<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="82">
<package pkgid="a3392ff1e336162c1e92a3d5d3522fc37b5adc89542407be32819fbf6c2e6391746360ddd556933479fc07da5db6aafa6fb0f8a68d6a3e1345c4456efbbd3f53" name="matrix-synapse" arch="i586">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="d6bf03e4a686c6f68c76a0c60e7fad967ff342061bc62ac8f7e8be3d1029a4d0ee9b6c2267a0fa0b87929eaa31cb56e80d83d195681def5d91cc433d164b16e4" name="matrix-synapse" arch="src">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="e0afe105424a66dbecf90b6186e26cdcac676b9b21c6d40f2413b79f6d871a7a30453daa06ce58e2360f0fcd34334fb773d3b7e2c98c34b6475c497906a8d725" name="matrix-synapse" arch="x86_64">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="d152f194f543a0ecd53677d52cbccc0b4bfc952eb63ecc1354bc27b84b6ac14c1155d3d8c0cd09a305a9da9abbef7010ec1181c3aef91047bd40e81de63e1fbd" name="matrix-synapse-debuginfo" arch="i586">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="d66d676b3a0b9185d7e9b58bef82dcd9eec95ca4643e4c0b935fb8db531f775b02e49accc67f665f67d6c1f927887935abfac6b3374e92e09a6bc6655dbadc46" name="matrix-synapse-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="db0faa94491a83525a9d97d9b4c9a05cbb68b5b5427a9902b0487385582ddd0581f2bef6a351702c71e6fcce0bade51db619a9e35be370dec36d018cc66a25f9" name="matrix-synapse-debugsource" arch="i586">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="03de5f26efc572d1f5593f6c212e1d7dbdef2fc2535b8be479207bbfeb6676533027d39c5e43df0e04f1fa616b95e71fbc1b6eb45e3f9b236d72f76ebe66fb35" name="matrix-synapse-debugsource" arch="x86_64">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="1e28d478e6cc584e0a44f10cadb899e3bb001831468bb77668b3ae6165d638fb857922c5bfb4e0026bb7616c0b1f3fca3626b8a739adc7b64c72f4a60d64f745" name="matrix-synapse-test" arch="src">
  <version epoch="0" ver="1.147.0" rel="1.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="03b2f15d7818efa057e1a7a369f21709a3dc8a11b3bd33d5ab94d4ed9b55103742ac1bf00e2c1f869b395911e85f038371e71a42c8c257f2e2567c0e326c771d" name="matrix-synapse-test" arch="src">
  <version epoch="0" ver="1.147.0" rel="2.1"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1751371200">- Update to 1.133.0
  - Features
  - Add support for the MSC4260 user report API. (#18120)
  - Bugfixes
  - Fix an issue where, during state resolution for v11 rooms,
    Synapse would incorrectly calculate the power level of the
    creator when there was no power levels event in the room.
    (#18534, #18547)
  - Fix long-standing bug where sliding sync did not honour the
    room_id_to_include config option. (#18535)
  - Fix an issue where "Lock timeout is getting excessive"
    warnings would be logged even when the lock timeout was &lt;10
    minutes. (#18543)
  - Fix an issue where Synapse could calculate the wrong power
    level for the creator of the room if there was no power
    levels event. (#18545)
  - Improved Documentation
  - Generate config documentation from JSON Schema file. (#18528)
  - Fix typo in user type documentation. (#18568)
  - Internal Changes
  - Increase performance of introspecting access tokens when
    using delegated auth. (#18357, #18561)
  - Log user deactivations. (#18541)
  - Enable flake8-logging and flake8-logging-format rules in Ruff
    and fix related issues throughout the codebase. (#18542)
  - Clean up old, unused rows from the device_federation_inbox
    table. (#18546)
  - Run config schema CI on develop and release branches.
    (#18551)
  - Add support for Twisted 25.5.0+ releases. (#18577)
  - Update PyO3 to version 0.25. (#18578)
  - Updates to locked dependencies
  - Bump actions/setup-python from 5.5.0 to 5.6.0. (#18555)
  - Bump base64 from 0.21.7 to 0.22.1. (#18559)
  - Bump dawidd6/action-download-artifact from 9 to 11. (#18556)
  - Bump headers from 0.4.0 to 0.4.1. (#18529)
  - Bump requests from 2.32.2 to 2.32.4. (#18533)
  - Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611.
    (#18558)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752580800">- Update to 1.134.0
  - Features
  - Support for MSC4235: via query param for hierarchy endpoint.
    Contributed by Krishan (@kfiven). (#18070)
  - Add forget_forced_upon_leave capability as per MSC4267.
    (#18196)
  - Add federated_user_may_invite spam checker callback which
    receives the entire invite event. Contributed by @tulir @
    Beeper. (#18241)
  - Bugfixes
  - Fix KeyError on background updates when using split
    main/state databases. (#18509)
  - Improve performance of device deletion by adding missing
    index. (#18582)
  - Fix avatar_url and displayname being sent on federation
    profile queries when they are not set. (#18593)
  - Respond with 401 &amp; M_USER_LOCKED when a locked user calls
    POST /login, as per the spec. (#18594)
  - Ensure policy servers are not asked to scan policy server
    change events, allowing rooms to disable the use of a policy
    server while the policy server is down. (#18605)
  - Improved Documentation
  - Fix documentation of the Delete Room Admin API's status
    field. (#18519)
  - Deprecations and Removals
  - Stop adding the "origin" field to newly-created events
    (PDUs). (#18418)
  - Internal Changes
  - Replace PyICU crate with equivalent icu_segmenter Rust crate.
    (#18553, #18646)
  - Improve docstring on simple_upsert_many. (#18573)
  - Raise poetry-core version cap to 2.1.3. (#18575)
  - Raise setuptools_rust version cap to 1.11.1. (#18576)
  - Better handling of ratelimited requests. (#18595, #18600)
  - Update to Rust 1.87.0 in CI, and bump the pinned commit of
    the dtolnay/rust-toolchain GitHub Action to
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b. (#18596)
  - Speed up bulk device deletion. (#18602)
  - Speed up the building of arm-based wheels in CI. (#18618)
  - Speed up the building of Docker images in CI. (#18620)
  - Add .zed/ directory to .gitignore. (#18623)
  - Log the room ID we're purging state for. (#18625)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. (#18612)
  - Bump attrs from 24.2.0 to 25.3.0. (#18649)
  - Bump authlib from 1.5.2 to 1.6.0. (#18642)
  - Bump base64 from 0.21.7 to 0.22.1. (#18589)
  - Bump base64 from 0.21.7 to 0.22.1. (#18629)
  - Bump docker/build-push-action from 6.17.0 to 6.18.0. (#18497)
  - Bump docker/setup-buildx-action from 3.10.0 to 3.11.1.
    (#18587)
  - Bump hiredis from 3.1.0 to 3.2.1. (#18638)
  - Bump ijson from 3.3.0 to 3.4.0. (#18650)
  - Bump jsonschema from 4.23.0 to 4.24.0. (#18630)
  - Bump msgpack from 1.1.0 to 1.1.1. (#18651)
  - Bump mypy-zope from 1.0.11 to 1.0.12. (#18640)
  - Bump phonenumbers from 9.0.2 to 9.0.8. (#18652)
  - Bump pillow from 11.2.1 to 11.3.0. (#18624)
  - Bump prometheus-client from 0.21.0 to 0.22.1. (#18609)
  - Bump pyasn1-modules from 0.4.1 to 0.4.2. (#18495)
  - Bump pydantic from 2.11.4 to 2.11.7. (#18639)
  - Bump reqwest from 0.12.15 to 0.12.20. (#18590)
  - Bump reqwest from 0.12.20 to 0.12.22. (#18627)
  - Bump ruff from 0.11.11 to 0.12.1. (#18645)
  - Bump ruff from 0.12.1 to 0.12.2. (#18657)
  - Bump sentry-sdk from 2.22.0 to 2.32.0. (#18633)
  - Bump setuptools-rust from 1.10.2 to 1.11.1. (#18655)
  - Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. (#18588)
  - Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. (#18608)
  - Bump stefanzweifel/git-auto-commit-action from 5.2.0 to
    6.0.1. (#18607)
  - Bump tokio from 1.45.1 to 1.46.0. (#18628)
  - Bump tokio from 1.46.0 to 1.46.1. (#18667)
  - Bump treq from 24.9.1 to 25.5.0. (#18610)
  - Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514.
    (#18634)
  - Bump types-jsonschema from 4.23.0.20250516 to
    4.24.0.20250528. (#18611)
  - Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622.
    (#18586)
  - Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516.
    (#18658)
  - Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516.
    (#18643)
  - Bump types-setuptools from 75.2.0.20241019 to
    80.9.0.20250529. (#18644)
  - Bump typing-extensions from 4.12.2 to 4.14.0. (#18654)
  - Bump typing-extensions from 4.14.0 to 4.14.1. (#18668)
  - Bump urllib3 from 2.2.2 to 2.5.0. (#18572)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754049600">- Update to 1.135.0
  - Features
  - Add recaptcha_private_key_path and recaptcha_public_key_path
    config option. (#17984, #18684)
  - Add plain-text handling for rich-text topics as per MSC3765.
    (#18195)
  - If enabled by the user, server admins will see soft failed
    events over the Client-Server API. (#18238)
  - Add experimental support for MSC4277: Harmonizing the
    reporting endpoints. (#18263)
  - Add ability to limit amount of media uploaded by a user in a
    given time period. (#18527)
  - Enable workers to write directly to the device lists stream
    and handle device list updates, reducing load on the main
    process. (#18581)
  - Support arbitrary profile fields. Contributed by @clokep.
    (#18635)
  - Advertise support for Matrix v1.12. (#18647)
  - Add an option to issue redactions as an admin user via the
    admin redaction endpoint. (#18671)
  - Add experimental and incomplete support for MSC4306: Thread
    Subscriptions. (#18674)
  - Include event_id when getting state with ?format=event.
    Contributed by @tulir @ Beeper. (#18675)
  - Bugfixes
  - Fix user failing to deactivate with MAS when /_synapse/mas is
    handled by a worker. (#18716)
  - Fix CPU and database spinning when retrying sending events to
    servers whilst at the same time purging those events.
    (#18499)
  - Don't allow creation of tags with names longer than 255
    bytes, as per the spec. (#18660)
  - Fix sliding_sync_connections-related errors when porting from
    SQLite to Postgres. (#18677)
  - Fix the MAS integration not working when Synapse is started
    with --daemonize or using synctl. (#18691)
  - Improved Documentation
  - Document that some config options for the user directory are
    in violation of the Matrix spec. (#18548)
  - Update rc_delayed_event_mgmt docs to the actual nesting
    level. Contributed by @HarHarLinks. (#18692)
  - Internal Changes
  - Fix performance regression introduced in #18238 by adding a
    cache to is_server_admin. (#18747)
  - Add a dedicated internal API for Matrix Authentication
    Service to Synapse communication. (#18520)
  - Allow user registrations to be done on workers. (#18552)
  - Remove unnecessary HTTP replication calls. (#18564)
  - Refactor Measure block metrics to be homeserver-scoped.
