automation: Update matrix-synapse Docker tag to v1.121.1

This MR contains the following updates:

Package	Update	Change
matrix-synapse (source)	minor	1.118.0 -> 1.121.1

---

Release Notes

element-hq/synapse (matrix-synapse)

v1.121.1

Compare Source

This release contains a fix for our docker build CI. It is functionally identical to 1.121.0, whose changelog is below.

Internal Changes

• Downgrade the Ubuntu GHA runner when building docker images. (#​18026)

v1.120.2

Compare Source

This version has building of wheels for macOS disabled. It is functionally identical to 1.120.1, which contains multiple security fixes. If you are already using 1.120.1, there is no need to upgrade to this version.

v1.120.1

Compare Source

This patch release fixes multiple security vulnerabilities, some affecting all prior versions of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild.

Administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below.

Security advisory

The following issues are fixed in 1.120.1.

• GHSA-rfq8-j7rh-8hf2 / CVE-2024-52805: Unsupported content types can lead to memory exhaustion

  Synapse instances which have a high max_upload_size and which don't have a reverse proxy in front of them that would otherwise limit upload size are affected.

  Fixed by 4b7154c58501b4bf5e1c2d6c11ebef96529f2fdf.

• GHSA-f3r3-h2mq-hx2h / CVE-2024-52815: Malicious invites via federation can break a user's sync

  Fixed by d82e1ed357b7ee21dff83d06cba7a67840cfd464.

• GHSA-vp6v-whfm-rv3g / CVE-2024-53863: Synapse can be forced to thumbnail unexpected file formats, invoking potentially untrustworthy decoders

  Synapse instances can disable dynamic thumbnailing by setting dynamic_thumbnails to false in the configuration file.

  Fixed by b64a4e5fbbbf119b6c65aedf0d999b4237d55503.

• GHSA-56w4-5538-8v8h / CVE-2024-53867: The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room

  Non-state events, like messages, are unaffected.

  Synapse instances can disable the Sliding Sync feature by setting experimental_features.msc3575_enabled to false in the configuration file.

  Fixed by 4daa533e82f345ce87b9495d31781af570ba3ead.

See the advisories for more details. If you have any questions, email security at element.io.

Bugfixes

• Fix release process to not create duplicate releases. (#​17970)

v1.120.0

Compare Source

Bugfixes

• Fix a bug introduced in Synapse v1.120rc1 which would cause the newly-introduced delete_old_otks job to fail in worker-mode deployments. (#​17960)

v1.119.0

Compare Source

No significant changes since 1.119.0rc2.

Python 3.8 support dropped

Python 3.8 is end-of-life and is no longer supported by Synapse. The minimum supported Python version is now 3.9.

If you are running Synapse with Python 3.8, please upgrade to Python 3.9 (or greater) before upgrading Synapse.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Renovate Bot. The local configuration can be found in the local Renovate Bot repository.