Disable auto search for prefixes in event search

Revert "Unified search query syntax using the full-text search capabilities of the underlying DB. (#11635 )"
This reverts commit d902181de9.
2022-11-02 12:31:16 +00:00 · 2022-11-02 12:29:34 +00:00 · 2022-11-02 12:28:47 +00:00 · 2022-11-02 12:28:24 +00:00 · 2022-11-01 12:48:12 +00:00 · 2022-10-28 12:27:04 +01:00
366 changed files with 5853 additions and 12127 deletions
@@ -46,7 +46,7 @@ if not IS_PR:
            "database": "sqlite",
            "extras": "all",
        }
-        for version in ("3.8", "3.9", "3.10", "3.11")
+        for version in ("3.8", "3.9", "3.10")
    )


@@ -54,7 +54,7 @@ trial_postgres_tests = [
    {
        "python-version": "3.7",
        "database": "postgres",
-        "postgres-version": "11",
+        "postgres-version": "10",
        "extras": "all",
    }
 ]
@@ -62,9 +62,9 @@ trial_postgres_tests = [
 if not IS_PR:
    trial_postgres_tests.append(
        {
-            "python-version": "3.11",
+            "python-version": "3.10",
            "database": "postgres",
-            "postgres-version": "15",
+            "postgres-version": "14",
            "extras": "all",
        }
    )
@@ -21,7 +21,7 @@ endblock

 block Install Complement Dependencies
  sudo apt-get -qq update && sudo apt-get install -qqy libolm3 libolm-dev
-  go install -v github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest
+  go get -v github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest
 endblock

 block Install custom gotestfmt template
@@ -4,7 +4,7 @@
 root = true

 # 4 space indentation
-[*.{py,pyi}]
+[*.py]
 indent_style = space
 indent_size = 4
 max_line_length = 88
@@ -74,36 +74,6 @@ body:
        - Debian packages from packages.matrix.org
        - pip (from PyPI)
        - Other (please mention below)
-        - I don't know
-    validations:
-      required: true
-  - type: input
-    id: database
-    attributes:
-      label: Database
-      description: |
-        Are you using SQLite or PostgreSQL? What's the version of your database?
-
-        If PostgreSQL, please also answer the following:
-         - are you using a single PostgreSQL server
-        or [separate servers for `main` and `state`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#databases)?
-         - have you previously ported from SQLite using the Synapse "portdb" script?
-         - have you previously restored from a backup?
-    validations:
-      required: true
-  - type: dropdown
-    id: workers
-    attributes:
-      label: Workers
-      description: |
-        Are you running a single Synapse process, or are you running
-        [2 or more workers](https://matrix-org.github.io/synapse/latest/workers.html)?
-      options:
-        - Single process
-        - Multiple workers
-        - I don't know
-    validations:
-      required: true
  - type: textarea
    id: platform
    attributes:
@@ -113,28 +83,17 @@ body:
        e.g. distro, hardware, if it's running in a vm/container, etc.
    validations:
      required: true
-  - type: textarea
-    id: config
-    attributes:
-      label: Configuration
-      description: |
-        Do you have any unusual config options turned on? If so, please provide details.
-
-        - Experimental or undocumented features
-        - [Presence](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#presence)
-        - [Message retention](https://matrix-org.github.io/synapse/latest/message_retention_policies.html)
-        - [Synapse modules](https://matrix-org.github.io/synapse/latest/modules/index.html)
  - type: textarea
    id: logs
    attributes:
      label: Relevant log output
      description: |
        Please copy and paste any relevant log output, ideally at INFO or DEBUG log level.
-        This will be automatically formatted into code, so there is no need for backticks (`\``).
+        This will be automatically formatted into code, so there is no need for backticks.

        Please be careful to remove any personal or private data.

-        **Bug reports are usually impossible to diagnose without logging.**
+        **Bug reports are usually very difficult to diagnose without logging.**
      render: shell
    validations:
      required: true
@@ -18,6 +18,5 @@ updates:

  - package-ecosystem: "cargo"
    directory: "/"
-    versioning-strategy: "lockfile-only"
    schedule:
      interval: "weekly"
@@ -1,34 +0,0 @@
-name: Deploy documentation PR preview
-
-on:
-  workflow_run:
-    workflows: [ "Prepare documentation PR preview" ]
-    types:
-      - completed
-
-jobs:
-  netlify:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      # There's a 'download artifact' action, but it hasn't been updated for the workflow_run action
-      # (https://github.com/actions/download-artifact/issues/60) so instead we get this mess:
-      - name: 📥 Download artifact
-        uses: dawidd6/action-download-artifact@e6e25ac3a2b93187502a8be1ef9e9603afc34925 # v2.24.2
-        with:
-          workflow: docs-pr.yaml
-          run_id: ${{ github.event.workflow_run.id }}
-          name: book
-          path: book
-
-      - name: 📤 Deploy to Netlify
-        uses: matrix-org/netlify-pr-preview@v1
-        with:
-          path: book
-          owner: ${{ github.event.workflow_run.head_repository.owner.login }}
-          branch: ${{ github.event.workflow_run.head_branch }}
-          revision: ${{ github.event.workflow_run.head_sha }}
-          token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          site_id: ${{ secrets.NETLIFY_SITE_ID }}
-          desc: Documentation preview
-          deployment_env: PR Documentation Preview
@@ -1,34 +0,0 @@
-name: Prepare documentation PR preview
-
-on:
-  pull_request:
-    paths:
-      - docs/**
-
-jobs:
-  pages:
-    name: GitHub Pages
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Setup mdbook
-        uses: peaceiris/actions-mdbook@adeb05db28a0c0004681db83893d56c0388ea9ea # v1.2.0
-        with:
-          mdbook-version: '0.4.17'
-
-      - name: Build the documentation
-        # mdbook will only create an index.html if we're including docs/README.md in SUMMARY.md.
-        # However, we're using docs/README.md for other purposes and need to pick a new page
-        # as the default. Let's opt for the welcome page instead.
-        run: |
-          mdbook build
-          cp book/welcome_and_overview.html book/index.html
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: book
-          path: book
-          # We'll only use this in a workflow_run, then we're done with it
-          retention-days: 1
@@ -27,9 +27,10 @@ jobs:
    steps:
      - uses: actions/checkout@v3
      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+            toolchain: stable
+            override: true
      - uses: Swatinem/rust-cache@v2

      # The dev dependencies aren't exposed in the wheel metadata (at least with current
@@ -61,9 +62,10 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+            toolchain: stable
+            override: true
      - uses: Swatinem/rust-cache@v2

      - run: sudo apt-get -qq install xmlsec1
@@ -134,9 +136,10 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+            toolchain: stable
+            override: true
      - uses: Swatinem/rust-cache@v2

      - name: Ensure sytest runs `pip install`
@@ -208,7 +211,7 @@ jobs:

    steps:
      - uses: actions/checkout@v3
-      - uses: JasonEtco/create-an-issue@77399b6110ef82b94c1c9f9f615acf9e604f7f56 # v2.5.0, 2020-12-06
+      - uses: JasonEtco/create-an-issue@5d9504915f79f9cc6d791934b8ef34f2353dd74d # v2.5.0, 2020-12-06
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
@@ -1,74 +0,0 @@
-# This task does not run complement tests, see tests.yaml instead.
-# This task does not build docker images for synapse for use on docker hub, see docker.yaml instead
-
-name: Store complement-synapse image in ghcr.io
-on:
-  push:
-    branches: [ "master" ]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      branch:
-        required: true
-        default: 'develop'
-        type: choice
-        options:
-          - develop
-          - master
-
-# Only run this action once per pull request/branch; restart if a new commit arrives.
-# C.f. https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency
-# and https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#github-context
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: Build and push complement image
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout specific branch (debug build)
-        uses: actions/checkout@v3
-        if: github.event_name == 'workflow_dispatch'
-        with:
-          ref: ${{ inputs.branch }}
-      - name: Checkout clean copy of develop (scheduled build)
-        uses: actions/checkout@v3
-        if: github.event_name == 'schedule'
-        with:
-          ref: develop
-      - name: Checkout clean copy of master (on-push)
-        uses: actions/checkout@v3
-        if: github.event_name == 'push'
-        with:
-          ref: master
-      - name: Login to registry
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Work out labels for complement image
-        id: meta
-        uses: docker/metadata-action@v4
-        with:
-          images: ghcr.io/${{ github.repository }}/complement-synapse
-          tags: |
-            type=schedule,pattern=nightly,enable=${{ github.event_name == 'schedule'}}
-            type=raw,value=develop,enable=${{ github.event_name == 'schedule' || inputs.branch == 'develop' }}
-            type=raw,value=latest,enable=${{ github.event_name == 'push' || inputs.branch == 'master' }}
-            type=sha,format=long
-      - name: Run scripts-dev/complement.sh to generate complement-synapse:latest image.
-        run: scripts-dev/complement.sh --build-only
-      - name: Tag and push generated image
-        run: |
-          for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do 
-            echo "tag and push $TAG"
-            docker tag complement-synapse $TAG
-            docker push $TAG
-          done
@@ -27,15 +27,12 @@ jobs:
          rust:
            - 'rust/**'
            - 'Cargo.toml'
-            - 'Cargo.lock'

  check-sampleconfig:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
-        with:
-          python-version: "3.x"
      - uses: matrix-org/setup-python-poetry@v1
        with:
          extras: "all"
@@ -47,8 +44,6 @@ jobs:
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
-        with:
-          python-version: "3.x"
      - run: "pip install 'click==8.1.1' 'GitPython>=3.1.20'"
      - run: scripts-dev/check_schema_delta.py --force-colors

@@ -73,8 +68,6 @@ jobs:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - uses: actions/setup-python@v4
-        with:
-          python-version: "3.x"
      - run: "pip install 'towncrier>=18.6.0rc1'"
      - run: scripts-dev/check-newsfragment.sh
        env:
@@ -100,38 +93,14 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
            toolchain: 1.58.1
+            override: true
            components: clippy
      - uses: Swatinem/rust-cache@v2

-      - run: cargo clippy -- -D warnings
-
-  # We also lint against a nightly rustc so that we can lint the benchmark
-  # suite, which requires a nightly compiler.
-  lint-clippy-nightly:
-    runs-on: ubuntu-latest
-    needs: changes
-    if: ${{ needs.changes.outputs.rust == 'true' }}
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
-        with:
-            toolchain: nightly-2022-12-01
-            components: clippy
-      - uses: Swatinem/rust-cache@v2
-
-      - run: cargo clippy --all-features -- -D warnings
+      - run: cargo clippy

  lint-rustfmt:
    runs-on: ubuntu-latest
@@ -142,13 +111,11 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: 1.58.1
-          components: rustfmt
+            toolchain: 1.58.1
+            override: true
+            components: rustfmt
      - uses: Swatinem/rust-cache@v2

      - run: cargo fmt --check
@@ -176,8 +143,6 @@ jobs:
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
-        with:
-          python-version: "3.x"
      - id: get-matrix
        run: .ci/scripts/calculate_jobs.py
    outputs:
@@ -197,23 +162,17 @@ jobs:
      - run: sudo apt-get -qq install xmlsec1
      - name: Set up PostgreSQL ${{ matrix.job.postgres-version }}
        if: ${{ matrix.job.postgres-version }}
-        # 1. Mount postgres data files onto a tmpfs in-memory filesystem to reduce overhead of docker's overlayfs layer.
-        # 2. Expose the unix socket for postgres. This removes latency of using docker-proxy for connections.
        run: |
          docker run -d -p 5432:5432 \
-            --tmpfs /var/lib/postgres:rw,size=6144m \
-            --mount 'type=bind,src=/var/run/postgresql,dst=/var/run/postgresql' \
            -e POSTGRES_PASSWORD=postgres \
            -e POSTGRES_INITDB_ARGS="--lc-collate C --lc-ctype C --encoding UTF8" \
            postgres:${{ matrix.job.postgres-version }}

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
            toolchain: 1.58.1
+            override: true
      - uses: Swatinem/rust-cache@v2

      - uses: matrix-org/setup-python-poetry@v1
@@ -224,10 +183,10 @@ jobs:
        if: ${{ matrix.job.postgres-version }}
        timeout-minutes: 2
        run: until pg_isready -h localhost; do sleep 1; done
-      - run: poetry run trial --jobs=6 tests
+      - run: poetry run trial --jobs=2 tests
        env:
          SYNAPSE_POSTGRES: ${{ matrix.job.database == 'postgres' || '' }}
-          SYNAPSE_POSTGRES_HOST: /var/run/postgresql
+          SYNAPSE_POSTGRES_HOST: localhost
          SYNAPSE_POSTGRES_USER: postgres
          SYNAPSE_POSTGRES_PASSWORD: postgres
      - name: Dump logs
@@ -252,12 +211,10 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
            toolchain: 1.58.1
+            override: true
      - uses: Swatinem/rust-cache@v2

      # There aren't wheels for some of the older deps, so we need to install
@@ -296,7 +253,7 @@ jobs:
          python-version: '3.7'
          extras: "all test"

-      - run: poetry run trial -j6 tests
+      - run: poetry run trial -j2 tests
      - name: Dump logs
        # Logs are most useful when the command fails, always include them.
        if: ${{ always() }}
@@ -370,12 +327,10 @@ jobs:
        run: cat sytest-blacklist .ci/worker-blacklist > synapse-blacklist-with-workers

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
            toolchain: 1.58.1
+            override: true
      - uses: Swatinem/rust-cache@v2

      - name: Run SyTest
@@ -436,10 +391,10 @@ jobs:
      matrix:
        include:
          - python-version: "3.7"
-            postgres-version: "11"
+            postgres-version: "10"

-          - python-version: "3.11"
-            postgres-version: "15"
+          - python-version: "3.10"
+            postgres-version: "14"

    services:
      postgres:
@@ -457,15 +412,6 @@ jobs:

    steps:
      - uses: actions/checkout@v3
-      - name: Add PostgreSQL apt repository
-        # We need a version of pg_dump that can handle the version of
-        # PostgreSQL being tested against. The Ubuntu package repository lags
-        # behind new releases, so we have to use the PostreSQL apt repository.
-        # Steps taken from https://www.postgresql.org/download/linux/ubuntu/
-        run: |
-          sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
-          wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
-          sudo apt-get update
      - run: sudo apt-get -qq install xmlsec1 postgresql-client
      - uses: matrix-org/setup-python-poetry@v1
        with:
@@ -513,12 +459,10 @@ jobs:
          path: synapse

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
            toolchain: 1.58.1
+            override: true
      - uses: Swatinem/rust-cache@v2

      - name: Prepare Complement's Prerequisites
@@ -541,12 +485,10 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        # There don't seem to be versioned releases of this action per se: for each rust
-        # version there is a branch which gets constantly rebased on top of master.
-        # We pin to a specific commit for paranoia's sake.
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
            toolchain: 1.58.1
+            override: true
      - uses: Swatinem/rust-cache@v2

      - run: cargo test
@@ -11,34 +11,34 @@ jobs:
    if: >
      contains(github.event.issue.labels.*.name, 'X-Needs-Info')
    steps:
-      - uses: actions/add-to-project@main
-        id: add_project
+      - uses: octokit/graphql-action@v2.x
+        id: add_to_project
        with:
-          project-url: "https://github.com/orgs/matrix-org/projects/67"
-          github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-      - name: Set status
-        env:
-          GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
-        run: |
-          gh api graphql -f query='
-          mutation(
-              $project: ID!
-              $item: ID!
-              $fieldid: ID!
-              $columnid: String!
-            )  {
-            updateProjectV2ItemFieldValue(
-              input: {
-               projectId: $project
-                itemId: $item
-                fieldId: $fieldid
-                value: { 
-                  singleSelectOptionId: $columnid
+          headers: '{"GraphQL-Features": "projects_next_graphql"}'
+          query: |
+            mutation {
+              updateProjectV2ItemFieldValue(
+                input: {
+                  projectId: $projectid
+                  itemId: $contentid
+                  fieldId: $fieldid
+                  value: {
+                    singleSelectOptionId: "Todo"
                  }
-              }
-            ) {
-              projectV2Item {
-                id
+                }
+              ) {
+                projectV2Item {
+                  id
+                }
              }
            }
-          }' -f project="PVT_kwDOAIB0Bs4AFDdZ" -f item=${{ steps.add_project.outputs.itemId }} -f fieldid="PVTSSF_lADOAIB0Bs4AFDdZzgC6ZA4" -f columnid=ba22e43c --silent
+
+          projectid: ${{ env.PROJECT_ID }}
+          contentid: ${{ github.event.issue.node_id }}
+          fieldid: ${{ env.FIELD_ID }}
+          optionid: ${{ env.OPTION_ID }}
+        env:
+          PROJECT_ID: "PVT_kwDOAIB0Bs4AFDdZ"
+          GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+          FIELD_ID: "PVTSSF_lADOAIB0Bs4AFDdZzgC6ZA4"
+          OPTION_ID: "ba22e43c"
@@ -18,9 +18,10 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+            toolchain: stable
+            override: true
      - uses: Swatinem/rust-cache@v2

      - uses: matrix-org/setup-python-poetry@v1
@@ -43,9 +44,10 @@ jobs:
      - run: sudo apt-get -qq install xmlsec1

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+            toolchain: stable
+            override: true
      - uses: Swatinem/rust-cache@v2

      - uses: matrix-org/setup-python-poetry@v1
@@ -82,9 +84,10 @@ jobs:
      - uses: actions/checkout@v3

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e645b0cf01249a964ec099494d38d2da0f0b349f
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+            toolchain: stable
+            override: true
      - uses: Swatinem/rust-cache@v2

      - name: Patch dependencies
@@ -174,7 +177,7 @@ jobs:

    steps:
      - uses: actions/checkout@v3
-      - uses: JasonEtco/create-an-issue@77399b6110ef82b94c1c9f9f615acf9e604f7f56 # v2.5.0, 2020-12-06
+      - uses: JasonEtco/create-an-issue@5d9504915f79f9cc6d791934b8ef34f2353dd74d # v2.5.0, 2020-12-06
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
@@ -1,269 +1,3 @@
-Synapse 1.74.0rc1 (2022-12-13)
-==============================
-
-Features
--------
-
- Improve user search for international display names. ([\#14464](https://github.com/matrix-org/synapse/issues/14464))
- Stop using deprecated `keyIds` parameter when calling `/_matrix/key/v2/server`. ([\#14490](https://github.com/matrix-org/synapse/issues/14490), [\#14525](https://github.com/matrix-org/synapse/issues/14525))
- Add new `push.enabled` config option to allow opting out of push notification calculation. ([\#14551](https://github.com/matrix-org/synapse/issues/14551), [\#14619](https://github.com/matrix-org/synapse/issues/14619))
- Advertise support for Matrix 1.5 on `/_matrix/client/versions`. ([\#14576](https://github.com/matrix-org/synapse/issues/14576))
- Improve opentracing and logging for to-device message handling. ([\#14598](https://github.com/matrix-org/synapse/issues/14598))
- Allow selecting "prejoin" events by state keys in addition to event types. ([\#14642](https://github.com/matrix-org/synapse/issues/14642))
-
-
-Bugfixes
--------
-
- Fix a long-standing bug where a device list update might not be sent to clients in certain circumstances. ([\#14435](https://github.com/matrix-org/synapse/issues/14435), [\#14592](https://github.com/matrix-org/synapse/issues/14592), [\#14604](https://github.com/matrix-org/synapse/issues/14604))
- Suppress a spurious warning when `POST /rooms/<room_id>/<membership>/`, `POST /join/<room_id_or_alias`, or the unspecced `PUT /join/<room_id_or_alias>/<txn_id>` receive an empty HTTP request body. ([\#14600](https://github.com/matrix-org/synapse/issues/14600))
- Return spec-compliant JSON errors when unknown endpoints are requested. ([\#14620](https://github.com/matrix-org/synapse/issues/14620), [\#14621](https://github.com/matrix-org/synapse/issues/14621))
- Update html templates to load images over HTTPS. Contributed by @ashfame. ([\#14625](https://github.com/matrix-org/synapse/issues/14625))
- Fix a long-standing bug where the user directory would return 1 more row than requested. ([\#14631](https://github.com/matrix-org/synapse/issues/14631))
- Reject invalid read receipt requests with empty room or event IDs. Contributed by Nick @ Beeper (@fizzadar). ([\#14632](https://github.com/matrix-org/synapse/issues/14632))
- Fix a bug introduced in Synapse 1.67.0 where not specifying a config file or a server URL would lead to the `register_new_matrix_user` script failing. ([\#14637](https://github.com/matrix-org/synapse/issues/14637))
- Fix a long-standing bug where the user directory and room/user stats might be out of sync. ([\#14639](https://github.com/matrix-org/synapse/issues/14639), [\#14643](https://github.com/matrix-org/synapse/issues/14643))
- Fix a bug introduced in Synapse 1.72.0 where the background updates to add non-thread unique indexes on receipts would fail if they were previously interrupted. ([\#14650](https://github.com/matrix-org/synapse/issues/14650))
- Improve validation of field size limits in events. ([\#14664](https://github.com/matrix-org/synapse/issues/14664))
- Fix bugs introduced in Synapse 1.55.0 and 1.69.0 where application services would not be notified of events in the correct rooms, due to stale caches. ([\#14670](https://github.com/matrix-org/synapse/issues/14670))
-
-
-Improved Documentation
----------------------
-
- Update worker settings for `pusher` and `federation_sender` functionality. ([\#14493](https://github.com/matrix-org/synapse/issues/14493))
- Add links to third party package repositories, and point to the bug which highlights Ubuntu's out-of-date packages. ([\#14517](https://github.com/matrix-org/synapse/issues/14517))
- Remove old, incorrect minimum postgres version note and replace with a link to the [Dependency Deprecation Policy](https://matrix-org.github.io/synapse/v1.73/deprecation_policy.html). ([\#14590](https://github.com/matrix-org/synapse/issues/14590))
- Add Single-Sign On setup instructions for Mastodon-based instances. ([\#14594](https://github.com/matrix-org/synapse/issues/14594))
- Change `turn_allow_guests` example value to lowercase `true`. ([\#14634](https://github.com/matrix-org/synapse/issues/14634))
-
-
-Internal Changes
----------------
-
- Optimise push badge count calculations. Contributed by Nick @ Beeper (@fizzadar). ([\#14255](https://github.com/matrix-org/synapse/issues/14255))
- Faster remote room joins: stream the un-partial-stating of rooms over replication. ([\#14473](https://github.com/matrix-org/synapse/issues/14473), [\#14474](https://github.com/matrix-org/synapse/issues/14474))
- Share the `ClientRestResource` for both workers and the main process. ([\#14528](https://github.com/matrix-org/synapse/issues/14528))
- Add `--editable` flag to `complement.sh` which uses an editable install of Synapse for faster turn-around times whilst developing iteratively. ([\#14548](https://github.com/matrix-org/synapse/issues/14548))
- Faster joins: use servers list approximation to send read receipts when in partial state instead of waiting for the full state of the room. ([\#14549](https://github.com/matrix-org/synapse/issues/14549))
- Modernize unit tests configuration related to workers. ([\#14568](https://github.com/matrix-org/synapse/issues/14568))
- Bump jsonschema from 4.17.0 to 4.17.3. ([\#14591](https://github.com/matrix-org/synapse/issues/14591))
- Fix Rust lint CI. ([\#14602](https://github.com/matrix-org/synapse/issues/14602))
- Bump JasonEtco/create-an-issue from 2.5.0 to 2.8.1. ([\#14607](https://github.com/matrix-org/synapse/issues/14607))
- Alter some unit test environment parameters to decrease time spent running tests. ([\#14610](https://github.com/matrix-org/synapse/issues/14610))
- Switch to Go recommended installation method for `gotestfmt` template in CI. ([\#14611](https://github.com/matrix-org/synapse/issues/14611))
- Bump phonenumbers from 8.13.0 to 8.13.1. ([\#14612](https://github.com/matrix-org/synapse/issues/14612))
- Bump types-setuptools from 65.5.0.3 to 65.6.0.1. ([\#14613](https://github.com/matrix-org/synapse/issues/14613))
- Bump twine from 4.0.1 to 4.0.2. ([\#14614](https://github.com/matrix-org/synapse/issues/14614))
- Bump types-requests from 2.28.11.2 to 2.28.11.5. ([\#14615](https://github.com/matrix-org/synapse/issues/14615))
- Bump cryptography from 38.0.3 to 38.0.4. ([\#14616](https://github.com/matrix-org/synapse/issues/14616))
- Remove useless cargo install with apt from Dockerfile. ([\#14636](https://github.com/matrix-org/synapse/issues/14636))
- Bump certifi from 2021.10.8 to 2022.12.7. ([\#14645](https://github.com/matrix-org/synapse/issues/14645))
- Bump flake8-bugbear from 22.10.27 to 22.12.6. ([\#14656](https://github.com/matrix-org/synapse/issues/14656))
- Bump packaging from 21.3 to 22.0. ([\#14657](https://github.com/matrix-org/synapse/issues/14657))
- Bump types-pillow from 9.3.0.1 to 9.3.0.4. ([\#14658](https://github.com/matrix-org/synapse/issues/14658))
- Bump serde from 1.0.148 to 1.0.150. ([\#14659](https://github.com/matrix-org/synapse/issues/14659))
- Bump phonenumbers from 8.13.1 to 8.13.2. ([\#14660](https://github.com/matrix-org/synapse/issues/14660))
- Bump authlib from 1.1.0 to 1.2.0. ([\#14661](https://github.com/matrix-org/synapse/issues/14661))
- Move `StateFilter` to `synapse.types`. ([\#14668](https://github.com/matrix-org/synapse/issues/14668))
- Improve type hints. ([\#14597](https://github.com/matrix-org/synapse/issues/14597), [\#14646](https://github.com/matrix-org/synapse/issues/14646), [\#14671](https://github.com/matrix-org/synapse/issues/14671))
-
-
-Synapse 1.73.0 (2022-12-06)
-===========================
-
-Please note that legacy Prometheus metric names have been removed in this release; see [the upgrade notes](https://github.com/matrix-org/synapse/blob/release-v1.73/docs/upgrade.md#legacy-prometheus-metric-names-have-now-been-removed) for more details.
-
-No significant changes since 1.73.0rc2.
-
-
-Synapse 1.73.0rc2 (2022-12-01)
-==============================
-
-Bugfixes
--------
-
- Fix a regression in Synapse 1.73.0rc1 where Synapse's main process would stop responding to HTTP requests when a user with a large number of devices logs in. ([\#14582](https://github.com/matrix-org/synapse/issues/14582))
-
-
-Synapse 1.73.0rc1 (2022-11-29)
-==============================
-
-Features
--------
-
- Speed-up `/messages` with `filter_events_for_client` optimizations. ([\#14527](https://github.com/matrix-org/synapse/issues/14527))
- Improve DB performance by reducing amount of data that gets read in `device_lists_changes_in_room`. ([\#14534](https://github.com/matrix-org/synapse/issues/14534))
- Add support for handling avatar in SSO OIDC login. Contributed by @ashfame. ([\#13917](https://github.com/matrix-org/synapse/issues/13917))
- Move MSC3030 `/timestamp_to_event` endpoints to stable `v1` location (`/_matrix/client/v1/rooms/<roomID>/timestamp_to_event?ts=<timestamp>&dir=<direction>`, `/_matrix/federation/v1/timestamp_to_event/<roomID>?ts=<timestamp>&dir=<direction>`). ([\#14471](https://github.com/matrix-org/synapse/issues/14471))
- Reduce database load of [Client-Server endpoints](https://spec.matrix.org/v1.5/client-server-api/#aggregations) which return bundled aggregations. ([\#14491](https://github.com/matrix-org/synapse/issues/14491), [\#14508](https://github.com/matrix-org/synapse/issues/14508), [\#14510](https://github.com/matrix-org/synapse/issues/14510))
- Add unstable support for an Extensible Events room version (`org.matrix.msc1767.10`) via [MSC1767](https://github.com/matrix-org/matrix-spec-proposals/pull/1767), [MSC3931](https://github.com/matrix-org/matrix-spec-proposals/pull/3931), [MSC3932](https://github.com/matrix-org/matrix-spec-proposals/pull/3932), and [MSC3933](https://github.com/matrix-org/matrix-spec-proposals/pull/3933). ([\#14520](https://github.com/matrix-org/synapse/issues/14520), [\#14521](https://github.com/matrix-org/synapse/issues/14521), [\#14524](https://github.com/matrix-org/synapse/issues/14524))
- Prune user's old devices on login if they have too many. ([\#14038](https://github.com/matrix-org/synapse/issues/14038), [\#14580](https://github.com/matrix-org/synapse/issues/14580))
-
-
-Bugfixes
--------
-
- Fix a long-standing bug where paginating from the start of a room did not work. Contributed by @gnunicorn. ([\#14149](https://github.com/matrix-org/synapse/issues/14149))
- Fix a bug introduced in Synapse 1.58.0 where a user with presence state `org.matrix.msc3026.busy` would mistakenly be set to `online` when calling `/sync` or `/events` on a worker process. ([\#14393](https://github.com/matrix-org/synapse/issues/14393))
- Fix a bug introduced in Synapse 1.70.0 where a receipt's thread ID was not sent over federation. ([\#14466](https://github.com/matrix-org/synapse/issues/14466))
- Fix a long-standing bug where the [List media admin API](https://matrix-org.github.io/synapse/latest/admin_api/media_admin_api.html#list-all-media-in-a-room) would fail when processing an image with broken thumbnail information. ([\#14537](https://github.com/matrix-org/synapse/issues/14537))
- Fix a bug introduced in Synapse 1.67.0 where two logging context warnings would be logged on startup. ([\#14574](https://github.com/matrix-org/synapse/issues/14574))
- In application service transactions that include the experimental `org.matrix.msc3202.device_one_time_key_counts` key, include a duplicate key of `org.matrix.msc3202.device_one_time_keys_count` to match the name proposed by [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). ([\#14565](https://github.com/matrix-org/synapse/issues/14565))
- Fix a bug introduced in Synapse 0.9 where Synapse would fail to fetch server keys whose IDs contain a forward slash. ([\#14490](https://github.com/matrix-org/synapse/issues/14490))
-
-
-Improved Documentation
----------------------
-
- Fixed link to 'Synapse administration endpoints'. ([\#14499](https://github.com/matrix-org/synapse/issues/14499))
-
-
-Deprecations and Removals
-------------------------
-
- Remove legacy Prometheus metrics names. They were deprecated in Synapse v1.69.0 and disabled by default in Synapse v1.71.0. ([\#14538](https://github.com/matrix-org/synapse/issues/14538))
-
-
-Internal Changes
----------------
-
- Improve type hinting throughout Synapse. ([\#14055](https://github.com/matrix-org/synapse/issues/14055), [\#14412](https://github.com/matrix-org/synapse/issues/14412), [\#14529](https://github.com/matrix-org/synapse/issues/14529), [\#14452](https://github.com/matrix-org/synapse/issues/14452)).
- Remove old stream ID tracking code. Contributed by Nick @Beeper (@fizzadar). ([\#14376](https://github.com/matrix-org/synapse/issues/14376), [\#14468](https://github.com/matrix-org/synapse/issues/14468))
- Remove the `worker_main_http_uri` configuration setting. This is now handled via internal replication. ([\#14400](https://github.com/matrix-org/synapse/issues/14400), [\#14476](https://github.com/matrix-org/synapse/issues/14476))
- Refactor `federation_sender` and `pusher` configuration loading. ([\#14496](https://github.com/matrix-org/synapse/issues/14496))
-([\#14509](https://github.com/matrix-org/synapse/issues/14509), [\#14573](https://github.com/matrix-org/synapse/issues/14573))
- Faster joins: do not wait for full state when creating events to send. ([\#14403](https://github.com/matrix-org/synapse/issues/14403))
- Faster joins: filter out non local events when a room doesn't have its full state. ([\#14404](https://github.com/matrix-org/synapse/issues/14404))
- Faster joins: send events to initial list of servers if we don't have the full state yet. ([\#14408](https://github.com/matrix-org/synapse/issues/14408))
- Faster joins: use servers list approximation received during `send_join` (potentially updated with received membership events) in `assert_host_in_room`. ([\#14515](https://github.com/matrix-org/synapse/issues/14515))
- Fix type logic in TCP replication code that prevented correctly ignoring blank commands. ([\#14449](https://github.com/matrix-org/synapse/issues/14449))
- Remove option to skip locking of tables when performing emulated upserts, to avoid a class of bugs in future. ([\#14469](https://github.com/matrix-org/synapse/issues/14469))
- `scripts-dev/federation_client`: Fix routing on servers with `.well-known` files. ([\#14479](https://github.com/matrix-org/synapse/issues/14479))
- Reduce default third party invite rate limit to 216 invites per day. ([\#14487](https://github.com/matrix-org/synapse/issues/14487))
- Refactor conversion of device list changes in room to outbound pokes to track unconverted rows using a `(stream ID, room ID)` position instead of updating the `converted_to_destinations` flag on every row. ([\#14516](https://github.com/matrix-org/synapse/issues/14516))
- Add more prompts to the bug report form. ([\#14522](https://github.com/matrix-org/synapse/issues/14522))
- Extend editorconfig rules on indent and line length to `.pyi` files. ([\#14526](https://github.com/matrix-org/synapse/issues/14526))
- Run Rust CI when `Cargo.lock` changes. This is particularly useful for dependabot updates. ([\#14571](https://github.com/matrix-org/synapse/issues/14571))
- Fix a possible variable shadow in `create_new_client_event`. ([\#14575](https://github.com/matrix-org/synapse/issues/14575))
- Bump various dependencies in the `poetry.lock` file and in CI scripts. ([\#14557](https://github.com/matrix-org/synapse/issues/14557), [\#14559](https://github.com/matrix-org/synapse/issues/14559), [\#14560](https://github.com/matrix-org/synapse/issues/14560), [\#14500](https://github.com/matrix-org/synapse/issues/14500), [\#14501](https://github.com/matrix-org/synapse/issues/14501), [\#14502](https://github.com/matrix-org/synapse/issues/14502), [\#14503](https://github.com/matrix-org/synapse/issues/14503), [\#14504](https://github.com/matrix-org/synapse/issues/14504), [\#14505](https://github.com/matrix-org/synapse/issues/14505)).
-
-
-Synapse 1.72.0 (2022-11-22)
-===========================
-
-Please note that Synapse now only supports PostgreSQL 11+, because PostgreSQL 10 has reached end-of-life, c.f. our [Deprecation Policy](https://github.com/matrix-org/synapse/blob/develop/docs/deprecation_policy.md).
-
-Bugfixes
--------
-
- Update forgotten references to legacy metrics in the included Grafana dashboard. ([\#14477](https://github.com/matrix-org/synapse/issues/14477))
-
-
-Synapse 1.72.0rc1 (2022-11-16)
-==============================
-
-Features
--------
-
- Add experimental support for [MSC3912](https://github.com/matrix-org/matrix-spec-proposals/pull/3912): Relation-based redactions. ([\#14260](https://github.com/matrix-org/synapse/issues/14260))
- Build Debian packages for Ubuntu 22.10 (Kinetic Kudu). ([\#14396](https://github.com/matrix-org/synapse/issues/14396))
- Add an [Admin API](https://matrix-org.github.io/synapse/latest/usage/administration/admin_api/index.html) endpoint for user lookup based on third-party ID (3PID). Contributed by @ashfame. ([\#14405](https://github.com/matrix-org/synapse/issues/14405))
- Faster joins: include heroes' membership events in the partial join response, for rooms without a name or canonical alias. ([\#14442](https://github.com/matrix-org/synapse/issues/14442))
-
-
-Bugfixes
--------
-
- Faster joins: do not block creation of or queries for room aliases during the resync. ([\#14292](https://github.com/matrix-org/synapse/issues/14292))
- Fix a bug introduced in Synapse 1.64.0rc1 which could cause log spam when fetching events from other homeservers. ([\#14347](https://github.com/matrix-org/synapse/issues/14347))
- Fix a bug introduced in 1.66 which would not send certain pushrules to clients. Contributed by Nico. ([\#14356](https://github.com/matrix-org/synapse/issues/14356))
- Fix a bug introduced in v1.71.0rc1 where the power level event was incorrectly created during initial room creation. ([\#14361](https://github.com/matrix-org/synapse/issues/14361))
- Fix the refresh token endpoint to be under /r0 and /v3 instead of /v1. Contributed by Tulir @ Beeper. ([\#14364](https://github.com/matrix-org/synapse/issues/14364))
- Fix a long-standing bug where Synapse would raise an error when encountering an unrecognised field in a `/sync` filter, instead of ignoring it for forward compatibility. ([\#14369](https://github.com/matrix-org/synapse/issues/14369))
- Fix a background database update, introduced in Synapse 1.64.0, which could cause poor database performance. ([\#14374](https://github.com/matrix-org/synapse/issues/14374))
- Fix PostgreSQL sometimes using table scans for queries against the `event_search` table, taking a long time and a large amount of IO. ([\#14409](https://github.com/matrix-org/synapse/issues/14409))
- Fix rendering of some HTML templates (including emails). Introduced in v1.71.0. ([\#14448](https://github.com/matrix-org/synapse/issues/14448))
- Fix a bug introduced in Synapse 1.70.0 where the background updates to add non-thread unique indexes on receipts could fail when upgrading from 1.67.0 or earlier. ([\#14453](https://github.com/matrix-org/synapse/issues/14453))
-
-
-Updates to the Docker image
---------------------------
-
- Add all Stream Writer worker types to `configure_workers_and_start.py`. ([\#14197](https://github.com/matrix-org/synapse/issues/14197))
- Remove references to legacy worker types in the multi-worker Dockerfile. ([\#14294](https://github.com/matrix-org/synapse/issues/14294))
-
-
-Improved Documentation
----------------------
-
- Upload documentation PRs to Netlify. ([\#12947](https://github.com/matrix-org/synapse/issues/12947), [\#14370](https://github.com/matrix-org/synapse/issues/14370))
- Add addtional TURN server configuration example based on [eturnal](https://github.com/processone/eturnal) and adjust general TURN server doc structure. ([\#14293](https://github.com/matrix-org/synapse/issues/14293))
- Add example on how to load balance /sync requests. Contributed by [aceArt](https://aceart.de). ([\#14297](https://github.com/matrix-org/synapse/issues/14297))
- Edit sample Nginx reverse proxy configuration to use HTTP/1.1. Contributed by Brad Jones. ([\#14414](https://github.com/matrix-org/synapse/issues/14414))
-
-
-Deprecations and Removals
-------------------------
-
- Remove support for PostgreSQL 10. ([\#14392](https://github.com/matrix-org/synapse/issues/14392), [\#14397](https://github.com/matrix-org/synapse/issues/14397))
-
-
-Internal Changes
----------------
-
- Run unit tests against Python 3.11. ([\#13812](https://github.com/matrix-org/synapse/issues/13812))
- Add TLS support for generic worker endpoints. ([\#14128](https://github.com/matrix-org/synapse/issues/14128), [\#14455](https://github.com/matrix-org/synapse/issues/14455))
- Switch to a maintained action for installing Rust in CI. ([\#14313](https://github.com/matrix-org/synapse/issues/14313))
- Add override ability to `complement.sh` command line script to request certain types of workers. ([\#14324](https://github.com/matrix-org/synapse/issues/14324))
- Enabling testing of [MSC3874](https://github.com/matrix-org/matrix-spec-proposals/pull/3874) (filtering of `/messages` by relation type) in complement. ([\#14339](https://github.com/matrix-org/synapse/issues/14339))
- Concisely log a failure to resolve state due to missing `prev_events`. ([\#14346](https://github.com/matrix-org/synapse/issues/14346))
- Use a maintained Github action to install Rust. ([\#14351](https://github.com/matrix-org/synapse/issues/14351))
- Cleanup old worker datastore classes. Contributed by Nick @ Beeper (@fizzadar). ([\#14375](https://github.com/matrix-org/synapse/issues/14375))
- Test against PostgreSQL 15 in CI. ([\#14394](https://github.com/matrix-org/synapse/issues/14394))
- Remove unreachable code. ([\#14410](https://github.com/matrix-org/synapse/issues/14410))
- Clean-up event persistence code. ([\#14411](https://github.com/matrix-org/synapse/issues/14411))
- Update docstring to clarify that `get_partial_state_events_batch` does not just give you completely arbitrary partial-state events. ([\#14417](https://github.com/matrix-org/synapse/issues/14417))
- Fix mypy errors introduced by bumping the locked version of `attrs` and `gitpython`. ([\#14433](https://github.com/matrix-org/synapse/issues/14433))
- Make Dependabot only bump Rust deps in the lock file. ([\#14434](https://github.com/matrix-org/synapse/issues/14434))
- Fix an incorrect stub return type for `PushRuleEvaluator.run`. ([\#14451](https://github.com/matrix-org/synapse/issues/14451))
- Improve performance of `/context` in large rooms. ([\#14461](https://github.com/matrix-org/synapse/issues/14461))
-
-
-Synapse 1.71.0 (2022-11-08)
-===========================
-
-Please note that, as announced in the release notes for Synapse 1.69.0, legacy Prometheus metric names are now disabled by default.
-They will be removed altogether in Synapse 1.73.0.
-If not already done, server administrators should update their dashboards and alerting rules to avoid using the deprecated metric names.
-See the [upgrade notes](https://matrix-org.github.io/synapse/v1.71/upgrade.html#upgrading-to-v1710) for more details.
-
-**Note:** in line with our [deprecation policy](https://matrix-org.github.io/synapse/latest/deprecation_policy.html) for platform dependencies, this will be the last release to support PostgreSQL 10, which reaches upstream end-of-life on November 10th, 2022. Future releases of Synapse will require PostgreSQL 11+.
-
-No significant changes since 1.71.0rc2.
-
-
-Synapse 1.71.0rc2 (2022-11-04)
-==============================
-
-Improved Documentation
----------------------
-
- Document the changes to monthly active user metrics due to deprecation of legacy Prometheus metric names. ([\#14358](https://github.com/matrix-org/synapse/issues/14358), [\#14360](https://github.com/matrix-org/synapse/issues/14360))
-
-
-Deprecations and Removals
-------------------------
-
- Disable legacy Prometheus metric names by default. They can still be re-enabled for now, but they will be removed altogether in Synapse 1.73.0. ([\#14353](https://github.com/matrix-org/synapse/issues/14353))
-
-
-Internal Changes
----------------
-
- Run unit tests against Python 3.11. ([\#13812](https://github.com/matrix-org/synapse/issues/13812))
-
-
 Synapse 1.71.0rc1 (2022-11-01)
 ==============================