    (#18601)
  - Refactor cache metrics to be homeserver-scoped. (#18604)
  - Unbreak "Latest dependencies" workflow by using the --without
    dev poetry option instead of removed --no-dev. (#18617)
  - Update URL Preview code to work with lxml 6.0.0+. (#18622)
  - Use markdown-it-py instead of commonmark in the release
    script. (#18637)
  - Fix typing errors with upgraded mypy version. (#18653)
  - Add doc comment explaining that config files are shallowly
    merged. (#18664)
  - Minor speed up of insertion into stream_positions table.
    (#18672)
  - Remove unused allow_no_prev_events option when creating an
    event. (#18676)
  - Clean up MetricsResource and Prometheus hacks. (#18687)
  - Fix dirty Cargo.lock changes appearing after install
    (base64). (#18689)
  - Prevent dirty Cargo.lock changes from install. (#18693)
  - Correct spelling of 'Admin token used' log line. (#18697)
  - Reduce log spam when client stops downloading media while it
    is being streamed to them. (#18699)
  - Updates to locked dependencies
  - Bump authlib from 1.6.0 to 1.6.1. (#18704)
  - Bump base64 from 0.21.7 to 0.22.1. (#18666)
  - Bump jsonschema from 4.24.0 to 4.25.0. (#18707)
  - Bump lxml from 5.4.0 to 6.0.0. (#18631)
  - Bump mypy from 1.13.0 to 1.16.1. (#18653)
  - Bump once_cell from 1.19.0 to 1.21.3. (#18710)
  - Bump phonenumbers from 9.0.8 to 9.0.9. (#18681)
  - Bump ruff from 0.12.2 to 0.12.5. (#18683, #18705)
  - Bump serde_json from 1.0.140 to 1.0.141. (#18709)
  - Bump sigstore/cosign-installer from 3.9.1 to 3.9.2. (#18708)
  - Bump types-jsonschema from 4.24.0.20250528 to
    4.24.0.20250708. (#18682)
- drop bump-dependencies.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754913600">- Update to 1.135.2
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  - Bugfixes
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755000000">- Update to 1.136.0 (boo#1247970)
  Please check the relevant section in the upgrade notes as this
  release contains changes to MAS support, metrics labels and the
  module API which may require your attention when upgrading.
  This is the Synapse portion of the Matrix coordinated security
  release. This release includes support for room version 12 which
  fixes a number of security vulnerabilities, including
  CVE-2025-49090.
  The default room version is not changed. Not all clients will
  support room version 12 immediately, and not all users will be
  using the latest version of their clients. Large, public rooms
  are advised to wait a few weeks before upgrading to room version
  12 to allow users throughout the Matrix ecosystem to update their
  clients.
  https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11360
  - Features
  - Add configurable rate limiting for the creation of rooms.
    (#18514)
  - Add support for MSC4293 - Redact on Kick/Ban. (#18540)
  - When admins enable themselves to see soft-failed events, they
    will also see if the cause is due to the policy server
    flagging them as spam via unsigned. (#18585)
  - Add ability to configure forward/outbound proxy via
    homeserver config instead of environment variables. See
    http_proxy, https_proxy, no_proxy_hosts. (#18686)
  - Advertise experimental support for MSC4306 (Thread
    Subscriptions) through /_matrix/clients/versions if enabled.
    (#18722)
  - Stabilise support for delegating authentication to Matrix
    Authentication Service. (#18759)
  - Implement the push rules for experimental MSC4306: Thread
    Subscriptions. (#18762)
  - Bugfixes
  - Fix bug introduced in 1.135.2 and 1.136.0rc2 where the Make
    Room Admin API would not treat a room v12's creator power
    level as the highest in room. (#18805)
  - Update MSC4293 redaction logic for room v12. (#80)
  - Allow return code 403 (allowed by C2S Spec since v1.2) when
    fetching profiles via federation. (#18696)
  - Register the MSC4306 (Thread Subscriptions) endpoints in the
    CS API when the experimental feature is enabled. (#18726)
  - Fix a long-standing bug where suspended users could not have
    server notices sent to them (a 403 was returned to the
    admin). (#18750)
  - Fix an issue that could cause logcontexts to be lost on
    rate-limited requests. Found by @realtyem. (#18763)
  - Fix invalidation of storage cache that was broken in 1.135.0.
    (#18786)
  - Improved Documentation
  - Minor improvements to README. (#18700)
  - Document that there can be multiple workers handling the
    receipts stream. (#18760)
  - Improve worker documentation for some device paths. (#18761)
  - Deprecations and Removals
  - Deprecate run_as_background_process exported as part of the
    module API interface in favor of
    ModuleApi.run_as_background_process. See the relevant section
    in the upgrade notes for more information. (#18737)
  - Internal Changes
  - Add a parameter to upgrade_rooms(..) to allow auto join local
    users. (#82)
  - Add debug logging for HMAC digest verification failures when
    using the admin API to register users. (#18474)
  - Speed up upgrading a room with large numbers of banned users.
    (#18574)
  - Fix config documentation generation script on Windows by
    enforcing UTF-8. (#18580)
  - Refactor cache, background process, Counter, LaterGauge,
    GaugeBucketCollector, Histogram, and Gauge metrics to be
    homeserver-scoped. (#18656, #18714, #18715, #18724, #18753,
    [#18725], #18670, #18748, #18751)
  - Reduce database usage in Sliding Sync by not querying for
    background update completion after the update is known to be
    complete. (#18718)
  - Improve order of validation and ratelimiting in room
    creation. (#18723)
  - Bump minimum version bound on Twisted to 21.2.0. (#18727,
    [#18729])
  - Use twisted.internet.testing module in tests instead of
    deprecated twisted.test.proto_helpers. (#18728)
  - Remove obsolete /send_event replication endpoint. (#18730)
  - Update metrics linting to be able to handle custom metrics.
    (#18733)
  - Work around twisted.protocols.amp.TooLong error by reducing
    logging in some tests. (#18736)
  - Prevent "Move labelled issues to correct projects" GitHub
    Actions workflow from failing when an issue is already on the
    project board. (#18755)
  - Bump minimum supported Rust version (MSRV) to 1.82.0. Missed
    in #18553 (released in Synapse 1.134.0). (#18757)
  - Make Clock.sleep(...) return a coroutine, so that mypy can
    catch places where we don't await on it. (#18772)
  - Update implementation of MSC4306: Thread Subscriptions to
    include automatic subscription conflict prevention as
    introduced in later drafts. (#18756)
  - Updates to locked dependencies
  - Bump gitpython from 3.1.44 to 3.1.45. (#18743)
  - Bump mypy-zope from 1.0.12 to 1.0.13. (#18744)
  - Bump phonenumbers from 9.0.9 to 9.0.10. (#18741)
  - Bump ruff from 0.12.4 to 0.12.5. (#18742)
  - Bump sentry-sdk from 2.32.0 to 2.33.2. (#18745)
  - Bump tokio from 1.46.1 to 1.47.0. (#18740)
  - Bump types-jsonschema from 4.24.0.20250708 to
    4.25.0.20250720. (#18703)
  - Bump types-psycopg2 from 2.9.21.20250516 to 2.9.21.20250718.
    (#18706)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1756209600">- Update to 1.137.0
  - Bugfixes
  - Fix a bug which could corrupt auth chains making it
    impossible to perform state resolution. (#18746)
  - Fix error message in register_new_matrix_user utility script
    for empty registration_shared_secret. (#18780)
  - Allow enabling MSC4108 when the stable Matrix Authentication
    Service integration is enabled. (#18832)
  - Improved Documentation
  - Include IPv6 networks in denied-peer-ips of coturn setup.
    Contributed by @litetex. (#18781)
  - Internal Changes
  - Update tests to ensure all database tables are emptied when
    purging a room. (#18794)
  - Instrument the encode_response part of Sliding Sync requests
    for more complete traces in Jaeger. (#18815)
  - Tag Sliding Sync traces when we wait_for_events. (#18816)
  - Fix portdb CI by hardcoding the new pg_dump restrict key that
    was added due to CVE-2025-8714. (#18824)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    5b1a254a3546aef88e0a7724a77a623fa2e47c36 to
    0c37450c4be3b6a7582b2fb013c9ebfd9c8e9300. (#18557)
  - Bump actions/cache from 4.2.3 to 4.2.4. (#18799)
  - Bump actions/checkout from 4.2.2 to 4.3.0. (#18800)
  - Bump actions/download-artifact from 4.3.0 to 5.0.0. (#18801)
  - Bump docker/metadata-action from 5.7.0 to 5.8.0. (#18773)
  - Bump mypy from 1.16.1 to 1.17.1. (#18775)
  - Bump phonenumbers from 9.0.10 to 9.0.11. (#18797)
  - Bump pygithub from 2.6.1 to 2.7.0. (#18779)
  - Bump serde_json from 1.0.141 to 1.0.142. (#18776)
  - Bump slab from 0.4.10 to 0.4.11. (#18809)
  - Bump tokio from 1.47.0 to 1.47.1. (#18774)
  - Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250809.
    (#18798)
  - Bump types-setuptools from 80.9.0.20250529 to
    80.9.0.20250809. (#18796)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1757419200">- Update to 1.138.0
  - Features
  - Support for the stable endpoint and scopes of MSC3861 &amp; co.
    (#18549)
  - Bugfixes
  - Improve database performance of MSC4293 - Redact on Kick/Ban.
    (#18851)
  - Do not throw an error when fetching a rejected delayed state
    event on startup. (#18858)
  - Improved Documentation
  - Fix worker documentation incorrectly indicating all room
    Admin API requests were capable of being handled by workers.
    (#18853)
  - Internal Changes
  - Instrument _ByteProducer with tracing to measure potential
    dead time while writing bytes to the request. (#18804)
  - Switch to OpenTracing's ContextVarsScopeManager instead of
    our own custom LogContextScopeManager. (#18849)
  - Trace how much work is being done while "recursively fetching
    redactions". (#18854)
  - Link upstream Twisted bug tracking the problem that explains
    why we have to use a Producer to write bytes to the request.
