to facilitate proper comparisons and `RoomStreamToken` generation.
				`@@ -0,0 +1 @@`
				`Add debug logging for when room keys are uploaded, including whether they are replacing other room keys.`
				`@@ -0,0 +1 @@`
				`Add support for the unstable [MSC4151](https://github.com/matrix-org/matrix-spec-proposals/pull/4151) report room API.`
				`@@ -0,0 +1 @@`
				`Fix wrong retention policy being used when filtering events.`
				`@@ -0,0 +1 @@`
				`Don't try and resync devices for remote users whose servers are marked as down.`
				`@@ -0,0 +1 @@`
				Fix bug where OTKs were not always included in `/sync` response when using workers.
				`@@ -0,0 +1 @@`
				`Re-organize Pydantic models and types used in handlers.`