@@ -1670,7 +1404,7 @@ Internal Changes
 Synapse 1.59.1 (2022-05-18)
 ===========================

-This release fixes a long-standing issue which could prevent Synapse's user directory for updating properly.
+This release fixes a long-standing issue which could prevent Synapse's user directory from updating properly.

 Bugfixes
 ----------------
@@ -37,9 +37,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "blake2"
-version = "0.10.5"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b12e5fd123190ce1c2e559308a94c9bacad77907d4c6005d9e58fe1a0689e55e"
+checksum = "b9cf849ee05b2ee5fba5e36f97ff8ec2533916700fc0758d40d92136a42f3388"
 dependencies = [
 "digest",
 ]
@@ -194,9 +194,9 @@ dependencies = [

 [[package]]
 name = "pyo3"
-version = "0.17.3"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "268be0c73583c183f2b14052337465768c07726936a260f480f0857cb95ba543"
+checksum = "201b6887e5576bf2f945fe65172c1fcbf3fcf285b23e4d71eb171d9736e38d32"
 dependencies = [
 "anyhow",
 "cfg-if",
@@ -212,9 +212,9 @@ dependencies = [

 [[package]]
 name = "pyo3-build-config"
-version = "0.17.3"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28fcd1e73f06ec85bf3280c48c67e731d8290ad3d730f8be9dc07946923005c8"
+checksum = "bf0708c9ed01692635cbf056e286008e5a2927ab1a5e48cdd3aeb1ba5a6fef47"
 dependencies = [
 "once_cell",
 "target-lexicon",
@@ -222,9 +222,9 @@ dependencies = [

 [[package]]
 name = "pyo3-ffi"
-version = "0.17.3"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f6cb136e222e49115b3c51c32792886defbfb0adead26a688142b346a0b9ffc"
+checksum = "90352dea4f486932b72ddf776264d293f85b79a1d214de1d023927b41461132d"
 dependencies = [
 "libc",
 "pyo3-build-config",
@@ -243,9 +243,9 @@ dependencies = [

 [[package]]
 name = "pyo3-macros"
-version = "0.17.3"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94144a1266e236b1c932682136dc35a9dee8d3589728f68130c7c3861ef96b28"
+checksum = "7eb24b804a2d9e88bfcc480a5a6dd76f006c1e3edaf064e8250423336e2cd79d"
 dependencies = [
 "proc-macro2",
 "pyo3-macros-backend",
@@ -255,9 +255,9 @@ dependencies = [

 [[package]]
 name = "pyo3-macros-backend"
-version = "0.17.3"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8df9be978a2d2f0cdebabb03206ed73b11314701a5bfe71b0d753b81997777f"
+checksum = "f22bb49f6a7348c253d7ac67a6875f2dc65f36c2ae64a82c381d528972bea6d6"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -294,9 +294,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.7.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e076559ef8e241f2ae3479e36f97bd5741c0330689e217ad51ce2c76808b868a"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -323,18 +323,18 @@ checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"

 [[package]]
 name = "serde"
-version = "1.0.150"
+version = "1.0.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e326c9ec8042f1b5da33252c8a37e9ffbd2c9bef0155215b6e6c80c790e05f91"
+checksum = "d193d69bae983fc11a79df82342761dfbf28a99fc8d203dca4c3c1b590948965"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.150"
+version = "1.0.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42a3df25b0713732468deadad63ab9da1f1fd75a48a15024b50363f128db627e"
+checksum = "4f1d362ca8fc9c3e3a7484440752472d68a6caa98f1ab81d99b5dfe517cec852"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -343,9 +343,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.89"
+version = "1.0.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020ff22c755c2ed3f8cf162dbb41a7268d934702f3ed3631656ea597e08fc3db"
+checksum = "6ce777b7b150d76b9cf60d28b55f5847135a003f7d7350c6be7a773508ce7d45"
 dependencies = [
 "itoa",
 "ryu",
@@ -366,9 +366,9 @@ checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"

 [[package]]
 name = "syn"
-version = "1.0.104"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae548ec36cf198c0ef7710d3c230987c2d6d7bd98ad6edc0274462724c585ce"
+checksum = "3fcd952facd492f9be3ef0d0b7032a6e442ee9b361d4acc2b1d0c4aaa5f613a1"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -0,0 +1 @@
+Fix a performance regression in `/sync` handling, introduced in 1.49.0.
@@ -1,53 +1,3 @@
-matrix-synapse-py3 (1.74.0~rc1) stable; urgency=medium
-
-  * New dependency on libicu-dev to provide improved results for user
-    search.
-  * New Synapse release 1.74.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 13 Dec 2022 13:30:01 +0000
-
-matrix-synapse-py3 (1.73.0) stable; urgency=medium
-
-  * New Synapse release 1.73.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 06 Dec 2022 11:48:56 +0000
-
-matrix-synapse-py3 (1.73.0~rc2) stable; urgency=medium
-
-  * New Synapse release 1.73.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Thu, 01 Dec 2022 10:02:19 +0000
-
-matrix-synapse-py3 (1.73.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.73.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 29 Nov 2022 12:28:13 +0000
-
-matrix-synapse-py3 (1.72.0) stable; urgency=medium
-
-  * New Synapse release 1.72.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 22 Nov 2022 10:57:30 +0000
-
-matrix-synapse-py3 (1.72.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.72.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 16 Nov 2022 15:10:59 +0000
-
-matrix-synapse-py3 (1.71.0) stable; urgency=medium
-
-  * New Synapse release 1.71.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 08 Nov 2022 10:38:10 +0000
-
-matrix-synapse-py3 (1.71.0~rc2) stable; urgency=medium
-
-  * New Synapse release 1.71.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Fri, 04 Nov 2022 12:00:33 +0000
-
 matrix-synapse-py3 (1.71.0~rc1) stable; urgency=medium

  * New Synapse release 1.71.0rc1.
@@ -8,8 +8,6 @@ Build-Depends:
 dh-virtualenv (>= 1.1),
 libsystemd-dev,
 libpq-dev,
- libicu-dev,
- pkg-config,
 lsb-release,
 python3-dev,
 python3,
@@ -43,7 +43,7 @@ RUN \
   --mount=type=cache,target=/var/cache/apt,sharing=locked \
   --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update -qq && apt-get install -yqq \
-      build-essential git libffi-dev libssl-dev \
+      build-essential cargo git libffi-dev libssl-dev \
    && rm -rf /var/lib/apt/lists/*

 # We install poetry in its own build stage to avoid its dependencies conflicting with
@@ -97,8 +97,6 @@ RUN \
    zlib1g-dev \
    git \
    curl \
-    libicu-dev \
-    pkg-config \
    && rm -rf /var/lib/apt/lists/*


@@ -84,8 +84,6 @@ RUN apt-get update -qq -o Acquire::Languages=none \
        python3-venv \
        sqlite3 \
        libpq-dev \
-        libicu-dev \
-        pkg-config \
        xmlsec1

 # Install rust and ensure it's in the PATH
@@ -1,7 +1,6 @@
 # syntax=docker/dockerfile:1

 ARG SYNAPSE_VERSION=latest
-ARG FROM=matrixdotorg/synapse:$SYNAPSE_VERSION

 # first of all, we create a base image with an nginx which we can copy into the
 # target image. For repeated rebuilds, this is much faster than apt installing
@@ -24,7 +23,7 @@ FROM debian:bullseye-slim AS deps_base
 FROM redis:6-bullseye AS redis_base

 # now build the final image, based on the the regular Synapse docker image
-FROM $FROM
+FROM matrixdotorg/synapse:$SYNAPSE_VERSION

    # Install supervisord with pip instead of apt, to avoid installing a second
    # copy of python.
@@ -7,9 +7,8 @@
 # https://github.com/matrix-org/synapse/blob/develop/docker/README-testing.md#testing-with-postgresql-and-single-or-multi-process-synapse

 ARG SYNAPSE_VERSION=latest
-ARG FROM=matrixdotorg/synapse-workers:$SYNAPSE_VERSION

-FROM $FROM
+FROM matrixdotorg/synapse-workers:$SYNAPSE_VERSION
    # First of all, we copy postgres server from the official postgres image,
    # since for repeated rebuilds, this is much faster than apt installing
    # postgres each time.
@@ -45,12 +45,7 @@ esac

 if [[ -n "$SYNAPSE_COMPLEMENT_USE_WORKERS" ]]; then
  # Specify the workers to test with
-  # Allow overriding by explicitly setting SYNAPSE_WORKER_TYPES outside, while still
-  # utilizing WORKERS=1 for backwards compatibility.
-  # -n True if the length of string is non-zero.
-  # -z True if the length of string is zero.
-  if [[ -z "$SYNAPSE_WORKER_TYPES" ]]; then
-    export SYNAPSE_WORKER_TYPES="\
+  export SYNAPSE_WORKER_TYPES="\
      event_persister, \
      event_persister, \
      background_worker, \
@@ -66,8 +61,6 @@ if [[ -n "$SYNAPSE_COMPLEMENT_USE_WORKERS" ]]; then
      appservice, \
      pusher"

-  fi
-  log "Workers requested: $SYNAPSE_WORKER_TYPES"
  # Improve startup times by using a launcher based on fork()
  export SYNAPSE_USE_EXPERIMENTAL_FORKING_LAUNCHER=1
 else
@@ -92,6 +92,8 @@ allow_device_name_lookup_over_federation: true
 ## Experimental Features ##

 experimental_features:
+  # Enable spaces support
+  spaces_enabled: true
  # Enable history backfilling support
  msc2716_enabled: true
  # server-side support for partial state in /send_join responses
@@ -100,8 +102,8 @@ experimental_features:
  # client-side support for partial state in /send_join responses
  faster_joins: true
  {% endif %}
-  # Filtering /messages by relation type.
-  msc3874_enabled: true
+  # Enable jump to date endpoint
+  msc3030_enabled: true

 server_notices:
  system_mxid_localpart: _server
@@ -20,7 +20,7 @@
 #   * SYNAPSE_SERVER_NAME: The desired server_name of the homeserver.
 #   * SYNAPSE_REPORT_STATS: Whether to report stats.
 #   * SYNAPSE_WORKER_TYPES: A comma separated list of worker names as specified in WORKER_CONFIG
-#         below. Leave empty for no workers.
+#         below. Leave empty for no workers, or set to '*' for all possible workers.
 #   * SYNAPSE_AS_REGISTRATION_DIR: If specified, a directory in which .yaml and .yml files
 #         will be treated as Application Service registration files.
 #   * SYNAPSE_TLS_CERT: Path to a TLS certificate in PEM format.
@@ -50,18 +50,13 @@ from jinja2 import Environment, FileSystemLoader

 MAIN_PROCESS_HTTP_LISTENER_PORT = 8080

-# Workers with exposed endpoints needs either "client", "federation", or "media" listener_resources
-# Watching /_matrix/client needs a "client" listener
-# Watching /_matrix/federation needs a "federation" listener
-# Watching /_matrix/media and related needs a "media" listener
-# Stream Writers require "client" and "replication" listeners because they
-#   have to attach by instance_map to the master process and have client endpoints.
+
 WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
    "pusher": {
-        "app": "synapse.app.generic_worker",
+        "app": "synapse.app.pusher",
        "listener_resources": [],
        "endpoint_patterns": [],
-        "shared_extra_conf": {},
+        "shared_extra_conf": {"start_pushers": False},
        "worker_extra_conf": "",
    },
    "user_dir": {
@@ -84,11 +79,7 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
            "^/_synapse/admin/v1/media/.*$",
            "^/_synapse/admin/v1/quarantine_media/.*$",
        ],
-        # The first configured media worker will run the media background jobs
-        "shared_extra_conf": {
-            "enable_media_repo": False,
-            "media_instance_running_background_jobs": "media_repository1",
-        },
+        "shared_extra_conf": {"enable_media_repo": False},
        "worker_extra_conf": "enable_media_repo: true",
    },
    "appservice": {
@@ -99,10 +90,10 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
        "worker_extra_conf": "",
    },
    "federation_sender": {
-        "app": "synapse.app.generic_worker",
+        "app": "synapse.app.federation_sender",
        "listener_resources": [],
        "endpoint_patterns": [],
-        "shared_extra_conf": {},
+        "shared_extra_conf": {"send_federation": False},
        "worker_extra_conf": "",
    },
    "synchrotron": {
@@ -140,7 +131,6 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
            "^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event",
            "^/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms",
            "^/_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases",
-            "^/_matrix/client/v1/rooms/.*/timestamp_to_event$",
            "^/_matrix/client/(api/v1|r0|v3|unstable)/search",
        ],
        "shared_extra_conf": {},
@@ -164,7 +154,6 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
            "^/_matrix/federation/(v1|v2)/invite/",
            "^/_matrix/federation/(v1|v2)/query_auth/",
            "^/_matrix/federation/(v1|v2)/event_auth/",
-            "^/_matrix/federation/v1/timestamp_to_event/",
            "^/_matrix/federation/(v1|v2)/exchange_third_party_invite/",
            "^/_matrix/federation/(v1|v2)/user/devices/",
            "^/_matrix/federation/(v1|v2)/get_groups_publicised$",
@@ -211,54 +200,14 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
        "worker_extra_conf": "",
    },
    "frontend_proxy": {
-        "app": "synapse.app.generic_worker",
+        "app": "synapse.app.frontend_proxy",
        "listener_resources": ["client", "replication"],
        "endpoint_patterns": ["^/_matrix/client/(api/v1|r0|v3|unstable)/keys/upload"],
        "shared_extra_conf": {},
-        "worker_extra_conf": "",
-    },
-    "account_data": {
-        "app": "synapse.app.generic_worker",
-        "listener_resources": ["client", "replication"],
-        "endpoint_patterns": [
-            "^/_matrix/client/(r0|v3|unstable)/.*/tags",
-            "^/_matrix/client/(r0|v3|unstable)/.*/account_data",
-        ],
-        "shared_extra_conf": {},
-        "worker_extra_conf": "",
-    },
-    "presence": {
-        "app": "synapse.app.generic_worker",
-        "listener_resources": ["client", "replication"],
-        "endpoint_patterns": ["^/_matrix/client/(api/v1|r0|v3|unstable)/presence/"],
-        "shared_extra_conf": {},
-        "worker_extra_conf": "",
-    },
-    "receipts": {
-        "app": "synapse.app.generic_worker",
-        "listener_resources": ["client", "replication"],
-        "endpoint_patterns": [
-            "^/_matrix/client/(r0|v3|unstable)/rooms/.*/receipt",
-            "^/_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers",
-        ],
-        "shared_extra_conf": {},
-        "worker_extra_conf": "",
-    },
-    "to_device": {
-        "app": "synapse.app.generic_worker",
-        "listener_resources": ["client", "replication"],
-        "endpoint_patterns": ["^/_matrix/client/(r0|v3|unstable)/sendToDevice/"],
-        "shared_extra_conf": {},
-        "worker_extra_conf": "",
-    },
-    "typing": {
-        "app": "synapse.app.generic_worker",
-        "listener_resources": ["client", "replication"],
-        "endpoint_patterns": [
-            "^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/typing"
-        ],
-        "shared_extra_conf": {},
-        "worker_extra_conf": "",
+        "worker_extra_conf": (
+            "worker_main_http_uri: http://127.0.0.1:%d"
+            % (MAIN_PROCESS_HTTP_LISTENER_PORT,)
+        ),
    },
 }

@@ -322,14 +271,14 @@ def convert(src: str, dst: str, **template_vars: object) -> None:
        outfile.write(rendered)


-def add_worker_roles_to_shared_config(
+def add_sharding_to_shared_config(
    shared_config: dict,
    worker_type: str,
    worker_name: str,
    worker_port: int,
 ) -> None:
    """Given a dictionary representing a config file shared across all workers,
-    append appropriate worker information to it for the current worker_type instance.
+    append sharded worker information to it for the current worker_type instance.

    Args:
        shared_config: The config dict that all worker instances share (after being converted to YAML)
@@ -360,19 +309,9 @@ def add_worker_roles_to_shared_config(
            "port": worker_port,
        }

-    elif worker_type in ["account_data", "presence", "receipts", "to_device", "typing"]:
-        # Update the list of stream writers
-        # It's convenient that the name of the worker type is the same as the stream to write
-        shared_config.setdefault("stream_writers", {}).setdefault(
-            worker_type, []
-        ).append(worker_name)
-
-        # Map of stream writer instance names to host/ports combos
-        # For now, all stream writers need http replication ports
-        instance_map[worker_name] = {
-            "host": "localhost",
-            "port": worker_port,
-        }
+    elif worker_type == "media_repository":
+        # The first configured media worker will run the media background jobs
+        shared_config.setdefault("media_instance_running_background_jobs", worker_name)


 def generate_base_homeserver_config() -> None:
@@ -482,7 +421,8 @@ def generate_worker_files(
        if worker_config:
            worker_config = worker_config.copy()
        else:
-            error(worker_type + " is an unknown worker type! Please fix!")
+            log(worker_type + " is an unknown worker type! It will be ignored")
+            continue

        new_worker_count = worker_type_counter.setdefault(worker_type, 0) + 1
        worker_type_counter[worker_type] = new_worker_count
@@ -501,11 +441,11 @@ def generate_worker_files(

        # Check if more than one instance of this worker type has been specified
        worker_type_total_count = worker_types.count(worker_type)
-
-        # Update the shared config with sharding-related options if necessary
-        add_worker_roles_to_shared_config(
-            shared_config, worker_type, worker_name, worker_port
-        )
+        if worker_type_total_count > 1:
+            # Update the shared config with sharding-related options if necessary
+            add_sharding_to_shared_config(
+                shared_config, worker_type, worker_name, worker_port
+            )

        # Enable the worker in supervisord
        worker_descriptors.append(worker_config)
@@ -1,75 +0,0 @@
-# syntax=docker/dockerfile:1
-# This dockerfile builds an editable install of Synapse.
-#
-# Used by `complement.sh`. Not suitable for production use.
-
-ARG PYTHON_VERSION=3.9
-
-###
-### Stage 0: generate requirements.txt
-###
-# We hardcode the use of Debian bullseye here because this could change upstream
-# and other Dockerfiles used for testing are expecting bullseye.
-FROM docker.io/python:${PYTHON_VERSION}-slim-bullseye
-
-# Install Rust and other dependencies (stolen from normal Dockerfile)
-# install the OS build deps
-RUN \
-   --mount=type=cache,target=/var/cache/apt,sharing=locked \
-   --mount=type=cache,target=/var/lib/apt,sharing=locked \
- apt-get update -qq && apt-get install -yqq \
-    build-essential \
-    libffi-dev \
-    libjpeg-dev \
-    libpq-dev \
-    libssl-dev \
-    libwebp-dev \
-    libxml++2.6-dev \
-    libxslt1-dev \
-    openssl \
-    zlib1g-dev \
-    git \
-    curl \
-    gosu \
-    libjpeg62-turbo \
-    libpq5 \
-    libwebp6 \
-    xmlsec1 \
-    libjemalloc2 \
-    && rm -rf /var/lib/apt/lists/*
-ENV RUSTUP_HOME=/rust
-ENV CARGO_HOME=/cargo
-ENV PATH=/cargo/bin:/rust/bin:$PATH
-RUN mkdir /rust /cargo
-RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain stable --profile minimal
-
-
-# Make a base copy of the editable source tree, so that we have something to
-# install and build now — even though it's going to be covered up by a mount
-# at runtime.
-COPY synapse /editable-src/synapse/
-COPY rust /editable-src/rust/
-# ... and what we need to `pip install`.
-COPY pyproject.toml poetry.lock README.rst build_rust.py Cargo.toml Cargo.lock /editable-src/
-
-RUN pip install poetry
-RUN poetry config virtualenvs.create false
-RUN cd /editable-src && poetry install --extras all
-
-# Make copies of useful things for inspection:
-# - the Rust module (must be copied to the editable source tree before startup)
-# - poetry.lock is useful for checking if dependencies have changed.
-RUN cp /editable-src/synapse/synapse_rust.abi3.so /synapse_rust.abi3.so.bak
-RUN cp /editable-src/poetry.lock /poetry.lock.bak
-
-
-### Extra setup from original Dockerfile
-COPY ./docker/start.py /start.py
-COPY ./docker/conf /conf
-
-EXPOSE 8008/tcp 8009/tcp 8448/tcp
-
-ENTRYPOINT ["/start.py"]
-
-HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
-    CMD curl -fSs http://localhost:8008/health || exit 1
@@ -9,8 +9,6 @@
  - [Configuring a Reverse Proxy](reverse_proxy.md)
  - [Configuring a Forward/Outbound Proxy](setup/forward_proxy.md)
  - [Configuring a Turn Server](turn-howto.md)
-    - [coturn TURN server](setup/turn/coturn.md)
-    - [eturnal TURN server](setup/turn/eturnal.md)
  - [Delegation](delegate.md)

 # Upgrading
@@ -1197,42 +1197,3 @@ Returns a `404` HTTP status code if no user was found, with a response body like
 ```

 _Added in Synapse 1.68.0._
-
-
-### Find a user based on their Third Party ID (ThreePID or 3PID)
-
-The API is:
-
-```
-GET /_synapse/admin/v1/threepid/$medium/users/$address
-```
-
-When a user matched the given address for the given medium, an HTTP code `200` with a response body like the following is returned:
-
-```json
-{
-    "user_id": "@hello:example.org"
-}
-```
-
-**Parameters**
-
-The following parameters should be set in the URL:
-
- `medium` - Kind of third-party ID, either `email` or `msisdn`.
- `address` - Value of the third-party ID.
-
-The `address` may have characters that are not URL-safe, so it is advised to URL-encode those parameters.
-
-**Errors**
-
-Returns a `404` HTTP status code if no user was found, with a response body like this:
-
-```json
-{
-    "errcode":"M_NOT_FOUND",
-    "error":"User not found"
-}
-```
-
-_Added in Synapse 1.72.0._
@@ -324,12 +324,6 @@ The above will run a monolithic (single-process) Synapse with SQLite as the data

 - Passing `POSTGRES=1` as an environment variable to use the Postgres database instead.
 - Passing `WORKERS=1` as an environment variable to use a workerised setup instead. This option implies the use of Postgres.
-  - If setting `WORKERS=1`, optionally set `WORKER_TYPES=` to declare which worker
-    types you wish to test. A simple comma-delimited string containing the worker types
-    defined from the `WORKERS_CONFIG` template in
-    [here](https://github.com/matrix-org/synapse/blob/develop/docker/configure_workers_and_start.py#L54).
-    A safe example would be `WORKER_TYPES="federation_inbound, federation_sender, synchrotron"`.
-    See the [worker documentation](../workers.md) for additional information on workers.

 To increase the log level for the tests, set `SYNAPSE_TEST_LOG_LEVEL`, e.g:
 ```sh
@@ -209,9 +209,6 @@ altogether in Synapse v1.73.0.**
 | synapse_http_httppusher_http_pushes_failed_total                             | synapse_http_httppusher_http_pushes_failed                             |
 | synapse_http_httppusher_badge_updates_processed_total                        | synapse_http_httppusher_badge_updates_processed                        |
 | synapse_http_httppusher_badge_updates_failed_total                           | synapse_http_httppusher_badge_updates_failed                           |
-| synapse_admin_mau_current                                                    | synapse_admin_mau:current                                              |
-| synapse_admin_mau_max                                                        | synapse_admin_mau:max                                                  |
-| synapse_admin_mau_registered_reserved_users                                  | synapse_admin_mau:registered_reserved_users                            |

 Removal of deprecated metrics & time based counters becoming histograms in 0.31.0
 ---------------------------------------------------------------------------------
@@ -590,44 +590,3 @@ oidc_providers:
        display_name_template: "{{ user.first_name }} {{ user.last_name }}"
        email_template: "{{ user.email }}"
 ```
-
-### Mastodon
-
-[Mastodon](https://docs.joinmastodon.org/) instances provide an [OAuth API](https://docs.joinmastodon.org/spec/oauth/), allowing those instances to be used as a single sign-on provider for Synapse.
-
-The first step is to register Synapse as an application with your Mastodon instance, using the [Create an application API](https://docs.joinmastodon.org/methods/apps/#create) (see also [here](https://docs.joinmastodon.org/client/token/)). There are several ways to do this, but in the example below we are using CURL.
-
-This example assumes that:
-* the Mastodon instance website URL is `https://your.mastodon.instance.url`, and
-* Synapse will be registered as an app named `my_synapse_app`.
-
-Send the following request, substituting the value of `synapse_public_baseurl` from your Synapse installation.
-```sh
-curl -d "client_name=my_synapse_app&redirect_uris=https://[synapse_public_baseurl]/_synapse/client/oidc/callback" -X POST https://your.mastodon.instance.url/api/v1/apps
-```
-
-You should receive a response similar to the following. Make sure to save it.
-```json
-{"client_id":"someclientid_123","client_secret":"someclientsecret_123","id":"12345","name":"my_synapse_app","redirect_uri":"https://[synapse_public_baseurl]/_synapse/client/oidc/callback","website":null,"vapid_key":"somerandomvapidkey_123"}
-```
-
-As the Synapse login mechanism needs an attribute to uniquely identify users, and Mastodon's endpoint does not return a `sub` property, an alternative `subject_claim` has to be set. Your Synapse configuration should include the following:
-
-```yaml
-oidc_providers:
-  - idp_id: my_mastodon
-    idp_name: "Mastodon Instance Example"
-    discover: false
-    issuer: "https://your.mastodon.instance.url/@admin"
-    client_id: "someclientid_123"    
-    client_secret: "someclientsecret_123"
-    authorization_endpoint: "https://your.mastodon.instance.url/oauth/authorize"
-    token_endpoint: "https://your.mastodon.instance.url/oauth/token"
-    userinfo_endpoint: "https://your.mastodon.instance.url/api/v1/accounts/verify_credentials"
-    scopes: ["read"]
-    user_mapping_provider:
-      config:
-        subject_claim: "id"
-```
-
-Note that the fields `client_id` and `client_secret` are taken from the CURL response above.
@@ -1,7 +1,6 @@
 # Using Postgres

-The minimum supported version of PostgreSQL is determined by the [Dependency
-Deprecation Policy](deprecation_policy.md).
+Synapse supports PostgreSQL versions 10 or later.

 ## Install postgres client libraries

@@ -79,9 +79,6 @@ server {
        # Nginx by default only allows file uploads up to 1M in size
        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
        client_max_body_size 50M;
-	
-	# Synapse responses may be chunked, which is an HTTP/1.1 feature.
-	proxy_http_version 1.1;
    }
 }
 ```
@@ -84,9 +84,7 @@ file when you upgrade the Debian package to a later version.