    (#18855)
  - Introduce EventPersistencePair type. (#18857)
  - Updates to locked dependencies
  - Bump actions/add-to-project from
    c0c5949b017d0d4a39f7ba888255881bdac2a823 to
    4515659e2b458b27365e167605ac44f219494b66. (#18863)
  - Bump actions/checkout from 4.3.0 to 5.0.0. (#18834)
  - Bump anyhow from 1.0.98 to 1.0.99. (#18841)
  - Bump docker/login-action from 3.4.0 to 3.5.0. (#18835)
  - Bump dtolnay/rust-toolchain from
    b3b07ba8b418998c39fb20f53e8b695cdcc8de1b to
    e97e2d8cc328f1b50210efc529dca0028893a2d9. (#18862)
  - Bump phonenumbers from 9.0.11 to 9.0.12. (#18837)
  - Bump regex from 1.11.1 to 1.11.2. (#18864)
  - Bump reqwest from 0.12.22 to 0.12.23. (#18842)
  - Bump ruff from 0.12.7 to 0.12.10. (#18865)
  - Bump serde_json from 1.0.142 to 1.0.143. (#18866)
  - Bump types-bleach from 6.2.0.20250514 to 6.2.0.20250809.
    (#18838)
  - Bump types-jsonschema from 4.25.0.20250720 to
    4.25.1.20250822. (#18867)
  - Bump types-psycopg2 from 2.9.21.20250718 to 2.9.21.20250809.
    (#18836)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1758715200">- Update to 1.138.2
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759320000">- Update to 1.139.0
  /register requests from old application service implementations
  may break when using MAS
  If you are using Matrix Authentication Service (MAS), as of this
  release any Application Services that do not set
  inhibit_login=true when calling POST /_matrix/client/v3/register
  will receive the error
  IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED in response.
  Please see the upgrade notes for more information.
  https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas
  - Features
  - Add experimental support for MSC4308: Thread Subscriptions
    extension to Sliding Sync when MSC4306: Thread Subscriptions
    and MSC4186: Simplified Sliding Sync are enabled. (#18695)
  - Update push rules for experimental MSC4306: Thread
    Subscriptions to follow a newer draft. (#18846)
  - Add get_media_upload_limits_for_user and
    on_media_upload_limit_exceeded module API callbacks to the
    media repository. (#18848)
  - Support MSC4169 for backwards-compatible redaction sending
    using the /send endpoint. Contributed by @SpiritCroc @
    Beeper. (#18898)
  - Add an in-memory cache to
    _get_e2e_cross_signing_signatures_for_devices to reduce DB
    load. (#18899)
  - Update MSC4190 support to return correct errors and allow
    appservices to reset cross-signing keys without
    user-interactive authentication. Contributed by @tulir @
    Beeper. (#18946)
  - Bugfixes
  - Fix a bug introduced in 1.139.0rc1 where
    `run_coroutine_in_background(...)` incorrectly handling
    logcontext (#18964)
  - Ensure all PDUs sent via /send pass canonical JSON checks.
    (#18641)
  - Fix bug where we did not send invite revocations over
    federation. (#18823)
  - Fix prefixed support for MSC4133. (#18875)
  - Fix open redirect in legacy SSO flow with the idp query
    parameter. (#18909)
  - Fix a performance regression related to the experimental
    Delayed Events (MSC4140) feature. (#18926)
  - Updates to the Docker image
  - Suppress "Applying schema" log noise bulk when
    SYNAPSE_LOG_TESTING is set. (#18878)
  - Improved Documentation
  - Clarify Python dependency constraints in our deprecation
    policy. (#18856)
  - Clarify necessary jwt_config parameter in OIDC documentation
    for authentik. Contributed by @maxkratz. (#18931)
  - Deprecations and Removals
  - Remove obsolete and experimental /sync/e2ee endpoint.
    (#18583)
  - Internal Changes
  - Fix LaterGauge metrics to collect from all servers. (#18791)
  - Configure Synapse to run MSC4306: Thread Subscriptions
    Complement tests. (#18819)
  - Remove sentinel logcontext usage where we log in setup, start
    and exit. (#18870)
  - Use the Enum's value for the dictionary key when responding
    to an admin request for experimental features. (#18874)
  - Start background tasks after we fork the process (daemonize).
    (#18886)
  - Better explain how we manage the logcontext in
    run_in_background(...) and run_as_background_process(...).
    (#18900, #18906)
  - Remove sentinel logcontext usage in Clock utilities like
    looping_call and call_later. (#18907)
  - Replace usages of the deprecated pkg_resources interface in
    preparation of setuptools dropping it soon. (#18910)
  - Split loading config from homeserver setup. (#18933)
  - Fix run_in_background not being awaited properly in some
    tests causing LoggingContext problems. (#18937)
  - Fix run_as_background_process not being awaited properly
    causing LoggingContext problems in experimental MSC4140:
    Delayed events implementation. (#18938)
  - Introduce Clock.call_when_running(...) to wrap startup code
    in a logcontext, ensuring we can identify which server
    generated the logs. (#18944)
  - Introduce Clock.add_system_event_trigger(...) to wrap system
    event callback code in a logcontext, ensuring we can identify
    which server generated the logs. (#18945)
  - Updates to locked dependencies
  - Bump actions/setup-go from 5.5.0 to 6.0.0. (#18891)
  - Bump actions/setup-python from 5.6.0 to 6.0.0. (#18890)
  - Bump authlib from 1.6.1 to 1.6.3. (#18921)
  - Bump jsonschema from 4.25.0 to 4.25.1. (#18897)
  - Bump log from 0.4.27 to 0.4.28. (#18892)
  - Bump phonenumbers from 9.0.12 to 9.0.13. (#18893)
  - Bump pydantic from 2.11.7 to 2.11.9. (#18922)
  - Bump serde from 1.0.219 to 1.0.223. (#18920)
  - Bump serde_json from 1.0.143 to 1.0.145. (#18919)
  - Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. (#18917)
  - Bump towncrier from 24.8.0 to 25.8.0. (#18894)
  - Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915.
    (#18918)
  - Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809.
    (#18895)
  - Bump types-setuptools from 80.9.0.20250809 to
    80.9.0.20250822. (#18924)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838400">- Update to 1.139.1 (boo#1251231)
  - Security Fixes
  - Fix CVE-2025-61672 / GHSA-fh66-fcv5-jjfr. Lack of validation
    for device keys in Synapse before 1.139.1 allows an attacker
    registered on the victim homeserver to degrade federation
    functionality, unpredictably breaking outbound federation to
    other homeservers. (#17097)
  - Deprecations and Removals
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. This change allows unit
    tests to pass following the security patch above. (#18996)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1759838401">- Update to 1.139.2
  - Fix a bug introduced in 1.139.1 where a client could receive an
    Internal Server Error if they set device_keys: null in the
    request to POST /_matrix/client/v3/keys/upload. (#19023)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1760443200">- Update to 1.140.0
  - Compatibility notice for users of synapse-s3-storage-provider
  - Deployments that make use of the synapse-s3-storage-provider
    module must upgrade to v1.6.0. Using older versions of the
    module with this release of Synapse will prevent users from
    being able to upload or download media.
  - Features
  - Add a new Media Query by ID Admin API that allows server
    admins to query and investigate the metadata of local or
    cached remote media via
  - the origin/media_id identifier found in a Matrix Content URI.
    (#18911)
  - Add a new Fetch Event Admin API to fetch an event by ID.
    (#18963)
  - Update MSC4284: Policy Servers implementation to support
    signatures when available. (#18934)
  - Add experimental implementation of the GET
    /_matrix/client/v1/rtc/transports endpoint for the latest
    draft of MSC4143: MatrixRTC. (#18967)
  - Expose a defer_to_threadpool function in the Synapse Module
    API that allows modules to run a function on a separate
    thread in a custom threadpool. (#19032)
  - Bugfixes
  - Fix room upgrade room_config argument and documentation for
    user_may_create_room spam-checker callback. (#18721)
  - Compute a user's last seen timestamp from their devices' last
    seen timestamps instead of IPs, because the latter are
    automatically cleared according to user_ips_max_age. (#18948)
  - Fix bug where ephemeral events were not filtered by room ID.
    Contributed by @frastefanini. (#19002)
  - Update Synapse main process version string to include git
    info. (#19011)
  - Improved Documentation
  - Explain how Deferred callbacks interact with logcontexts.
    (#18914)
  - Fix documentation for rc_room_creation and rc_reports to
    clarify that a per_user rate limit is not supported. (#18998)
  - Deprecations and Removals
  - Remove deprecated
    LoggingContext.set_current_context/LoggingContext.current_context
    methods which already have equivalent bare methods in
    synapse.logging.context. (#18989)
  - Drop support for unstable field names from the long-accepted
    MSC2732 (Olm fallback keys) proposal. (#18996)
  - Internal Changes
  - Cleanly shutdown SynapseHomeServer object, allowing artifacts
    of embedded small hosts to be properly garbage collected.
    (#18828)
  - Update OEmbed providers to use 'X' instead of 'Twitter' in
    URL previews, following a rebrand. Contributed by
    @HammyHavoc. (#18767)
  - Fix server_name in logging context for multiple Synapse
    instances in one process. (#18868)
  - Wrap the Rust HTTP client with make_deferred_yieldable so it
    follows Synapse logcontext rules. (#18903)
  - Fix the GitHub Actions workflow that moves issues labeled
    "X-Needs-Info" to the "Needs info" column on the team's
    internal triage board. (#18913)
  - Disconnect background process work from request trace.
    (#18932)
  - Reduce overall number of calls to
    _get_e2e_cross_signing_signatures_for_devices by increasing
    the batch size of devices the query is called with, reducing
    DB load. (#18939)
  - Update error code used when an appservice tries to masquerade
    as an unknown device using MSC4326. Contributed by @tulir @
    Beeper. (#18947)
  - Fix no active span when trying to log tracing error on
    startup (when OpenTracing is enabled). (#18959)
  - Fix run_coroutine_in_background(...) incorrectly handling
    logcontext. (#18964)
  - Add debug logs wherever we change current logcontext.
