- Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via`…

… query param for hierarchy endpoint. Contributed by Krishan (@kfiven). ([\element-hq#18070](element-hq#18070))

- Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\element-hq#18196](element-hq#18196))
- Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\element-hq#18241](element-hq#18241))

- Fix `KeyError` on background updates when using split main/state databases. ([\element-hq#18509](element-hq#18509))
- Improve performance of device deletion by adding missing index. ([\element-hq#18582](element-hq#18582))
- Fix `avatar_url` and `displayname` being sent on federation profile queries when they are not set. ([\element-hq#18593](element-hq#18593))
- Respond with 401 & `M_USER_LOCKED` when a locked user calls `POST /login`, as per the spec. ([\element-hq#18594](element-hq#18594))
- Ensure policy servers are not asked to scan policy server change events, allowing rooms to disable the use of a policy server while the policy server is down. ([\element-hq#18605](element-hq#18605))

- Fix documentation of the Delete Room Admin API's status field. ([\element-hq#18519](element-hq#18519))

- Stop adding the "origin" field to newly-created events (PDUs). ([\element-hq#18418](element-hq#18418))

- Replace `PyICU` crate with equivalent `icu_segmenter` Rust crate. ([\element-hq#18553](element-hq#18553), [\element-hq#18646](element-hq#18646))
- Improve docstring on `simple_upsert_many`. ([\element-hq#18573](element-hq#18573))
- Raise poetry-core version cap to 2.1.3. ([\element-hq#18575](element-hq#18575))
- Raise setuptools_rust version cap to 1.11.1. ([\element-hq#18576](element-hq#18576))
- Better handling of ratelimited requests. ([\element-hq#18595](element-hq#18595), [\element-hq#18600](element-hq#18600))
- Update to Rust 1.87.0 in CI, and bump the pinned commit of the `dtolnay/rust-toolchain` GitHub Action to `b3b07ba8b418998c39fb20f53e8b695cdcc8de1b`. ([\element-hq#18596](element-hq#18596))
- Speed up bulk device deletion. ([\element-hq#18602](element-hq#18602))
- Speed up the building of arm-based wheels in CI. ([\element-hq#18618](element-hq#18618))
- Speed up the building of Docker images in CI. ([\element-hq#18620](element-hq#18620))
- Add `.zed/` directory to `.gitignore`. ([\element-hq#18623](element-hq#18623))
- Log the room ID we're purging state for. ([\element-hq#18625](element-hq#18625))