 ##### Downstream Debian packages

-Andrej Shadura maintains a
-[`matrix-synapse`](https://packages.debian.org/sid/matrix-synapse) package in
-the Debian repositories.
+Andrej Shadura maintains a `matrix-synapse` package in the Debian repositories.
 For `bookworm` and `sid`, it can be installed simply with:

 ```sh
@@ -102,27 +100,23 @@ for information on how to use backports.
 ##### Downstream Ubuntu packages

 We do not recommend using the packages in the default Ubuntu repository
-at this time, as they are [old and suffer from known security vulnerabilities](
-    https://bugs.launchpad.net/ubuntu/+source/matrix-synapse/+bug/1848709
-).
+at this time, as they are old and suffer from known security vulnerabilities.
 The latest version of Synapse can be installed from [our repository](#matrixorg-packages).

 #### Fedora

-Synapse is in the Fedora repositories as
-[`matrix-synapse`](https://src.fedoraproject.org/rpms/matrix-synapse):
+Synapse is in the Fedora repositories as `matrix-synapse`:

 ```sh
 sudo dnf install matrix-synapse
 ```

-Additionally, Oleg Girko provides Fedora RPMs at
+Oleg Girko provides Fedora RPMs at
 <https://obs.infoserver.lv/project/monitor/matrix-synapse>

 #### OpenSUSE

-Synapse is in the OpenSUSE repositories as
-[`matrix-synapse`](https://software.opensuse.org/package/matrix-synapse):
+Synapse is in the OpenSUSE repositories as `matrix-synapse`:

 ```sh
 sudo zypper install matrix-synapse
@@ -157,8 +151,7 @@ sudo pip install py-bcrypt

 #### Void Linux

-Synapse can be found in the void repositories as
-['synapse'](https://github.com/void-linux/void-packages/tree/master/srcpkgs/synapse):
+Synapse can be found in the void repositories as 'synapse':

 ```sh
 xbps-install -Su
@@ -1,188 +0,0 @@
-# coturn TURN server
-
-The following sections describe how to install [coturn](<https://github.com/coturn/coturn>) (which implements the TURN REST API).
-
-## `coturn` setup
-
-### Initial installation
-
-The TURN daemon `coturn` is available from a variety of sources such as native package managers, or installation from source.
-
-#### Debian and Ubuntu based distributions
-
-Just install the debian package:
-
-```sh
-sudo apt install coturn
-```
-
-This will install and start a systemd service called `coturn`.
-
-#### Source installation
-
-1. Download the [latest release](https://github.com/coturn/coturn/releases/latest) from github.  Unpack it and `cd` into the directory.
-
-1.  Configure it:
-
-    ```sh
-    ./configure
-    ```
-
-    You may need to install `libevent2`: if so, you should do so in
-    the way recommended by your operating system. You can ignore
-    warnings about lack of database support: a database is unnecessary
-    for this purpose.
-
-1.  Build and install it:
-
-    ```sh
-    make
-    sudo make install
-    ```
-
-### Configuration
-
-1.  Create or edit the config file in `/etc/turnserver.conf`. The relevant
-    lines, with example values, are:
-
-    ```
-    use-auth-secret
-    static-auth-secret=[your secret key here]
-    realm=turn.myserver.org
-    ```
-
-    See `turnserver.conf` for explanations of the options. One way to generate
-    the `static-auth-secret` is with `pwgen`:
-
-    ```sh
-    pwgen -s 64 1
-    ```
-
-    A `realm` must be specified, but its value is somewhat arbitrary. (It is
-    sent to clients as part of the authentication flow.) It is conventional to
-    set it to be your server name.
-
-1.  You will most likely want to configure `coturn` to write logs somewhere. The
-    easiest way is normally to send them to the syslog:
-
-    ```sh
-    syslog
-    ```
-
-    (in which case, the logs will be available via `journalctl -u coturn` on a
-    systemd system). Alternatively, `coturn` can be configured to write to a
-    logfile - check the example config file supplied with `coturn`.
-
-1.  Consider your security settings. TURN lets users request a relay which will
-    connect to arbitrary IP addresses and ports. The following configuration is
-    suggested as a minimum starting point:
-
-    ```
-    # VoIP traffic is all UDP. There is no reason to let users connect to arbitrary TCP endpoints via the relay.
-    no-tcp-relay
-
-    # don't let the relay ever try to connect to private IP address ranges within your network (if any)
-    # given the turn server is likely behind your firewall, remember to include any privileged public IPs too.
-    denied-peer-ip=10.0.0.0-10.255.255.255
-    denied-peer-ip=192.168.0.0-192.168.255.255
-    denied-peer-ip=172.16.0.0-172.31.255.255
-
-    # recommended additional local peers to block, to mitigate external access to internal services.
-    # https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/#how-to-fix-an-open-turn-relay-to-address-this-vulnerability
-    no-multicast-peers
-    denied-peer-ip=0.0.0.0-0.255.255.255
-    denied-peer-ip=100.64.0.0-100.127.255.255
-    denied-peer-ip=127.0.0.0-127.255.255.255
-    denied-peer-ip=169.254.0.0-169.254.255.255
-    denied-peer-ip=192.0.0.0-192.0.0.255
-    denied-peer-ip=192.0.2.0-192.0.2.255
-    denied-peer-ip=192.88.99.0-192.88.99.255
-    denied-peer-ip=198.18.0.0-198.19.255.255
-    denied-peer-ip=198.51.100.0-198.51.100.255
-    denied-peer-ip=203.0.113.0-203.0.113.255
-    denied-peer-ip=240.0.0.0-255.255.255.255
-
-    # special case the turn server itself so that client->TURN->TURN->client flows work
-    # this should be one of the turn server's listening IPs
-    allowed-peer-ip=10.0.0.1
-
-    # consider whether you want to limit the quota of relayed streams per user (or total) to avoid risk of DoS.
-    user-quota=12 # 4 streams per video call, so 12 streams = 3 simultaneous relayed calls per user.
-    total-quota=1200
-    ```
-
-1.  Also consider supporting TLS/DTLS. To do this, add the following settings
-    to `turnserver.conf`:
-
-    ```
-    # TLS certificates, including intermediate certs.
-    # For Let's Encrypt certificates, use `fullchain.pem` here.
-    cert=/path/to/fullchain.pem
-
-    # TLS private key file
-    pkey=/path/to/privkey.pem
-
-    # Ensure the configuration lines that disable TLS/DTLS are commented-out or removed
-    #no-tls
-    #no-dtls
-    ```
-
-    In this case, replace the `turn:` schemes in the `turn_uris` settings below
-    with `turns:`.
-
-    We recommend that you only try to set up TLS/DTLS once you have set up a
-    basic installation and got it working.
-
-    NB: If your TLS certificate was provided by Let's Encrypt, TLS/DTLS will
-    not work with any Matrix client that uses Chromium's WebRTC library. This
-    currently includes Element Android & iOS; for more details, see their
-    [respective](https://github.com/vector-im/element-android/issues/1533)
-    [issues](https://github.com/vector-im/element-ios/issues/2712) as well as the underlying
-    [WebRTC issue](https://bugs.chromium.org/p/webrtc/issues/detail?id=11710).
-    Consider using a ZeroSSL certificate for your TURN server as a working alternative.
-
-1.  Ensure your firewall allows traffic into the TURN server on the ports
-    you've configured it to listen on (By default: 3478 and 5349 for TURN
-    traffic (remember to allow both TCP and UDP traffic), and ports 49152-65535
-    for the UDP relay.)
-
-1.  If your TURN server is behind NAT, the NAT gateway must have an external,
-    publicly-reachable IP address. You must configure `coturn` to advertise that
-    address to connecting clients:
-
-    ```
-    external-ip=EXTERNAL_NAT_IPv4_ADDRESS
-    ```
-
-    You may optionally limit the TURN server to listen only on the local
-    address that is mapped by NAT to the external address:
-
-    ```
-    listening-ip=INTERNAL_TURNSERVER_IPv4_ADDRESS
-    ```
-
-    If your NAT gateway is reachable over both IPv4 and IPv6, you may
-    configure `coturn` to advertise each available address:
-
-    ```
-    external-ip=EXTERNAL_NAT_IPv4_ADDRESS
-    external-ip=EXTERNAL_NAT_IPv6_ADDRESS
-    ```
-
-    When advertising an external IPv6 address, ensure that the firewall and
-    network settings of the system running your TURN server are configured to
-    accept IPv6 traffic, and that the TURN server is listening on the local
-    IPv6 address that is mapped by NAT to the external IPv6 address.
-
-1.  (Re)start the turn server:
-
-    * If you used the Debian package (or have set up a systemd unit yourself):
-      ```sh
-      sudo systemctl restart coturn
-      ```
-
-    * If you built from source:
-
-      ```sh
-      /usr/local/bin/turnserver -o
-      ```
@@ -1,170 +0,0 @@
-# eturnal TURN server
-
-The following sections describe how to install [eturnal](<https://github.com/processone/eturnal>) 
-(which implements the TURN REST API).
-
-## `eturnal` setup
-
-### Initial installation
-
-The `eturnal` TURN server implementation is available from a variety of sources 
-such as native package managers, binary packages, installation from source or 
-[container image](https://eturnal.net/documentation/code/docker.html). They are 
-all described [here](https://github.com/processone/eturnal#installation).
-
-Quick-Test instructions in a [Linux Shell](https://github.com/processone/eturnal/blob/master/QUICK-TEST.md) 
-or with [Docker](https://github.com/processone/eturnal/blob/master/docker-k8s/QUICK-TEST.md) 
-are available as well.
-
-### Configuration
-
-After installation, `eturnal` usually ships a [default configuration file](https://github.com/processone/eturnal/blob/master/config/eturnal.yml) 
-here: `/etc/eturnal.yml` (and, if not found there, there is a backup file here: 
-`/opt/eturnal/etc/eturnal.yml`). It uses the (indentation-sensitive!) [YAML](https://en.wikipedia.org/wiki/YAML) 
-format. The file contains further explanations.
-
-Here are some hints how to configure eturnal on your [host machine](https://github.com/processone/eturnal#configuration) 
-or when using e.g. [Docker](https://eturnal.net/documentation/code/docker.html).
-You may also further deep dive into the [reference documentation](https://eturnal.net/documentation/).
-
-`eturnal` runs out of the box with the default configuration. To enable TURN and 
-to integrate it with your homeserver, some aspects in `eturnal`'s default configuration file 
-must be edited:
-
-1.  Homeserver's [`turn_shared_secret`](../../usage/configuration/config_documentation.md#turn_shared_secret) 
-    and eturnal's shared `secret` for authentication
-
-    Both need to have the same value. Uncomment and adjust this line in `eturnal`'s 
-    configuration file:
-
-    ```yaml
-    secret: "long-and-cryptic"     # Shared secret, CHANGE THIS.
-    ```
-
-    One way to generate a `secret` is with `pwgen`:
-
-    ```sh
-    pwgen -s 64 1
-    ```
-
-1.  Public IP address
-
-    If your TURN server is behind NAT, the NAT gateway must have an external,
-    publicly-reachable IP address. `eturnal` tries to autodetect the public IP address, 
-    however, it may also be configured by uncommenting and adjusting this line, so 
-    `eturnal` advertises that address to connecting clients:
-
-    ```yaml
-    relay_ipv4_addr: "203.0.113.4" # The server's public IPv4 address.
-    ```
-
-    If your NAT gateway is reachable over both IPv4 and IPv6, you may
-    configure `eturnal` to advertise each available address:
-
-    ```yaml
-    relay_ipv4_addr: "203.0.113.4" # The server's public IPv4 address.
-    relay_ipv6_addr: "2001:db8::4" # The server's public IPv6 address (optional).
-    ```
-
-    When advertising an external IPv6 address, ensure that the firewall and
-    network settings of the system running your TURN server are configured to
-    accept IPv6 traffic, and that the TURN server is listening on the local
-    IPv6 address that is mapped by NAT to the external IPv6 address.
-
-1.  Logging
-
-    If `eturnal` was started by systemd, log files are written into the
-    `/var/log/eturnal` directory by default. In order to log to the [journal](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html)
-    instead, the `log_dir` option can be set to `stdout` in the configuration file.
-
-1.  Security considerations
-
-    Consider your security settings. TURN lets users request a relay which will
-    connect to arbitrary IP addresses and ports. The following configuration is
-    suggested as a minimum starting point, [see also the official documentation](https://eturnal.net/documentation/#blacklist):
-
-    ```yaml
-    ## Reject TURN relaying from/to the following addresses/networks:
-    blacklist:                 # This is the default blacklist.
-        - "127.0.0.0/8"        # IPv4 loopback.
-        - "::1"                # IPv6 loopback.
-        - recommended          # Expands to a number of networks recommended to be
-                               # blocked, but includes private networks. Those
-                               # would have to be 'whitelist'ed if eturnal serves
-                               # local clients/peers within such networks.
-    ```
-
-    To whitelist IP addresses or specific (private) networks, you need to **add** a 
-    whitelist part into the configuration file, e.g.:
-
-    ```yaml
-    whitelist:
-        - "192.168.0.0/16"
-        - "203.0.113.113"
-        - "2001:db8::/64"
-    ```
-
-    The more specific, the better.
-
-1.  TURNS (TURN via TLS/DTLS)
-
-    Also consider supporting TLS/DTLS. To do this, adjust the following settings
-    in the `eturnal.yml` configuration file (TLS parts should not be commented anymore):
-
-    ```yaml
-    listen:
-        - ip: "::"
-          port: 3478
-          transport: udp
-        - ip: "::"
-          port: 3478
-          transport: tcp
-        - ip: "::"
-          port: 5349
-          transport: tls
-
-    ## TLS certificate/key files (must be readable by 'eturnal' user!):
-    tls_crt_file: /etc/eturnal/tls/crt.pem
-    tls_key_file: /etc/eturnal/tls/key.pem
-    ```
-
-    In this case, replace the `turn:` schemes in homeserver's `turn_uris` settings
-    with `turns:`. More is described [here](../../usage/configuration/config_documentation.md#turn_uris).
-
-    We recommend that you only try to set up TLS/DTLS once you have set up a
-    basic installation and got it working.
-
-    NB: If your TLS certificate was provided by Let's Encrypt, TLS/DTLS will
-    not work with any Matrix client that uses Chromium's WebRTC library. This
-    currently includes Element Android & iOS; for more details, see their
-    [respective](https://github.com/vector-im/element-android/issues/1533)
-    [issues](https://github.com/vector-im/element-ios/issues/2712) as well as the underlying
-    [WebRTC issue](https://bugs.chromium.org/p/webrtc/issues/detail?id=11710).
-    Consider using a ZeroSSL certificate for your TURN server as a working alternative.
-
-1.  Firewall
-
-    Ensure your firewall allows traffic into the TURN server on the ports
-    you've configured it to listen on (By default: 3478 and 5349 for TURN
-    traffic (remember to allow both TCP and UDP traffic), and ports 49152-65535
-    for the UDP relay.)
-
-1.  Reload/ restarting `eturnal`
-
-    Changes in the configuration file require `eturnal` to reload/ restart, this
-    can be achieved by:
-
-    ```sh
-    eturnalctl reload
-    ```
-    
-    `eturnal` performs a configuration check before actually reloading/ restarting
-    and provides hints, if something is not correctly configured.
-
-### eturnalctl opterations script
-
-`eturnal` offers a handy [operations script](https://eturnal.net/documentation/#Operation) 
-which can be called e.g. to check, whether the service is up, to restart the service, 
-to query how many active sessions exist, to change logging behaviour and so on.
-
-Hint: If `eturnalctl` is not part of your `$PATH`, consider either sym-linking it (e.g. ´ln -s /opt/eturnal/bin/eturnalctl /usr/local/bin/eturnalctl´) or call it from the default `eturnal` directory directly: e.g. `/opt/eturnal/bin/eturnalctl info`
@@ -9,28 +9,222 @@ allows the homeserver to generate credentials that are valid for use on the
 TURN server through the use of a secret shared between the homeserver and the
 TURN server.

-This documentation provides two TURN server configuration examples:
-
-* [coturn](setup/turn/coturn.md)
-* [eturnal](setup/turn/eturnal.md)
+The following sections describe how to install [coturn](<https://github.com/coturn/coturn>) (which implements the TURN REST API) and integrate it with synapse.

 ## Requirements

-For TURN relaying to work, the TURN service must be hosted on a server/endpoint with a public IP.
+For TURN relaying with `coturn` to work, it must be hosted on a server/endpoint with a public IP.

 Hosting TURN behind NAT requires port forwaring and for the NAT gateway to have a public IP.
 However, even with appropriate configuration, NAT is known to cause issues and to often not work.

-Afterwards, the homeserver needs some further configuration.
+## `coturn` setup
+
+### Initial installation
+
+The TURN daemon `coturn` is available from a variety of sources such as native package managers, or installation from source.
+
+#### Debian installation
+
+Just install the debian package:
+
+```sh
+apt install coturn
+```
+
+This will install and start a systemd service called `coturn`.
+
+#### Source installation
+
+1. Download the [latest release](https://github.com/coturn/coturn/releases/latest) from github.  Unpack it and `cd` into the directory.
+
+1.  Configure it:
+
+    ```sh
+    ./configure
+    ```
+
+    You may need to install `libevent2`: if so, you should do so in
+    the way recommended by your operating system. You can ignore
+    warnings about lack of database support: a database is unnecessary
+    for this purpose.
+
+1.  Build and install it:
+
+    ```sh
+    make
+    make install
+    ```
+
+### Configuration
+
+1.  Create or edit the config file in `/etc/turnserver.conf`. The relevant
+    lines, with example values, are:
+
+    ```
+    use-auth-secret
+    static-auth-secret=[your secret key here]
+    realm=turn.myserver.org
+    ```
+
+    See `turnserver.conf` for explanations of the options. One way to generate
+    the `static-auth-secret` is with `pwgen`:
+
+    ```sh
+    pwgen -s 64 1
+    ```
+
+    A `realm` must be specified, but its value is somewhat arbitrary. (It is
+    sent to clients as part of the authentication flow.) It is conventional to
+    set it to be your server name.
+
+1.  You will most likely want to configure coturn to write logs somewhere. The
+    easiest way is normally to send them to the syslog:
+
+    ```sh
+    syslog
+    ```
+
+    (in which case, the logs will be available via `journalctl -u coturn` on a
+    systemd system). Alternatively, coturn can be configured to write to a
+    logfile - check the example config file supplied with coturn.
+
+1.  Consider your security settings. TURN lets users request a relay which will
+    connect to arbitrary IP addresses and ports. The following configuration is
+    suggested as a minimum starting point:
+
+    ```
+    # VoIP traffic is all UDP. There is no reason to let users connect to arbitrary TCP endpoints via the relay.
+    no-tcp-relay
+
+    # don't let the relay ever try to connect to private IP address ranges within your network (if any)
+    # given the turn server is likely behind your firewall, remember to include any privileged public IPs too.
+    denied-peer-ip=10.0.0.0-10.255.255.255
+    denied-peer-ip=192.168.0.0-192.168.255.255
+    denied-peer-ip=172.16.0.0-172.31.255.255
+
+    # recommended additional local peers to block, to mitigate external access to internal services.
+    # https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/#how-to-fix-an-open-turn-relay-to-address-this-vulnerability
+    no-multicast-peers
+    denied-peer-ip=0.0.0.0-0.255.255.255
+    denied-peer-ip=100.64.0.0-100.127.255.255
+    denied-peer-ip=127.0.0.0-127.255.255.255
+    denied-peer-ip=169.254.0.0-169.254.255.255
+    denied-peer-ip=192.0.0.0-192.0.0.255
+    denied-peer-ip=192.0.2.0-192.0.2.255
+    denied-peer-ip=192.88.99.0-192.88.99.255
+    denied-peer-ip=198.18.0.0-198.19.255.255
+    denied-peer-ip=198.51.100.0-198.51.100.255
+    denied-peer-ip=203.0.113.0-203.0.113.255
+    denied-peer-ip=240.0.0.0-255.255.255.255
+
+    # special case the turn server itself so that client->TURN->TURN->client flows work
+    # this should be one of the turn server's listening IPs
+    allowed-peer-ip=10.0.0.1
+
+    # consider whether you want to limit the quota of relayed streams per user (or total) to avoid risk of DoS.
+    user-quota=12 # 4 streams per video call, so 12 streams = 3 simultaneous relayed calls per user.
+    total-quota=1200
+    ```
+
+1.  Also consider supporting TLS/DTLS. To do this, add the following settings
+    to `turnserver.conf`:
+
+    ```
+    # TLS certificates, including intermediate certs.
+    # For Let's Encrypt certificates, use `fullchain.pem` here.
+    cert=/path/to/fullchain.pem
+
+    # TLS private key file
+    pkey=/path/to/privkey.pem
+
+    # Ensure the configuration lines that disable TLS/DTLS are commented-out or removed
+    #no-tls
+    #no-dtls
+    ```
+
+    In this case, replace the `turn:` schemes in the `turn_uris` settings below
+    with `turns:`.
+
+    We recommend that you only try to set up TLS/DTLS once you have set up a
+    basic installation and got it working.
+
+    NB: If your TLS certificate was provided by Let's Encrypt, TLS/DTLS will
+    not work with any Matrix client that uses Chromium's WebRTC library. This
+    currently includes Element Android & iOS; for more details, see their
+    [respective](https://github.com/vector-im/element-android/issues/1533)
+    [issues](https://github.com/vector-im/element-ios/issues/2712) as well as the underlying
+    [WebRTC issue](https://bugs.chromium.org/p/webrtc/issues/detail?id=11710).
+    Consider using a ZeroSSL certificate for your TURN server as a working alternative.
+
+1.  Ensure your firewall allows traffic into the TURN server on the ports
+    you've configured it to listen on (By default: 3478 and 5349 for TURN
+    traffic (remember to allow both TCP and UDP traffic), and ports 49152-65535
+    for the UDP relay.)
+
+1.  If your TURN server is behind NAT, the NAT gateway must have an external,
+    publicly-reachable IP address. You must configure coturn to advertise that
+    address to connecting clients:
+
+    ```
+    external-ip=EXTERNAL_NAT_IPv4_ADDRESS
+    ```
+
+    You may optionally limit the TURN server to listen only on the local
+    address that is mapped by NAT to the external address:
+
+    ```
+    listening-ip=INTERNAL_TURNSERVER_IPv4_ADDRESS
+    ```
+
+    If your NAT gateway is reachable over both IPv4 and IPv6, you may
+    configure coturn to advertise each available address:
+
+    ```
+    external-ip=EXTERNAL_NAT_IPv4_ADDRESS
+    external-ip=EXTERNAL_NAT_IPv6_ADDRESS
+    ```
+
+    When advertising an external IPv6 address, ensure that the firewall and
+    network settings of the system running your TURN server are configured to
+    accept IPv6 traffic, and that the TURN server is listening on the local
+    IPv6 address that is mapped by NAT to the external IPv6 address.
+
+1.  (Re)start the turn server:
+
+    * If you used the Debian package (or have set up a systemd unit yourself):
+      ```sh
+      systemctl restart coturn
+      ```
+
+    * If you installed from source:
+
+      ```sh
+      bin/turnserver -o
+      ```

 ## Synapse setup

 Your homeserver configuration file needs the following extra keys:

-1.  [`turn_uris`](usage/configuration/config_documentation.md#turn_uris)
-2.  [`turn_shared_secret`](usage/configuration/config_documentation.md#turn_shared_secret)
-3.  [`turn_user_lifetime`](usage/configuration/config_documentation.md#turn_user_lifetime)
-4.  [`turn_allow_guests`](usage/configuration/config_documentation.md#turn_allow_guests)
+1.  "`turn_uris`": This needs to be a yaml list of public-facing URIs
+    for your TURN server to be given out to your clients. Add separate
+    entries for each transport your TURN server supports.
+2.  "`turn_shared_secret`": This is the secret shared between your
+    homeserver and your TURN server, so you should set it to the same
+    string you used in turnserver.conf.
+3.  "`turn_user_lifetime`": This is the amount of time credentials
+    generated by your homeserver are valid for (in milliseconds).
+    Shorter times offer less potential for abuse at the expense of
+    increased traffic between web clients and your homeserver to
+    refresh credentials. The TURN REST API specification recommends
+    one day (86400000).
+4.  "`turn_allow_guests`": Whether to allow guest users to use the
+    TURN server. This is enabled by default, as otherwise VoIP will
+    not work reliably for guests. However, it does introduce a
+    security risk as it lets guests connect to arbitrary endpoints
+    without having gone through a CAPTCHA or similar to register a
+    real account.

 As an example, here is the relevant section of the config file for `matrix.org`. The
 `turn_uris` are appropriate for TURN servers listening on the default ports, with no TLS.
@@ -38,7 +232,7 @@ As an example, here is the relevant section of the config file for `matrix.org`.
    turn_uris: [ "turn:turn.matrix.org?transport=udp", "turn:turn.matrix.org?transport=tcp" ]
    turn_shared_secret: "n0t4ctuAllymatr1Xd0TorgSshar3d5ecret4obvIousreAsons"
    turn_user_lifetime: 86400000
-    turn_allow_guests: true
+    turn_allow_guests: True

 After updating the homeserver configuration, you must restart synapse:

@@ -69,7 +263,7 @@ Here are a few things to try:
 * Check that you have opened your firewall to allow UDP traffic to the UDP
   relay ports (49152-65535 by default).

- * Try disabling TLS/DTLS listeners and enable only its (unencrypted)
+ * Try disabling `coturn`'s TLS/DTLS listeners and enable only its (unencrypted)
   TCP/UDP listeners. (This will only leave signaling traffic unencrypted;
   voice & video WebRTC traffic is always encrypted.)

@@ -94,19 +288,12 @@ Here are a few things to try:

    * ensure that your TURN server uses the NAT gateway as its default route.

- * Enable more verbose logging, in `coturn` via the `verbose` setting:
+ * Enable more verbose logging in coturn via the `verbose` setting:

   ```
   verbose
   ```

-    or with `eturnal` with the shell command `eturnalctl loglevel debug` or in the configuration file (the service needs to [reload](https://eturnal.net/documentation/#Operation) for it to become effective):
-
-    ```yaml
-        ## Logging configuration:
-            log_level: debug
-    ```
-
   ... and then see if there are any clues in its logs.

 * If you are using a browser-based client under Chrome, check
@@ -130,7 +317,7 @@ Here are a few things to try:
      matrix client to your homeserver in your browser's network inspector. In
      the response you should see `username` and `password`. Or:

-    * Use the following shell commands for `coturn`:
+    * Use the following shell commands:

      ```sh
      secret=staticAuthSecretHere
@@ -140,16 +327,11 @@ Here are a few things to try:
      echo -e "username: $u\npassword: $p"
      ```

-      or for `eturnal`
+      Or:

-      ```sh
-      eturnalctl credentials
-      ```
-      
-
-    * Or (**coturn only**): Temporarily configure `coturn` to accept a static
-      username/password. To do this, comment out `use-auth-secret` and
-      `static-auth-secret` and add the following:
+    * Temporarily configure coturn to accept a static username/password. To do
+      this, comment out `use-auth-secret` and `static-auth-secret` and add the
+      following:

      ```
      lt-cred-mech
@@ -88,38 +88,6 @@ process, for example:
    dpkg -i matrix-synapse-py3_1.3.0+stretch1_amd64.deb
    ```

-# Upgrading to v1.73.0
-
-## Legacy Prometheus metric names have now been removed
-
-Synapse v1.69.0 included the deprecation of legacy Prometheus metric names
-and offered an option to disable them.
-Synapse v1.71.0 disabled legacy Prometheus metric names by default.
-
-This version, v1.73.0, removes those legacy Prometheus metric names entirely.
-This also means that the `enable_legacy_metrics` configuration option has been
-removed; it will no longer be possible to re-enable the legacy metric names.
-
-If you use metrics and have not yet updated your Grafana dashboard(s),
-Prometheus console(s) or alerting rule(s), please consider doing so when upgrading
-to this version.
-Note that the included Grafana dashboard was updated in v1.72.0 to correct some
-metric names which were missed when legacy metrics were disabled by default.
-
-See [v1.69.0: Deprecation of legacy Prometheus metric names](#deprecation-of-legacy-prometheus-metric-names)
-for more context.
-
-
-# Upgrading to v1.72.0
-
-## Dropping support for PostgreSQL 10
-
-In line with our [deprecation policy](deprecation_policy.md), we've dropped
-support for PostgreSQL 10, as it is no longer supported upstream.
-
-This release of Synapse requires PostgreSQL 11+.
-
-
 # Upgrading to v1.71.0

 ## Removal of the `generate_short_term_login_token` module API method
@@ -148,22 +116,6 @@ local users and some remote users is why the spec was changed/clarified and this
 caveat is no longer supported.


-## Legacy Prometheus metric names are now disabled by default
-
-Synapse v1.71.0 disables legacy Prometheus metric names by default.
-For administrators that still rely on them and have not yet had chance to update their
-uses of the metrics, it's still possible to specify `enable_legacy_metrics: true` in
-the configuration to re-enable them temporarily.
-
-Synapse v1.73.0 will **remove legacy metric names altogether** and at that point,
-it will no longer be possible to re-enable them.
-
-If you do not use metrics or you have already updated your Grafana dashboard(s),
-Prometheus console(s) and alerting rule(s), there is no action needed.
-
-See [v1.69.0: Deprecation of legacy Prometheus metric names](#deprecation-of-legacy-prometheus-metric-names).
-
-
 # Upgrading to v1.69.0

 ## Changes to the receipts replication streams
@@ -19,7 +19,7 @@ already on your `$PATH` depending on how Synapse was installed.
 Finding your user's `access_token` is client-dependent, but will usually be shown in the client's settings.

 ## Making an Admin API request
-For security reasons, we [recommend](../../../reverse_proxy.md#synapse-administration-endpoints)
+For security reasons, we [recommend](reverse_proxy.md#synapse-administration-endpoints)
 that the Admin API (`/_synapse/admin/...`) should be hidden from public view using a
 reverse proxy. This means you should typically query the Admin API from a terminal on
 the machine which runs Synapse.
@@ -79,7 +79,7 @@ Here we can see that the request has been tagged with `GET-37`. (The tag depends
 grep 'GET-37' homeserver.log
 ```

-If you want to paste that output into a github issue or matrix room, please remember to surround it with triple-backticks (```) to make it legible (see [quoting code](https://help.github.com/en/articles/basic-writing-and-formatting-syntax#quoting-code)).
+If you want to paste that output into a github issue or matrix room, please remember to surround it with triple-backticks (```) to make it legible (see https://help.github.com/en/articles/basic-writing-and-formatting-syntax#quoting-code).