    (#18966)
  - Update dockerfile metadata to fix broken link; point to
    documentation website. (#18971)
  - Note that the code is additionally licensed under the Element
    Commercial license in SPDX expression field configs. (#18973)
  - Fix logcontext handling in timeout_deferred tests. (#18974)
  - Remove internal ReplicationUploadKeysForUserRestServlet as a
    follow-up to the work in #18581 that moved device changes off
    the main process. (#18988)
  - Switch task scheduler from raw logcontext manipulation to
    using the dedicated logcontext utils. (#18990)
  - Remove MockClock() in tests. (#18992)
  - Switch back to our own custom LogContextScopeManager instead
    of OpenTracing's ContextVarsScopeManager which was causing
    problems when using the experimental SYNAPSE_ASYNC_IO_REACTOR
    option with tracing enabled. (#19007)
  - Remove version_string argument from HomeServer since it's
    always the same. (#19012)
  - Remove duplicate call to hs.start_background_tasks()
    introduced from a bad merge. (#19013)
  - Split homeserver creation (create_homeserver) and setup
    (setup). (#19015)
  - Swap near-end-of-life macos-13 GitHub Actions runner for the
    macos-15-intel variant. (#19025)
  - Introduce RootConfig.validate_config() which can be
    subclassed in HomeServerConfig to do cross-config class
    validation. (#19027)
  - Allow any command of the release.py script to accept a
  - -gh-token argument. (#19035)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. (#18949)
  - Bump actions/cache from 4.2.4 to 4.3.0. (#18983)
  - Bump anyhow from 1.0.99 to 1.0.100. (#18950)
  - Bump authlib from 1.6.3 to 1.6.4. (#18957)
  - Bump authlib from 1.6.4 to 1.6.5. (#19019)
  - Bump bcrypt from 4.3.0 to 5.0.0. (#18984)
  - Bump docker/login-action from 3.5.0 to 3.6.0. (#18978)
  - Bump lxml from 6.0.0 to 6.0.2. (#18979)
  - Bump phonenumbers from 9.0.13 to 9.0.14. (#18954)
  - Bump phonenumbers from 9.0.14 to 9.0.15. (#18991)
  - Bump prometheus-client from 0.22.1 to 0.23.1. (#19016)
  - Bump pydantic from 2.11.9 to 2.11.10. (#19017)
  - Bump pygithub from 2.7.0 to 2.8.1. (#18952)
  - Bump regex from 1.11.2 to 1.11.3. (#18981)
  - Bump serde from 1.0.224 to 1.0.226. (#18953)
  - Bump serde from 1.0.226 to 1.0.228. (#18982)
  - Bump setuptools-rust from 1.11.1 to 1.12.0. (#18980)
  - Bump twine from 6.1.0 to 6.2.0. (#18985)
  - Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915.
    (#19018)
  - Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913.
    (#18951)
  - Bump typing-extensions from 4.14.1 to 4.15.0. (#18956)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1761739200">- Update to 1.141.0
  - Features
  - Allow using MSC4190 behavior without the opt-in registration
    flag. Contributed by @tulir @ Beeper. (#19031)
  - Stabilize support for MSC4326: Device masquerading for
    appservices. Contributed by @tulir @ Beeper. (#19033)
  - Bugfixes
  - Fix users being unable to log in if their password, or the
    server's configured pepper, was too long. (#19101)
  - Fix a bug introduced in 1.136.0 that would prevent Synapse
    from being able to be reload-ed more than once when running
    under systemd. (#19060)
  - Fix a bug introduced in 1.140.0 where an internal server
    error could be raised when hashing user passwords that are
    too long. (#19078)
  - Updates to the Docker image
  - Update docker image to use Debian trixie as the base and thus
    Python 3.13. (#19064)
  - Internal Changes
  - Move unique snowflake homeserver background tasks to
    start_background_tasks (the standard pattern for this kind of
    thing). (#19037)
  - Drop a deprecated field of the PyGitHub dependency in the
    release script and raise the dependency's minimum version to
    1.59.0. (#19039)
  - Update TODO list of conflicting areas where we encounter
    metrics being clobbered (ApplicationService). (#19040)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1762862400">- Update to 1.142.0
  - Features
  - Add support for Python 3.14. (#19055, #19134)
  - Add an Admin API
  - to allow an admin to fetch the space/room hierarchy for a
    given space. (#19021)
  - Bugfixes
  - Fix a bug introduced in 1.142.0rc1 where any attempt to
    configure matrix_authentication_service.secret_path would
    prevent the homeserver from starting up. (#19144)
  - Fix a bug introduced in 1.111.0 where failed attempts to
    download authenticated remote media would not be handled
    correctly. (#19062)
  - Update the oidc_session_no_samesite cookie to have the Secure
    attribute, so the only difference between it and the paired
    oidc_session cookie, is the configuration of the SameSite
    attribute as described in the comments / cookie names.
    Contributed by @kieranlane. (#19079)
  - Fix a bug introduced in 1.140.0 where lost logcontext
    warnings would be emitted from timeouts in sync and requests
    made by Synapse itself. (#19090)
  - Fix a bug introdued in 1.140.0 where lost logcontext warning
    were emitted when using HomeServer.shutdown(). (#19108)
  - Improved Documentation
  - Update the link to the Debian oldstable package for SQLite.
    (#19047)
  - Point out additional Redis configuration options available in
    the worker docs. Contributed by @servisbryce. (#19073)
  - Update the list of Debian releases that the downstream Debian
    package is maintained for. (#19100)
  - Add a page to the documentation describing the steps the
    Synapse team takes to review the release notes before
    publishing them. (#19109)
  - Deprecations and Removals
  - Drop support for Python 3.9. (#19099)
  - Remove support for SQLite &lt; 3.37.2. (#19047)
  - Internal Changes
  - Properly stop building wheels for Python 3.9 and
    free-threaded CPython. (#19154)
  - Update release scripts to prevent building wheels for
    free-threaded Python, as Synapse does not currently support
    it. (#19140)
  - Manually skip building Python 3.9 wheels, to prevent errors
    in the release workflow. (#19119)
  - Fix CI linter for schema delta files to correctly handle all
    types of CREATE TABLE syntax. (#19020)
  - Use type hinting generics in standard collections, as per PEP
    585, added in Python 3.9. (#19046)
  - Always treat RETURNING as supported by SQL engines, now that
    the minimum-supported versions of both SQLite and PostgreSQL
    support it. (#19047)
  - Move oidc.load_metadata() startup into _base.start().
    (#19056)
  - Remove logcontext problems caused by awaiting raw
    deferLater(...). (#19058)
  - Prevent duplicate logging setup when running multiple Synapse
    instances. (#19067)
  - Be mindful of other logging context filters in 3rd-party code
    and avoid overwriting log record fields unless we know the
    log record is relevant to Synapse. (#19068)
  - Update pydantic to v2. (#19071)
  - Update deprecated code in the release script to prevent a
    warning message from being printed. (#19080)
  - Update the deprecated poetry development dependencies group
    name in pyproject.toml. (#19081)
  - Remove pp38* skip selector from cibuildwheel to silence
    warning. (#19085)
  - Don't immediately exit the release script if the checkout is
    dirty. Instead, allow the user to clear the dirty changes and
    retry. (#19088)
  - Update the release script's generated announcement text to
    include a title and extra text for RC's. (#19089)
  - Fix lints on main branch. (#19092)
  - Use cheaper random string function in logcontext utilities.
    (#19094)
  - Avoid clobbering other SIGHUP handlers in 3rd-party code.
    (#19095)
  - Prevent duplicate GitHub draft releases being created during
    the Synapse release process. (#19096)
  - Use Pillow's Image.getexif method instead of the experimental
    Image._getexif. (#19098)
  - Prevent uv /usr/local/.lock file from appearing in built
    Synapse docker images. (#19107)
  - Allow Synapse's runtime dependency checking code to take
    packaging markers (i.e. python &lt;= 3.14) into account when
    checking dependencies. (#19110)
  - Move exception handling up the stack (avoid exit(1) in our
    composable functions). (#19116)
  - Fix a lint error related to lifetimes in Rust 1.90. (#19118)
  - Refactor and align app entrypoints (avoid exit(1) in our
    composable functions). (#19121, #19131)
  - Speed up pruning of ratelimiters. (#19129)
  - Updates to locked dependencies
  - Bump actions/download-artifact from 5.0.0 to 6.0.0. (#19102)
  - Bump actions/upload-artifact from 4 to 5. (#19106)
  - Bump hiredis from 3.2.1 to 3.3.0. (#19103)
  - Bump icu_segmenter from 2.0.0 to 2.0.1. (#19126)
  - Bump idna from 3.10 to 3.11. (#19053)
  - Bump ijson from 3.4.0 to 3.4.0.post0. (#19051)
  - Bump markdown-it-py from 3.0.0 to 4.0.0. (#19123)
  - Bump msgpack from 1.1.1 to 1.1.2. (#19050)
  - Bump psycopg2 from 2.9.10 to 2.9.11. (#19125)
  - Bump pyyaml from 6.0.2 to 6.0.3. (#19105)
  - Bump regex from 1.11.3 to 1.12.2. (#19074)jjjjjjjjj
  - Bump reqwest from 0.12.23 to 0.12.24. (#19077)
  - Bump ruff from 0.12.10 to 0.14.3. (#19124)
  - Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. (#19075)
  - Bump stefanzweifel/git-auto-commit-action from 6.0.1 to
    7.0.0. (#19052)
  - Bump tokio from 1.47.1 to 1.48.0. (#19076)
  - Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012.
    (#19054)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1763467200">- Update to 1.142.1
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764072000">- Update to 1.143.0
  In line with our deprecation policy, we've dropped support for
  PostgreSQL 13, as it is no longer supported upstream. This
  release of Synapse requires PostgreSQL 14+.
  - Features
  - Support multiple config files in register_new_matrix_user.
    (#18784)
  - Remove authentication from POST
    /_matrix/client/v1/delayed_events, and allow calling this
    endpoint with the update action to take (send/cancel/restart)
    in the request path instead of the body. (#19152)
  - Bugfixes
  - Fixed a longstanding bug where background updates were only
    run on the main database. (#19181)
  - Fixed a bug introduced in v1.142.0 preventing subpaths in MAS
    endpoints from working. (#19186)
  - Fix the SQLite-to-PostgreSQL migration script to correctly
    migrate a boolean column in the delayed_events table.
    (#19155)
  - Improved Documentation
  - Improve documentation around streams, particularly ID
    generators and adding new streams. (#18943)
  - Deprecations and Removals
  - Remove support for PostgreSQL 13. (#19170)
  - Internal Changes
  - Fixes docker image creation in the release workflow.
  - Provide additional servers with federation room directory
    results. (#18970)
  - Add a shortcut return when there are no events to purge.
    (#19093)
  - Write union types as X | Y where possible, as per PEP 604,
    added in Python 3.10. (#19111)
  - Reduce cardinality of
    synapse_storage_events_persisted_events_sep_total metric by
    removing origin_entity label. This also separates out events
    sent by local application services by changing the
    origin_type for such events to application_service. The type
    field also only tracks common event types, and anything else
    is bucketed under *other*. (#19133, #19168)
  - Run trial tests on Python 3.14 for PRs. (#19135)
  - Update pyproject.toml project metadata to be compatible with
    standard Python packaging tooling. (#19137)
  - Minor speed up of processing of inbound replication. (#19138,
    [#19145], #19146)
  - Ignore recent Python language refactors from git blame
    (.git-blame-ignore-revs). (#19150)
  - Bump lower bounds of dependencies parameterized to 0.9.0 and
    idna to 3.3 as those are the first to advertise support for
    Python 3.10. (#19167)
  - Point out which event caused the exception when checking
    MSC4293 redactions. (#19169)
  - Restore printing sentinel for the log record request when no
    logcontext is active. (#19172)
  - Add debug logs to track Clock utilities. (#19173)
  - Remove explicit python version skips in cibuildwheel config
    as it's no longer required after #19137. (#19177)
  - Fix potential lost logcontext when
    PerDestinationQueue.shutdown(...) is called. (#19178)
  - Fix bad deferred logcontext handling across the codebase.