* Bump Swatinem/rust-cache from 2.7.8 to 2.8.0. ([\element-hq#18612](element-hq#18612))
* Bump attrs from 24.2.0 to 25.3.0. ([\element-hq#18649](element-hq#18649))
* Bump authlib from 1.5.2 to 1.6.0. ([\element-hq#18642](element-hq#18642))
* Bump base64 from 0.21.7 to 0.22.1. ([\element-hq#18589](element-hq#18589))
* Bump base64 from 0.21.7 to 0.22.1. ([\element-hq#18629](element-hq#18629))
* Bump docker/build-push-action from 6.17.0 to 6.18.0. ([\element-hq#18497](element-hq#18497))
* Bump docker/setup-buildx-action from 3.10.0 to 3.11.1. ([\element-hq#18587](element-hq#18587))
* Bump hiredis from 3.1.0 to 3.2.1. ([\element-hq#18638](element-hq#18638))
* Bump ijson from 3.3.0 to 3.4.0. ([\element-hq#18650](element-hq#18650))
* Bump jsonschema from 4.23.0 to 4.24.0. ([\element-hq#18630](element-hq#18630))
* Bump msgpack from 1.1.0 to 1.1.1. ([\element-hq#18651](element-hq#18651))
* Bump mypy-zope from 1.0.11 to 1.0.12. ([\element-hq#18640](element-hq#18640))
* Bump phonenumbers from 9.0.2 to 9.0.8. ([\element-hq#18652](element-hq#18652))
* Bump pillow from 11.2.1 to 11.3.0. ([\element-hq#18624](element-hq#18624))
* Bump prometheus-client from 0.21.0 to 0.22.1. ([\element-hq#18609](element-hq#18609))
* Bump pyasn1-modules from 0.4.1 to 0.4.2. ([\element-hq#18495](element-hq#18495))
* Bump pydantic from 2.11.4 to 2.11.7. ([\element-hq#18639](element-hq#18639))
* Bump reqwest from 0.12.15 to 0.12.20. ([\element-hq#18590](element-hq#18590))
* Bump reqwest from 0.12.20 to 0.12.22. ([\element-hq#18627](element-hq#18627))
* Bump ruff from 0.11.11 to 0.12.1. ([\element-hq#18645](element-hq#18645))
* Bump ruff from 0.12.1 to 0.12.2. ([\element-hq#18657](element-hq#18657))
* Bump sentry-sdk from 2.22.0 to 2.32.0. ([\element-hq#18633](element-hq#18633))
* Bump setuptools-rust from 1.10.2 to 1.11.1. ([\element-hq#18655](element-hq#18655))
* Bump sigstore/cosign-installer from 3.8.2 to 3.9.0. ([\element-hq#18588](element-hq#18588))
* Bump sigstore/cosign-installer from 3.9.0 to 3.9.1. ([\element-hq#18608](element-hq#18608))
* Bump stefanzweifel/git-auto-commit-action from 5.2.0 to 6.0.1. ([\element-hq#18607](element-hq#18607))
* Bump tokio from 1.45.1 to 1.46.0. ([\element-hq#18628](element-hq#18628))
* Bump tokio from 1.46.0 to 1.46.1. ([\element-hq#18667](element-hq#18667))
* Bump treq from 24.9.1 to 25.5.0. ([\element-hq#18610](element-hq#18610))
* Bump types-bleach from 6.2.0.20241123 to 6.2.0.20250514. ([\element-hq#18634](element-hq#18634))
* Bump types-jsonschema from 4.23.0.20250516 to 4.24.0.20250528. ([\element-hq#18611](element-hq#18611))
* Bump types-opentracing from 2.4.10.6 to 2.4.10.20250622. ([\element-hq#18586](element-hq#18586))
* Bump types-psycopg2 from 2.9.21.20250318 to 2.9.21.20250516. ([\element-hq#18658](element-hq#18658))
* Bump types-pyyaml from 6.0.12.20241230 to 6.0.12.20250516. ([\element-hq#18643](element-hq#18643))
* Bump types-setuptools from 75.2.0.20241019 to 80.9.0.20250529. ([\element-hq#18644](element-hq#18644))
* Bump typing-extensions from 4.12.2 to 4.14.0. ([\element-hq#18654](element-hq#18654))
* Bump typing-extensions from 4.14.0 to 4.14.1. ([\element-hq#18668](element-hq#18668))
* Bump urllib3 from 2.2.2 to 2.5.0. ([\element-hq#18572](element-hq#18572))

Pre-built wheels are now built using the [manylinux_2_28](https://git…

…hub.com/pypa/manylinux#manylinux_2_28-almalinux-8-based) base, which is expected to be compatible with distros using glibc 2.28 or later, including:

 - Debian 10+
 - Ubuntu 18.10+
 - Fedora 29+
 - CentOS/RHEL 8+

Previously, wheels were built using the [manylinux2014](https://github.com/pypa/manylinux#manylinux2014-centos-7-based-glibc-217) base, which was expected to be compatible with distros using glibc 2.17 or later.

- Bump `cibuildwheel` to 3.0.0 to fix the `manylinux` wheel builds. ([\element-hq#18615](element-hq#18615))

- Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\element-hq#18120](element-hq#18120))

- Fix an issue where, during state resolution for v11 rooms, Synapse would incorrectly calculate the power level of the creator when there was no power levels event in the room. ([\element-hq#18534](element-hq#18534), [\element-hq#18547](element-hq#18547))
- Fix long-standing bug where sliding sync did not honour the `room_id_to_include` config option. ([\element-hq#18535](element-hq#18535))
- Fix an issue where "Lock timeout is getting excessive" warnings would be logged even when the lock timeout was <10 minutes. ([\element-hq#18543](element-hq#18543))
- Fix an issue where Synapse could calculate the wrong power level for the creator of the room if there was no power levels event. ([\element-hq#18545](element-hq#18545))

- Generate config documentation from JSON Schema file. ([\element-hq#18528](element-hq#18528))
- Fix typo in user type documentation. ([\element-hq#18568](element-hq#18568))

- Increase performance of introspecting access tokens when using delegated auth. ([\element-hq#18357](element-hq#18357), [\element-hq#18561](element-hq#18561))
- Log user deactivations. ([\element-hq#18541](element-hq#18541))
- Enable [`flake8-logging`](https://docs.astral.sh/ruff/rules/#flake8-logging-log) and [`flake8-logging-format`](https://docs.astral.sh/ruff/rules/#flake8-logging-format-g) rules in Ruff and fix related issues throughout the codebase. ([\element-hq#18542](element-hq#18542))
- Clean up old, unused rows from the `device_federation_inbox` table. ([\element-hq#18546](element-hq#18546))
- Run config schema CI on develop and release branches. ([\element-hq#18551](element-hq#18551))
- Add support for Twisted `25.5.0`+ releases. ([\element-hq#18577](element-hq#18577))
- Update PyO3 to version 0.25. ([\element-hq#18578](element-hq#18578))