 What do all those fields in the 'Processed' line mean?
@@ -73,12 +73,12 @@ When a request is blocked, the response will have the `errcode` `M_RESOURCE_LIMI

 Synapse records several different prometheus metrics for MAU.

-`synapse_admin_mau_current` records the current MAU figure for native (non-application-service) users.
+`synapse_admin_mau:current` records the current MAU figure for native (non-application-service) users.

-`synapse_admin_mau_max` records the maximum MAU as dictated by the `max_mau_value` config value.
+`synapse_admin_mau:max` records the maximum MAU as dictated by the `max_mau_value` config value.

 `synapse_admin_mau_current_mau_by_service` records the current MAU including application service users. The label `app_service` can be used
 to filter by a specific service ID. This *also* includes non-application-service users under `app_service=native` .

-`synapse_admin_mau_registered_reserved_users` records the number of users specified in `mau_limits_reserved_threepids` which have
+`synapse_admin_mau:registered_reserved_users` records the number of users specified in `mau_limits_reserved_threepids` which have
 registered accounts on the homeserver.
@@ -858,7 +858,7 @@ which are older than the room's maximum retention period. Synapse will also
 filter events received over federation so that events that should have been
 purged are ignored and not stored again.

-The message retention policies feature is disabled by default. Please be advised
+The message retention policies feature is disabled by default. Please be advised 
 that enabling this feature carries some risk. There are known bugs with the implementation
 which can cause database corruption. Setting retention to delete older history
 is less risky than deleting newer history but in general caution is advised when enabling this
@@ -2437,6 +2437,31 @@ Example configuration:
 enable_metrics: true
 ```
 ---
+### `enable_legacy_metrics`
+
+Set to `true` to publish both legacy and non-legacy Prometheus metric names,
+or to `false` to only publish non-legacy Prometheus metric names.
+Defaults to `true`. Has no effect if `enable_metrics` is `false`.
+**In Synapse v1.71.0, this will default to `false` before being removed in Synapse v1.73.0.**
+
+Legacy metric names include:
+- metrics containing colons in the name, such as `synapse_util_caches_response_cache:hits`, because colons are supposed to be reserved for user-defined recording rules;
+- counters that don't end with the `_total` suffix, such as `synapse_federation_client_sent_edus`, therefore not adhering to the OpenMetrics standard.
+
+These legacy metric names are unconventional and not compliant with OpenMetrics standards.
+They are included for backwards compatibility.
+
+Example configuration:
+```yaml
+enable_legacy_metrics: false
+```
+
+See https://github.com/matrix-org/synapse/issues/11106 for context.
+
+*Since v1.67.0.*
+
+**Will be removed in v1.73.0.**
+---
 ### `sentry`

 Use this option to enable sentry integration. Provide the DSN assigned to you by sentry
@@ -2501,53 +2526,32 @@ Config settings related to the client/server API
 ---
 ### `room_prejoin_state`

-This setting controls the state that is shared with users upon receiving an
-invite to a room, or in reply to a knock on a room. By default, the following
-state events are shared with users:
-
- `m.room.join_rules`
- `m.room.canonical_alias`
- `m.room.avatar`
- `m.room.encryption`
- `m.room.name`
- `m.room.create`
- `m.room.topic`
+Controls for the state that is shared with users who receive an invite
+to a room. By default, the following state event types are shared with users who
+receive invites to the room:
+- m.room.join_rules
+- m.room.canonical_alias
+- m.room.avatar
+- m.room.encryption
+- m.room.name
+- m.room.create
+- m.room.topic

 To change the default behavior, use the following sub-options:
-* `disable_default_event_types`: boolean. Set to `true` to disable the above 
-  defaults. If this is enabled, only the event types listed in
-  `additional_event_types` are shared. Defaults to `false`.
-* `additional_event_types`: A list of additional state events to include in the 
-  events to be shared. By default, this list is empty (so only the default event 
-  types are shared).
-
-  Each entry in this list should be either a single string or a list of two
-  strings. 
-  * A standalone string `t` represents all events with type `t` (i.e.
-    with no restrictions on state keys).
-  * A pair of strings `[t, s]` represents a single event with type `t` and 
-    state key `s`. The same type can appear in two entries with different state
-    keys: in this situation, both state keys are included in prejoin state.
+* `disable_default_event_types`: set to true to disable the above defaults. If this
+   is enabled, only the event types listed in `additional_event_types` are shared.
+   Defaults to false.
+* `additional_event_types`: Additional state event types to share with users when they are invited
+   to a room. By default, this list is empty (so only the default event types are shared).

 Example configuration:
 ```yaml
 room_prejoin_state:
-   disable_default_event_types: false
+   disable_default_event_types: true
   additional_event_types:
-     # Share all events of type `org.example.custom.event.typeA`
-     - org.example.custom.event.typeA
-     # Share only events of type `org.example.custom.event.typeB` whose
-     # state_key is "foo"
-     - ["org.example.custom.event.typeB", "foo"]
-     # Share only events of type `org.example.custom.event.typeC` whose
-     # state_key is "bar" or "baz"
-     - ["org.example.custom.event.typeC", "bar"]
-     - ["org.example.custom.event.typeC", "baz"]
+     - org.example.custom.event.type
+     - m.room.join_rules
 ```
-
-*Changed in Synapse 1.74:* admins can filter the events in prejoin state based
-on their state key.
-
 ---
 ### `track_puppeted_user_ips`

@@ -2989,17 +2993,10 @@ Options for each entry include:

        For the default provider, the following settings are available:

-       * `subject_claim`: name of the claim containing a unique identifier
+       * subject_claim: name of the claim containing a unique identifier
         for the user. Defaults to 'sub', which OpenID Connect
         compliant providers should provide.

-       * `picture_claim`: name of the claim containing an url for the user's profile picture.
-         Defaults to 'picture', which OpenID Connect compliant providers should provide
-         and has to refer to a direct image file such as PNG, JPEG, or GIF image file.
-         
-         Currently only supported in monolithic (single-process) server configurations
-         where the media repository runs within the Synapse process.
-
       * `localpart_template`: Jinja2 template for the localpart of the MXID.
          If this is not set, the user will be prompted to choose their
          own username (see the documentation for the `sso_auth_account_details.html`
@@ -3024,7 +3021,7 @@ Options for each entry include:
     which is set to the claims returned by the UserInfo Endpoint and/or
     in the ID Token.

-* `backchannel_logout_enabled`: set to `true` to process OIDC Back-Channel Logout notifications.
+* `backchannel_logout_enabled`: set to `true` to process OIDC Back-Channel Logout notifications. 
  Those notifications are expected to be received on `/_synapse/client/oidc/backchannel_logout`.
  Defaults to `false`.

@@ -3376,10 +3373,6 @@ Configuration settings related to push notifications
 This setting defines options for push notifications.

 This option has a number of sub-options. They are as follows:
-* `enabled`: Enables or disables push notification calculation. Note, disabling this will also
-   stop unread counts being calculated for rooms. This mode of operation is intended
-   for homeservers which may only have bots or appservice users connected, or are otherwise
-   not interested in push/unread counters. This is enabled by default.
 * `include_content`: Clients requesting push notifications can either have the body of
   the message sent in the notification poke along with other details
   like the sender, or just the event ID and room ID (`event_id_only`).
@@ -3400,7 +3393,6 @@ This option has a number of sub-options. They are as follows:
 Example configuration:
 ```yaml
 push:
-  enabled: true
  include_content: false
  group_unread_count_by_room: false
 ```
@@ -3446,7 +3438,7 @@ This option has the following sub-options:
    NB. If you set this to true, and the last time the user_directory search
    indexes were (re)built was before Synapse 1.44, you'll have to
    rebuild the indexes in order to search through all known users.
-
+    
    These indexes are built the first time Synapse starts; admins can
    manually trigger a rebuild via the API following the instructions
    [for running background updates](../administration/admin_api/background_updates.md#run),
@@ -3705,7 +3697,7 @@ As a result, the worker configuration is divided into two parts.

 1. The first part (in this section of the manual) defines which shardable tasks
   are delegated to privileged workers. This allows unprivileged workers to make
-   requests to a privileged worker to act on their behalf.
+   request a privileged worker to act on their behalf.
 1. [The second part](#individual-worker-configuration)
   controls the behaviour of individual workers in isolation.

@@ -3717,7 +3709,7 @@ For guidance on setting up workers, see the [worker documentation](../../workers
 A shared secret used by the replication APIs on the main process to authenticate
 HTTP requests from workers.

-The default, this value is omitted (equivalently `null`), which means that
+The default, this value is omitted (equivalently `null`), which means that 
 traffic between the workers and the main process is not authenticated.

 Example configuration:
@@ -3727,8 +3719,6 @@ worker_replication_secret: "secret_secret"
 ---
 ### `start_pushers`

-Unnecessary to set if using [`pusher_instances`](#pusher_instances) with [`generic_workers`](../../workers.md#synapseappgeneric_worker).
-
 Controls sending of push notifications on the main process. Set to `false`
 if using a [pusher worker](../../workers.md#synapseapppusher). Defaults to `true`.

@@ -3739,30 +3729,25 @@ start_pushers: false
 ---
 ### `pusher_instances`

-It is possible to scale the processes that handle sending push notifications to [sygnal](https://github.com/matrix-org/sygnal)
-and email by running a [`generic_worker`](../../workers.md#synapseappgeneric_worker) and adding it's [`worker_name`](#worker_name) to
-a `pusher_instances` map. Doing so will remove handling of this function from the main
-process. Multiple workers can be added to this map, in which case the work is balanced
-across them. Ensure the main process and all pusher workers are restarted after changing
-this option.
+It is possible to run multiple [pusher workers](../../workers.md#synapseapppusher),
+in which case the work is balanced across them. Use this setting to list the pushers by
+[`worker_name`](#worker_name). Ensure the main process and all pusher workers are
+restarted after changing this option.

-Example configuration for a single worker:
-```yaml
-pusher_instances:
-  - pusher_worker1
-```
-And for multiple workers:
+If no or only one pusher worker is configured, this setting is not necessary.
+The main process will send out push notifications by default if you do not disable
+it by setting [`start_pushers: false`](#start_pushers).
+
+Example configuration:
 ```yaml
+start_pushers: false
 pusher_instances:
  - pusher_worker1
  - pusher_worker2
 ```
-
 ---
 ### `send_federation`

-Unnecessary to set if using [`federation_sender_instances`](#federation_sender_instances) with [`generic_workers`](../../workers.md#synapseappgeneric_worker).
-
 Controls sending of outbound federation transactions on the main process.
 Set to `false` if using a [federation sender worker](../../workers.md#synapseappfederation_sender).
 Defaults to `true`.
@@ -3774,36 +3759,29 @@ send_federation: false
 ---
 ### `federation_sender_instances`

-It is possible to scale the processes that handle sending outbound federation requests
-by running a [`generic_worker`](../../workers.md#synapseappgeneric_worker) and adding it's [`worker_name`](#worker_name) to
-a `federation_sender_instances` map. Doing so will remove handling of this function from
-the main process. Multiple workers can be added to this map, in which case the work is
-balanced across them.
+It is possible to run multiple
+[federation sender worker](../../workers.md#synapseappfederation_sender), in which
+case the work is balanced across them. Use this setting to list the senders.

-This configuration setting must be shared between all workers handling federation
-sending, and if changed all federation sender workers must be stopped at the same time
-and then started, to ensure that all instances are running with the same config (otherwise
+This configuration setting must be shared between all federation sender workers, and if
+changed all federation sender workers must be stopped at the same time and then
+started, to ensure that all instances are running with the same config (otherwise
 events may be dropped).

-Example configuration for a single worker:
+Example configuration:
 ```yaml
+send_federation: false
 federation_sender_instances:
  - federation_sender1
 ```
-And for multiple workers:
-```yaml
-federation_sender_instances:
-  - federation_sender1
-  - federation_sender2
-```
 ---
 ### `instance_map`

 When using workers this should be a map from [`worker_name`](#worker_name) to the
 HTTP replication listener of the worker, if configured.
-Each worker declared under [`stream_writers`](../../workers.md#stream-writers) needs
+Each worker declared under [`stream_writers`](../../workers.md#stream-writers) needs 
 a HTTP replication listener, and that listener should be included in the `instance_map`.
-(The main process also needs an HTTP replication listener, but it should not be
+(The main process also needs an HTTP replication listener, but it should not be 
 listed in the `instance_map`.)

 Example configuration:
@@ -3915,30 +3893,10 @@ Example configuration:
 worker_replication_http_port: 9093
 ```
 ---
-### `worker_replication_http_tls`
-
-Whether TLS should be used for talking to the HTTP replication port on the main
-Synapse process.
-The main Synapse process defines this with the `tls` option on its [listener](#listeners) that
-has the `replication` resource enabled.
-
-**Please note:** by default, it is not safe to expose replication ports to the
-public Internet, even with TLS enabled.
-See [`worker_replication_secret`](#worker_replication_secret).
-
-Defaults to `false`.
-
-*Added in Synapse 1.72.0.*
-
-Example configuration:
-```yaml
-worker_replication_http_tls: true
-```
---
 ### `worker_listeners`

-A worker can handle HTTP requests. To do so, a `worker_listeners` option
-must be declared, in the same way as the [`listeners` option](#listeners)
+A worker can handle HTTP requests. To do so, a `worker_listeners` option 
+must be declared, in the same way as the [`listeners` option](#listeners) 
 in the shared config.

 Workers declared in [`stream_writers`](#stream_writers) will need to include a
@@ -3957,7 +3915,7 @@ worker_listeners:
 ### `worker_daemonize`

 Specifies whether the worker should be started as a daemon process.
-If Synapse is being managed by [systemd](../../systemd-with-workers/README.md), this option
+If Synapse is being managed by [systemd](../../systemd-with-workers/README.md), this option 
 must be omitted or set to `false`.

 Defaults to `false`.
@@ -3969,11 +3927,11 @@ worker_daemonize: true
 ---
 ### `worker_pid_file`

-When running a worker as a daemon, we need a place to store the
+When running a worker as a daemon, we need a place to store the 
 [PID](https://en.wikipedia.org/wiki/Process_identifier) of the worker.
 This option defines the location of that "pid file".

-This option is required if `worker_daemonize` is `true` and ignored
+This option is required if `worker_daemonize` is `true` and ignored 
 otherwise. It has no default.