    (#19180)
  - Updates to locked dependencies
  - Bump bytes from 1.10.1 to 1.11.0. (#19193)
  - Bump click from 8.1.8 to 8.3.1. (#19195)
  - Bump cryptography from 43.0.3 to 45.0.7. (#19159)
  - Bump docker/metadata-action from 5.8.0 to 5.9.0. (#19161)
  - Bump pydantic from 2.12.3 to 2.12.4. (#19158)
  - Bump pyo3-log from 0.13.1 to 0.13.2. (#19156)
  - Bump ruff from 0.14.3 to 0.14.5. (#19196)
  - Bump sentry-sdk from 2.34.1 to 2.43.0. (#19157)
  - Bump sentry-sdk from 2.43.0 to 2.44.0. (#19197)
  - Bump tomli from 2.2.1 to 2.3.0. (#19194)
  - Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108.
    (#19160)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1765281600">- Update to 1.144.0
  Admins using the unstable MSC2666 endpoint
  (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms),
  please check the relevant section in the upgrade notes as this
  release contains changes that disable that endpoint by default.
  - Features
  - Add experimentatal implememntation of MSC4380 (invite
    blocking). (#19203)
  - Allow restarting delayed event timeouts on workers. (#19207)
  - Bugfixes
  - Fix a bug in the database function for fetching state deltas
    that could result in unnecessarily long query times. (#18960)
  - Fix v12 rooms when running with use_frozen_dicts: True.
    (#19235)
  - Fix bug where invalid canonical_alias content would return
    500 instead of 400. (#19240)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Improved Documentation
  - Document in the --config-path help how multiple files are
    merged - by merging them shallowly. (#19243)
  - Deprecations and Removals
  - Stop building release wheels for MacOS. (#19225)
  - Internal Changes
  - Improve event filtering for Simplified Sliding Sync. (#17782)
  - Export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES environment
    variable from scripts-dev/complement.sh. (#19208)
  - Refactor scripts-dev/complement.sh logic to avoid exit to
    facilitate being able to source it from other scripts
    (composable). (#19209)
  - Expire sliding sync connections that are too old or have too
    much pending data. (#19211)
  - Require an experimental feature flag to be enabled in order
    for the unstable MSC2666 endpoint
    (/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms)
    to be available. (#19219)
  - Prevent changelog check CI running on @dependabot's PRs even
    when a human has modified the branch. (#19220)
  - Auto-fix trailing spaces in multi-line strings and comments
    when running the lint script. (#19221)
  - Move towards using a dedicated Duration type. (#19223,
    [#19229])
  - Improve robustness of the SQL schema linting in CI. (#19224)
  - Add log to determine whether clients are using /messages as
    expected. (#19226)
  - Simplify README and add ESS Getting started section. (#19228,
    [#19259])
  - Add a unit test for ensuring associated refresh tokens are
    erased when a device is deleted. (#19230)
  - Prompt user to consider adding future deprecations to the
    changelog in release script. (#19239)
  - Fix check of the Rust compiled code being outdated when using
    source checkout and .egg-info. (#19251)
  - Stop building macos wheels in CI pipeline. (#19263)
  - Updates to locked dependencies
  - Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. (#19244)
  - Bump actions/checkout from 5.0.0 to 6.0.0. (#19213)
  - Bump actions/setup-go from 6.0.0 to 6.1.0. (#19214)
  - Bump actions/setup-python from 6.0.0 to 6.1.0. (#19245)
  - Bump attrs from 25.3.0 to 25.4.0. (#19215)
  - Bump docker/metadata-action from 5.9.0 to 5.10.0. (#19246)
  - Bump http from 1.3.1 to 1.4.0. (#19249)
  - Bump pydantic from 2.12.4 to 2.12.5. (#19250)
  - Bump pyopenssl from 25.1.0 to 25.3.0. (#19248)
  - Bump rpds-py from 0.28.0 to 0.29.0. (#19216)
  - Bump rpds-py from 0.29.0 to 0.30.0. (#19247)
  - Bump sentry-sdk from 2.44.0 to 2.46.0. (#19218)
  - Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115.
    (#19217)
  - Bump types-jsonschema from 4.25.1.20250822 to
    4.25.1.20251009. (#19252)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1768305600">- Update to 1.145.0
  - Features
  - Add memberships endpoint to the admin API. This is useful for
    forensics and T&amp;S purpose. (#19260)
  - Server admins can bypass the quarantine media check when
    downloading media by setting the
    admin_unsafely_bypass_quarantine query parameter to true on
    Client-Server API media download requests. (#19275)
  - Implemented pagination for the MSC2666 mutual rooms endpoint.
    Contributed by @tulir @ Beeper. (#19279)
  - Admin API: add worker support to GET
    /_synapse/admin/v2/users/&lt;user_id&gt;. (#19281)
  - Improve proxy support for the federation_client.py dev
    script. Contributed by Denis Kasak (@dkasak). (#19300)
  - Bugfixes
  - Fix sliding sync performance slow down for long lived
    connections. (#19206)
  - Fix a bug where Mastodon posts (and possibly other embeds)
    have the wrong description for URL previews. (#19231)
  - Fix bug where Duration was logged incorrectly. (#19267)
  - Fix bug introduced in 1.143.0 that broke support for versions
    of zope-interface older than 6.2. (#19274)
  - Transform events with client metadata before serialising in
    /event response. (#19340)
  - Updates to the Docker image
  - Add a way to expose metrics from the Docker image
    (SYNAPSE_ENABLE_METRICS). (#19324)
  - Improved Documentation
  - Document the importance of public_baseurl when configuring
    OpenID Connect authentication. (#19270)
  - Deprecations and Removals
  - Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17,
    2026. Synapse will stop building packages for Ubuntu 25.04
    shortly thereafter.
  - Remove the "Updates to locked dependencies" section from the
    changelog due to lack of use and the maintenance burden.
    (#19254)
  - Internal Changes
  - Group together dependabot update PRs to reduce the review
    load. (#18402)
  - Fix HomeServer.shutdown() failing if the homeserver hasn't
    been setup yet. (#19187)
  - Respond with useful error codes with Content-Length header/s
    are invalid. (#19212)
  - Fix HomeServer.shutdown() failing if the homeserver failed to
    start. (#19232)
  - Switch the build backend from poetry-core to maturin.
    (#19234)
  - Raise the limit for concurrently-open non-security
    @dependabot PRs from 5 to 10. (#19253)
  - Require 14 days to pass before pulling in general dependency
    updates to help mitigate upstream supply chain attacks.
    (#19258)
  - Drop the broken netlify documentation workflow until a new
    one is implemented. (#19262)
  - Don't include debug logs in Clock unless explicitly enabled.
    (#19278)
  - Use uv to test olddeps to ensure all transitive dependencies
    use minimum versions. (#19289)
  - Add a config to be able to rate limit search in the user
    directory. (#19291)
  - Log the original bind exception when encountering Failed to
    listen on 0.0.0.0, continuing because listening on [::].
    (#19297)
  - Unpin the version of Rust we use to build Synapse wheels (was
    1.82.0) now that MacOS support has been dropped. (#19302)
  - Make it more clear how shared_extra_conf is combined in our
    Docker configuration scripts. (#19323)
  - Update CI to stream Complement progress and format logs in a
    separate step after all tests are done. (#19326)
  - Format .github/workflows/tests.yml. (#19327)
- refresh matrix-synapse-1.4.1-paths.patch
- manually install the shared library with the rust code. the new
  installer does not handle it yet.
- patch out the runtime dependency for setuptools-rust</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769515200">- Update to 1.146.0
  - Deprecations and Removals
  - MSC2697 (Dehydrated devices) has been removed, as the MSC is
    closed. Developers should migrate to MSC3814. (#19346)
  - Support for Ubuntu 25.04 (Plucky Puffin) has been dropped.
    Synapse no longer builds debian packages for Ubuntu 25.04.
  - Features
  - Add a new config option enable_local_media_storage which
    controls whether media is additionally stored locally when
    using configured media_storage_providers. Setting this to
    false allows off-site media storage without a local cache.
    Contributed by Patrice Brend'amour @dr.allgood. (#19204)
  - Stabilise support for MSC4312's m.oauth User-Interactive Auth
    stage for resetting cross-signing identity with the OAuth 2.0
    API. The old, unstable name (org.matrix.cross_signing_reset)
    is now deprecated and will be removed in a future release.
    (#19273)
  - Refactor Grafana dashboard to use server_name label (instead
    of instance). (#19337)
  - Bugfixes
  - Fix joining a restricted v12 room locally when no local room
    creator is present but local users with sufficient power
    levels are. Contributed by @nexy7574. (#19321)
  - Fixed parallel calls to /_matrix/media/v1/create being
    ratelimited for appservices even if rate_limited: false was
    set in the registration. Contributed by @tulir @ Beeper.
    (#19335)
  - Fix a bug introduced in 1.61.0 where a user's membership in a
    room was accidentally ignored when considering access to
    historical state events in rooms with the "shared" history
    visibility. Contributed by Lukas Tautz. (#19353)
  - MSC4140: Store the JSON content of scheduled delayed events
    as text instead of a byte array. This fixes the inability to
    schedule a delayed event with non-ASCII characters in its
    content. (#19360)
  - Always rollback database transactions when retrying (avoid
    orphaned connections). (#19372)
  - Fix InFlightGauge typing to allow upgrading to
    prometheus_client 0.24. (#19379)
  - Updates to the Docker image
  - Add Prometheus HTTP service discovery endpoint for easy
    discovery of all workers when using the
    docker/Dockerfile-workers image (see the Metrics section of
    our Docker testing docs). (#19336)
  - Improved Documentation
  - Remove docs on legacy metric names (no longer in the codebase
    since 2022-12-06). (#19341)
  - Clarify how the estimated value of room complexity is
    calculated internally. (#19384)
  - Internal Changes
  - Add an internal cancel_task API to the task scheduler.
