chore(deps): update dependency element-hq/synapse to v1.149.1

[renovate]

This PR contains the following updates:

Package	Update	Change
element-hq/synapse	minor	v1.146.0 → v1.149.1

---

Pre-merge checks for Synapse or MAS workloads

• The Release Notes do not describe any breaking changes.

• The Upgrade document does not describe any breaking changes.

---

Release Notes

element-hq/synapse (element-hq/synapse)

v1.149.1

Compare Source

Synapse 1.149.1 (2026-03-11)

Internal Changes

• Bump matrix-synapse-ldap3 to 0.4.0 to support setuptools>=82.0.0. Fixes #​19541. (#​19543)

v1.149.0

Compare Source

Synapse 1.149.0 (2026-03-10)

No significant changes since 1.149.0rc1.

Synapse 1.149.0rc1 (2026-03-03)

Features

• Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#​19127)
• Add stable support for MSC4380 invite blocking. (#​19431)

Bugfixes

• Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#​18518)
• Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#​19460)

Internal Changes

• Add log to explain when and why we freeze objects in the garbage collector. (#​19440)
• Better instrument JoinRoomAliasServlet with tracing. (#​19461)
• Fix Complement CI not running against the code from our PRs. (#​19475)
• Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#​19480)
• Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#​19486)
• Add a log line when we delete devices. Contributed by @​bradtgmurray @​ Beeper. (#​19496)
• Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#​19498)
• Cancel long-running sync requests if the client has gone away. (#​19499)
• Try and reduce reactor tick times when under heavy load. (#​19507)
• Simplify Rust HTTP client response streaming and limiting. (#​19510)
• Replace deprecated collection import locations with current locations. (#​19515)
• Bump most locked Python dependencies to their latest versions. (#​19519)

v1.148.0

Compare Source

Synapse 1.148.0 (2026-02-24)

No significant changes since 1.148.0rc1.

Synapse 1.148.0rc1 (2026-02-17)

Features

• Support sending and receiving MSC4354 Sticky Event metadata. (#​19365)

Improved Documentation

• Fix reference to the experimental_features section of the configuration manual documentation. (#​19435)

Deprecations and Removals

• Remove support for MSC3244: Room version capabilities as the MSC was rejected. (#​19429)

Internal Changes

• Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. (#​19406)
• Push Synapse docker images to Element OCI Registry. (#​19420)
• Allow configuring the Rust HTTP client to use HTTP/2 only. (#​19457)
• Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. (#​19470)

v1.147.1

Compare Source

Synapse 1.147.1 (2026-02-12)

• Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670. (#​19459)

v1.147.0

Compare Source

Synapse 1.147.0 (2026-02-10)

No significant changes since 1.147.0rc1.

Synapse 1.147.0rc1 (2026-02-03)

Bugfixes

• Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. (#​19416)
• Fix a typo that incorrectly made setuptools_rust a runtime dependency. (#​19417)

Internal Changes

• Prune stale entries from sliding_sync_connection_required_state table. (#​19306)
• Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). (#​19399)
• Update and align Grafana dashboard to use regex matching for job selectors (job=~"$job") so the "all" value works correctly across all panels. (#​19400)
• Don't retry joining partial state rooms all at once on startup. (#​19402)
• Disallow requests to the health endpoint from containing trailing path characters. (#​19405)
• Add notes that new experimental features should have associated tracking issues. (#​19410)
• Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to 0.27.0. Contributed by @​razvp @​ ERCOM. (#​19412)

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.