 See also the [`pid_file` option](#pid_file) option for the main Synapse process.
@@ -4023,3 +3981,4 @@ background_updates:
    min_batch_size: 10
    default_batch_size: 50
 ```
+
@@ -135,8 +135,8 @@ In the config file for each worker, you must specify:
   [`worker_replication_http_port`](usage/configuration/config_documentation.md#worker_replication_http_port)).
 * If handling HTTP requests, a [`worker_listeners`](usage/configuration/config_documentation.md#worker_listeners) option
   with an `http` listener.
- * **Synapse 1.72 and older:** if handling the `^/_matrix/client/v3/keys/upload` endpoint, the HTTP URI for
-   the main process (`worker_main_http_uri`). This config option is no longer required and is ignored when running Synapse 1.73 and newer.
+ * If handling the `^/_matrix/client/v3/keys/upload` endpoint, the HTTP URI for
+   the main process (`worker_main_http_uri`).

 For example:

@@ -191,7 +191,6 @@ information.
    ^/_matrix/federation/(v1|v2)/send_leave/
    ^/_matrix/federation/(v1|v2)/invite/
    ^/_matrix/federation/v1/event_auth/
-    ^/_matrix/federation/v1/timestamp_to_event/
    ^/_matrix/federation/v1/exchange_third_party_invite/
    ^/_matrix/federation/v1/user/devices/
    ^/_matrix/key/v2/query
@@ -219,10 +218,10 @@ information.
    ^/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$
    ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/
    ^/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$
-    ^/_matrix/client/v1/rooms/.*/timestamp_to_event$
    ^/_matrix/client/(api/v1|r0|v3|unstable)/search$

    # Encryption requests
+    # Note that ^/_matrix/client/(r0|v3|unstable)/keys/upload/ requires `worker_main_http_uri`
    ^/_matrix/client/(r0|v3|unstable)/keys/query$
    ^/_matrix/client/(r0|v3|unstable)/keys/changes$
    ^/_matrix/client/(r0|v3|unstable)/keys/claim$
@@ -306,11 +305,9 @@ may wish to run multiple groups of workers handling different endpoints so that
 load balancing can be done in different ways.

 For `/sync` and `/initialSync` requests it will be more efficient if all
-requests from a particular user are routed to a single instance. This can
-be done e.g. in nginx via IP `hash $http_x_forwarded_for;` or via
-`hash $http_authorization consistent;` which contains the users access token.
-
-Admins may additionally wish to separate out `/sync`
+requests from a particular user are routed to a single instance. Extracting a
+user ID from the access token or `Authorization` header is currently left as an
+exercise for the reader. Admins may additionally wish to separate out `/sync`
 requests that have a `since` query parameter from those that don't (and
 `/initialSync`), as requests that don't are known as "initial sync" that happens
 when a user logs in on a new device and can be *very* resource intensive, so
@@ -377,7 +374,7 @@ responsible for
 - persisting them to the DB, and finally
 - updating the events stream.

-Because load is sharded in this way, you *must* restart all worker instances when
+Because load is sharded in this way, you *must* restart all worker instances when 
 adding or removing event persisters.

 An `event_persister` should not be mistaken for an `event_creator`.
@@ -505,9 +502,6 @@ worker application type.

 ### `synapse.app.pusher`

-It is likely this option will be deprecated in the future and is not recommended for new
-installations. Instead, [use `synapse.app.generic_worker` with the `pusher_instances`](usage/configuration/config_documentation.md#pusher_instances).
-
 Handles sending push notifications to sygnal and email. Doesn't handle any
 REST endpoints itself, but you should set
 [`start_pushers: false`](usage/configuration/config_documentation.md#start_pushers) in the
@@ -546,9 +540,6 @@ Note this worker cannot be load-balanced: only one instance should be active.

 ### `synapse.app.federation_sender`

-It is likely this option will be deprecated in the future and not recommended for
-new installations. Instead, [use `synapse.app.generic_worker` with the `federation_sender_instances`](usage/configuration/config_documentation.md#federation_sender_instances). 
-
 Handles sending federation traffic to other servers. Doesn't handle any
 REST endpoints itself, but you should set
 [`send_federation: false`](usage/configuration/config_documentation.md#send_federation)
@@ -645,9 +636,7 @@ equivalent to `synapse.app.generic_worker`:
 * `synapse.app.client_reader`
 * `synapse.app.event_creator`
 * `synapse.app.federation_reader`
- * `synapse.app.federation_sender`
 * `synapse.app.frontend_proxy`
- * `synapse.app.pusher`
 * `synapse.app.synchrotron`


@@ -11,8 +11,6 @@ warn_unused_ignores = True
 local_partial_types = True
 no_implicit_optional = True
 disallow_untyped_defs = True
-strict_equality = True
-warn_redundant_casts = True

 files =
  docker/,
@@ -60,6 +58,21 @@ exclude = (?x)
   |tests/server_notices/test_resource_limits_server_notices.py
   |tests/test_state.py
   |tests/test_terms_auth.py
+   |tests/util/caches/test_cached_call.py
+   |tests/util/caches/test_deferred_cache.py
+   |tests/util/caches/test_descriptors.py
+   |tests/util/caches/test_response_cache.py
+   |tests/util/caches/test_ttlcache.py
+   |tests/util/test_async_helpers.py
+   |tests/util/test_batching_queue.py
+   |tests/util/test_dict_cache.py
+   |tests/util/test_expiring_cache.py
+   |tests/util/test_file_consumer.py
+   |tests/util/test_linearizer.py
+   |tests/util/test_logcontext.py
+   |tests/util/test_lrucache.py
+   |tests/util/test_rwlock.py
+   |tests/util/test_wheel_timer.py
   )$

 [mypy-synapse.federation.transport.client]
@@ -89,15 +102,6 @@ disallow_untyped_defs = False
 [mypy-tests.*]
 disallow_untyped_defs = False

-[mypy-tests.config.test_api]
-disallow_untyped_defs = True
-
-[mypy-tests.federation.transport.test_client]
-disallow_untyped_defs = True
-
-[mypy-tests.handlers.test_sso]
-disallow_untyped_defs = True
-
 [mypy-tests.handlers.test_user_directory]
 disallow_untyped_defs = True

@@ -107,33 +111,28 @@ disallow_untyped_defs = True
 [mypy-tests.push.test_bulk_push_rule_evaluator]
 disallow_untyped_defs = True

-[mypy-tests.rest.*]
+[mypy-tests.test_server]
 disallow_untyped_defs = True

 [mypy-tests.state.test_profile]
 disallow_untyped_defs = True

-[mypy-tests.storage.*]
+[mypy-tests.storage.test_profile]
 disallow_untyped_defs = True

-[mypy-tests.test_server]
+[mypy-tests.storage.test_user_directory]
 disallow_untyped_defs = True

-[mypy-tests.types.*]
+[mypy-tests.rest.*]
 disallow_untyped_defs = True

-[mypy-tests.util.caches.*]
-disallow_untyped_defs = True
-
-[mypy-tests.util.caches.test_descriptors]
-disallow_untyped_defs = False
-
-[mypy-tests.util.*]
+[mypy-tests.federation.transport.test_client]
 disallow_untyped_defs = True

 [mypy-tests.utils]
 disallow_untyped_defs = True

+
 ;; Dependencies without annotations
 ;; Before ignoring a module, check to see if type stubs are available.
 ;; The `typeshed` project maintains stubs here:
@@ -57,7 +57,7 @@ manifest-path = "rust/Cargo.toml"

 [tool.poetry]
 name = "matrix-synapse"
-version = "1.74.0rc1"
+version = "1.71.0rc1"
 description = "Homeserver for the Matrix decentralised comms protocol"
 authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
 license = "Apache-2.0"
@@ -141,8 +141,7 @@ pyasn1 = ">=0.1.9"
 pyasn1-modules = ">=0.0.7"
 bcrypt = ">=3.1.7"
 Pillow = ">=5.4.0"
-# We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2.
-sortedcontainers = ">=1.5.2"
+sortedcontainers = ">=1.4.4"
 pymacaroons = ">=0.13.0"
 msgpack = ">=0.5.2"
 phonenumbers = ">=8.2.0"
@@ -208,8 +207,6 @@ hiredis = { version = "*", optional = true }
 Pympler = { version = "*", optional = true }
 parameterized = { version = ">=0.7.4", optional = true }
 idna = { version = ">=2.5", optional = true }
-pyicu = { version = ">=2.10.2", optional = true }
-uvloop = { version = ">=0.17.0", optional = true }

 [tool.poetry.extras]
 # NB: Packages that should be part of `pip install matrix-synapse[all]` need to be specified
@@ -232,11 +229,6 @@ redis = ["txredisapi", "hiredis"]
 # Required to use experimental `caches.track_memory_usage` config option.
 cache-memory = ["pympler"]
 test = ["parameterized", "idna"]
-# Allows for better search for international characters in the user directory. This
-# requires libicu's development headers installed on the system (e.g. libicu-dev on
-# Debian-based distributions).
-user-search = ["pyicu"]
-uvloop = ["uvloop"]

 # The duplication here is awful. I hate hate hate hate hate it. However, for now I want
 # to ensure you can still `pip install matrix-synapse[all]` like today. Two motivations:
@@ -268,10 +260,6 @@ all = [
    "txredisapi", "hiredis",
    # cache-memory
    "pympler",
-    # improved user search
-    "pyicu",
-    # uvloop
-    "uvloop",
    # omitted:
    #   - test: it's useful to have this separate from dev deps in the olddeps job
    #   - systemd: this is a system-based requirement
@@ -20,15 +20,15 @@ crate-type = ["lib", "cdylib"]
 name = "synapse.synapse_rust"

 [dependencies]
-anyhow = "1.0.63"
+anyhow = "1.0.66"
 lazy_static = "1.4.0"
 log = "0.4.17"
 pyo3 = { version = "0.17.1", features = ["extension-module", "macros", "anyhow", "abi3", "abi3-py37"] }
 pyo3-log = "0.7.0"
 pythonize = "0.17.0"
 regex = "1.6.0"
-serde = { version = "1.0.144", features = ["derive"] }
-serde_json = "1.0.85"
+serde = { version = "1.0.147", features = ["derive"] }
+serde_json = "1.0.87"

 [build-dependencies]
 blake2 = "0.10.4"
@@ -33,12 +33,10 @@ fn bench_match_exact(b: &mut Bencher) {
    let eval = PushRuleEvaluator::py_new(
        flattened_keys,
        10,
-        Some(0),
+        0,
        Default::default(),
        Default::default(),
        true,
-        vec![],
-        false,
    )
    .unwrap();

@@ -69,12 +67,10 @@ fn bench_match_word(b: &mut Bencher) {
    let eval = PushRuleEvaluator::py_new(
        flattened_keys,
        10,
-        Some(0),
+        0,
        Default::default(),
        Default::default(),
        true,
-        vec![],
-        false,
    )
    .unwrap();

@@ -105,12 +101,10 @@ fn bench_match_word_miss(b: &mut Bencher) {
    let eval = PushRuleEvaluator::py_new(
        flattened_keys,
        10,
-        Some(0),
+        0,
        Default::default(),
        Default::default(),
        true,
-        vec![],
-        false,
    )
    .unwrap();

@@ -141,12 +135,10 @@ fn bench_eval_message(b: &mut Bencher) {
    let eval = PushRuleEvaluator::py_new(
        flattened_keys,
        10,
-        Some(0),
+        0,
        Default::default(),
        Default::default(),
        true,
-        vec![],
-        false,
    )
    .unwrap();

@@ -274,156 +274,6 @@ pub const BASE_APPEND_UNDERRIDE_RULES: &[PushRule] = &[
        default: true,
        default_enabled: true,
    },
-    PushRule {
-        rule_id: Cow::Borrowed(
-            "global/underride/.org.matrix.msc3933.rule.extensible.encrypted_room_one_to_one",
-        ),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("org.matrix.msc1767.encrypted")),
-                pattern_type: None,
-            })),
-            Condition::Known(KnownCondition::RoomMemberCount {
-                is: Some(Cow::Borrowed("2")),
-            }),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, SOUND_ACTION, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed(
-            "global/underride/.org.matrix.msc3933.rule.extensible.message.room_one_to_one",
-        ),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("org.matrix.msc1767.message")),
-                pattern_type: None,
-            })),
-            Condition::Known(KnownCondition::RoomMemberCount {
-                is: Some(Cow::Borrowed("2")),
-            }),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, SOUND_ACTION, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed(
-            "global/underride/.org.matrix.msc3933.rule.extensible.file.room_one_to_one",
-        ),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("org.matrix.msc1767.file")),
-                pattern_type: None,
-            })),
-            Condition::Known(KnownCondition::RoomMemberCount {
-                is: Some(Cow::Borrowed("2")),
-            }),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, SOUND_ACTION, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed(
-            "global/underride/.org.matrix.msc3933.rule.extensible.image.room_one_to_one",
-        ),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("org.matrix.msc1767.image")),
-                pattern_type: None,
-            })),
-            Condition::Known(KnownCondition::RoomMemberCount {
-                is: Some(Cow::Borrowed("2")),
-            }),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, SOUND_ACTION, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed(
-            "global/underride/.org.matrix.msc3933.rule.extensible.video.room_one_to_one",
-        ),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("org.matrix.msc1767.video")),
-                pattern_type: None,
-            })),
-            Condition::Known(KnownCondition::RoomMemberCount {
-                is: Some(Cow::Borrowed("2")),
-            }),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, SOUND_ACTION, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed(
-            "global/underride/.org.matrix.msc3933.rule.extensible.audio.room_one_to_one",
-        ),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("org.matrix.msc1767.audio")),
-                pattern_type: None,
-            })),
-            Condition::Known(KnownCondition::RoomMemberCount {
-                is: Some(Cow::Borrowed("2")),
-            }),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, SOUND_ACTION, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
    PushRule {
        rule_id: Cow::Borrowed("global/underride/.m.rule.message"),
        priority_class: 1,
@@ -452,126 +302,6 @@ pub const BASE_APPEND_UNDERRIDE_RULES: &[PushRule] = &[
        default: true,
        default_enabled: true,
    },
-    PushRule {
-        rule_id: Cow::Borrowed("global/underride/.org.matrix.msc1767.rule.extensible.encrypted"),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("m.encrypted")),
-                pattern_type: None,
-            })),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed("global/underride/.org.matrix.msc1767.rule.extensible.message"),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("m.message")),
-                pattern_type: None,
-            })),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed("global/underride/.org.matrix.msc1767.rule.extensible.file"),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("m.file")),
-                pattern_type: None,
-            })),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed("global/underride/.org.matrix.msc1767.rule.extensible.image"),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("m.image")),
-                pattern_type: None,
-            })),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed("global/underride/.org.matrix.msc1767.rule.extensible.video"),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("m.video")),
-                pattern_type: None,
-            })),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
-    PushRule {
-        rule_id: Cow::Borrowed("global/underride/.org.matrix.msc1767.rule.extensible.audio"),
-        priority_class: 1,
-        conditions: Cow::Borrowed(&[
-            Condition::Known(KnownCondition::EventMatch(EventMatchCondition {
-                key: Cow::Borrowed("type"),
-                // MSC3933: Type changed from template rule - see MSC.
-                pattern: Some(Cow::Borrowed("m.audio")),
-                pattern_type: None,
-            })),
-            // MSC3933: Add condition on top of template rule - see MSC.
-            Condition::Known(KnownCondition::RoomVersionSupports {
-                // RoomVersionFeatures::ExtensibleEvents.as_str(), ideally
-                feature: Cow::Borrowed("org.matrix.msc3932.extensible_events"),
-            }),
-        ]),
-        actions: Cow::Borrowed(&[Action::Notify, HIGHLIGHT_FALSE_ACTION]),
-        default: true,
-        default_enabled: true,
-    },
    PushRule {
        rule_id: Cow::Borrowed("global/underride/.im.vector.jitsi"),
        priority_class: 1,
@@ -29,33 +29,6 @@ use super::{
 lazy_static! {
    /// Used to parse the `is` clause in the room member count condition.
    static ref INEQUALITY_EXPR: Regex = Regex::new(r"^([=<>]*)([0-9]+)$").expect("valid regex");
-
-    /// Used to determine which MSC3931 room version feature flags are actually known to
-    /// the push evaluator.
-    static ref KNOWN_RVER_FLAGS: Vec<String> = vec![
-        RoomVersionFeatures::ExtensibleEvents.as_str().to_string(),
-    ];
-
-    /// The "safe" rule IDs which are not affected by MSC3932's behaviour (room versions which
-    /// declare Extensible Events support ultimately *disable* push rules which do not declare
-    /// *any* MSC3931 room_version_supports condition).
-    static ref SAFE_EXTENSIBLE_EVENTS_RULE_IDS: Vec<String> = vec![
-        "global/override/.m.rule.master".to_string(),
-        "global/override/.m.rule.roomnotif".to_string(),
-        "global/content/.m.rule.contains_user_name".to_string(),
-    ];
-}
-
-enum RoomVersionFeatures {
-    ExtensibleEvents,
-}
-
-impl RoomVersionFeatures {
-    fn as_str(&self) -> &'static str {
-        match self {
-            RoomVersionFeatures::ExtensibleEvents => "org.matrix.msc3932.extensible_events",
-        }
-    }
 }

 /// Allows running a set of push rules against a particular event.
@@ -84,19 +57,11 @@ pub struct PushRuleEvaluator {

    /// If msc3664, push rules for related events, is enabled.
    related_event_match_enabled: bool,
-
-    /// If MSC3931 is applicable, the feature flags for the room version.
-    room_version_feature_flags: Vec<String>,
-
-    /// If MSC3931 (room version feature flags) is enabled. Usually controlled by the same
-    /// flag as MSC1767 (extensible events core).
-    msc3931_enabled: bool,
 }

 #[pymethods]
 impl PushRuleEvaluator {
    /// Create a new `PushRuleEvaluator`. See struct docstring for details.
-    #[allow(clippy::too_many_arguments)]
    #[new]
    pub fn py_new(
        flattened_keys: BTreeMap<String, String>,
@@ -105,8 +70,6 @@ impl PushRuleEvaluator {
        notification_power_levels: BTreeMap<String, i64>,
        related_events_flattened: BTreeMap<String, BTreeMap<String, String>>,
        related_event_match_enabled: bool,
-        room_version_feature_flags: Vec<String>,
-        msc3931_enabled: bool,
    ) -> Result<Self, Error> {
        let body = flattened_keys
            .get("content.body")
@@ -121,8 +84,6 @@ impl PushRuleEvaluator {
            sender_power_level,
            related_events_flattened,
            related_event_match_enabled,
-            room_version_feature_flags,
-            msc3931_enabled,
        })
    }

@@ -145,19 +106,7 @@ impl PushRuleEvaluator {
                continue;
            }

-            let rule_id = &push_rule.rule_id().to_string();
-            let extev_flag = &RoomVersionFeatures::ExtensibleEvents.as_str().to_string();
-            let supports_extensible_events = self.room_version_feature_flags.contains(extev_flag);
-            let safe_from_rver_condition = SAFE_EXTENSIBLE_EVENTS_RULE_IDS.contains(rule_id);
-            let mut has_rver_condition = false;
-
            for condition in push_rule.conditions.iter() {
-                has_rver_condition |= matches!(
-                    condition,
-                    // per MSC3932, we just need *any* room version condition to match
-                    Condition::Known(KnownCondition::RoomVersionSupports { feature: _ }),
-                );
-
                match self.match_condition(condition, user_id, display_name) {
                    Ok(true) => {}
                    Ok(false) => continue 'outer,
@@ -168,13 +117,6 @@ impl PushRuleEvaluator {
                }
            }

-            // MSC3932: Disable push rules in extensible event-supporting room versions if they
-            // don't describe *any* MSC3931 room version condition, unless the rule is on the
-            // safe list.
-            if !has_rver_condition && !safe_from_rver_condition && supports_extensible_events {
-                continue;
-            }
-
            let actions = push_rule
                .actions
                .iter()
@@ -262,15 +204,6 @@ impl PushRuleEvaluator {
                    false
                }
            }
-            KnownCondition::RoomVersionSupports { feature } => {
-                if !self.msc3931_enabled {
-                    false
-                } else {
-                    let flag = feature.to_string();
-                    KNOWN_RVER_FLAGS.contains(&flag)
-                        && self.room_version_feature_flags.contains(&flag)
-                }
-            }
        };

        Ok(result)
@@ -429,63 +362,9 @@ fn push_rule_evaluator() {
        BTreeMap::new(),
        BTreeMap::new(),
        true,
-        vec![],
-        true,
    )
    .unwrap();

    let result = evaluator.run(&FilteredPushRules::default(), None, Some("bob"));
    assert_eq!(result.len(), 3);
 }
-
-#[test]
-fn test_requires_room_version_supports_condition() {
-    use std::borrow::Cow;
-
-    use crate::push::{PushRule, PushRules};
-
-    let mut flattened_keys = BTreeMap::new();
-    flattened_keys.insert("content.body".to_string(), "foo bar bob hello".to_string());
-    let flags = vec![RoomVersionFeatures::ExtensibleEvents.as_str().to_string()];
-    let evaluator = PushRuleEvaluator::py_new(
-        flattened_keys,
-        10,
-        Some(0),
-        BTreeMap::new(),
-        BTreeMap::new(),
-        false,
-        flags,
-        true,
-    )
-    .unwrap();
-
-    // first test: are the master and contains_user_name rules excluded from the "requires room
-    // version condition" check?
-    let mut result = evaluator.run(
-        &FilteredPushRules::default(),
-        Some("@bob:example.org"),
-        None,
-    );
-    assert_eq!(result.len(), 3);
-
-    // second test: if an appropriate push rule is in play, does it get handled?
-    let custom_rule = PushRule {
-        rule_id: Cow::from("global/underride/.org.example.extensible"),
-        priority_class: 1, // underride
-        conditions: Cow::from(vec![Condition::Known(
-            KnownCondition::RoomVersionSupports {
-                feature: Cow::from(RoomVersionFeatures::ExtensibleEvents.as_str().to_string()),
-            },
-        )]),
-        actions: Cow::from(vec![Action::Notify]),
-        default: false,
-        default_enabled: true,
-    };
-    let rules = PushRules::new(vec![custom_rule]);
-    result = evaluator.run(
-        &FilteredPushRules::py_new(rules, BTreeMap::new(), true, true),
-        None,
-        None,
-    );
-    assert_eq!(result.len(), 1);
-}
@@ -277,10 +277,6 @@ pub enum KnownCondition {
    SenderNotificationPermission {
        key: Cow<'static, str>,
    },
-    #[serde(rename = "org.matrix.msc3931.room_version_supports")]
-    RoomVersionSupports {
-        feature: Cow<'static, str>,
-    },
 }

 impl IntoPy<PyObject> for Condition {
@@ -412,7 +408,6 @@ pub struct FilteredPushRules {
    push_rules: PushRules,
    enabled_map: BTreeMap<String, bool>,
    msc3664_enabled: bool,
-    msc1767_enabled: bool,
 }

 #[pymethods]
@@ -422,13 +417,11 @@ impl FilteredPushRules {
        push_rules: PushRules,
        enabled_map: BTreeMap<String, bool>,
        msc3664_enabled: bool,
-        msc1767_enabled: bool,
    ) -> Self {
        Self {
            push_rules,
            enabled_map,
            msc3664_enabled,
-            msc1767_enabled,
        }
    }

@@ -453,10 +446,6 @@ impl FilteredPushRules {
                    return false;
                }

-                if !self.msc1767_enabled && rule.rule_id.contains("org.matrix.msc1767") {
-                    return false;
-                }
-
                true
            })
            .map(|r| {
@@ -502,18 +491,6 @@ fn test_deserialize_unstable_msc3664_condition() {
    ));
 }

-#[test]
-fn test_deserialize_unstable_msc3931_condition() {
-    let json =
-        r#"{"kind":"org.matrix.msc3931.room_version_supports","feature":"org.example.feature"}"#;
-
-    let condition: Condition = serde_json::from_str(json).unwrap();
-    assert!(matches!(
-        condition,
-        Condition::Known(KnownCondition::RoomVersionSupports { feature: _ })
-    ));
-}
-
 #[test]
 fn test_deserialize_custom_condition() {
    let json = r#"{"kind":"custom_tag"}"#;
@@ -27,7 +27,6 @@ DISTS = (
    "debian:sid",
    "ubuntu:focal",  # 20.04 LTS (our EOL forced by Py38 on 2024-10-14)
    "ubuntu:jammy",  # 22.04 LTS (EOL 2027-04)
-    "ubuntu:kinetic",  # 22.10 (EOL 2023-07-20)
 )

 DESC = """\
@@ -53,12 +53,6 @@ Run the complement test suite on Synapse.
        Only build the Docker images. Don't actually run Complement.
        Conflicts with -f/--fast.

-  -e, --editable
-        Use an editable build of Synapse, rebuilding the image if necessary.
-        This is suitable for use in development where a fast turn-around time
-        is important.
-        Not suitable for use in CI in case the editable environment is impure.
-
 For help on arguments to 'go test', run 'go help testflag'.
 EOF
 }
@@ -79,9 +73,6 @@ while [ $# -ge 1 ]; do
        "--build-only")
            skip_complement_run=1
            ;;
-        "-e"|"--editable")
-            use_editable_synapse=1
-            ;;
        *)
            # unknown arg: presumably an argument to gotest. break the loop.
            break
@@ -105,76 +96,25 @@ if [[ -z "$COMPLEMENT_DIR" ]]; then
  echo "Checkout available at 'complement-${COMPLEMENT_REF}'"
 fi

-if [ -n "$use_editable_synapse" ]; then
-    if [[ -e synapse/synapse_rust.abi3.so ]]; then
-        # In an editable install, back up the host's compiled Rust module to prevent
-        # inconvenience; the container will overwrite the module with its own copy.
-        mv -n synapse/synapse_rust.abi3.so synapse/synapse_rust.abi3.so~host
-        # And restore it on exit:
-        synapse_pkg=`realpath synapse`
-        trap "mv -f '$synapse_pkg/synapse_rust.abi3.so~host' '$synapse_pkg/synapse_rust.abi3.so'" EXIT
-    fi
-
-    editable_mount="$(realpath .):/editable-src:z"
-    if docker inspect complement-synapse-editable &>/dev/null; then
-        # complement-synapse-editable already exists: see if we can still use it:
-        # - The Rust module must still be importable; it will fail to import if the Rust source has changed.
-        # - The Poetry lock file must be the same (otherwise we assume dependencies have changed)
-
-        # First set up the module in the right place for an editable installation.
-        docker run --rm -v $editable_mount --entrypoint 'cp' complement-synapse-editable -- /synapse_rust.abi3.so.bak /editable-src/synapse/synapse_rust.abi3.so
-
-        if (docker run --rm -v $editable_mount --entrypoint 'python' complement-synapse-editable -c 'import synapse.synapse_rust' \
-            && docker run --rm -v $editable_mount --entrypoint 'diff' complement-synapse-editable --brief /editable-src/poetry.lock /poetry.lock.bak); then
-            skip_docker_build=1
-        else
-            echo "Editable Synapse image is stale. Will rebuild."
-            unset skip_docker_build
-        fi
-    fi
-fi
-
 if [ -z "$skip_docker_build" ]; then
-    if [ -n "$use_editable_synapse" ]; then
+    # Build the base Synapse image from the local checkout
+    echo_if_github "::group::Build Docker image: matrixdotorg/synapse"
+    docker build -t matrixdotorg/synapse \
+      --build-arg TEST_ONLY_SKIP_DEP_HASH_VERIFICATION \
+      --build-arg TEST_ONLY_IGNORE_POETRY_LOCKFILE \
+      -f "docker/Dockerfile" .
+    echo_if_github "::endgroup::"

-        # Build a special image designed for use in development with editable
-        # installs.
-        docker build -t synapse-editable \
-            -f "docker/editable.Dockerfile" .
+    # Build the workers docker image (from the base Synapse image we just built).
+    echo_if_github "::group::Build Docker image: matrixdotorg/synapse-workers"
+    docker build -t matrixdotorg/synapse-workers -f "docker/Dockerfile-workers" .
+    echo_if_github "::endgroup::"

-        docker build -t synapse-workers-editable \
-            --build-arg FROM=synapse-editable \
-            -f "docker/Dockerfile-workers" .
-
-        docker build -t complement-synapse-editable \
-            --build-arg FROM=synapse-workers-editable \
-            -f "docker/complement/Dockerfile" "docker/complement"
-
-        # Prepare the Rust module
-        docker run --rm -v $editable_mount --entrypoint 'cp' complement-synapse-editable -- /synapse_rust.abi3.so.bak /editable-src/synapse/synapse_rust.abi3.so
-
-    else
-
-        # Build the base Synapse image from the local checkout
-        echo_if_github "::group::Build Docker image: matrixdotorg/synapse"
-        docker build -t matrixdotorg/synapse \
-        --build-arg TEST_ONLY_SKIP_DEP_HASH_VERIFICATION \
-        --build-arg TEST_ONLY_IGNORE_POETRY_LOCKFILE \
-        -f "docker/Dockerfile" .
-        echo_if_github "::endgroup::"
-
-        # Build the workers docker image (from the base Synapse image we just built).
-        echo_if_github "::group::Build Docker image: matrixdotorg/synapse-workers"
-        docker build -t matrixdotorg/synapse-workers -f "docker/Dockerfile-workers" .
-        echo_if_github "::endgroup::"
-
-        # Build the unified Complement image (from the worker Synapse image we just built).
-        echo_if_github "::group::Build Docker image: complement/Dockerfile"
-        docker build -t complement-synapse \
-            -f "docker/complement/Dockerfile" "docker/complement"
-        echo_if_github "::endgroup::"
-
-    fi
+    # Build the unified Complement image (from the worker Synapse image we just built).
+    echo_if_github "::group::Build Docker image: complement/Dockerfile"
+    docker build -t complement-synapse \
+           -f "docker/complement/Dockerfile" "docker/complement"
+    echo_if_github "::endgroup::"
 fi

 if [ -n "$skip_complement_run" ]; then
@@ -183,14 +123,10 @@ if [ -n "$skip_complement_run" ]; then
 fi

 export COMPLEMENT_BASE_IMAGE=complement-synapse
-if [ -n "$use_editable_synapse" ]; then
-    export COMPLEMENT_BASE_IMAGE=complement-synapse-editable
-    export COMPLEMENT_HOST_MOUNTS="$editable_mount"
-fi

 extra_test_args=()

-test_tags="synapse_blacklist,msc3787,msc3874"
+test_tags="synapse_blacklist,msc3787"

 # All environment variables starting with PASS_ will be shared.
 # (The prefix is stripped off before reaching the container.)
@@ -203,9 +139,6 @@ if [[ -n "$WORKERS" ]]; then
  # Use workers.
  export PASS_SYNAPSE_COMPLEMENT_USE_WORKERS=true

-  # Pass through the workers defined. If none, it will be an empty string
-  export PASS_SYNAPSE_WORKER_TYPES="$WORKER_TYPES"
-
  # Workers can only use Postgres as a database.
  export PASS_SYNAPSE_COMPLEMENT_DATABASE=postgres

@@ -226,9 +159,9 @@ else
  # We only test faster room joins on monoliths, because they are purposefully
  # being developed without worker support to start with.
  #
-  # The tests for importing historical messages (MSC2716) also only pass with monoliths,
-  # currently.
-  test_tags="$test_tags,faster_joins,msc2716"
+  # The tests for importing historical messages (MSC2716) and jump to date (MSC3030)
+  # also only pass with monoliths, currently.
+  test_tags="$test_tags,faster_joins,msc2716,msc3030"
 fi


@@ -46,12 +46,11 @@ import signedjson.key
 import signedjson.types
 import srvlookup
 import yaml
-from requests import PreparedRequest, Response
 from requests.adapters import HTTPAdapter
 from urllib3 import HTTPConnectionPool

 # uncomment the following to enable debug logging of http requests
-# from http.client import HTTPConnection
+# from httplib import HTTPConnection
 # HTTPConnection.debuglevel = 1


@@ -104,7 +103,6 @@ def request(
    destination: str,
    path: str,
    content: Optional[str],
-    verify_tls: bool,
 ) -> requests.Response:
    if method is None:
        if content is None:
@@ -143,6 +141,7 @@ def request(
    s.mount("matrix://", MatrixConnectionAdapter())

    headers: Dict[str, str] = {
+        "Host": destination,
        "Authorization": authorization_headers[0],
    }

@@ -153,7 +152,7 @@ def request(
        method=method,
        url=dest,
        headers=headers,
-        verify=verify_tls,
+        verify=False,
        data=content,
        stream=True,
    )
@@ -203,12 +202,6 @@ def main() -> None:

    parser.add_argument("--body", help="Data to send as the body of the HTTP request")

-    parser.add_argument(
-        "--insecure",
-        action="store_true",
-        help="Disable TLS certificate verification",
-    )
-
    parser.add_argument(
        "path", help="request path, including the '/_matrix/federation/...' prefix."
    )
@@ -234,7 +227,6 @@ def main() -> None:
        args.destination,
        args.path,
        content=args.body,
-        verify_tls=not args.insecure,
    )

    sys.stderr.write("Status Code: %d\n" % (result.status_code,))
@@ -262,93 +254,36 @@ def read_args_from_config(args: argparse.Namespace) -> None:


 class MatrixConnectionAdapter(HTTPAdapter):
-    def send(
-        self,
-        request: PreparedRequest,
-        *args: Any,
-        **kwargs: Any,
-    ) -> Response:
-        # overrides the send() method in the base class.
-
-        # We need to look for .well-known redirects before passing the request up to
-        # HTTPAdapter.send().
-        assert isinstance(request.url, str)
-        parsed = urlparse.urlsplit(request.url)
-        server_name = parsed.netloc
-        well_known = self._get_well_known(parsed.netloc)
-
-        if well_known:
-            server_name = well_known
-
-        # replace the scheme in the uri with https, so that cert verification is done
-        # also replace the hostname if we got a .well-known result
-        request.url = urlparse.urlunsplit(
-            ("https", server_name, parsed.path, parsed.query, parsed.fragment)
-        )
-
-        # at this point we also add the host header (otherwise urllib will add one
-        # based on the `host` from the connection returned by `get_connection`,
-        # which will be wrong if there is an SRV record).
-        request.headers["Host"] = server_name
-
-        return super().send(request, *args, **kwargs)
-
-    def get_connection(
-        self, url: str, proxies: Optional[Dict[str, str]] = None
-    ) -> HTTPConnectionPool:
-        # overrides the get_connection() method in the base class
-        parsed = urlparse.urlsplit(url)
-        (host, port, ssl_server_name) = self._lookup(parsed.netloc)
-        print(
-            f"Connecting to {host}:{port} with SNI {ssl_server_name}", file=sys.stderr
-        )
-        return self.poolmanager.connection_from_host(
-            host,
-            port=port,
-            scheme="https",
-            pool_kwargs={"server_hostname": ssl_server_name},
-        )
-
    @staticmethod
-    def _lookup(server_name: str) -> Tuple[str, int, str]:
-        """
-        Do an SRV lookup on a server name and return the host:port to connect to
-        Given the server_name (after any .well-known lookup), return the host, port and
-        the ssl server name
-        """
-        if server_name[-1] == "]":
+    def lookup(s: str, skip_well_known: bool = False) -> Tuple[str, int]:
+        if s[-1] == "]":
            # ipv6 literal (with no port)
-            return server_name, 8448, server_name
+            return s, 8448

-        if ":" in server_name:
-            # explicit port
-            out = server_name.rsplit(":", 1)
+        if ":" in s:
+            out = s.rsplit(":", 1)
            try:
                port = int(out[1])
            except ValueError:
-                raise ValueError("Invalid host:port '%s'" % (server_name,))
-            return out[0], port, out[0]
+                raise ValueError("Invalid host:port '%s'" % s)
+            return out[0], port
+
+        # try a .well-known lookup
+        if not skip_well_known:
+            well_known = MatrixConnectionAdapter.get_well_known(s)
+            if well_known:
+                return MatrixConnectionAdapter.lookup(well_known, skip_well_known=True)

        try:
-            srv = srvlookup.lookup("matrix", "tcp", server_name)[0]
-            print(
-                f"SRV lookup on _matrix._tcp.{server_name} gave {srv}",
-                file=sys.stderr,
-            )
-            return srv.host, srv.port, server_name
+            srv = srvlookup.lookup("matrix", "tcp", s)[0]
+            return srv.host, srv.port
        except Exception:
-            return server_name, 8448, server_name
+            return s, 8448

    @staticmethod
-    def _get_well_known(server_name: str) -> Optional[str]:
-        if ":" in server_name:
-            # explicit port, or ipv6 literal. Either way, no .well-known
-            return None
-
-        # TODO: check for ipv4 literals
-
-        uri = f"https://{server_name}/.well-known/matrix/server"
-        print(f"fetching {uri}", file=sys.stderr)
+    def get_well_known(server_name: str) -> Optional[str]:
+        uri = "https://%s/.well-known/matrix/server" % (server_name,)
+        print("fetching %s" % (uri,), file=sys.stderr)

        try:
            resp = requests.get(uri)
@@ -369,6 +304,19 @@ class MatrixConnectionAdapter(HTTPAdapter):
            print("Invalid response from %s: %s" % (uri, e), file=sys.stderr)
        return None

+    def get_connection(
+        self, url: str, proxies: Optional[Dict[str, str]] = None
+    ) -> HTTPConnectionPool:
+        parsed = urlparse.urlparse(url)
+
+        (host, port) = self.lookup(parsed.netloc)
+        netloc = "%s:%d" % (host, port)
+        print("Connecting to %s" % (netloc,), file=sys.stderr)
+        url = urlparse.urlunparse(
+            ("https", netloc, parsed.path, parsed.params, parsed.query, parsed.fragment)
+        )
+        return super().get_connection(url, proxies)
+

 if __name__ == "__main__":
    main()
@@ -27,7 +27,7 @@ import time
 import urllib.request
 from os import path
 from tempfile import TemporaryDirectory
-from typing import Any, List, Optional
+from typing import Any, List, Optional, cast

 import attr
 import click
@@ -174,7 +174,9 @@ def _prepare() -> None:
        click.get_current_context().abort()

    # Switch to the release branch.
-    parsed_new_version = version.parse(new_version)
+    # Cast safety: parse() won't return a version.LegacyVersion from our
+    # version string format.
+    parsed_new_version = cast(version.Version, version.parse(new_version))

    # We assume for debian changelogs that we only do RCs or full releases.
    assert not parsed_new_version.is_devrelease
@@ -217,7 +219,9 @@ def _prepare() -> None:
                update_branch(repo)

            # Create the new release branch
-            repo.create_head(release_branch_name, commit=base_branch)
+            # Type ignore will no longer be needed after GitPython 3.1.28.
+            # See https://github.com/gitpython-developers/GitPython/pull/1419
+            repo.create_head(release_branch_name, commit=base_branch)  # type: ignore[arg-type]

        # Special-case SyTest: we don't actually prepare any files so we may
        # as well push it now (and only when we create a release branch;
@@ -1,4 +1,4 @@
-from typing import Any, Collection, Dict, Mapping, Optional, Sequence, Tuple, Union
+from typing import Any, Collection, Dict, Mapping, Optional, Sequence, Set, Tuple, Union

 from synapse.types import JsonDict

@@ -26,11 +26,7 @@ class PushRules:

 class FilteredPushRules:
    def __init__(
-        self,
-        push_rules: PushRules,
-        enabled_map: Dict[str, bool],
-        msc3664_enabled: bool,
-        msc1767_enabled: bool,
+        self, push_rules: PushRules, enabled_map: Dict[str, bool], msc3664_enabled: bool
    ): ...
    def rules(self) -> Collection[Tuple[PushRule, bool]]: ...

@@ -45,12 +41,10 @@ class PushRuleEvaluator:
        notification_power_levels: Mapping[str, int],
        related_events_flattened: Mapping[str, Mapping[str, str]],
        related_event_match_enabled: bool,