    (#19310)
  - Tweak docstrings and signatures of auth_types_for_event and
    get_catchup_room_event_ids. (#19320)
  - Replace usage of deprecated assertEquals with assertEqual in
    unit test code. (#19345)
  - Drop support for Ubuntu 25.04 'Plucky Puffin', add support
    for Ubuntu 25.10 'Questing Quokka'. (#19348)
  - Revert "Add an Admin API endpoint for listing quarantined
    media (#19268)". (#19351)
  - Bump mdbook from 0.4.17 to 0.5.2 and remove our custom
    table-of-contents plugin in favour of the new default
    functionality. (#19356)
  - Replace deprecated usage of PyGitHub's GitRelease.title with
    .name in release script. (#19358)
  - Update the Element logo in Synapse's README to be an absolute
    URL, allowing it to render on other sites (such as PyPI).
    (#19368)
  - Apply minor tweaks to v1.145.0 changelog. (#19376)
  - Update Grafana dashboard syntax to use the latest from
    importing/exporting with Grafana 12.3.1. (#19381)
  - Warn about skipping reactor metrics when using unknown
    reactor type. (#19383)
  - Add support for reactor metrics with the ProxiedReactor used
    in worker Complement tests. (#19385)
- Also set RUSTFLAGS to the %{build_rustflags}. This adds
  cargo-packaging.
- Import 2 patches from fedora to fix debugsymbols
  0001-pyo3-Disable-abi3-feature.patch
  0002-Build-RustExtension-with-debug-symbols.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724800">- Update to 1.147.0
  - Bugfixes
  - Fix memory leak caused by not cleaning up stopped looping
    calls. Introduced in v1.140.0. (#19416)
  - Fix a typo that incorrectly made setuptools_rust a runtime
    dependency. (#19417)
  - Internal Changes
  - Prune stale entries from
    sliding_sync_connection_required_state table. (#19306)
  - Update "Event Send Time Quantiles" graph to only use dots for
    the event persistence rate (Grafana dashboard). (#19399)
  - Update and align Grafana dashboard to use regex matching for
    job selectors (job=~"$job") so the "all" value works
    correctly across all panels. (#19400)
  - Don't retry joining partial state rooms all at once on
    startup. (#19402)
  - Disallow requests to the health endpoint from containing
    trailing path characters. (#19405)
  - Add notes that new experimental features should have
    associated tracking issues. (#19410)
  - Bump pyo3 from 0.26.0 to 0.27.2 and pythonize from 0.26.0 to
    0.27.0. Contributed by @razvp @ ERCOM. (#19412)
- refresh 0001-pyo3-Disable-abi3-feature.patch</changelog>
</package>
<package pkgid="2f74750ff4320b18a88ffb29f67aa58445467cb1e78c7f36e5dc959ff5b23644d0dcb51af3718b97e6184cb49b39b54983c7bc92df0f06d6ad59ce50e888aafa" name="postfix" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="feee7fb24ae409eaeed3cc2543671170efc6a168f2629dce0d9b04d68638071940a78869d934fd062a0d8eb944d235e120fdbdec39f986398a2bf5fe1b2b39ba" name="postfix" arch="src">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="6e07fdd96ba54f9352969f3d1972fdafb30fe9ef2ffdd80f253f2ba41d90a713e720543e376ab11617861454ff10af6c92617468fc5b59db64c8a8133bc9d0ea" name="postfix" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="d896eda61be41d195096a492c9e3b974f3fca48eb8ce3a15e9a90bc92af29c63476ecf3ba4e90ce5d5b7a2cd9082841533c14a5a2790c3de656b2cf6d8911a0d" name="postfix-bdb" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="a31ae5c240f40697ed08f66687e0c5c174d285c72f4705244acddaeea55ff4e7b657a0d4bb462c97d5ed47a24b7ced76f05d58e5c61958924b428d3abb479d74" name="postfix-bdb" arch="src">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="2d05e24e48829dafc9b33fce52a2a0ea097cd7da4ec4850fed21eabde147092fab8fd1257798d312ce00a4eb56293387795ca4d12ee6187f49e1d28b5f61502a" name="postfix-bdb" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="713f2a2286abee5ef2bedd9bafac46448ac1a8dee0d23ec4b32290dcd7728bf7c01ad15a99e975b76394c3bb68b1515bc8fdadc32d4ac16369b49532b520a2a0" name="postfix-bdb-debuginfo" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="7d98af5e260049897c7d6007798ca409b87707a85e2b2ae913d06d47d670d1c57003c92d39f2a4853d2cd78a4c9dee89f884354926b1f5b2f74db97a3cd0b66b" name="postfix-bdb-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="400db035e9d30ac2fc7bdb30e9ca90ec7eebba78892a0b432120673dc6d24fbc3ed9a6db7d940fc50eb49ed8646223701370d37641025d4a57bf7418b8a09b53" name="postfix-bdb-debugsource" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="b4bb9d476a73daf9569a5e6825b84c25b73c19c26ad618060efd799bf72bd5ea9972d760fd0e7c0ac29df342aa79848459eba86660c10bbd3807583c1f48bf5f" name="postfix-bdb-debugsource" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="aaebab65449ae1d77bd419e2f37ce96722599c8c8802c85c9fa126cfabd2cd4c61414c6fe39dd8aa86434ec5a00755aee6182d91e912f393035ed5de7567ec3d" name="postfix-bdb-lmdb" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="5d163b5570a819080199c7b02a24aaa2dd3b9fda291f9e4bb3d4e9b1ce8cce8ae1ed824214a37a6b5b0ba32e99b7b9ba1adcf849ea77a44f12cddbe67796ad9d" name="postfix-bdb-lmdb" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="f5f8e68e993d5212c86723f0ed1a482ef1a2db22a8d89029c626256202355a957cdfb4d2928f0e1519a7fc2045a607257063b649d3c840141d86b5fb8af94003" name="postfix-bdb-lmdb-debuginfo" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="c834aa762d5ec10627f2329059e838091df57cef7608bf8d4545330b84f7f248b3cea76d43e3e755089031ffefd8c64f8daf6b3a2a5ea080842fbf8961bb7a84" name="postfix-bdb-lmdb-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-bdb-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="a4f65d6bcaa6c525c2175429d12e3116d4f23f7fed80d62f69011c0cd62f69ec3adba20f48a36e87768aa82798e22e0dbe209bec7bf3f99023d5340c6cd29cb8" name="postfix-debuginfo" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="e962cf54c67b95194106bad08280b6911aced22881366301858789544d24c7bcd74fda76493df29783e963a6fef4ed6b46be8463565025a3f9e535d4d38d5bc6" name="postfix-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="c0085423971b299653477a05c065e14739730e8ad140376d380b80185f82c091022191c038c5e82e6017cb3527202275fa54c30661b7abb841d99273bb6705e5" name="postfix-debugsource" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="f51b9e210ae8c03c71a2f7978a5017fdb79028acc36e25b5279d5ec2cf37569abd32a8102b8a8b988b13d0735eb37821af637ff4826ffbd0bfccb84a52d33ebe" name="postfix-debugsource" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="e9c610e07f6db3b78646fe5b6a3d7dc063eb563179fbe2e4ce0865856bb5b90da9922094adbdb1dfbea2e9ef1bb0a0167809c94e0f31dd5d1359e18d95973da0" name="postfix-devel" arch="noarch">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="8454177a965b28141bfa772a38f07d682e581ec0139d2aeac022c374561d651cc33d2938484feb181b2ad044420d2326f0f9249b67aa783a931c9a0815956331" name="postfix-doc" arch="noarch">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="57fac55cd1b57223d176638de35111d165d748ecf4525d5c4184df7c21f18951aede3e9e91868d92f85439ad44c73d0e892bb17b55e14a4efd6719af603b26da" name="postfix-ldap" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="57b5221129f9a370006a1676f20f690e3bf65b4152aa1813081f8123f0bab54ce821eeb86e94a76cb02fd6fd68ccff32b016b9845932542a0875887c6b015361" name="postfix-ldap" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="98c24ff0b9cebb76377702586a3c7cb24efd0ebecf1e9a3a3c7ac2283a12483c1e4262f63989830464864e38a7488517a35317d1bfbd1bfcc5662dddb2a3cc6c" name="postfix-ldap-debuginfo" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="017b08eafaddae16cfddf1ee240e0be690efea8f2eb07529a9eec2c12bf5e777fbb169e03921c5964ff8c8bc67661bacebda95c78800ff463c75c327f4a3e40f" name="postfix-ldap-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="c50b6559bfe0250fcd19db26c6f9bb44430cc0fb637f3ba4a7f95681a7dd40f0fb66829fed886469048ec9f6be6487cda6d24c7557f5bc67c92c315d34396c41" name="postfix-mysql" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="c50205d16a596409b6b3b235a2946063be704e2d58808673eb2cf35c2f5844bfdd52520d8fdfd1e3ecc40733024a9777d19c9f1a901f187ea1df780a0837cd47" name="postfix-mysql" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="0a32b2cfbd43624ccec0b098d9db2e6da712709e843982b30e806c4a85eab6ce528f4d2c9f90225e974b7e9120b7002b12a518f647d9ca4ff66e5056974708d2" name="postfix-mysql-debuginfo" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="4563cc9c1a1b0bcb7406c24237c2625a81c2d0312779386b3b9b8e0be51bd99f42671df0b215c53afc55b306bf50670f47370884c1d8baff2f14fc43c8c80f12" name="postfix-mysql-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="5bc7812c3dd6a3bd788a8ae524b81264a997cb457c201dc27c2cc53fde2026896298a402c9610aa25b90f9de26f39ea35061babc6ce845b82e5d568641440761" name="postfix-postgresql" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="c32adb658ccd38cfe11452de03e76b05563cdd2d7a58257c01b5dbed385821a4e8e159697e93ffca9efc7f8f5f3df881c5e7e6519004c03cd14827080bc54c72" name="postfix-postgresql" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="9064412eaf334b552a2d527dfb8f8d218cc7cf01dc34dde92189daa9823f407ad9f4977c9ed4b2885dda9fc9615eec8e786d36ce9f2c6b608d321521eb7bde7b" name="postfix-postgresql-debuginfo" arch="i586">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="7988f2111177627bc7bad48cb693932644a76b6f8266c6944d9e892598938cb0a7a7dc1d6644d5bb82ac7df948df654fd96daaf87533fc95c6b4d019d8348056" name="postfix-postgresql-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.10.7" rel="9.1"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1745323200">- update to 3.10.2
  * Bugfix (defect introduced: date 19991116): when appending a
    setting to a main.cf or master.cf file that did not end in a
    newline character, the "postconf -e" command did not add an
    extra newline character before appending the new setting, causing
    information to become garbled.
  * Bugfix (defect introduced: Postfix 2.3, date 20051222): the
    Dovecot auth client did not attempt to create a new connection
    after an I/O error on an existing connection.
  * Improved and corrected error messages when converting (host or
    service) information to (symbolic text, numerical text, or
    binary) form.
  * Documentation: updated link to Dovecot documentation.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1746705600">- postfix incorrect logic for the master.cf handling for tls ports
  (bsc#1242822)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747742400">- move /var/spool/mail/ to separate package (bsc#1179574)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1747828800">-  [sle16][postfix] postfix service failed to start due to
  "chmod: cannot access '/etc/postfix/virtual.lmdb': No such file or directory"
  (bsc#1243409)</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1748865600">- Fix place of pam file
- [Build 20250527] postfix mail delivery fails (bsc#1243886)
- move /var/spool/mail/ to separate package (bsc#1179574)
  Revert last bad change
- Adapt rpmlint</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1754222400">- update to 3.10.3
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1755604800">- update to 3.10.4
  * Fixes for postscreen(8):
  - Bugfix (defect introduced: Postfix 2.2, date 20050203): after
    detecting a lookup table change, and after starting a new
    postscreen process, the old postscreen process logged an ENOTSOCK
    error while attempting to accept a connection on a socket that
    it was no longer listening on. This error was introduced first
    in the multi_server skeleton code, and was five years later
    duplicated in the event_server skeleton that was created for
    postscreen.
  - Bugfix (defect introduced: Postfix 2.8, date 20101230):
    after detecting a cache table change and before starting a new
    postscreen process, the old postscreen process did not close the
    postscreen_cache_map, and therefore kept an exclusive lock that
    could prevent a new postscreen process from starting.
  * Fixes for tlsproxy(8):
  - Bugfix (defect introduced: Postfix 3.7): incorrect backwards
    compatible support for the legacy configuration parameters
    tlsproxy_client_level and tlsproxy_client_policy. This
    disabled the tlsproxy TLS client role when a legacy parameter
    was set (instead of the newer tlsproxy_client_security_level
    or tlsproxy_client_policy_maps).
  - Bugfix (defect introduced: Postfix 3.4): with the TLS client role
    disabled by configuration, the tlsproxy daemon dereferenced a
    null pointer while handling a tlsproxy client request.
  * Reducing process churn: Postfix daemons no longer automatically
    restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
    modification time change, when they opened that table for writing.
  * Portability: deleted an &lt;openssl/engine.h&gt; build dependency,
    because the feature is being removed from OpenSSL, and Postfix
    no longer needs it.
  * Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
    will no longer maintain TLSRPT statistics for messages that contain
    a "TLS-Required: no" header. This can prevent TLSRPT notifications
    for TLSRPT notifications.
  * Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
    client code logged "Untrusted TLS connection" (wrong) instead of
    "Trusted TLS connection" (right), for a new or resumed TLS session,
    when a server offered a trusted (valid PKI trust chain) certificate
    that did not match the expected server name pattern.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1762776000">- update to 3.10.5
  * Workaround for an interface mis-match between the Postfix SMTP
    client and MTA-STS policy plugins.
  * The existing behavior is to connect to any MX host listed
    in DNS, and to match the server certificate against any STS
    policy MX host pattern.
  * The corrected behavior is to connect to an MX host only if
    its name matches any STS policy MX host pattern, and to
    match the server certificate against the MX hostname.
    The corrected behavior must be enabled in two places: in Postfix
    with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
    "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
    that the plugin forwards STS policy attributes to Postfix. This
    works even if Postfix TLSRPT support is disabled at build time
    or at runtime.
  * TLSRPT Workaround: when a TLSRPT policy-type value is
    "no-policy-found", pretend that the TLSRPT policy domain value
    is equal to the recipient domain. This ignores that different
    policy types (TLSA, STS) use different policy domains. But this
    is what Microsoft does, and therefore, what other tools expect.
  * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
    client's connection reuse logic did not distinguish between
    sessions that require SMTPUTF8 support, and sessions that do
    not. The solution is 1) to store sessions with different SMTPUTF8
    requirements under distinct connection cache storage keys, and
    2) to not cache a connection when SMTPUTF8 is required but the
    server does not support that feature.
  * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
    smtpd 'disconnect' command statistics did not count commands
    with "bad syntax" and "bad UTF-8 syntax" errors.
  * Bugfix: the August 2025 patch broke DBM library support which
    is still needed on Solaris; and the same change could result
    in warnings with "database X is older than source file Y".
  * Postfix 3.11 forward compatibility: to avoid ugly warnings when
    Postfix 3.11 is rolled back to an older version, allow a
    preliminary 'size' record in maildrop queue files created with
    Postfix 3.11 or later.
  * Bugfix (defect introduced: Postfix 3.8, date 20220128):
    non-reproducible build, because the 'postconf -e' output order
    for new main.cf entries was no longer deterministic. Problem
    reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
  * To make builds predictable, add missing meta_directory and
    shlib_directory settings to the stock main.cf file. Problem
    diagnosed by Eray Aslan.
  * Bugfix (defect introduced: Postfix 3.9, date 20230517):
    posttls-finger(1) logged an incorrectly-formatted port number.
    Viktor Dukhovni.
- rebase postfix-main.cf.patch
- adapt rpmlint
  o dir-or-file-outside-snapshot</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1764158400">- update to 3.10.6
  * Bugfix (defect introduced: Postfix 3.10, date: 20250117).
    Symptom: warning messages that smtp_tls_wrappermode requires
    "smtp_tls_security_level = encrypt".
    Root cause: support for "TLS-Required: no" broke client-side
    TLS wrappermode support, by downgrading a connection to TLS
    security level 'may'.
    The fix changes the downgrade level for wrappermode connections
    to 'encrypt'. Rationale: by design, TLS can be optional only
    for connections that use STARTTLS. The downgrade to unauthenticated
    'encrypt' allows a sender to avoid an email delivery problem.
    Problem reported by Joshua Tyler Cochran.
  * New logging: the Postfix SMTP client will log a warning when
    an MX hostname does not match STS policy MX patterns, with
    "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
    TLSRPT support enabled in a TLS policy plugin. It will log a
    successful match only when verbose logging is enabled.
  * Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
    client null pointer crash when an STS policy plugin sends no
    policy_string or no mx_pattern attributes. This can happen only
    during tests with a fake STS plugin.
  * Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
    when a duplicate parameter name is given to "postconf -X" or
    "postconf -#'.
  * Documentation: removed incorrect text from the parameter
    description for smtp_cname_overrides_servername. File:
    proto/postconf.proto.</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1764936000">- postfix is unable to send mail by default (bsc#1253775)
  o Clean up the package
  * Get rid of config.postfix script to avoid unintentional changes
    of the configuration. The sysconfig files mail and postfix
    were removed also.
  * Deliver the original main.cf and master.cf
  * Remove a lot of deprecated stuff from the package.
  * Remove the ExecStartPre scripts to maintain the postmaps
    and the chroot environment.
  * A new ExecStartPre script manages the default alias map which
    is part of the default configuration of postfix.
    /sbin/postalias /etc/aliases
  * Do not use the permissions framework. A new ExecStartPre script
    takes care of the right permissions: /usr/sbin/postfix set-permissions
  * Remove mkpostfixcert
  * Get rid of berkley db converting scripts
  o Remove patches:
  * postfix-master.cf.patch
  * postfix-main.cf.patch
  * postfix-bdb-main.cf.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1765368000">- Add /var/spool/mail to the permissions.d drop-in. This directory used to be
  whitelisted globally in the permissions package but an update for the exim
  mail server changed that (bsc#1254597 bsc#1240755).
- Reintroduce permissions.d/postfix-paranoid drop-in that was removed in r534.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1765368001">- update to 3.10.7
  * This patch addresses build errors on recent Linux distributions.
    With the patch, Postfix builds will run the compiler with a
    backwards compatibility option that is supported by Gcc and Clang.
    For other compilers, an error message provides hints.</changelog>
  <changelog author="Stefan Botter &lt;obs@botter.cc&gt;" date="1765454400">- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1765713600">- Put /etc/permissions.d/postfix.paranoid into the postfix-SUSE.tar.gz</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1766318400">- (jsc#PED-14859) Fix packages for Immutable Mode - postfix</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768305600">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Put postfix set-permisson into %post</changelog>
  <changelog author="Peter Varkoly &lt;varkoly@suse.com&gt;" date="1768478400">- fix (bsc#1256462) [Build 12.10] openQA test fails in mta: Failed to start postfix.service
  Remove postfix set-permisson from all spaces
- Strip binaries</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1768996800">- Don't fail strip on non-existing files (easy hack to fix 32bit
  builds).</changelog>
  <changelog author="Ana Guerrero &lt;ana.guerrero@suse.com&gt;" date="1769083200">- Re-add dropped change:
- fix postfix-SUSE.tar.gz, postfix.service: correct path for postalias
  from /sbin/postalias to /usr/sbin/postalias</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1769083201">- Do not strip binaries at all
- also drop " -s " from the CCARGS to prevent stripping there</changelog>
</package>