-        room_version_feature_flags: Tuple[str, ...],
-        msc3931_enabled: bool,
    ): ...
    def run(
        self,
        push_rules: FilteredPushRules,
        user_id: Optional[str],
        display_name: Optional[str],
-    ) -> Collection[Union[Mapping, str]]: ...
+    ) -> Collection[dict]: ...
@@ -44,15 +44,8 @@ if strtobool(os.environ.get("SYNAPSE_ASYNC_IO_REACTOR", "0")):

    from twisted.internet import asyncioreactor

-    if bool(os.environ.get("SYNAPSE_UVLOOP", False)):
-        import uvloop
-
-        uvloop.install()
-        print("Using uvloop")
-
    asyncioreactor.install(asyncio.get_event_loop())

-
 # Twisted and canonicaljson will fail to import when this file is executed to
 # get the __version__ during a fresh install. That's OK and subsequent calls to
 # actually start Synapse will import these libraries fine.
@@ -222,7 +222,6 @@ def main() -> None:

    args = parser.parse_args()

-    config: Optional[Dict[str, Any]] = None
    if "config" in args and args.config:
        config = yaml.safe_load(args.config)

@@ -230,7 +229,7 @@ def main() -> None:
        secret = args.shared_secret
    else:
        # argparse should check that we have either config or shared secret
-        assert config is not None
+        assert config

        secret = config.get("registration_shared_secret")
        secret_file = config.get("registration_shared_secret_path")
@@ -245,7 +244,7 @@ def main() -> None:

    if args.server_url:
        server_url = args.server_url
-    elif config is not None:
+    elif config:
        server_url = _find_client_listener(config)
        if not server_url:
            server_url = _DEFAULT_SERVER_URL
@@ -125,8 +125,6 @@ class EventTypes:
    MSC2716_BATCH: Final = "org.matrix.msc2716.batch"
    MSC2716_MARKER: Final = "org.matrix.msc2716.marker"

-    Reaction: Final = "m.reaction"
-

 class ToDeviceEventTypes:
    RoomKeyRequest: Final = "m.room_key_request"
@@ -152,7 +150,6 @@ class EduTypes:

 class RejectedReason:
    AUTH_ERROR: Final = "auth_error"
-    OVERSIZED_EVENT: Final = "oversized_event"


 class RoomCreationPreset:
@@ -231,9 +228,6 @@ class EventContentFields:
    # The authorising user for joining a restricted room.
    AUTHORISING_USER: Final = "join_authorised_via_users_server"

-    # an unspecced field added to to-device messages to identify them uniquely-ish
-    TO_DEVICE_MSGID: Final = "org.matrix.msgid"
-

 class RoomTypes:
    """Understood values of the room_type field of m.room.create events."""
@@ -300,8 +300,10 @@ class InteractiveAuthIncompleteError(Exception):
 class UnrecognizedRequestError(SynapseError):
    """An error indicating we don't understand the request you're trying to make"""

-    def __init__(self, msg: str = "Unrecognized request", code: int = 400):
-        super().__init__(code, msg, Codes.UNRECOGNIZED)
+    def __init__(
+        self, msg: str = "Unrecognized request", errcode: str = Codes.UNRECOGNIZED
+    ):
+        super().__init__(400, msg, errcode)


 class NotFoundError(SynapseError):
@@ -424,17 +426,8 @@ class ResourceLimitError(SynapseError):
 class EventSizeError(SynapseError):
    """An error raised when an event is too big."""

-    def __init__(self, msg: str, unpersistable: bool):
-        """
-        unpersistable:
-            if True, the PDU must not be persisted, not even as a rejected PDU
-            when received over federation.
-            This is notably true when the entire PDU exceeds the size limit for a PDU,
-            (as opposed to an individual key's size limit being exceeded).
-        """
-
+    def __init__(self, msg: str):
        super().__init__(413, msg, Codes.TOO_LARGE)
-        self.unpersistable = unpersistable


 class LoginError(SynapseError):
@@ -720,7 +713,7 @@ class HttpResponseException(CodeMessageException):
        set to the reason code from the HTTP response.

        Returns:
-            The error converted to a SynapseError.
+            SynapseError:
        """
        # try to parse the body as json, to get better errcode/msg, but
        # default to M_UNKNOWN with the HTTP status as the error text
@@ -43,7 +43,7 @@ if TYPE_CHECKING:
    from synapse.server import HomeServer

 FILTER_SCHEMA = {
-    "additionalProperties": True,  # Allow new fields for forward compatibility
+    "additionalProperties": False,
    "type": "object",
    "properties": {
        "limit": {"type": "number"},
@@ -63,7 +63,7 @@ FILTER_SCHEMA = {
 }

 ROOM_FILTER_SCHEMA = {
-    "additionalProperties": True,  # Allow new fields for forward compatibility
+    "additionalProperties": False,
    "type": "object",
    "properties": {
        "not_rooms": {"$ref": "#/definitions/room_id_array"},
@@ -77,7 +77,7 @@ ROOM_FILTER_SCHEMA = {
 }

 ROOM_EVENT_FILTER_SCHEMA = {
-    "additionalProperties": True,  # Allow new fields for forward compatibility
+    "additionalProperties": False,
    "type": "object",
    "properties": {
        "limit": {"type": "number"},
@@ -143,7 +143,7 @@ USER_FILTER_SCHEMA = {
            },
        },
    },
-    "additionalProperties": True,  # Allow new fields for forward compatibility
+    "additionalProperties": False,
 }


@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-from typing import Callable, Dict, Optional, Tuple
+from typing import Callable, Dict, Optional

 import attr

@@ -51,13 +51,6 @@ class RoomDisposition:
    UNSTABLE = "unstable"


-class PushRuleRoomFlag:
-    """Enum for listing possible MSC3931 room version feature flags, for push rules"""
-
-    # MSC3932: Room version supports MSC1767 Extensible Events.
-    EXTENSIBLE_EVENTS = "org.matrix.msc3932.extensible_events"
-
-
@attr.s(slots=True, frozen=True, auto_attribs=True)
 class RoomVersion:
    """An object which describes the unique attributes of a room version."""
@@ -98,12 +91,6 @@ class RoomVersion:
    msc3787_knock_restricted_join_rule: bool
    # MSC3667: Enforce integer power levels
    msc3667_int_only_power_levels: bool
-    # MSC3931: Adds a push rule condition for "room version feature flags", making
-    # some push rules room version dependent. Note that adding a flag to this list
-    # is not enough to mark it "supported": the push rule evaluator also needs to
-    # support the flag. Unknown flags are ignored by the evaluator, making conditions
-    # fail if used.
-    msc3931_push_features: Tuple[str, ...]  # values from PushRuleRoomFlag


 class RoomVersions:
@@ -124,7 +111,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V2 = RoomVersion(
        "2",
@@ -143,7 +129,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V3 = RoomVersion(
        "3",
@@ -162,7 +147,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V4 = RoomVersion(
        "4",
@@ -181,7 +165,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V5 = RoomVersion(
        "5",
@@ -200,7 +183,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V6 = RoomVersion(
        "6",
@@ -219,7 +201,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    MSC2176 = RoomVersion(
        "org.matrix.msc2176",
@@ -238,7 +219,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V7 = RoomVersion(
        "7",
@@ -257,7 +237,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V8 = RoomVersion(
        "8",
@@ -276,7 +255,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V9 = RoomVersion(
        "9",
@@ -295,7 +273,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    MSC3787 = RoomVersion(
        "org.matrix.msc3787",
@@ -314,7 +291,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=True,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
    )
    V10 = RoomVersion(
        "10",
@@ -333,7 +309,6 @@ class RoomVersions:
        msc2716_redactions=False,
        msc3787_knock_restricted_join_rule=True,
        msc3667_int_only_power_levels=True,
-        msc3931_push_features=(),
    )
    MSC2716v4 = RoomVersion(
        "org.matrix.msc2716v4",
@@ -352,27 +327,6 @@ class RoomVersions:
        msc2716_redactions=True,
        msc3787_knock_restricted_join_rule=False,
        msc3667_int_only_power_levels=False,
-        msc3931_push_features=(),
-    )
-    MSC1767v10 = RoomVersion(
-        # MSC1767 (Extensible Events) based on room version "10"
-        "org.matrix.msc1767.10",
-        RoomDisposition.UNSTABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        msc2176_redaction_rules=False,
-        msc3083_join_rules=True,
-        msc3375_redaction_rules=True,
-        msc2403_knocking=True,
-        msc2716_historical=False,
-        msc2716_redactions=False,
-        msc3787_knock_restricted_join_rule=True,
-        msc3667_int_only_power_levels=True,
-        msc3931_push_features=(PushRuleRoomFlag.EXTENSIBLE_EVENTS,),
    )


@@ -47,7 +47,6 @@ from twisted.internet.tcp import Port
 from twisted.logger import LoggingFile, LogLevel
 from twisted.protocols.tls import TLSMemoryBIOFactory
 from twisted.python.threadpool import ThreadPool
-from twisted.web.resource import Resource

 import synapse.util.caches
 from synapse.api.constants import MAX_PDU_SIZE
@@ -56,13 +55,12 @@ from synapse.app.phone_stats_home import start_phone_stats_home
 from synapse.config import ConfigError
 from synapse.config._base import format_config_error
 from synapse.config.homeserver import HomeServerConfig
-from synapse.config.server import ListenerConfig, ManholeConfig
+from synapse.config.server import ManholeConfig
 from synapse.crypto import context_factory
 from synapse.events.presence_router import load_legacy_presence_router
 from synapse.events.spamcheck import load_legacy_spam_checkers
 from synapse.events.third_party_rules import load_legacy_third_party_event_rules
 from synapse.handlers.auth import load_legacy_password_auth_providers
-from synapse.http.site import SynapseSite
 from synapse.logging.context import PreserveLoggingContext
 from synapse.logging.opentracing import init_tracer
 from synapse.metrics import install_gc_manager, register_threadpool
@@ -266,18 +264,26 @@ def register_start(
    reactor.callWhenRunning(lambda: defer.ensureDeferred(wrapper()))


-def listen_metrics(bind_addresses: Iterable[str], port: int) -> None:
+def listen_metrics(
+    bind_addresses: Iterable[str], port: int, enable_legacy_metric_names: bool
+) -> None:
    """
    Start Prometheus metrics server.
    """
    from prometheus_client import start_http_server as start_http_server_prometheus

-    from synapse.metrics import RegistryProxy
+    from synapse.metrics import (
+        RegistryProxy,
+        start_http_server as start_http_server_legacy,
+    )

    for host in bind_addresses:
        logger.info("Starting metrics listener on %s:%d", host, port)
-        _set_prometheus_client_use_created_metrics(False)
-        start_http_server_prometheus(port, addr=host, registry=RegistryProxy)
+        if enable_legacy_metric_names:
+            start_http_server_legacy(port, addr=host, registry=RegistryProxy)
+        else:
+            _set_prometheus_client_use_created_metrics(False)
+            start_http_server_prometheus(port, addr=host, registry=RegistryProxy)


 def _set_prometheus_client_use_created_metrics(new_value: bool) -> None:
@@ -351,55 +357,6 @@ def listen_tcp(
    return r  # type: ignore[return-value]


-def listen_http(
-    listener_config: ListenerConfig,
-    root_resource: Resource,
-    version_string: str,
-    max_request_body_size: int,
-    context_factory: Optional[IOpenSSLContextFactory],
-    reactor: ISynapseReactor = reactor,
-) -> List[Port]:
-    port = listener_config.port
-    bind_addresses = listener_config.bind_addresses
-    tls = listener_config.tls
-
-    assert listener_config.http_options is not None
-
-    site_tag = listener_config.http_options.tag
-    if site_tag is None:
-        site_tag = str(port)
-
-    site = SynapseSite(
-        "synapse.access.%s.%s" % ("https" if tls else "http", site_tag),
-        site_tag,
-        listener_config,
-        root_resource,
-        version_string,
-        max_request_body_size=max_request_body_size,
-        reactor=reactor,
-    )
-    if tls:
-        # refresh_certificate should have been called before this.
-        assert context_factory is not None
-        ports = listen_ssl(
-            bind_addresses,
-            port,
-            site,
-            context_factory,
-            reactor=reactor,
-        )
-        logger.info("Synapse now listening on TCP port %d (TLS)", port)
-    else:
-        ports = listen_tcp(
-            bind_addresses,
-            port,
-            site,
-            reactor=reactor,
-        )
-        logger.info("Synapse now listening on TCP port %d", port)
-    return ports
-
-
 def listen_ssl(
    bind_addresses: Collection[str],
    port: int,
@@ -28,6 +28,10 @@ from synapse.config.homeserver import HomeServerConfig
 from synapse.config.logger import setup_logging
 from synapse.events import EventBase
 from synapse.handlers.admin import ExfiltrationWriter
+from synapse.replication.slave.storage.devices import SlavedDeviceStore
+from synapse.replication.slave.storage.events import SlavedEventStore
+from synapse.replication.slave.storage.filtering import SlavedFilteringStore
+from synapse.replication.slave.storage.push_rule import SlavedPushRuleStore
 from synapse.server import HomeServer
 from synapse.storage.database import DatabasePool, LoggingDatabaseConnection
 from synapse.storage.databases.main.account_data import AccountDataWorkerStore
@@ -36,24 +40,10 @@ from synapse.storage.databases.main.appservice import (
    ApplicationServiceWorkerStore,
 )
 from synapse.storage.databases.main.deviceinbox import DeviceInboxWorkerStore
-from synapse.storage.databases.main.devices import DeviceWorkerStore
-from synapse.storage.databases.main.event_federation import EventFederationWorkerStore
-from synapse.storage.databases.main.event_push_actions import (
-    EventPushActionsWorkerStore,
-)
-from synapse.storage.databases.main.events_worker import EventsWorkerStore
-from synapse.storage.databases.main.filtering import FilteringWorkerStore
-from synapse.storage.databases.main.push_rule import PushRulesWorkerStore
 from synapse.storage.databases.main.receipts import ReceiptsWorkerStore
 from synapse.storage.databases.main.registration import RegistrationWorkerStore
-from synapse.storage.databases.main.relations import RelationsWorkerStore
 from synapse.storage.databases.main.room import RoomWorkerStore
-from synapse.storage.databases.main.roommember import RoomMemberWorkerStore
-from synapse.storage.databases.main.signatures import SignatureWorkerStore
-from synapse.storage.databases.main.state import StateGroupWorkerStore
-from synapse.storage.databases.main.stream import StreamWorkerStore
 from synapse.storage.databases.main.tags import TagsWorkerStore
-from synapse.storage.databases.main.user_erasure_store import UserErasureWorkerStore
 from synapse.types import StateMap
 from synapse.util import SYNAPSE_VERSION
 from synapse.util.logcontext import LoggingContext
@@ -62,25 +52,17 @@ logger = logging.getLogger("synapse.app.admin_cmd")


 class AdminCmdSlavedStore(
-    FilteringWorkerStore,
-    DeviceWorkerStore,
+    SlavedFilteringStore,
+    SlavedPushRuleStore,
+    SlavedEventStore,
+    SlavedDeviceStore,
    TagsWorkerStore,
    DeviceInboxWorkerStore,
    AccountDataWorkerStore,
-    PushRulesWorkerStore,
    ApplicationServiceTransactionWorkerStore,
    ApplicationServiceWorkerStore,
-    RoomMemberWorkerStore,
-    RelationsWorkerStore,
-    EventFederationWorkerStore,
-    EventPushActionsWorkerStore,
-    StateGroupWorkerStore,
-    SignatureWorkerStore,
-    UserErasureWorkerStore,
-    ReceiptsWorkerStore,
-    StreamWorkerStore,
-    EventsWorkerStore,
    RegistrationWorkerStore,
+    ReceiptsWorkerStore,
    RoomWorkerStore,
 ):
    def __init__(
@@ -14,12 +14,14 @@
 # limitations under the License.
 import logging
 import sys
-from typing import Dict, List
+from typing import Dict, List, Optional, Tuple

+from twisted.internet import address
 from twisted.web.resource import Resource

 import synapse
 import synapse.events
+from synapse.api.errors import HttpResponseException, RequestSendFailed, SynapseError
 from synapse.api.urls import (
    CLIENT_API_PREFIX,
    FEDERATION_PREFIX,
@@ -41,11 +43,51 @@ from synapse.config.logger import setup_logging
 from synapse.config.server import ListenerConfig
 from synapse.federation.transport.server import TransportLayerServer
 from synapse.http.server import JsonResource, OptionsResource
+from synapse.http.servlet import RestServlet, parse_json_object_from_request
+from synapse.http.site import SynapseRequest, SynapseSite
 from synapse.logging.context import LoggingContext
 from synapse.metrics import METRICS_PREFIX, MetricsResource, RegistryProxy
 from synapse.replication.http import REPLICATION_PREFIX, ReplicationRestResource
-from synapse.rest import ClientRestResource
+from synapse.replication.slave.storage.devices import SlavedDeviceStore
+from synapse.replication.slave.storage.events import SlavedEventStore
+from synapse.replication.slave.storage.filtering import SlavedFilteringStore
+from synapse.replication.slave.storage.keys import SlavedKeyStore
+from synapse.replication.slave.storage.push_rule import SlavedPushRuleStore
+from synapse.replication.slave.storage.pushers import SlavedPusherStore
 from synapse.rest.admin import register_servlets_for_media_repo
+from synapse.rest.client import (
+    account_data,
+    events,
+    initial_sync,
+    login,
+    presence,
+    profile,
+    push_rule,
+    read_marker,
+    receipts,
+    relations,
+    room,
+    room_batch,
+    room_keys,
+    sendtodevice,
+    sync,
+    tags,
+    user_directory,
+    versions,
+    voip,
+)
+from synapse.rest.client._base import client_patterns
+from synapse.rest.client.account import ThreepidRestServlet, WhoamiRestServlet
+from synapse.rest.client.devices import DevicesRestServlet
+from synapse.rest.client.keys import (
+    KeyChangesServlet,
+    KeyQueryServlet,
+    OneTimeKeyServlet,
+)
+from synapse.rest.client.register import (
+    RegisterRestServlet,
+    RegistrationTokenValidityRestServlet,
+)
 from synapse.rest.health import HealthResource
 from synapse.rest.key.v2 import KeyResource
 from synapse.rest.synapse.client import build_synapse_client_resource_tree
@@ -59,16 +101,8 @@ from synapse.storage.databases.main.appservice import (
 from synapse.storage.databases.main.censor_events import CensorEventsStore
 from synapse.storage.databases.main.client_ips import ClientIpWorkerStore
 from synapse.storage.databases.main.deviceinbox import DeviceInboxWorkerStore
-from synapse.storage.databases.main.devices import DeviceWorkerStore
 from synapse.storage.databases.main.directory import DirectoryWorkerStore
 from synapse.storage.databases.main.e2e_room_keys import EndToEndRoomKeyStore
-from synapse.storage.databases.main.event_federation import EventFederationWorkerStore
-from synapse.storage.databases.main.event_push_actions import (
-    EventPushActionsWorkerStore,
-)
-from synapse.storage.databases.main.events_worker import EventsWorkerStore
-from synapse.storage.databases.main.filtering import FilteringWorkerStore
-from synapse.storage.databases.main.keys import KeyStore
 from synapse.storage.databases.main.lock import LockStore
 from synapse.storage.databases.main.media_repository import MediaRepositoryStore
 from synapse.storage.databases.main.metrics import ServerMetricsStore
@@ -77,31 +111,118 @@ from synapse.storage.databases.main.monthly_active_users import (
 )
 from synapse.storage.databases.main.presence import PresenceStore
 from synapse.storage.databases.main.profile import ProfileWorkerStore
-from synapse.storage.databases.main.push_rule import PushRulesWorkerStore
-from synapse.storage.databases.main.pusher import PusherWorkerStore
 from synapse.storage.databases.main.receipts import ReceiptsWorkerStore
 from synapse.storage.databases.main.registration import RegistrationWorkerStore
-from synapse.storage.databases.main.relations import RelationsWorkerStore
 from synapse.storage.databases.main.room import RoomWorkerStore
 from synapse.storage.databases.main.room_batch import RoomBatchStore
-from synapse.storage.databases.main.roommember import RoomMemberWorkerStore
 from synapse.storage.databases.main.search import SearchStore
 from synapse.storage.databases.main.session import SessionStore
-from synapse.storage.databases.main.signatures import SignatureWorkerStore
-from synapse.storage.databases.main.state import StateGroupWorkerStore
 from synapse.storage.databases.main.stats import StatsStore
-from synapse.storage.databases.main.stream import StreamWorkerStore
 from synapse.storage.databases.main.tags import TagsWorkerStore
 from synapse.storage.databases.main.transactions import TransactionWorkerStore
 from synapse.storage.databases.main.ui_auth import UIAuthWorkerStore
 from synapse.storage.databases.main.user_directory import UserDirectoryStore
-from synapse.storage.databases.main.user_erasure_store import UserErasureWorkerStore
+from synapse.types import JsonDict
 from synapse.util import SYNAPSE_VERSION
 from synapse.util.httpresourcetree import create_resource_tree

 logger = logging.getLogger("synapse.app.generic_worker")


+class KeyUploadServlet(RestServlet):
+    """An implementation of the `KeyUploadServlet` that responds to read only
+    requests, but otherwise proxies through to the master instance.
+    """
+
+    PATTERNS = client_patterns("/keys/upload(/(?P<device_id>[^/]+))?$")
+
+    def __init__(self, hs: HomeServer):
+        """
+        Args:
+            hs: server
+        """
+        super().__init__()
+        self.auth = hs.get_auth()
+        self.store = hs.get_datastores().main
+        self.http_client = hs.get_simple_http_client()
+        self.main_uri = hs.config.worker.worker_main_http_uri
+
+    async def on_POST(
+        self, request: SynapseRequest, device_id: Optional[str]
+    ) -> Tuple[int, JsonDict]:
+        requester = await self.auth.get_user_by_req(request, allow_guest=True)
+        user_id = requester.user.to_string()
+        body = parse_json_object_from_request(request)
+
+        if device_id is not None:
+            # passing the device_id here is deprecated; however, we allow it
+            # for now for compatibility with older clients.
+            if requester.device_id is not None and device_id != requester.device_id:
+                logger.warning(
+                    "Client uploading keys for a different device "
+                    "(logged in as %s, uploading for %s)",
+                    requester.device_id,
+                    device_id,
+                )
+        else:
+            device_id = requester.device_id
+
+        if device_id is None:
+            raise SynapseError(
+                400, "To upload keys, you must pass device_id when authenticating"
+            )
+
+        if body:
+            # They're actually trying to upload something, proxy to main synapse.
+
+            # Proxy headers from the original request, such as the auth headers
+            # (in case the access token is there) and the original IP /
+            # User-Agent of the request.
+            headers: Dict[bytes, List[bytes]] = {
+                header: list(request.requestHeaders.getRawHeaders(header, []))
+                for header in (b"Authorization", b"User-Agent")
+            }
+            # Add the previous hop to the X-Forwarded-For header.
+            x_forwarded_for = list(
+                request.requestHeaders.getRawHeaders(b"X-Forwarded-For", [])
+            )
+            # we use request.client here, since we want the previous hop, not the
+            # original client (as returned by request.getClientAddress()).
+            if isinstance(request.client, (address.IPv4Address, address.IPv6Address)):
+                previous_host = request.client.host.encode("ascii")
+                # If the header exists, add to the comma-separated list of the first
+                # instance of the header. Otherwise, generate a new header.
+                if x_forwarded_for:
+                    x_forwarded_for = [x_forwarded_for[0] + b", " + previous_host]
+                    x_forwarded_for.extend(x_forwarded_for[1:])
+                else:
+                    x_forwarded_for = [previous_host]
+            headers[b"X-Forwarded-For"] = x_forwarded_for
+
+            # Replicate the original X-Forwarded-Proto header. Note that
+            # XForwardedForRequest overrides isSecure() to give us the original protocol
+            # used by the client, as opposed to the protocol used by our upstream proxy
+            # - which is what we want here.
+            headers[b"X-Forwarded-Proto"] = [
+                b"https" if request.isSecure() else b"http"
+            ]
+
+            try:
+                result = await self.http_client.post_json_get_json(
+                    self.main_uri + request.uri.decode("ascii"), body, headers=headers
+                )
+            except HttpResponseException as e:
+                raise e.to_synapse_error() from e
+            except RequestSendFailed as e:
+                raise SynapseError(502, "Failed to talk to master") from e
+
+            return 200, result
+        else:
+            # Just interested in counts.
+            result = await self.store.count_e2e_one_time_keys(user_id, device_id)
+            return 200, {"one_time_key_counts": result}
+
+
 class GenericWorkerSlavedStore(
    # FIXME(#3714): We need to add UserDirectoryStore as we write directly
    # rather than going via the correct worker.
@@ -111,36 +232,26 @@ class GenericWorkerSlavedStore(
    EndToEndRoomKeyStore,
    PresenceStore,
    DeviceInboxWorkerStore,
-    DeviceWorkerStore,
+    SlavedDeviceStore,
+    SlavedPushRuleStore,
    TagsWorkerStore,
    AccountDataWorkerStore,
+    SlavedPusherStore,
    CensorEventsStore,
    ClientIpWorkerStore,
-    # KeyStore isn't really safe to use from a worker, but for now we do so and hope that
-    # the races it creates aren't too bad.
-    KeyStore,
+    SlavedEventStore,
+    SlavedKeyStore,
    RoomWorkerStore,
    RoomBatchStore,
    DirectoryWorkerStore,
-    PushRulesWorkerStore,
    ApplicationServiceTransactionWorkerStore,
    ApplicationServiceWorkerStore,
    ProfileWorkerStore,
-    FilteringWorkerStore,
+    SlavedFilteringStore,
    MonthlyActiveUsersWorkerStore,
    MediaRepositoryStore,
    ServerMetricsStore,
-    PusherWorkerStore,
-    RoomMemberWorkerStore,
-    RelationsWorkerStore,
-    EventFederationWorkerStore,
-    EventPushActionsWorkerStore,
-    StateGroupWorkerStore,
-    SignatureWorkerStore,
-    UserErasureWorkerStore,
    ReceiptsWorkerStore,
-    StreamWorkerStore,
-    EventsWorkerStore,
    RegistrationWorkerStore,
    SearchStore,
    TransactionWorkerStore,
@@ -157,9 +268,15 @@ class GenericWorkerServer(HomeServer):
    DATASTORE_CLASS = GenericWorkerSlavedStore  # type: ignore

    def _listen_http(self, listener_config: ListenerConfig) -> None:
+        port = listener_config.port
+        bind_addresses = listener_config.bind_addresses

        assert listener_config.http_options is not None

+        site_tag = listener_config.http_options.tag
+        if site_tag is None:
+            site_tag = str(port)
+
        # We always include a health resource.
        resources: Dict[str, Resource] = {"/health": HealthResource()}

@@ -168,7 +285,45 @@ class GenericWorkerServer(HomeServer):
                if name == "metrics":
                    resources[METRICS_PREFIX] = MetricsResource(RegistryProxy)
                elif name == "client":
-                    resource: Resource = ClientRestResource(self)
+                    resource = JsonResource(self, canonical_json=False)
+
+                    RegisterRestServlet(self).register(resource)
+                    RegistrationTokenValidityRestServlet(self).register(resource)
+                    login.register_servlets(self, resource)
+                    ThreepidRestServlet(self).register(resource)
+                    WhoamiRestServlet(self).register(resource)
+                    DevicesRestServlet(self).register(resource)
+
+                    # Read-only
+                    KeyUploadServlet(self).register(resource)
+                    KeyQueryServlet(self).register(resource)
+                    KeyChangesServlet(self).register(resource)
+                    OneTimeKeyServlet(self).register(resource)
+
+                    voip.register_servlets(self, resource)
+                    push_rule.register_servlets(self, resource)
+                    versions.register_servlets(self, resource)
+
+                    profile.register_servlets(self, resource)
+
+                    sync.register_servlets(self, resource)
+                    events.register_servlets(self, resource)
+                    room.register_servlets(self, resource, is_worker=True)
+                    relations.register_servlets(self, resource)
+                    room.register_deprecated_servlets(self, resource)
+                    initial_sync.register_servlets(self, resource)
+                    room_batch.register_servlets(self, resource)
+                    room_keys.register_servlets(self, resource)
+                    tags.register_servlets(self, resource)
+                    account_data.register_servlets(self, resource)
+                    receipts.register_servlets(self, resource)
+                    read_marker.register_servlets(self, resource)
+
+                    sendtodevice.register_servlets(self, resource)
+
+                    user_directory.register_servlets(self, resource)
+
+                    presence.register_servlets(self, resource)

                    resources[CLIENT_API_PREFIX] = resource

@@ -220,15 +375,23 @@ class GenericWorkerServer(HomeServer):

        root_resource = create_resource_tree(resources, OptionsResource())

-        _base.listen_http(
-            listener_config,
-            root_resource,
-            self.version_string,
-            max_request_body_size(self.config),
-            self.tls_server_context_factory,
+        _base.listen_tcp(
+            bind_addresses,
+            port,
+            SynapseSite(
+                "synapse.access.http.%s" % (site_tag,),
+                site_tag,
+                listener_config,
+                root_resource,
+                self.version_string,
+                max_request_body_size=max_request_body_size(self.config),
+                reactor=self.get_reactor(),
+            ),
            reactor=self.get_reactor(),
        )

+        logger.info("Synapse worker now listening on port %d", port)
+
    def start_listening(self) -> None:
        for listener in self.config.worker.worker_listeners:
            if listener.type == "http":
@@ -250,6 +413,7 @@ class GenericWorkerServer(HomeServer):
                    _base.listen_metrics(
                        listener.bind_addresses,
                        listener.port,
+                        enable_legacy_metric_names=self.config.metrics.enable_legacy_metrics,
                    )
            else:
                logger.warning("Unsupported listener type: %s", listener.type)
@@ -37,7 +37,8 @@ from synapse.api.urls import (
 from synapse.app import _base
 from synapse.app._base import (
    handle_startup_exception,
-    listen_http,
+    listen_ssl,
+    listen_tcp,
    max_request_body_size,
    redirect_stdio_to_logs,
    register_start,
@@ -52,6 +53,7 @@ from synapse.http.server import (
    RootOptionsRedirectResource,
    StaticResource,
 )
+from synapse.http.site import SynapseSite
 from synapse.logging.context import LoggingContext
 from synapse.metrics import METRICS_PREFIX, MetricsResource, RegistryProxy
 from synapse.replication.http import REPLICATION_PREFIX, ReplicationRestResource
@@ -81,6 +83,8 @@ class SynapseHomeServer(HomeServer):
        self, config: HomeServerConfig, listener_config: ListenerConfig
    ) -> Iterable[Port]:
        port = listener_config.port
+        bind_addresses = listener_config.bind_addresses
+        tls = listener_config.tls
        # Must exist since this is an HTTP listener.
        assert listener_config.http_options is not None
        site_tag = listener_config.http_options.tag
@@ -136,15 +140,37 @@ class SynapseHomeServer(HomeServer):
        else:
            root_resource = OptionsResource()

-        ports = listen_http(
+        site = SynapseSite(
+            "synapse.access.%s.%s" % ("https" if tls else "http", site_tag),
+            site_tag,
            listener_config,
            create_resource_tree(resources, root_resource),
            self.version_string,
-            max_request_body_size(self.config),
-            self.tls_server_context_factory,
+            max_request_body_size=max_request_body_size(self.config),
            reactor=self.get_reactor(),
        )

+        if tls:
+            # refresh_certificate should have been called before this.
+            assert self.tls_server_context_factory is not None
+            ports = listen_ssl(
+                bind_addresses,
+                port,
+                site,
+                self.tls_server_context_factory,
+                reactor=self.get_reactor(),
+            )
+            logger.info("Synapse now listening on TCP port %d (TLS)", port)
+
+        else:
+            ports = listen_tcp(
+                bind_addresses,
+                port,
+                site,
+                reactor=self.get_reactor(),
+            )
+            logger.info("Synapse now listening on TCP port %d", port)
+
        return ports

    def _configure_named_resource(
@@ -265,6 +291,7 @@ class SynapseHomeServer(HomeServer):
                    _base.listen_metrics(
                        listener.bind_addresses,
                        listener.port,
+                        enable_legacy_metric_names=self.config.metrics.enable_legacy_metrics,
                    )
            else:
                # this shouldn't happen, as the listener type should have been checked
@@ -32,9 +32,9 @@ if TYPE_CHECKING:

 logger = logging.getLogger(__name__)

-# Type for the `device_one_time_keys_count` field in an appservice transaction
+# Type for the `device_one_time_key_counts` field in an appservice transaction
 #   user ID -> {device ID -> {algorithm -> count}}
-TransactionOneTimeKeysCount = Dict[str, Dict[str, Dict[str, int]]]
+TransactionOneTimeKeyCounts = Dict[str, Dict[str, Dict[str, int]]]

 # Type for the `device_unused_fallback_key_types` field in an appservice transaction
 #   user ID -> {device ID -> [algorithm]}
@@ -245,9 +245,7 @@ class ApplicationService:
            return True

        # likewise with the room's aliases (if it has any)
-        alias_list = await store.get_aliases_for_room(
-            room_id, on_invalidate=cache_context.invalidate
-        )
+        alias_list = await store.get_aliases_for_room(room_id)
        for alias in alias_list:
            if self.is_room_alias_in_namespace(alias):
                return True
@@ -313,9 +311,7 @@ class ApplicationService:
        # Find all the rooms the sender is in
        if self.is_interested_in_user(user_id.to_string()):
            return True
-        room_ids = await store.get_rooms_for_user(
-            user_id.to_string(), on_invalidate=cache_context.invalidate
-        )
+        room_ids = await store.get_rooms_for_user(user_id.to_string())

        # Then find out if the appservice is interested in any of those rooms
        for room_id in room_ids:
@@ -380,7 +376,7 @@ class AppServiceTransaction:
        events: List[EventBase],
        ephemeral: List[JsonDict],
        to_device_messages: List[JsonDict],
-        one_time_keys_count: TransactionOneTimeKeysCount,
+        one_time_key_counts: TransactionOneTimeKeyCounts,
        unused_fallback_keys: TransactionUnusedFallbackKeys,
        device_list_summary: DeviceListUpdates,
    ):
@@ -389,7 +385,7 @@ class AppServiceTransaction:
        self.events = events
        self.ephemeral = ephemeral
        self.to_device_messages = to_device_messages
-        self.one_time_keys_count = one_time_keys_count
+        self.one_time_key_counts = one_time_key_counts
        self.unused_fallback_keys = unused_fallback_keys
        self.device_list_summary = device_list_summary

@@ -406,7 +402,7 @@ class AppServiceTransaction:
            events=self.events,
            ephemeral=self.ephemeral,
            to_device_messages=self.to_device_messages,
-            one_time_keys_count=self.one_time_keys_count,
+            one_time_key_counts=self.one_time_key_counts,
            unused_fallback_keys=self.unused_fallback_keys,
            device_list_summary=self.device_list_summary,
            txn_id=self.id,
@@ -23,7 +23,7 @@ from synapse.api.constants import EventTypes, Membership, ThirdPartyEntityKind
 from synapse.api.errors import CodeMessageException
 from synapse.appservice import (
    ApplicationService,
-    TransactionOneTimeKeysCount,
+    TransactionOneTimeKeyCounts,
    TransactionUnusedFallbackKeys,
 )
 from synapse.events import EventBase
@@ -262,7 +262,7 @@ class ApplicationServiceApi(SimpleHttpClient):
        events: List[EventBase],
        ephemeral: List[JsonDict],
        to_device_messages: List[JsonDict],
-        one_time_keys_count: TransactionOneTimeKeysCount,
+        one_time_key_counts: TransactionOneTimeKeyCounts,
        unused_fallback_keys: TransactionUnusedFallbackKeys,
        device_list_summary: DeviceListUpdates,
        txn_id: Optional[int] = None,
@@ -310,13 +310,10 @@ class ApplicationServiceApi(SimpleHttpClient):

        # TODO: Update to stable prefixes once MSC3202 completes FCP merge
        if service.msc3202_transaction_extensions:
-            if one_time_keys_count:
+            if one_time_key_counts:
                body[
                    "org.matrix.msc3202.device_one_time_key_counts"
-                ] = one_time_keys_count
-                body[
-                    "org.matrix.msc3202.device_one_time_keys_count"
-                ] = one_time_keys_count
+                ] = one_time_key_counts
            if unused_fallback_keys:
                body[
                    "org.matrix.msc3202.device_unused_fallback_key_types"
@@ -64,7 +64,7 @@ from typing import (
 from synapse.appservice import (
    ApplicationService,
    ApplicationServiceState,
-    TransactionOneTimeKeysCount,
+    TransactionOneTimeKeyCounts,
    TransactionUnusedFallbackKeys,
 )
 from synapse.appservice.api import ApplicationServiceApi
@@ -258,7 +258,7 @@ class _ServiceQueuer:
                ):
                    return

-                one_time_keys_count: Optional[TransactionOneTimeKeysCount] = None
+                one_time_key_counts: Optional[TransactionOneTimeKeyCounts] = None
                unused_fallback_keys: Optional[TransactionUnusedFallbackKeys] = None

                if (
@@ -269,7 +269,7 @@ class _ServiceQueuer:
                    # for the users which are mentioned in this transaction,
                    # as well as the appservice's sender.
                    (
-                        one_time_keys_count,
+                        one_time_key_counts,
                        unused_fallback_keys,
                    ) = await self._compute_msc3202_otk_counts_and_fallback_keys(
                        service, events, ephemeral, to_device_messages_to_send
@@ -281,7 +281,7 @@ class _ServiceQueuer:
                        events,
                        ephemeral,
                        to_device_messages_to_send,
-                        one_time_keys_count,
+                        one_time_key_counts,
                        unused_fallback_keys,
                        device_list_summary,
                    )
@@ -296,7 +296,7 @@ class _ServiceQueuer:
        events: Iterable[EventBase],
        ephemerals: Iterable[JsonDict],
        to_device_messages: Iterable[JsonDict],
-    ) -> Tuple[TransactionOneTimeKeysCount, TransactionUnusedFallbackKeys]:
+    ) -> Tuple[TransactionOneTimeKeyCounts, TransactionUnusedFallbackKeys]:
        """
        Given a list of the events, ephemeral messages and to-device messages,
        - first computes a list of application services users that may have
@@ -367,7 +367,7 @@ class _TransactionController:
        events: List[EventBase],
        ephemeral: Optional[List[JsonDict]] = None,