<package pkgid="669f3914dfa57e09d58c26bbdfaab0c24317fe21767efd0bb16f795b916aff062bd02bb68d6af6dcb229a964d971d9d7310695e5ccdc8c3f1a9a400bc0379b54" name="update-test-32bit-pkg-32bit" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="bf44a1c1372876bf545941aed97ae6f463bfacfdaf02a19c0fc0fcc0d357e98be2ff6810b0b77cc88d125006e6b6aa3c1316adc8fd3378d033d041fb4ceee8c7" name="update-test-32bit-pkg" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="8f0b5d04887e8419110eaac104701e0050840989052b3e70f2f6effaf45a334e38ec516a4068d6355cb70f8c71ec180c43ef2d79d012663065d2d0d4c2a17af4" name="update-test-32bit-pkg" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="a21278b233a332b3b868339134a41e36a1d207fc9ef1f2ff4bbb025550883528afb49d8e69406245d0f2ba6dde67016fd38d7b5301b41975e566c1860464d3a9" name="update-test-32bit-pkg" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="9c438516f792770c2def732aeaea6cfb6b3dfd72b0478da423b111eb54de48a9ecf9c225a07e1ccb17d6c19726f6b7f34530d13c3775e067148609b316b8f035" name="update-test-32bit-pkg" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="e740aef3689a17f0a46662bea411cc5507c6f662755851aa1bdef52bb8b199f3b15935f3a7c368af47b7013151001fb8e9fc25afff7986cc6d3d36f5793bf811" name="update-test-affects-package-manager" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="64fae10f304a3226576cf7242c906e169d37f00f7e7f1533f67f4ff82d596be5db5649283d76f3abe662c370b8eef02c896ededeffe7eeeefaea07420c4ce2c8" name="update-test-affects-package-manager" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="a4b38218483e9b5c5dacf8cf3a8e38eabae4d8c6c4946db9f93af15619afdba864c127ce577a42092c157f42c8a876a173d922670a6b2bb9ce1a28544a72e5f8" name="update-test-affects-package-manager" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="04597ea850da592f0540c800ecfb7ff4911b323744b10c6bee83476a4a99682550bf3329227ca14471c9c213014e5acc5525c04ef0742a005f412824934bad2d" name="update-test-affects-package-manager" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="19545e6a014484b791207b2e26a6c8e0a0a69102618e15203ca0bbbd99a676710f8ff23fade5e839498d334b90572dda0f29f3e71d4f0010a7d47ccfa1183f52" name="update-test-broken" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="471f1ed3935c9dfe1261d0e9f7960c3e1efa8dbaec5541fd6d6ace15547fd8204e950abcd28a11e3a2c9aa3f9e6e5cc4c7a0fd78912123ab0779e025d15ed616" name="update-test-broken" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="1033fb6f0cc4f9cf5640fb0de519cd85d5e05cf0b9453ada8e0c964fa5c8056b3743460bd4d80ce7921ff80183d2284d3c081005c518910c6a3d195352c8c3bc" name="update-test-feature" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="632951b2fb62134dbe144801a9f567c174fd1340c4d620258c2115620ab24451bb80e8ee5035073d25fcf4375bd9e5ee1e99f26720658725ca7c9194d4b21987" name="update-test-feature" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="7e16071ed81fbb1b21493f4985d68bf9d0a345e42b047fa0b2c3a531d91ffddf8d03315d0fc5c88d8cc7e4caea0a4a48d8b3ce975efd0b18cdc8bcf61c2bbe6c" name="update-test-feature" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="c3adc5248538bed6162b93c67579453c7acde7b74d47d5e0860892c01a3bc1083595f43d9598ff5ad79ea3b2e91e3e351eaf134b5868c83ffb657d3fa6834dd8" name="update-test-feature" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="3281d5098ee46dcb470f04721eaf468f223a58f49b07086603731763f4867320024a784ee55c23486463fc527da0f31b36d4605dd0c34ab628d446b0fef907ec" name="update-test-interactive" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="a356ddf7ae5a099e24983bdc81640d769e9bba6d298d5e6f6431d3981b3cdb7a23502b1493b9113a04696cf431d9351e3381887305ea2407b77604a31af248c2" name="update-test-interactive" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="a13420801e7b0fa728c84e679790a6aba16e5e57187e25d1eeb3d26017cf49d03abc4e4c1ea0ad8cfa4cac2974fa025f1b1c8c3fa3fc5bff7adbffca7540d3a8" name="update-test-optional" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="a8b27d96a93aef9d2db4f2e531471e2c5635d9ce809515316d99a178ea6f48dd518aeb353f957dcc150d9ac8e40059fb031fa2054cf9a253dc7fd02835cad291" name="update-test-optional" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="5a108350ee987820af79e48a62ecf25a01006deb8d52e43ec364109fb62d7cf42f5895dba0f6fa259915dc2c46faebed961cbc1bde297e2fda863cd15c8ad59a" name="update-test-optional" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="ce6eed22ddbf87ca9cce0393c267f1afaa0564513d3cdbf19f1ff8753dc3c2d5b75ea1288b1c7b1dfb155fd74abf36d1ddb0c0a4b49c682fab8be3c85f3f6ca4" name="update-test-optional" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="6036ea19521e8346b33f116a88e825efdf24d55d353fcd4da81ae351775d98d386d6f50c05dedf4dbe79d837bfa5e6646c8ba413ca6f083eeea209844fbe21de" name="update-test-reboot-needed" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="b380f0688db3d3c618a7f34686bb8a68e7a113705eb7da897c98ed97f2ca03e5558e526f056a17da8e7b540d759f399d40ed1178491a11511ec6cd5b2f321b78" name="update-test-reboot-needed" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="19644fce2d4ab71ffc97e799da1871d213afa648cc753a2a8b3554fe6b2951c09f81d42b8f8e0c7c0b186ed69b09794c96cf9c8f57d6064373b9285e27ed0763" name="update-test-reboot-needed" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="5346e5bf0bca0345a249b3a6bac254a70a540a4318c565551906787899e46c55b4f480ee0b41360614e88ca1430c671a497e50bf54d5598f93a88d5cc8a5c2ef" name="update-test-reboot-needed" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="633de6bd4141a7f3174ab6f708e004b79e6761f830f61e172c60db57eea31c2cde44c3e6cc2698ae647701ee5e7817458a73018e67127a8a37d48cfe7d8aabd0" name="update-test-relogin-suggested" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="1554010f67b3402ef2d66c7d01fa7c1d69f540f42d6b22d734c01ae6699141709d3aa94227d59ab1f3e56a34afe1b4ecb7d059d4e4b0784f1ea02d8978a7c0bf" name="update-test-relogin-suggested" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="a7f6d94aa91019fc50cd668903e30543f77d7da79bcf27bfffd46e915416c323ae8c0277b60cace477cb0ec598d2b28e36e75a14d80ac7a7d2f64d6e660cf27f" name="update-test-relogin-suggested" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="0705b4afc3b2b257c033cc2a8494ea7c4d35a64c4cc4b745d314723087c4e94764af8ebade1b6e845ce129da273dff281e4b956c4615381dc3c710dbee9e3341" name="update-test-relogin-suggested" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="d62d0f57a5a7161096c929065587ea44c644b398ad149eb2bbc43cc310a8ab87d3b9b70d82a36f0945e386df3d8f334dd4614db9ad95fbfe45368419192e2650" name="update-test-retracted" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="25b0982f1df26b794e663e31b7b33b6080510589218883b8f9edcd6869e1f3eb07a145411950d16f3e8328879d40cd33f8f0ba63f4db80cc329d91918b6c89af" name="update-test-retracted" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="103fc6170a0fc7eb7e48d3f5c0d047f7cec63f3b8bf8ad98dc77eb833b21504ede3615abddda3727274ca7d8aef8ca8135a3485f00334a3984b6c34a89e49f3b" name="update-test-security" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="c68c401cf2496b3d82e764d74208998d525abfa8bd1ba3ef3eb11fc43c6d7457cc4cb8f8f95debf5371d2c2f2c6acb2a89372619d1b0d28a09f7ae82a4f294bc" name="update-test-security" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="c16030c88eb8c6172c1a86a241874cc20de52d7d1559d43563c56cafc56ce52d3849bea2e78c07c81d8a02ea80596cb3f8c04b10901d0b5ed78082706a0ed701" name="update-test-security" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="5f445d14d1c672e42a43b80ccbb79ef1610340391445010ba5a5fabc77fec152d81733492350e47e0f0d8a2ad76b709bd0bb063afabd1564aee7fb4840c09e68" name="update-test-security" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="e39ba94344d4c5e3e12d3def8f877777dfb93485ea7d9387eff8b833f12449e3f3c9fa4bd2e66406ec7a5718d83e296cb1bfde1233c6a709ee21a6e0bee9e768" name="update-test-trivial" arch="i586">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="331182180a31778b058063279826c7f6d4bfd2ac476dea919300a7a51a4ba1bb833e3e1be48e8105f0c4b45f41961b7630e0da4eee3579f380da5007e8c521dd" name="update-test-trivial" arch="src">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="hmuelle@suse.de" date="1161172800">- created initial update-test-trival package for testing our update
  stack</changelog>
  <changelog author="mvidner@suse.cz" date="1162987200">- Added subpackages to test other kinds of patches.
- 1.1</changelog>
  <changelog author="hmuelle@suse.de" date="1165233600">- Fixed specfile to avoid locale issues (Müller -&gt; Mueller)</changelog>
  <changelog author="hmuelle@suse.de" date="1169035200">- Fixed specfile and downgrade version to 1.2
  99.9 is reserved for "universal updates testing" during beta
  cycles</changelog>
  <changelog author="lrupp@suse.de" date="1171540800">- specfile rewrite:
  + create the documentation files inline:
    (add version, release and date)
  + use get_version_number.sh and get_release_number.sh
    for "easier" preparing mbuild numbers
- version 1.3-0</changelog>
  <changelog author="dmueller@suse.de" date="1241524800">- add relogin-suggested subpackage</changelog>
  <changelog author="dmueller@suse.de" date="1267185600">- add feature subpackage</changelog>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="63044d3b52db5b86e0b2163b177a1210b517fd0ba93149544e66bf2810187f1792ec3ef9257b98b2c5444c300f8f468a9477cc05b9f8720078af3901cac7c16a" name="update-test-trivial" arch="x86_64">
  <version epoch="0" ver="5.1" rel="2.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
</package>
<package pkgid="6a640676df1d4c2f2213f6bf875ac5b1ef7ac60be7070ff5b94fcc8c7a3f279985fa5f32f42bfd25f7f050b656ffda5152879b4bca0ae8b9ee348a759f8c6036" name="update-test-trivial" arch="i586">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="e5b437650c21eb1868a976dd3aeaf5c93070400c04efe84f2a3ee9eea1aafcf0ef610bf7222c29b6276980b931ad99962c553c3ff929e8f8e767f0f68ee240c5" name="update-test-trivial" arch="src">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="hmuelle@suse.de" date="1161172800">- created initial update-test-trival package for testing our update
  stack</changelog>
  <changelog author="mvidner@suse.cz" date="1162987200">- Added subpackages to test other kinds of patches.
- 1.1</changelog>
  <changelog author="hmuelle@suse.de" date="1165233600">- Fixed specfile to avoid locale issues (Müller -&gt; Mueller)</changelog>
  <changelog author="hmuelle@suse.de" date="1169035200">- Fixed specfile and downgrade version to 1.2
  99.9 is reserved for "universal updates testing" during beta
  cycles</changelog>
  <changelog author="lrupp@suse.de" date="1171540800">- specfile rewrite:
  + create the documentation files inline:
    (add version, release and date)
  + use get_version_number.sh and get_release_number.sh
    for "easier" preparing mbuild numbers
- version 1.3-0</changelog>
  <changelog author="dmueller@suse.de" date="1241524800">- add relogin-suggested subpackage</changelog>
  <changelog author="dmueller@suse.de" date="1267185600">- add feature subpackage</changelog>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
<package pkgid="b9e258622111cd4f0bedc3c91f7e72a5fb4869ec80e839699f0a0f7d7a35017a81160fa7ddeecec99b2875cfd52379ef1e151437f0356bebff16b44d8266c2df" name="update-test-trivial" arch="x86_64">
  <version epoch="0" ver="5.2" rel="2.1"/>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="mkravec@suse.com" date="1518091200">- Fix broken subpackage failing condition for Kubic</changelog>
  <changelog author="rbrown@suse.com" date="1521806400">- Make broken fail consistantly regardless of product</changelog>
  <changelog author="Gustavo Pichorim Boiko &lt;gboiko@suse.com&gt;" date="1593000000">- Add a retracted update test case</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1711886400">- make build reproducible</changelog>
</package>
</otherdata>