        to_device_messages: Optional[List[JsonDict]] = None,
-        one_time_keys_count: Optional[TransactionOneTimeKeysCount] = None,
+        one_time_key_counts: Optional[TransactionOneTimeKeyCounts] = None,
        unused_fallback_keys: Optional[TransactionUnusedFallbackKeys] = None,
        device_list_summary: Optional[DeviceListUpdates] = None,
    ) -> None:
@@ -380,7 +380,7 @@ class _TransactionController:
            events: The persistent events to include in the transaction.
            ephemeral: The ephemeral events to include in the transaction.
            to_device_messages: The to-device messages to include in the transaction.
-            one_time_keys_count: Counts of remaining one-time keys for relevant
+            one_time_key_counts: Counts of remaining one-time keys for relevant
                appservice devices in the transaction.
            unused_fallback_keys: Lists of unused fallback keys for relevant
                appservice devices in the transaction.
@@ -397,7 +397,7 @@ class _TransactionController:
                events=events,
                ephemeral=ephemeral or [],
                to_device_messages=to_device_messages or [],
-                one_time_keys_count=one_time_keys_count or {},
+                one_time_key_counts=one_time_key_counts or {},
                unused_fallback_keys=unused_fallback_keys or {},
                device_list_summary=device_list_summary or DeviceListUpdates(),
            )
@@ -33,9 +33,6 @@ def validate_config(
        config: the configuration value to be validated
        config_path: the path within the config file. This will be used as a basis
           for the error message.
-
-    Raises:
-        ConfigError, if validation fails.
    """
    try:
        jsonschema.validate(config, json_schema)
@@ -13,13 +13,12 @@
 # limitations under the License.

 import logging
-from typing import Any, Iterable, Optional, Tuple
+from typing import Any, Iterable

 from synapse.api.constants import EventTypes
 from synapse.config._base import Config, ConfigError
 from synapse.config._util import validate_config
 from synapse.types import JsonDict
-from synapse.types.state import StateFilter

 logger = logging.getLogger(__name__)

@@ -27,20 +26,16 @@ logger = logging.getLogger(__name__)
 class ApiConfig(Config):
    section = "api"

-    room_prejoin_state: StateFilter
-    track_puppetted_users_ips: bool
-
    def read_config(self, config: JsonDict, **kwargs: Any) -> None:
        validate_config(_MAIN_SCHEMA, config, ())
-        self.room_prejoin_state = StateFilter.from_types(
-            self._get_prejoin_state_entries(config)
-        )
+        self.room_prejoin_state = list(self._get_prejoin_state_types(config))
        self.track_puppeted_user_ips = config.get("track_puppeted_user_ips", False)

-    def _get_prejoin_state_entries(
-        self, config: JsonDict
-    ) -> Iterable[Tuple[str, Optional[str]]]:
-        """Get the event types and state keys to include in the prejoin state."""
+    def _get_prejoin_state_types(self, config: JsonDict) -> Iterable[str]:
+        """Get the event types to include in the prejoin state
+
+        Parses the config and returns an iterable of the event types to be included.
+        """
        room_prejoin_state_config = config.get("room_prejoin_state") or {}

        # backwards-compatibility support for room_invite_state_types
@@ -55,39 +50,33 @@ class ApiConfig(Config):

            logger.warning(_ROOM_INVITE_STATE_TYPES_WARNING)

-            for event_type in config["room_invite_state_types"]:
-                yield event_type, None
+            yield from config["room_invite_state_types"]
            return

        if not room_prejoin_state_config.get("disable_default_event_types"):
-            yield from _DEFAULT_PREJOIN_STATE_TYPES_AND_STATE_KEYS
+            yield from _DEFAULT_PREJOIN_STATE_TYPES

-        for entry in room_prejoin_state_config.get("additional_event_types", []):
-            if isinstance(entry, str):
-                yield entry, None
-            else:
-                yield entry
+        yield from room_prejoin_state_config.get("additional_event_types", [])


 _ROOM_INVITE_STATE_TYPES_WARNING = """\
 WARNING: The 'room_invite_state_types' configuration setting is now deprecated,
 and replaced with 'room_prejoin_state'. New features may not work correctly
-unless 'room_invite_state_types' is removed. See the config documentation at
-    https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#room_prejoin_state
-for details of 'room_prejoin_state'.
+unless 'room_invite_state_types' is removed. See the sample configuration file for
+details of 'room_prejoin_state'.
 --------------------------------------------------------------------------------
 """

-_DEFAULT_PREJOIN_STATE_TYPES_AND_STATE_KEYS = [
-    (EventTypes.JoinRules, ""),
-    (EventTypes.CanonicalAlias, ""),
-    (EventTypes.RoomAvatar, ""),
-    (EventTypes.RoomEncryption, ""),
-    (EventTypes.Name, ""),
+_DEFAULT_PREJOIN_STATE_TYPES = [
+    EventTypes.JoinRules,
+    EventTypes.CanonicalAlias,
+    EventTypes.RoomAvatar,
+    EventTypes.RoomEncryption,
+    EventTypes.Name,
    # Per MSC1772.
-    (EventTypes.Create, ""),
+    EventTypes.Create,
    # Per MSC3173.
-    (EventTypes.Topic, ""),
+    EventTypes.Topic,
 ]


@@ -101,17 +90,7 @@ _ROOM_PREJOIN_STATE_CONFIG_SCHEMA = {
                "disable_default_event_types": {"type": "boolean"},
                "additional_event_types": {
                    "type": "array",
-                    "items": {
-                        "oneOf": [
-                            {"type": "string"},
-                            {
-                                "type": "array",
-                                "items": {"type": "string"},
-                                "minItems": 2,
-                                "maxItems": 2,
-                            },
-                        ],
-                    },
+                    "items": {"type": "string"},
                },
            },
        },
@@ -16,7 +16,6 @@ from typing import Any, Optional

 import attr

-from synapse.api.room_versions import KNOWN_ROOM_VERSIONS, RoomVersions
 from synapse.config._base import Config
 from synapse.types import JsonDict

@@ -54,6 +53,9 @@ class ExperimentalConfig(Config):
        # MSC3266 (room summary api)
        self.msc3266_enabled: bool = experimental.get("msc3266_enabled", False)

+        # MSC3030 (Jump to date API endpoint)
+        self.msc3030_enabled: bool = experimental.get("msc3030_enabled", False)
+
        # MSC2409 (this setting only relates to optionally sending to-device messages).
        # Presence, typing and read receipt EDUs are already sent to application services that
        # have opted in to receive them. If enabled, this adds to-device messages to that list.
@@ -126,13 +128,3 @@ class ExperimentalConfig(Config):
        self.msc3886_endpoint: Optional[str] = experimental.get(
            "msc3886_endpoint", None
        )
-
-        # MSC3912: Relation-based redactions.
-        self.msc3912_enabled: bool = experimental.get("msc3912_enabled", False)
-
-        # MSC1767 and friends: Extensible Events
-        self.msc1767_enabled: bool = experimental.get("msc1767_enabled", False)
-        if self.msc1767_enabled:
-            # Enable room version (and thus applicable push rules from MSC3931/3932)
-            version_id = RoomVersions.MSC1767v10.identifier
-            KNOWN_ROOM_VERSIONS[version_id] = RoomVersions.MSC1767v10
@@ -317,9 +317,10 @@ def setup_logging(
    Set up the logging subsystem.

    Args:
-        config: configuration data
+        config (LoggingConfig | synapse.config.worker.WorkerConfig):
+            configuration data

-        use_worker_options: True to use the 'worker_log_config' option
+        use_worker_options (bool): True to use the 'worker_log_config' option
            instead of 'log_config'.

        logBeginner: The Twisted logBeginner to use.
@@ -43,6 +43,8 @@ class MetricsConfig(Config):
    def read_config(self, config: JsonDict, **kwargs: Any) -> None:
        self.enable_metrics = config.get("enable_metrics", False)

+        self.enable_legacy_metrics = config.get("enable_legacy_metrics", True)
+
        self.report_stats = config.get("report_stats", None)
        self.report_stats_endpoint = config.get(
            "report_stats_endpoint", "https://matrix.org/report-usage-stats/push"
@@ -26,7 +26,6 @@ class PushConfig(Config):
    def read_config(self, config: JsonDict, **kwargs: Any) -> None:
        push_config = config.get("push") or {}
        self.push_include_content = push_config.get("include_content", True)
-        self.enable_push = push_config.get("enabled", True)
        self.push_group_unread_count_by_room = push_config.get(
            "group_unread_count_by_room", True
        )
@@ -150,5 +150,8 @@ class RatelimitConfig(Config):

        self.rc_third_party_invite = RatelimitSettings(
            config.get("rc_third_party_invite", {}),
-            defaults={"per_second": 0.0025, "burst_count": 5},
+            defaults={
+                "per_second": self.rc_message.per_second,
+                "burst_count": self.rc_message.burst_count,
+            },
        )
@@ -29,6 +29,20 @@ from ._base import (
 )
 from .server import DIRECT_TCP_ERROR, ListenerConfig, parse_listener_def

+_FEDERATION_SENDER_WITH_SEND_FEDERATION_ENABLED_ERROR = """
+The send_federation config option must be disabled in the main
+synapse process before they can be run in a separate worker.
+
+Please add ``send_federation: false`` to the main config
+"""
+
+_PUSHER_WITH_START_PUSHERS_ENABLED_ERROR = """
+The start_pushers config option must be disabled in the main
+synapse process before they can be run in a separate worker.
+
+Please add ``start_pushers: false`` to the main config
+"""
+
 _DEPRECATED_WORKER_DUTY_OPTION_USED = """
 The '%s' configuration option is deprecated and will be removed in a future
 Synapse version. Please use ``%s: name_of_worker`` instead.
@@ -53,7 +67,6 @@ class InstanceLocationConfig:

    host: str
    port: int
-    tls: bool = False


@attr.s
@@ -136,25 +149,13 @@ class WorkerConfig(Config):
        # The port on the main synapse for HTTP replication endpoint
        self.worker_replication_http_port = config.get("worker_replication_http_port")

-        # The tls mode on the main synapse for HTTP replication endpoint.
-        # For backward compatibility this defaults to False.
-        self.worker_replication_http_tls = config.get(
-            "worker_replication_http_tls", False
-        )
-
        # The shared secret used for authentication when connecting to the main synapse.
        self.worker_replication_secret = config.get("worker_replication_secret", None)

        self.worker_name = config.get("worker_name", self.worker_app)
        self.instance_name = self.worker_name or "master"

-        # FIXME: Remove this check after a suitable amount of time.
        self.worker_main_http_uri = config.get("worker_main_http_uri", None)
-        if self.worker_main_http_uri is not None:
-            logger.warning(
-                "The config option worker_main_http_uri is unused since Synapse 1.73. "
-                "It can be safely removed from your configuration."
-            )

        # This option is really only here to support `--manhole` command line
        # argument.
@@ -168,12 +169,40 @@ class WorkerConfig(Config):
                )
            )

-        federation_sender_instances = self._worker_names_performing_this_duty(
-            config,
-            "send_federation",
-            "synapse.app.federation_sender",
-            "federation_sender_instances",
-        )
+        # Handle federation sender configuration.
+        #
+        # There are two ways of configuring which instances handle federation
+        # sending:
+        #   1. The old way where "send_federation" is set to false and running a
+        #      `synapse.app.federation_sender` worker app.
+        #   2. Specifying the workers sending federation in
+        #      `federation_sender_instances`.
+        #
+
+        send_federation = config.get("send_federation", True)
+
+        federation_sender_instances = config.get("federation_sender_instances")
+        if federation_sender_instances is None:
+            # Default to an empty list, which means "another, unknown, worker is
+            # responsible for it".
+            federation_sender_instances = []
+
+            # If no federation sender instances are set we check if
+            # `send_federation` is set, which means use master
+            if send_federation:
+                federation_sender_instances = ["master"]
+
+            if self.worker_app == "synapse.app.federation_sender":
+                if send_federation:
+                    # If we're running federation senders, and not using
+                    # `federation_sender_instances`, then we should have
+                    # explicitly set `send_federation` to false.
+                    raise ConfigError(
+                        _FEDERATION_SENDER_WITH_SEND_FEDERATION_ENABLED_ERROR
+                    )
+
+                federation_sender_instances = [self.worker_name]
+
        self.send_federation = self.instance_name in federation_sender_instances
        self.federation_shard_config = ShardedWorkerHandlingConfig(
            federation_sender_instances
@@ -240,12 +269,27 @@ class WorkerConfig(Config):
        )

        # Handle sharded push
-        pusher_instances = self._worker_names_performing_this_duty(
-            config,
-            "start_pushers",
-            "synapse.app.pusher",
-            "pusher_instances",
-        )
+        start_pushers = config.get("start_pushers", True)
+        pusher_instances = config.get("pusher_instances")
+        if pusher_instances is None:
+            # Default to an empty list, which means "another, unknown, worker is
+            # responsible for it".
+            pusher_instances = []
+
+            # If no pushers instances are set we check if `start_pushers` is
+            # set, which means use master
+            if start_pushers:
+                pusher_instances = ["master"]
+
+            if self.worker_app == "synapse.app.pusher":
+                if start_pushers:
+                    # If we're running pushers, and not using
+                    # `pusher_instances`, then we should have explicitly set
+                    # `start_pushers` to false.
+                    raise ConfigError(_PUSHER_WITH_START_PUSHERS_ENABLED_ERROR)
+
+                pusher_instances = [self.instance_name]
+
        self.start_pushers = self.instance_name in pusher_instances
        self.pusher_shard_config = ShardedWorkerHandlingConfig(pusher_instances)

@@ -368,64 +412,6 @@ class WorkerConfig(Config):
        # (By this point, these are either the same value or only one is not None.)
        return bool(new_option_should_run_here or legacy_option_should_run_here)

-    def _worker_names_performing_this_duty(
-        self,
-        config: Dict[str, Any],
-        legacy_option_name: str,
-        legacy_app_name: str,
-        modern_instance_list_name: str,
-    ) -> List[str]:
-        """
-        Retrieves the names of the workers handling a given duty, by either legacy
-        option or instance list.
-
-        There are two ways of configuring which instances handle a given duty, e.g.
-        for configuring pushers:
-
-        1. The old way where "start_pushers" is set to false and running a
-          `synapse.app.pusher'` worker app.
-        2. Specifying the workers sending federation in `pusher_instances`.
-
-        Args:
-            config: settings read from yaml.
-            legacy_option_name: the old way of enabling options. e.g. 'start_pushers'
-            legacy_app_name: The historical app name. e.g. 'synapse.app.pusher'
-            modern_instance_list_name: the string name of the new instance_list. e.g.
-            'pusher_instances'
-
-        Returns:
-            A list of worker instance names handling the given duty.
-        """
-
-        legacy_option = config.get(legacy_option_name, True)
-
-        worker_instances = config.get(modern_instance_list_name)
-        if worker_instances is None:
-            # Default to an empty list, which means "another, unknown, worker is
-            # responsible for it".
-            worker_instances = []
-
-            # If no worker instances are set we check if the legacy option
-            # is set, which means use the main process.
-            if legacy_option:
-                worker_instances = ["master"]
-
-            if self.worker_app == legacy_app_name:
-                if legacy_option:
-                    # If we're using `legacy_app_name`, and not using
-                    # `modern_instance_list_name`, then we should have
-                    # explicitly set `legacy_option_name` to false.
-                    raise ConfigError(
-                        f"The '{legacy_option_name}' config option must be disabled in "
-                        "the main synapse process before they can be run in a separate "
-                        "worker.\n"
-                        f"Please add `{legacy_option_name}: false` to the main config.\n",
-                    )
-
-                worker_instances = [self.worker_name]
-
-        return worker_instances
-
    def read_arguments(self, args: argparse.Namespace) -> None:
        # We support a bunch of command line arguments that override options in
        # the config. A lot of these options have a worker_* prefix when running
@@ -14,6 +14,7 @@

 import abc
 import logging
+import urllib
 from typing import TYPE_CHECKING, Callable, Dict, Iterable, List, Optional, Tuple

 import attr
@@ -212,7 +213,7 @@ class Keyring:

    def verify_json_objects_for_server(
        self, server_and_json: Iterable[Tuple[str, dict, int]]
-    ) -> List["defer.Deferred[None]"]:
+    ) -> List[defer.Deferred]:
        """Bulk verifies signatures of json objects, bulk fetching keys as
        necessary.

@@ -225,9 +226,10 @@ class Keyring:
                valid.

        Returns:
-            For each input triplet, a deferred indicating success or failure to
-            verify each json object's signature for the given server_name. The
-            deferreds run their callbacks in the sentinel logcontext.
+            List<Deferred[None]>: for each input triplet, a deferred indicating success
+                or failure to verify each json object's signature for the given
+                server_name. The deferreds run their callbacks in the sentinel
+                logcontext.
        """
        return [
            run_in_background(
@@ -812,27 +814,31 @@ class ServerKeyFetcher(BaseV2KeyFetcher):

        results = {}

-        async def get_keys(key_to_fetch_item: _FetchKeyRequest) -> None:
+        async def get_key(key_to_fetch_item: _FetchKeyRequest) -> None:
            server_name = key_to_fetch_item.server_name
+            key_ids = key_to_fetch_item.key_ids

            try:
-                keys = await self.get_server_verify_keys_v2_direct(server_name)
+                keys = await self.get_server_verify_key_v2_direct(server_name, key_ids)
                results[server_name] = keys
            except KeyLookupError as e:
-                logger.warning("Error looking up keys from %s: %s", server_name, e)
+                logger.warning(
+                    "Error looking up keys %s from %s: %s", key_ids, server_name, e
+                )
            except Exception:
-                logger.exception("Error getting keys from %s", server_name)
+                logger.exception("Error getting keys %s from %s", key_ids, server_name)

-        await yieldable_gather_results(get_keys, keys_to_fetch)
+        await yieldable_gather_results(get_key, keys_to_fetch)
        return results

-    async def get_server_verify_keys_v2_direct(
-        self, server_name: str
+    async def get_server_verify_key_v2_direct(
+        self, server_name: str, key_ids: Iterable[str]
    ) -> Dict[str, FetchKeyResult]:
        """

        Args:
-            server_name: Server to request keys from
+            server_name:
+            key_ids:

        Returns:
            Map from key ID to lookup result
@@ -840,41 +846,57 @@ class ServerKeyFetcher(BaseV2KeyFetcher):
        Raises:
            KeyLookupError if there was a problem making the lookup
        """
-        time_now_ms = self.clock.time_msec()
-        try:
-            response = await self.client.get_json(
-                destination=server_name,
-                path="/_matrix/key/v2/server",
-                ignore_backoff=True,
-                # we only give the remote server 10s to respond. It should be an
-                # easy request to handle, so if it doesn't reply within 10s, it's
-                # probably not going to.
-                #
-                # Furthermore, when we are acting as a notary server, we cannot
-                # wait all day for all of the origin servers, as the requesting
-                # server will otherwise time out before we can respond.
-                #
-                # (Note that get_json may make 4 attempts, so this can still take
-                # almost 45 seconds to fetch the headers, plus up to another 60s to
-                # read the response).
-                timeout=10000,
-            )
-        except (NotRetryingDestination, RequestSendFailed) as e:
-            # these both have str() representations which we can't really improve
-            # upon
-            raise KeyLookupError(str(e))
-        except HttpResponseException as e:
-            raise KeyLookupError("Remote server returned an error: %s" % (e,))
+        keys: Dict[str, FetchKeyResult] = {}

-        assert isinstance(response, dict)
-        if response["server_name"] != server_name:
-            raise KeyLookupError(
-                "Expected a response for server %r not %r"
-                % (server_name, response["server_name"])
-            )
+        for requested_key_id in key_ids:
+            # we may have found this key as a side-effect of asking for another.
+            if requested_key_id in keys:
+                continue

-        return await self.process_v2_response(
-            from_server=server_name,
-            response_json=response,
-            time_added_ms=time_now_ms,
-        )
+            time_now_ms = self.clock.time_msec()
+            try:
+                response = await self.client.get_json(
+                    destination=server_name,
+                    path="/_matrix/key/v2/server/"
+                    + urllib.parse.quote(requested_key_id),
+                    ignore_backoff=True,
+                    # we only give the remote server 10s to respond. It should be an
+                    # easy request to handle, so if it doesn't reply within 10s, it's
+                    # probably not going to.
+                    #
+                    # Furthermore, when we are acting as a notary server, we cannot
+                    # wait all day for all of the origin servers, as the requesting
+                    # server will otherwise time out before we can respond.
+                    #
+                    # (Note that get_json may make 4 attempts, so this can still take
+                    # almost 45 seconds to fetch the headers, plus up to another 60s to
+                    # read the response).
+                    timeout=10000,
+                )
+            except (NotRetryingDestination, RequestSendFailed) as e:
+                # these both have str() representations which we can't really improve
+                # upon
+                raise KeyLookupError(str(e))
+            except HttpResponseException as e:
+                raise KeyLookupError("Remote server returned an error: %s" % (e,))
+
+            assert isinstance(response, dict)
+            if response["server_name"] != server_name:
+                raise KeyLookupError(
+                    "Expected a response for server %r not %r"
+                    % (server_name, response["server_name"])
+                )
+
+            response_keys = await self.process_v2_response(
+                from_server=server_name,
+                response_json=response,
+                time_added_ms=time_now_ms,
+            )
+            await self.store.store_server_verify_keys(
+                server_name,
+                time_now_ms,
+                ((server_name, key_id, key) for key_id, key in response_keys.items()),
+            )
+            keys.update(response_keys)
+
+        return keys
@@ -52,7 +52,6 @@ from synapse.api.room_versions import (
    KNOWN_ROOM_VERSIONS,
    EventFormatVersions,
    RoomVersion,
-    RoomVersions,
 )
 from synapse.storage.databases.main.events_worker import EventRedactBehaviour
 from synapse.types import MutableStateMap, StateMap, UserID, get_domain_from_id
@@ -342,80 +341,19 @@ def check_state_dependent_auth_rules(
    logger.debug("Allowing! %s", event)


-# Set of room versions where Synapse did not apply event key size limits
-# in bytes, but rather in codepoints.
-# In these room versions, we are more lenient with event size validation.
-LENIENT_EVENT_BYTE_LIMITS_ROOM_VERSIONS = {
-    RoomVersions.V1,
-    RoomVersions.V2,
-    RoomVersions.V3,
-    RoomVersions.V4,
-    RoomVersions.V5,
-    RoomVersions.V6,
-    RoomVersions.MSC2176,
-    RoomVersions.V7,
-    RoomVersions.V8,
-    RoomVersions.V9,
-    RoomVersions.MSC3787,
-    RoomVersions.V10,
-    RoomVersions.MSC2716v4,
-    RoomVersions.MSC1767v10,
-}
-
-
 def _check_size_limits(event: "EventBase") -> None:
-    """
-    Checks the size limits in a PDU.
-
-    The entire size limit of the PDU is checked first.
-    Then the size of fields is checked, first in codepoints and then in bytes.
-
-    The codepoint size limits are only for Synapse compatibility.
-
-    Raises:
-        EventSizeError:
-            when a size limit has been violated.
-
-            unpersistable=True if Synapse never would have accepted the event and
-                the PDU must NOT be persisted.
-
-            unpersistable=False if a prior version of Synapse would have accepted the
-                event and so the PDU must be persisted as rejected to avoid
-                breaking the room.
-    """
-
-    # Whole PDU check
-    if len(encode_canonical_json(event.get_pdu_json())) > MAX_PDU_SIZE:
-        raise EventSizeError("event too large", unpersistable=True)
-
-    # Codepoint size check: Synapse always enforced these limits, so apply
-    # them strictly.
    if len(event.user_id) > 255:
-        raise EventSizeError("'user_id' too large", unpersistable=True)
+        raise EventSizeError("'user_id' too large")
    if len(event.room_id) > 255:
-        raise EventSizeError("'room_id' too large", unpersistable=True)
+        raise EventSizeError("'room_id' too large")
    if event.is_state() and len(event.state_key) > 255:
-        raise EventSizeError("'state_key' too large", unpersistable=True)
+        raise EventSizeError("'state_key' too large")
    if len(event.type) > 255:
-        raise EventSizeError("'type' too large", unpersistable=True)
+        raise EventSizeError("'type' too large")
    if len(event.event_id) > 255:
-        raise EventSizeError("'event_id' too large", unpersistable=True)
-
-    strict_byte_limits = (
-        event.room_version not in LENIENT_EVENT_BYTE_LIMITS_ROOM_VERSIONS
-    )
-
-    # Byte size check: if these fail, then be lenient to avoid breaking rooms.
-    if len(event.user_id.encode("utf-8")) > 255:
-        raise EventSizeError("'user_id' too large", unpersistable=strict_byte_limits)
-    if len(event.room_id.encode("utf-8")) > 255:
-        raise EventSizeError("'room_id' too large", unpersistable=strict_byte_limits)
-    if event.is_state() and len(event.state_key.encode("utf-8")) > 255:
-        raise EventSizeError("'state_key' too large", unpersistable=strict_byte_limits)
-    if len(event.type.encode("utf-8")) > 255:
-        raise EventSizeError("'type' too large", unpersistable=strict_byte_limits)
-    if len(event.event_id.encode("utf-8")) > 255:
-        raise EventSizeError("'event_id' too large", unpersistable=strict_byte_limits)
+        raise EventSizeError("'event_id' too large")
+    if len(encode_canonical_json(event.get_pdu_json())) > MAX_PDU_SIZE:
+        raise EventSizeError("event too large")


 def _check_create(event: "EventBase") -> None:
@@ -597,7 +597,8 @@ def _event_type_from_format_version(
        format_version: The event format version

    Returns:
-        A type that can be initialized as per the initializer of `FrozenEvent`
+        type: A type that can be initialized as per the initializer of
+        `FrozenEvent`
    """

    if format_version == EventFormatVersions.ROOM_V1_V2:
@@ -28,8 +28,8 @@ from synapse.event_auth import auth_types_for_event
 from synapse.events import EventBase, _EventInternalMetadata, make_event_from_dict
 from synapse.state import StateHandler
 from synapse.storage.databases.main import DataStore
+from synapse.storage.state import StateFilter
 from synapse.types import EventID, JsonDict
-from synapse.types.state import StateFilter
 from synapse.util import Clock
 from synapse.util.stringutils import random_string

@@ -128,7 +128,6 @@ class EventBuilder:
                state_filter=StateFilter.from_types(
                    auth_types_for_event(self.room_version, self)
                ),
-                await_full_state=False,
            )
            auth_event_ids = self._event_auth_handler.compute_auth_events(
                self, state_ids
@@ -23,7 +23,7 @@ from synapse.types import JsonDict, StateMap
 if TYPE_CHECKING:
    from synapse.storage.controllers import StorageControllers
    from synapse.storage.databases.main import DataStore
-    from synapse.types.state import StateFilter
+    from synapse.storage.state import StateFilter


@attr.s(slots=True, auto_attribs=True)
@@ -28,14 +28,8 @@ from typing import (
 )

 import attr
-from canonicaljson import encode_canonical_json

-from synapse.api.constants import (
-    MAX_PDU_SIZE,
-    EventContentFields,
-    EventTypes,
-    RelationTypes,
-)
+from synapse.api.constants import EventContentFields, EventTypes, RelationTypes
 from synapse.api.errors import Codes, SynapseError
 from synapse.api.room_versions import RoomVersion
 from synapse.types import JsonDict
@@ -680,27 +674,3 @@ def validate_canonicaljson(value: Any) -> None:
    elif not isinstance(value, (bool, str)) and value is not None:
        # Other potential JSON values (bool, None, str) are safe.
        raise SynapseError(400, "Unknown JSON value", Codes.BAD_JSON)
-
-
-def maybe_upsert_event_field(
-    event: EventBase, container: JsonDict, key: str, value: object
-) -> bool:
-    """Upsert an event field, but only if this doesn't make the event too large.
-
-    Returns true iff the upsert took place.
-    """
-    if key in container:
-        old_value: object = container[key]
-        container[key] = value
-        # NB: here and below, we assume that passing a non-None `time_now` argument to
-        # get_pdu_json doesn't increase the size of the encoded result.
-        upsert_okay = len(encode_canonical_json(event.get_pdu_json())) <= MAX_PDU_SIZE
-        if not upsert_okay:
-            container[key] = old_value
-    else:
-        container[key] = value
-        upsert_okay = len(encode_canonical_json(event.get_pdu_json())) <= MAX_PDU_SIZE
-        if not upsert_okay:
-            del container[key]
-
-    return upsert_okay
@@ -465,7 +465,7 @@ class FederationClient(FederationBase):
                    pdu_attempts[destination] = now

                    logger.info(
-                        "get_pdu(event_id=%s): Failed to get PDU from %s because %s",
+                        "get_pdu(event_id=): Failed to get PDU from %s because %s",
                        event_id,
                        destination,
                        e,
@@ -771,28 +771,17 @@ class FederationClient(FederationBase):
        """
        if synapse_error is None:
            synapse_error = e.to_synapse_error()
-        # MSC3743 specifies that servers should return a 404 or 405 with an errcode
-        # of M_UNRECOGNIZED when they receive a request to an unknown endpoint or
-        # to an unknown method, respectively.
+        # There is no good way to detect an "unknown" endpoint.
        #
-        # Older versions of servers don't properly handle this. This needs to be
-        # rather specific as some endpoints truly do return 404 errors.
+        # Dendrite returns a 404 (with a body of "404 page not found");
+        # Conduit returns a 404 (with no body); and Synapse returns a 400
+        # with M_UNRECOGNIZED.
+        #
+        # This needs to be rather specific as some endpoints truly do return 404
+        # errors.
        return (
-            # 404 is an unknown endpoint, 405 is a known endpoint, but unknown method.
-            (e.code == 404 or e.code == 405)
-            and (
-                # Older Dendrites returned a text or empty body.
-                # Older Conduit returned an empty body.
-                not e.response
-                or e.response == b"404 page not found"
-                # The proper response JSON with M_UNRECOGNIZED errcode.
-                or synapse_error.errcode == Codes.UNRECOGNIZED
-            )
-        ) or (
-            # Older Synapses returned a 400 error.
-            e.code == 400
-            and synapse_error.errcode == Codes.UNRECOGNIZED
-        )
+            e.code == 404 and (not e.response or e.response == b"404 page not found")
+        ) or (e.code == 400 and synapse_error.errcode == Codes.UNRECOGNIZED)

    async def _try_destination_list(
        self,
@@ -1702,19 +1691,9 @@ class FederationClient(FederationBase):
                #   to return events on *both* sides of the timestamp to
                #   help reconcile the gap faster.
                _timestamp_to_event_from_destination,
-                # Since this endpoint is new, we should try other servers before giving up.
-                # We can safely remove this in a year (remove after 2023-11-16).
-                failover_on_unknown_endpoint=True,
            )
            return timestamp_to_event_response
-        except SynapseError as e:
-            logger.warn(
-                "timestamp_to_event(room_id=%s, timestamp=%s, direction=%s): encountered error when trying to fetch from destinations: %s",
-                room_id,
-                timestamp,
-                direction,
-                e,
-            )
+        except SynapseError:
            return None

    async def _timestamp_to_event_from_destination(
@@ -74,8 +74,6 @@ from synapse.replication.http.federation import (
 )
 from synapse.storage.databases.main.events import PartialStateConflictError
 from synapse.storage.databases.main.lock import Lock
-from synapse.storage.databases.main.roommember import extract_heroes_from_room_summary
-from synapse.storage.roommember import MemberSummary
 from synapse.types import JsonDict, StateMap, get_domain_from_id
 from synapse.util import json_decoder, unwrapFirstError
 from synapse.util.async_helpers import Linearizer, concurrently_execute, gather_results
@@ -693,9 +691,8 @@ class FederationServer(FederationBase):
        state_event_ids: Collection[str]
        servers_in_room: Optional[Collection[str]]
        if caller_supports_partial_state:
-            summary = await self.store.get_room_summary(room_id)
            state_event_ids = _get_event_ids_for_partial_state_join(
-                event, prev_state_ids, summary
+                event, prev_state_ids
            )
            servers_in_room = await self.state.get_hosts_in_room_at_events(
                room_id, event_ids=event.prev_event_ids()
@@ -1498,7 +1495,6 @@ class FederationHandlerRegistry:
 def _get_event_ids_for_partial_state_join(
    join_event: EventBase,
    prev_state_ids: StateMap[str],
-    summary: Dict[str, MemberSummary],
 ) -> Collection[str]:
    """Calculate state to be retuned in a partial_state send_join

@@ -1525,19 +1521,8 @@ def _get_event_ids_for_partial_state_join(
    if current_membership_event_id is not None:
        state_event_ids.add(current_membership_event_id)

-    name_id = prev_state_ids.get((EventTypes.Name, ""))
-    canonical_alias_id = prev_state_ids.get((EventTypes.CanonicalAlias, ""))
-    if not name_id and not canonical_alias_id:
-        # Also include the hero members of the room (for DM rooms without a title).
-        # To do this properly, we should select the correct subset of membership events
-        # from `prev_state_ids`. Instead, we are lazier and use the (cached)
-        # `get_room_summary` function, which is based on the current state of the room.
-        # This introduces races; we choose to ignore them because a) they should be rare
-        # and b) even if it's wrong, joining servers will get the full state eventually.
-        heroes = extract_heroes_from_room_summary(summary, join_event.state_key)
-        for hero in heroes:
-            membership_event_id = prev_state_ids.get((EventTypes.Member, hero))
-            if membership_event_id:
-                state_event_ids.add(membership_event_id)
+    # TODO: return a few more members:
+    #   - those with invites
+    #   - those that are kicked? / banned

    return state_event_ids
@@ -434,23 +434,7 @@ class FederationSender(AbstractFederationSender):
                        # If there are no prev event IDs then the state is empty
                        # and so no remote servers in the room
                        destinations = set()
-
-                    if destinations is None:
-                        # During partial join we use the set of servers that we got
-                        # when beginning the join. It's still possible that we send
-                        # events to servers that left the room in the meantime, but
-                        # we consider that an acceptable risk since it is only our own
-                        # events that we leak and not other server's ones.
-                        partial_state_destinations = (
-                            await self.store.get_partial_state_servers_at_join(
-                                event.room_id
-                            )
-                        )
-
-                        if len(partial_state_destinations) > 0:
-                            destinations = partial_state_destinations
-
-                    if destinations is None:
+                    else:
                        # We check the external cache for the destinations, which is
                        # stored per state group.

@@ -647,7 +631,7 @@ class FederationSender(AbstractFederationSender):
        room_id = receipt.room_id

        # Work out which remote servers should be poked and poke them.
-        domains_set = await self._storage_controllers.state.get_current_hosts_in_room_or_partial_state_approximation(
+        domains_set = await self._storage_controllers.state.get_current_hosts_in_room(
            room_id
        )
        domains = [
@@ -35,7 +35,7 @@ from synapse.logging import issue9533_logger
 from synapse.logging.opentracing import SynapseTags, set_tag
 from synapse.metrics import sent_transactions_counter
 from synapse.metrics.background_process_metrics import run_as_background_process
-from synapse.types import JsonDict, ReadReceipt
+from synapse.types import ReadReceipt
 from synapse.util.retryutils import NotRetryingDestination, get_retry_limiter
 from synapse.visibility import filter_events_for_server

@@ -136,11 +136,8 @@ class PerDestinationQueue:
        # destination
        self._pending_presence: Dict[str, UserPresenceState] = {}

-        # List of room_id -> receipt_type -> user_id -> receipt_dict,
-        #
-        # Each receipt can only have a single receipt per
-        # (room ID, receipt type, user ID, thread ID) tuple.
-        self._pending_receipt_edus: List[Dict[str, Dict[str, Dict[str, dict]]]] = []
+        # room_id -> receipt_type -> user_id -> receipt_dict
+        self._pending_rrs: Dict[str, Dict[str, Dict[str, dict]]] = {}
        self._rrs_pending_flush = False

        # stream_id of last successfully sent to-device message.
@@ -205,53 +202,17 @@ class PerDestinationQueue:
        Args:
            receipt: receipt to be queued
        """
-        serialized_receipt: JsonDict = {
-            "event_ids": receipt.event_ids,
-            "data": receipt.data,
-        }
-        if receipt.thread_id is not None:
-            serialized_receipt["data"]["thread_id"] = receipt.thread_id
-
-        # Find which EDU to add this receipt to. There's three situations depending
-        # on the (room ID, receipt type, user, thread ID) tuple:
-        #
-        # 1. If it fully matches, clobber the information.
-        # 2. If it is missing, add the information.
-        # 3. If the subset tuple of (room ID, receipt type, user) matches, check
-        #    the next EDU (or add a new EDU).
-        for edu in self._pending_receipt_edus:
-            receipt_content = edu.setdefault(receipt.room_id, {}).setdefault(
-                receipt.receipt_type, {}
-            )
-            # If this room ID, receipt type, user ID is not in this EDU, OR if
-            # the full tuple matches, use the current EDU.
-            if (
-                receipt.user_id not in receipt_content
-                or receipt_content[receipt.user_id].get("thread_id")
-                == receipt.thread_id
-            ):
-                receipt_content[receipt.user_id] = serialized_receipt
-                break
-
-        # If no matching EDU was found, create a new one.
-        else:
-            self._pending_receipt_edus.append(
-                {
-                    receipt.room_id: {
-                        receipt.receipt_type: {receipt.user_id: serialized_receipt}
-                    }
-                }
-            )
+        self._pending_rrs.setdefault(receipt.room_id, {}).setdefault(
+            receipt.receipt_type, {}
+        )[receipt.user_id] = {"event_ids": receipt.event_ids, "data": receipt.data}

    def flush_read_receipts_for_room(self, room_id: str) -> None:
-        # If there are any pending receipts for this room then force-flush them
-        # in a new transaction.
-        for edu in self._pending_receipt_edus:
-            if room_id in edu:
-                self._rrs_pending_flush = True
-                self.attempt_new_transaction()
-                # No use in checking remaining EDUs if the room was found.
-                break
+        # if we don't have any read-receipts for this room, it may be that we've already
+        # sent them out, so we don't need to flush.
+        if room_id not in self._pending_rrs:
+            return
+        self._rrs_pending_flush = True
+        self.attempt_new_transaction()

    def send_keyed_edu(self, edu: Edu, key: Hashable) -> None:
        self._pending_edus_keyed[(edu.edu_type, key)] = edu
@@ -390,7 +351,7 @@ class PerDestinationQueue:
                self._pending_edus = []
                self._pending_edus_keyed = {}
                self._pending_presence = {}
-                self._pending_receipt_edus = []
+                self._pending_rrs = {}

                self._start_catching_up()
        except FederationDeniedError as e:
@@ -544,7 +505,6 @@ class PerDestinationQueue:
                    new_pdus = await filter_events_for_server(
                        self._storage_controllers,
                        self._destination,
-                        self._server_name,
                        new_pdus,
                        redact=False,
                    )
@@ -582,27 +542,22 @@ class PerDestinationQueue:
                    self._destination, last_successful_stream_ordering
                )

-    def _get_receipt_edus(self, force_flush: bool, limit: int) -> Iterable[Edu]:
-        if not self._pending_receipt_edus:
+    def _get_rr_edus(self, force_flush: bool) -> Iterable[Edu]:
+        if not self._pending_rrs:
            return
        if not force_flush and not self._rrs_pending_flush:
            # not yet time for this lot
            return

-        # Send at most limit EDUs for receipts.
-        for content in self._pending_receipt_edus[:limit]:
-            yield Edu(
-                origin=self._server_name,
-                destination=self._destination,
-                edu_type=EduTypes.RECEIPT,
-                content=content,
-            )
-        self._pending_receipt_edus = self._pending_receipt_edus[limit:]
-
-        # If there are still pending read-receipts, don't reset the pending flush
-        # flag.
-        if not self._pending_receipt_edus:
-            self._rrs_pending_flush = False
+        edu = Edu(
+            origin=self._server_name,
+            destination=self._destination,
+            edu_type=EduTypes.RECEIPT,
+            content=self._pending_rrs,
+        )
+        self._pending_rrs = {}
+        self._rrs_pending_flush = False
+        yield edu

    def _pop_pending_edus(self, limit: int) -> List[Edu]:
        pending_edus = self._pending_edus
@@ -641,7 +596,7 @@ class PerDestinationQueue:
            if not message_id:
                continue

-            set_tag(SynapseTags.TO_DEVICE_EDU_ID, message_id)
+            set_tag(SynapseTags.TO_DEVICE_MESSAGE_ID, message_id)

        edus = [
            Edu(
@@ -689,20 +644,40 @@ class _TransactionQueueManager:
    async def __aenter__(self) -> Tuple[List[EventBase], List[Edu]]:
        # First we calculate the EDUs we want to send, if any.

-        # There's a maximum number of EDUs that can be sent with a transaction,
-        # generally device updates and to-device messages get priority, but we
-        # want to ensure that there's room for some other EDUs as well.
-        #
-        # This is done by:
-        #
-        # * Add a presence EDU, if one exists.
-        # * Add up-to a small limit of read receipt EDUs.
-        # * Add to-device EDUs, but leave some space for device list updates.
-        # * Add device list updates EDUs.
-        # * If there's any remaining room, add other EDUs.
-        pending_edus = []
+        # We start by fetching device related EDUs, i.e device updates and to
+        # device messages. We have to keep 2 free slots for presence and rr_edus.
+        device_edu_limit = MAX_EDUS_PER_TRANSACTION - 2

-        # Add presence EDU.
+        # We prioritize to-device messages so that existing encryption channels
+        # work. We also keep a few slots spare (by reducing the limit) so that
+        # we can still trickle out some device list updates.
+        (
+            to_device_edus,
+            device_stream_id,
+        ) = await self.queue._get_to_device_message_edus(device_edu_limit - 10)
+
+        if to_device_edus:
+            self._device_stream_id = device_stream_id
+        else:
+            self.queue._last_device_stream_id = device_stream_id
+
+        device_edu_limit -= len(to_device_edus)
+
+        device_update_edus, dev_list_id = await self.queue._get_device_update_edus(
+            device_edu_limit
+        )
+
+        if device_update_edus:
+            self._device_list_id = dev_list_id
+        else:
+            self.queue._last_device_list_stream_id = dev_list_id
+
+        pending_edus = device_update_edus + to_device_edus
+
+        # Now add the read receipt EDU.
+        pending_edus.extend(self.queue._get_rr_edus(force_flush=False))
+
+        # And presence EDU.
        if self.queue._pending_presence:
            pending_edus.append(
                Edu(
@@ -721,47 +696,16 @@ class _TransactionQueueManager:
            )
            self.queue._pending_presence = {}

-        # Add read receipt EDUs.
-        pending_edus.extend(self.queue._get_receipt_edus(force_flush=False, limit=5))
-        edu_limit = MAX_EDUS_PER_TRANSACTION - len(pending_edus)
-
-        # Next, prioritize to-device messages so that existing encryption channels
-        # work. We also keep a few slots spare (by reducing the limit) so that
-        # we can still trickle out some device list updates.
-        (
-            to_device_edus,
-            device_stream_id,
-        ) = await self.queue._get_to_device_message_edus(edu_limit - 10)
-
-        if to_device_edus:
-            self._device_stream_id = device_stream_id
-        else:
-            self.queue._last_device_stream_id = device_stream_id
-
-        pending_edus.extend(to_device_edus)
-        edu_limit -= len(to_device_edus)
-
-        # Add device list update EDUs.
-        device_update_edus, dev_list_id = await self.queue._get_device_update_edus(
-            edu_limit
-        )
-
-        if device_update_edus:
-            self._device_list_id = dev_list_id
-        else:
-            self.queue._last_device_list_stream_id = dev_list_id
-
-        pending_edus.extend(device_update_edus)
-        edu_limit -= len(device_update_edus)
-
        # Finally add any other types of EDUs if there is room.
-        other_edus = self.queue._pop_pending_edus(edu_limit)
-        pending_edus.extend(other_edus)
-        edu_limit -= len(other_edus)
-        while edu_limit > 0 and self.queue._pending_edus_keyed:
+        pending_edus.extend(
+            self.queue._pop_pending_edus(MAX_EDUS_PER_TRANSACTION - len(pending_edus))
+        )
+        while (
+            len(pending_edus) < MAX_EDUS_PER_TRANSACTION
+            and self.queue._pending_edus_keyed
+        ):
            _, val = self.queue._pending_edus_keyed.popitem()
            pending_edus.append(val)
-            edu_limit -= 1

        # Now we look for any PDUs to send, by getting up to 50 PDUs from the
        # queue
@@ -772,10 +716,8 @@ class _TransactionQueueManager:

        # if we've decided to send a transaction anyway, and we have room, we
        # may as well send any pending RRs
-        if edu_limit:
-            pending_edus.extend(
-                self.queue._get_receipt_edus(force_flush=True, limit=edu_limit)
-            )
+        if len(pending_edus) < MAX_EDUS_PER_TRANSACTION:
+            pending_edus.extend(self.queue._get_rr_edus(force_flush=True))

        if self._pdus:
            self._last_stream_ordering = self._pdus[
@@ -185,8 +185,9 @@ class TransportLayerClient:
        Raises:
            Various exceptions when the request fails
        """
-        path = _create_v1_path(
-            "/timestamp_to_event/%s",
+        path = _create_path(
+            FEDERATION_UNSTABLE_PREFIX,
+            "/org.matrix.msc3030/timestamp_to_event/%s",
            room_id,
        )

@@ -279,11 +280,12 @@ class TransportLayerClient:
        Note that this does not append any events to any graphs.

        Args:
-            destination: address of remote homeserver
-            room_id: room to join/leave
-            user_id: user to be joined/left
-            membership: one of join/leave
-            params: Query parameters to include in the request.
+            destination (str): address of remote homeserver
+            room_id (str): room to join/leave
+            user_id (str): user to be joined/left
+            membership (str): one of join/leave
+            params (dict[str, str|Iterable[str]]): Query parameters to include in the
+                request.

        Returns:
            Succeeds when we get a 2xx HTTP response. The result
@@ -25,6 +25,7 @@ from synapse.federation.transport.server._base import (
 from synapse.federation.transport.server.federation import (
    FEDERATION_SERVLET_CLASSES,
    FederationAccountStatusServlet,
+    FederationTimestampLookupServlet,
 )
 from synapse.http.server import HttpServer, JsonResource
 from synapse.http.servlet import (
@@ -290,6 +291,13 @@ def register_servlets(
            )

        for servletclass in SERVLET_GROUPS[servlet_group]:
+            # Only allow the `/timestamp_to_event` servlet if msc3030 is enabled
+            if (
+                servletclass == FederationTimestampLookupServlet
+                and not hs.config.experimental.msc3030_enabled
+            ):
+                continue
+
            # Only allow the `/account_status` servlet if msc3720 is enabled
            if (
                servletclass == FederationAccountStatusServlet
@@ -224,10 +224,10 @@ class BaseFederationServlet:

        With arguments:

-            origin (str|None): The authenticated server_name of the calling server,
+            origin (unicode|None): The authenticated server_name of the calling server,
                unless REQUIRE_AUTH is set to False and authentication failed.

-            content (str|None): decoded json body of the request. None if the
+            content (unicode|None): decoded json body of the request. None if the
                request was a GET.

            query (dict[bytes, list[bytes]]): Query params from the request. url-decoded
@@ -218,13 +218,14 @@ class FederationTimestampLookupServlet(BaseFederationServerServlet):
    `dir` can be `f` or `b` to indicate forwards and backwards in time from the
    given timestamp.

-    GET /_matrix/federation/v1/timestamp_to_event/<roomID>?ts=<timestamp>&dir=<direction>
+    GET /_matrix/federation/unstable/org.matrix.msc3030/timestamp_to_event/<roomID>?ts=<timestamp>&dir=<direction>
    {
        "event_id": ...
    }
    """

    PATH = "/timestamp_to_event/(?P<room_id>[^/]*)/?"
+    PREFIX = FEDERATION_UNSTABLE_PREFIX + "/org.matrix.msc3030"

    async def on_GET(
        self,
@@ -578,6 +578,9 @@ class ApplicationServicesHandler:
            device_id,
        ), messages in recipient_device_to_messages.items():
            for message_json in messages:
+                # Remove 'message_id' from the to-device message, as it's an internal ID
+                message_json.pop("message_id", None)
+
                message_payload.append(
                    {
                        "to_user_id": user_id,
@@ -612,8 +615,8 @@ class ApplicationServicesHandler:
        )

        # Fetch the users who have modified their device list since then.
-        users_with_changed_device_lists = await self.store.get_all_devices_changed(
-            from_key, to_key=new_key
+        users_with_changed_device_lists = (
+            await self.store.get_users_whose_devices_changed(from_key, to_key=new_key)
        )

        # Filter out any users the application service is not interested in
@@ -16,7 +16,6 @@ import logging
 from typing import TYPE_CHECKING, Optional

 from synapse.api.errors import SynapseError
-from synapse.handlers.device import DeviceHandler
 from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.types import Codes, Requester, UserID, create_requester

@@ -77,9 +76,6 @@ class DeactivateAccountHandler:
            True if identity server supports removing threepids, otherwise False.
        """

-        # This can only be called on the main process.
-        assert isinstance(self._device_handler, DeviceHandler)
-
        # Check if this user can be deactivated
        if not await self._third_party_rules.check_can_deactivate_user(
            user_id, by_admin
@@ -65,8 +65,6 @@ DELETE_STALE_DEVICES_INTERVAL_MS = 24 * 60 * 60 * 1000


 class DeviceWorkerHandler:
-    device_list_updater: "DeviceListWorkerUpdater"
-
    def __init__(self, hs: "HomeServer"):
        self.clock = hs.get_clock()
        self.hs = hs
@@ -78,8 +76,6 @@ class DeviceWorkerHandler:
        self.server_name = hs.hostname
        self._msc3852_enabled = hs.config.experimental.msc3852_enabled

-        self.device_list_updater = DeviceListWorkerUpdater(hs)
-
    @trace
    async def get_devices_by_user(self, user_id: str) -> List[JsonDict]:
        """
@@ -103,19 +99,6 @@ class DeviceWorkerHandler:
        log_kv(device_map)
        return devices

-    async def get_dehydrated_device(
-        self, user_id: str
-    ) -> Optional[Tuple[str, JsonDict]]:
-        """Retrieve the information for a dehydrated device.
-
-        Args:
-            user_id: the user whose dehydrated device we are looking for
-        Returns:
-            a tuple whose first item is the device ID, and the second item is
-            the dehydrated device information
-        """
-        return await self.store.get_dehydrated_device(user_id)
-
    @trace
    async def get_device(self, user_id: str, device_id: str) -> JsonDict:
        """Retrieve the given device
@@ -144,7 +127,7 @@ class DeviceWorkerHandler:
    @cancellable
    async def get_device_changes_in_shared_rooms(
        self, user_id: str, room_ids: Collection[str], from_token: StreamToken
-    ) -> Set[str]:
+    ) -> Collection[str]:
        """Get the set of users whose devices have changed who share a room with
        the given user.
        """
@@ -337,8 +320,6 @@ class DeviceWorkerHandler:


 class DeviceHandler(DeviceWorkerHandler):
-    device_list_updater: "DeviceListUpdater"
-
    def __init__(self, hs: "HomeServer"):
        super().__init__(hs)

@@ -625,6 +606,19 @@ class DeviceHandler(DeviceWorkerHandler):
            await self.delete_devices(user_id, [old_device_id])
        return device_id

+    async def get_dehydrated_device(
+        self, user_id: str
+    ) -> Optional[Tuple[str, JsonDict]]:
+        """Retrieve the information for a dehydrated device.
+
+        Args:
+            user_id: the user whose dehydrated device we are looking for
+        Returns:
+            a tuple whose first item is the device ID, and the second item is
+            the dehydrated device information
+        """
+        return await self.store.get_dehydrated_device(user_id)
+
    async def rehydrate_device(
        self, user_id: str, access_token: str, device_id: str
    ) -> dict:
@@ -688,33 +682,13 @@ class DeviceHandler(DeviceWorkerHandler):
        hosts_already_sent_to: Set[str] = set()

        try:
-            stream_id, room_id = await self.store.get_device_change_last_converted_pos()
-
            while True:
                self._handle_new_device_update_new_data = False
-                max_stream_id = self.store.get_device_stream_token()
-                rows = await self.store.get_uncoverted_outbound_room_pokes(
-                    stream_id, room_id
-                )
+                rows = await self.store.get_uncoverted_outbound_room_pokes()
                if not rows:
                    # If the DB returned nothing then there is nothing left to
                    # do, *unless* a new device list update happened during the
                    # DB query.
-
-                    # Advance `(stream_id, room_id)`.
-                    # `max_stream_id` comes from *before* the query for unconverted
-                    # rows, which means that any unconverted rows must have a larger
-                    # stream ID.
-                    if max_stream_id > stream_id:
-                        stream_id, room_id = max_stream_id, ""
-                        await self.store.set_device_change_last_converted_pos(
-                            stream_id, room_id
-                        )
-                    else:
-                        assert max_stream_id == stream_id
-                        # Avoid moving `room_id` backwards.
-                        pass
-
                    if self._handle_new_device_update_new_data:
                        continue
                    else:
@@ -744,6 +718,7 @@ class DeviceHandler(DeviceWorkerHandler):
                        user_id=user_id,
                        device_id=device_id,
                        room_id=room_id,
+                        stream_id=stream_id,
                        hosts=hosts,
                        context=opentracing_context,
                    )
@@ -777,12 +752,6 @@ class DeviceHandler(DeviceWorkerHandler):
                    hosts_already_sent_to.update(hosts)
                    current_stream_id = stream_id

-                # Advance `(stream_id, room_id)`.
-                _, _, room_id, stream_id, _ = rows[-1]
-                await self.store.set_device_change_last_converted_pos(
-                    stream_id, room_id
-                )
-
        finally:
            self._handle_new_device_update_is_processing = False

@@ -865,6 +834,7 @@ class DeviceHandler(DeviceWorkerHandler):
                user_id=user_id,
                device_id=device_id,
                room_id=room_id,
+                stream_id=None,
                hosts=potentially_changed_hosts,
                context=None,
            )
@@ -888,36 +858,7 @@ def _update_device_from_client_ips(
    )


-class DeviceListWorkerUpdater:
-    "Handles incoming device list updates from federation and contacts the main process over replication"
-
-    def __init__(self, hs: "HomeServer"):
-        from synapse.replication.http.devices import (
-            ReplicationUserDevicesResyncRestServlet,
-        )
-
-        self._user_device_resync_client = (
-            ReplicationUserDevicesResyncRestServlet.make_client(hs)
-        )
-
-    async def user_device_resync(
-        self, user_id: str, mark_failed_as_stale: bool = True
-    ) -> Optional[JsonDict]:
-        """Fetches all devices for a user and updates the device cache with them.
-
-        Args:
-            user_id: The user's id whose device_list will be updated.
-            mark_failed_as_stale: Whether to mark the user's device list as stale
-                if the attempt to resync failed.
-        Returns:
-            A dict with device info as under the "devices" in the result of this
-            request:
-            https://matrix.org/docs/spec/server_server/r0.1.2#get-matrix-federation-v1-user-devices-userid
-        """
-        return await self._user_device_resync_client(user_id=user_id)
-
-
-class DeviceListUpdater(DeviceListWorkerUpdater):
+class DeviceListUpdater:
    "Handles incoming device list updates from federation and updates the DB"

    def __init__(self, hs: "HomeServer", device_handler: DeviceHandler):
@@ -996,7 +937,7 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
        # Check if we are partially joining any rooms. If so we need to store
        # all device list updates so that we can handle them correctly once we
        # know who is in the room.
-        # TODO(faster_joins): this fetches and processes a bunch of data that we don't
+        # TODO(faster joins): this fetches and processes a bunch of data that we don't
        # use. Could be replaced by a tighter query e.g.
        #   SELECT EXISTS(SELECT 1 FROM partial_state_rooms)
        partial_rooms = await self.store.get_partial_state_room_resync_info()
@@ -15,7 +15,7 @@
 import logging
 from typing import TYPE_CHECKING, Any, Dict

-from synapse.api.constants import EduTypes, EventContentFields, ToDeviceEventTypes
+from synapse.api.constants import EduTypes, ToDeviceEventTypes
 from synapse.api.errors import SynapseError
 from synapse.api.ratelimiting import Ratelimiter
 from synapse.logging.context import run_in_background
@@ -216,24 +216,14 @@ class DeviceMessageHandler:
        """
        sender_user_id = requester.user.to_string()

-        set_tag(SynapseTags.TO_DEVICE_TYPE, message_type)
-        set_tag(SynapseTags.TO_DEVICE_SENDER, sender_user_id)
+        message_id = random_string(16)
+        set_tag(SynapseTags.TO_DEVICE_MESSAGE_ID, message_id)
+
+        log_kv({"number_of_to_device_messages": len(messages)})
+        set_tag("sender", sender_user_id)
        local_messages = {}
        remote_messages: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
        for user_id, by_device in messages.items():
-            # add an opentracing log entry for each message
-            for device_id, message_content in by_device.items():
-                log_kv(
-                    {
-                        "event": "send_to_device_message",
-                        "user_id": user_id,
-                        "device_id": device_id,
-                        EventContentFields.TO_DEVICE_MSGID: message_content.get(
-                            EventContentFields.TO_DEVICE_MSGID
-                        ),
-                    }
-                )
-
            # Ratelimit local cross-user key requests by the sending device.
            if (
                message_type == ToDeviceEventTypes.RoomKeyRequest
@@ -243,7 +233,6 @@ class DeviceMessageHandler:
                    requester, (sender_user_id, requester.device_id)
                )
                if not allowed:
-                    log_kv({"message": f"dropping key requests to {user_id}"})
                    logger.info(
                        "Dropping room_key_request from %s to %s due to rate limit",
                        sender_user_id,
@@ -258,11 +247,18 @@ class DeviceMessageHandler:
                        "content": message_content,
                        "type": message_type,
                        "sender": sender_user_id,
+                        "message_id": message_id,
                    }
                    for device_id, message_content in by_device.items()
                }
                if messages_by_device:
                    local_messages[user_id] = messages_by_device
+                    log_kv(
+                        {
+                            "user_id": user_id,
+                            "device_id": list(messages_by_device),
+                        }
+                    )
            else:
                destination = get_domain_from_id(user_id)
                remote_messages.setdefault(destination, {})[user_id] = by_device
@@ -271,11 +267,7 @@ class DeviceMessageHandler:

        remote_edu_contents = {}
        for destination, messages in remote_messages.items():
-            # The EDU contains a "message_id" property which is used for
-            # idempotence. Make up a random one.
-            message_id = random_string(16)
-            log_kv({"destination": destination, "message_id": message_id})
-
+            log_kv({"destination": destination})
            remote_edu_contents[destination] = {
                "messages": messages,
                "sender": sender_user_id,
@@ -85,7 +85,7 @@ class DirectoryHandler:
        # TODO(erikj): Add transactions.
        # TODO(erikj): Check if there is a current association.
        if not servers:
-            servers = await self._storage_controllers.state.get_current_hosts_in_room_or_partial_state_approximation(
+            servers = await self._storage_controllers.state.get_current_hosts_in_room(
                room_id
            )

@@ -290,7 +290,7 @@ class DirectoryHandler:
                Codes.NOT_FOUND,
            )

-        extra_servers = await self._storage_controllers.state.get_current_hosts_in_room_or_partial_state_approximation(
+        extra_servers = await self._storage_controllers.state.get_current_hosts_in_room(
            room_id
        )
        servers_set = set(extra_servers) | set(servers)
@@ -27,9 +27,9 @@ from twisted.internet import defer

 from synapse.api.constants import EduTypes
 from synapse.api.errors import CodeMessageException, Codes, NotFoundError, SynapseError
-from synapse.handlers.device import DeviceHandler
 from synapse.logging.context import make_deferred_yieldable, run_in_background
 from synapse.logging.opentracing import log_kv, set_tag, tag_args, trace
+from synapse.replication.http.devices import ReplicationUserDevicesResyncRestServlet
 from synapse.types import (
    JsonDict,
    UserID,
@@ -56,23 +56,27 @@ class E2eKeysHandler:
        self.is_mine = hs.is_mine
        self.clock = hs.get_clock()

+        self._edu_updater = SigningKeyEduUpdater(hs, self)
+
        federation_registry = hs.get_federation_registry()

-        is_master = hs.config.worker.worker_app is None
-        if is_master:
-            edu_updater = SigningKeyEduUpdater(hs)
-
+        self._is_master = hs.config.worker.worker_app is None
+        if not self._is_master:
+            self._user_device_resync_client = (
+                ReplicationUserDevicesResyncRestServlet.make_client(hs)
+            )
+        else:
            # Only register this edu handler on master as it requires writing
            # device updates to the db
            federation_registry.register_edu_handler(
                EduTypes.SIGNING_KEY_UPDATE,
-                edu_updater.incoming_signing_key_update,
+                self._edu_updater.incoming_signing_key_update,
            )
            # also handle the unstable version
            # FIXME: remove this when enough servers have upgraded
            federation_registry.register_edu_handler(
                EduTypes.UNSTABLE_SIGNING_KEY_UPDATE,
-                edu_updater.incoming_signing_key_update,
+                self._edu_updater.incoming_signing_key_update,
            )

        # doesn't really work as part of the generic query API, because the
@@ -315,13 +319,14 @@ class E2eKeysHandler:
            # probably be tracking their device lists. However, we haven't
            # done an initial sync on the device list so we do it now.
            try:
-                resync_results = (
-                    await self.device_handler.device_list_updater.user_device_resync(
+                if self._is_master:
+                    resync_results = await self.device_handler.device_list_updater.user_device_resync(
                        user_id
                    )
-                )
-                if resync_results is None:
-                    raise ValueError("Device resync failed")
+                else:
+                    resync_results = await self._user_device_resync_client(
+                        user_id=user_id
+                    )

                # Add the device keys to the results.
                user_devices = resync_results["devices"]
@@ -600,8 +605,6 @@ class E2eKeysHandler:
    async def upload_keys_for_user(
        self, user_id: str, device_id: str, keys: JsonDict
    ) -> JsonDict:
-        # This can only be called from the main process.
-        assert isinstance(self.device_handler, DeviceHandler)

        time_now = self.clock.time_msec()

@@ -729,8 +732,6 @@ class E2eKeysHandler:
            user_id: the user uploading the keys
            keys: the signing keys
        """
-        # This can only be called from the main process.
-        assert isinstance(self.device_handler, DeviceHandler)

        # if a master key is uploaded, then check it.  Otherwise, load the
        # stored master key, to check signatures on other keys
@@ -822,9 +823,6 @@ class E2eKeysHandler:
        Raises:
            SynapseError: if the signatures dict is not valid.
        """
-        # This can only be called from the main process.
-        assert isinstance(self.device_handler, DeviceHandler)
-
        failures = {}

        # signatures to be stored.  Each item will be a SignatureListItem
@@ -872,7 +870,7 @@ class E2eKeysHandler:
        - signatures of the user's master key by the user's devices.

        Args:
-            user_id: the user uploading the keys
+            user_id (string): the user uploading the keys
            signatures (dict[string, dict]): map of devices to signed keys

        Returns:
@@ -1202,9 +1200,6 @@ class E2eKeysHandler:
            A tuple of the retrieved key content, the key's ID and the matching VerifyKey.
            If the key cannot be retrieved, all values in the tuple will instead be None.
        """
-        # This can only be called from the main process.
-        assert isinstance(self.device_handler, DeviceHandler)
-
        try:
            remote_result = await self.federation.query_user_devices(
                user.domain, user.to_string()
@@ -1401,14 +1396,11 @@ class SignatureListItem:
 class SigningKeyEduUpdater:
    """Handles incoming signing key updates from federation and updates the DB"""

-    def __init__(self, hs: "HomeServer"):
+    def __init__(self, hs: "HomeServer", e2e_keys_handler: E2eKeysHandler):
        self.store = hs.get_datastores().main
        self.federation = hs.get_federation_client()
        self.clock = hs.get_clock()
-
-        device_handler = hs.get_device_handler()
-        assert isinstance(device_handler, DeviceHandler)
-        self._device_handler = device_handler
+        self.e2e_keys_handler = e2e_keys_handler

        self._remote_edu_linearizer = Linearizer(name="remote_signing_key")

@@ -1453,6 +1445,9 @@ class SigningKeyEduUpdater:
            user_id: the user whose updates we are processing
        """

+        device_handler = self.e2e_keys_handler.device_handler
+        device_list_updater = device_handler.device_list_updater
+
        async with self._remote_edu_linearizer.queue(user_id):
            pending_updates = self._pending_updates.pop(user_id, [])
            if not pending_updates:
@@ -1464,11 +1459,13 @@ class SigningKeyEduUpdater:
            logger.info("pending updates: %r", pending_updates)

            for master_key, self_signing_key in pending_updates:
-                new_device_ids = await self._device_handler.device_list_updater.process_cross_signing_key_update(
-                    user_id,
-                    master_key,
-                    self_signing_key,
+                new_device_ids = (
+                    await device_list_updater.process_cross_signing_key_update(
+                        user_id,
+                        master_key,
+                        self_signing_key,
+                    )
                )
                device_ids = device_ids + new_device_ids

-            await self._device_handler.notify_device_update(user_id, device_ids)
+            await device_handler.notify_device_update(user_id, device_ids)
@@ -377,9 +377,8 @@ class E2eRoomKeysHandler:
        """Deletes a given version of the user's e2e_room_keys backup

        Args:
-            user_id: the user whose current backup version we're deleting
-            version: Optional. the version ID of the backup version we're deleting
-                If missing, we delete the current backup version info.
+            user_id(str): the user whose current backup version we're deleting
+            version(str): the version id of the backup being deleted
        Raises:
            NotFoundError: if this backup version doesn't exist
        """
@@ -45,7 +45,6 @@ class EventAuthHandler:
    def __init__(self, hs: "HomeServer"):
        self._clock = hs.get_clock()
        self._store = hs.get_datastores().main
-        self._state_storage_controller = hs.get_storage_controllers().state
        self._server_name = hs.hostname

    async def check_auth_rules_from_context(
@@ -180,22 +179,17 @@ class EventAuthHandler:
        this function may return an incorrect result as we are not able to fully
        track server membership in a room without full state.
        """
-        if await self._store.is_partial_state_room(room_id):
-            if allow_partial_state_rooms:
-                current_hosts = await self._state_storage_controller.get_current_hosts_in_room_or_partial_state_approximation(
-                    room_id
-                )
-                if host not in current_hosts:
-                    raise AuthError(403, "Host not in room (partial-state approx).")
-            else:
-                raise AuthError(
-                    403,
-                    "Unable to authorise you right now; room is partial-stated here.",
-                    errcode=Codes.UNABLE_DUE_TO_PARTIAL_STATE,
-                )
-        else:
-            if not await self.is_host_in_room(room_id, host):
-                raise AuthError(403, "Host not in room.")
+        if not allow_partial_state_rooms and await self._store.is_partial_state_room(
+            room_id
+        ):
+            raise AuthError(
+                403,
+                "Unable to authorise you right now; room is partial-stated here.",
+                errcode=Codes.UNABLE_DUE_TO_PARTIAL_STATE,
+            )
+
+        if not await self.is_host_in_room(room_id, host):
+            raise AuthError(403, "Host not in room.")

    async def check_restricted_join_rules(
        self,
@@ -70,8 +70,8 @@ from synapse.replication.http.federation import (
 )
 from synapse.storage.databases.main.events import PartialStateConflictError
 from synapse.storage.databases.main.events_worker import EventRedactBehaviour
+from synapse.storage.state import StateFilter
 from synapse.types import JsonDict, get_domain_from_id
-from synapse.types.state import StateFilter
 from synapse.util.async_helpers import Linearizer
 from synapse.util.retryutils import NotRetryingDestination
 from synapse.visibility import filter_events_for_server
@@ -152,7 +152,6 @@ class FederationHandler:
        self._federation_event_handler = hs.get_federation_event_handler()
        self._device_handler = hs.get_device_handler()
        self._bulk_push_rule_evaluator = hs.get_bulk_push_rule_evaluator()
-        self._notifier = hs.get_notifier()

        self._clean_room_for_join_client = ReplicationCleanRoomRestServlet.make_client(
            hs
@@ -380,7 +379,6 @@ class FederationHandler:
            filtered_extremities = await filter_events_for_server(
                self._storage_controllers,
                self.server_name,
-                self.server_name,
                events_to_check,
                redact=False,
                check_history_visibility_only=True,
@@ -1233,9 +1231,7 @@ class FederationHandler:
    async def on_backfill_request(
        self, origin: str, room_id: str, pdu_list: List[str], limit: int
    ) -> List[EventBase]:
-        # We allow partially joined rooms since in this case we are filtering out
-        # non-local events in `filter_events_for_server`.
-        await self._event_auth_handler.assert_host_in_room(room_id, origin, True)
+        await self._event_auth_handler.assert_host_in_room(room_id, origin)

        # Synapse asks for 100 events per backfill request. Do not allow more.
        limit = min(limit, 100)
@@ -1256,7 +1252,7 @@ class FederationHandler:
        )

        events = await filter_events_for_server(
-            self._storage_controllers, origin, self.server_name, events
+            self._storage_controllers, origin, events
        )

        return events
@@ -1287,7 +1283,7 @@ class FederationHandler:
        await self._event_auth_handler.assert_host_in_room(event.room_id, origin)

        events = await filter_events_for_server(
-            self._storage_controllers, origin, self.server_name, [event]
+            self._storage_controllers, origin, [event]
        )
        event = events[0]
        return event
@@ -1300,9 +1296,7 @@ class FederationHandler:
        latest_events: List[str],
        limit: int,
    ) -> List[EventBase]:
-        # We allow partially joined rooms since in this case we are filtering out
-        # non-local events in `filter_events_for_server`.
-        await self._event_auth_handler.assert_host_in_room(room_id, origin, True)
+        await self._event_auth_handler.assert_host_in_room(room_id, origin)

        # Only allow up to 20 events to be retrieved per request.
        limit = min(limit, 20)
@@ -1315,7 +1309,7 @@ class FederationHandler:
        )

        missing_events = await filter_events_for_server(
-            self._storage_controllers, origin, self.server_name, missing_events
+            self._storage_controllers, origin, missing_events
        )

        return missing_events
@@ -1602,8 +1596,8 @@ class FederationHandler:
        Fetch the complexity of a remote room over federation.

        Args:
-            remote_room_hosts: The remote servers to ask.
-            room_id: The room ID to ask about.
+            remote_room_hosts (list[str]): The remote servers to ask.
+            room_id (str): The room ID to ask about.

        Returns:
            Dict contains the complexity
@@ -1693,9 +1687,6 @@ class FederationHandler:
                    self._storage_controllers.state.notify_room_un_partial_stated(
                        room_id
                    )
-                    # Poke the notifier so that other workers see the write to
-                    # the un-partial-stated rooms stream.
-                    self._notifier.notify_replication()

                    # TODO(faster_joins) update room stats and user directory?
                    #   https://github.com/matrix-org/synapse/issues/12814
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				Fix a performance regression in `/sync` handling, introduced in 1.49.0.