* Bump actions/setup-python from 5.5.0 to 5.6.0. ([\element-hq#18555](element-hq#18555))
* Bump base64 from 0.21.7 to 0.22.1. ([\element-hq#18559](element-hq#18559))
* Bump dawidd6/action-download-artifact from 9 to 11. ([\element-hq#18556](element-hq#18556))
* Bump headers from 0.4.0 to 0.4.1. ([\element-hq#18529](element-hq#18529))
* Bump requests from 2.32.2 to 2.32.4. ([\element-hq#18533](element-hq#18533))
* Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611. ([\element-hq#18558](element-hq#18558))

- Add support for the [MSC4260 user report API](matrix-org/matrix-spe…

…c-proposals#4260). ([\element-hq#18120](element-hq#18120))

- Fix an issue where, during state resolution for v11 rooms, Synapse would incorrectly calculate the power level of the creator when there was no power levels event in the room. ([\element-hq#18534](element-hq#18534), [\element-hq#18547](element-hq#18547))
- Fix long-standing bug where sliding sync did not honour the `room_id_to_include` config option. ([\element-hq#18535](element-hq#18535))
- Fix an issue where "Lock timeout is getting excessive" warnings would be logged even when the lock timeout was <10 minutes. ([\element-hq#18543](element-hq#18543))
- Fix an issue where Synapse could calculate the wrong power level for the creator of the room if there was no power levels event. ([\element-hq#18545](element-hq#18545))

- Generate config documentation from JSON Schema file. ([\element-hq#18528](element-hq#18528))
- Fix typo in user type documentation. ([\element-hq#18568](element-hq#18568))

- Increase performance of introspecting access tokens when using delegated auth. ([\element-hq#18357](element-hq#18357), [\element-hq#18561](element-hq#18561))
- Log user deactivations. ([\element-hq#18541](element-hq#18541))
- Enable [`flake8-logging`](https://docs.astral.sh/ruff/rules/#flake8-logging-log) and [`flake8-logging-format`](https://docs.astral.sh/ruff/rules/#flake8-logging-format-g) rules in Ruff and fix related issues throughout the codebase. ([\element-hq#18542](element-hq#18542))
- Clean up old, unused rows from the `device_federation_inbox` table. ([\element-hq#18546](element-hq#18546))
- Run config schema CI on develop and release branches. ([\element-hq#18551](element-hq#18551))
- Add support for Twisted `25.5.0`+ releases. ([\element-hq#18577](element-hq#18577))
- Update PyO3 to version 0.25. ([\element-hq#18578](element-hq#18578))

* Bump actions/setup-python from 5.5.0 to 5.6.0. ([\element-hq#18555](element-hq#18555))
* Bump base64 from 0.21.7 to 0.22.1. ([\element-hq#18559](element-hq#18559))
* Bump dawidd6/action-download-artifact from 9 to 11. ([\element-hq#18556](element-hq#18556))
* Bump headers from 0.4.0 to 0.4.1. ([\element-hq#18529](element-hq#18529))
* Bump requests from 2.32.2 to 2.32.4. ([\element-hq#18533](element-hq#18533))
* Bump types-requests from 2.32.0.20250328 to 2.32.4.20250611. ([\element-hq#18558](element-hq#18558))

- Improvements to generate config documentation from JSON Schema file…

…. ([\element-hq#18522](element-hq#18522))

- Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\element-hq#18288](element-hq#18288))
- Add experimental `user_may_send_state_event` module API callback. ([\element-hq#18455](element-hq#18455))
- Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size. ([\element-hq#18457](element-hq#18457))
- Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\element-hq#18458](element-hq#18458))
- Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\element-hq#18486](element-hq#18486))
- Support configuration of default and extra user types. ([\element-hq#18456](element-hq#18456))
- Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\element-hq#18521](element-hq#18521))
- Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`. ([\element-hq#18513](element-hq#18513))

- Remove destinations from sending if not whitelisted. ([\element-hq#18484](element-hq#18484))
- Fixed room summary API incorrectly returning that a room is private in the room summary response when the join rule is omitted by the remote server. Contributed by @nexy7574. ([\element-hq#18493](element-hq#18493))
- Prevent users from adding themselves to their own user ignore list. ([\element-hq#18508](element-hq#18508))

- Generate config documentation from JSON Schema file. ([\element-hq#17892](element-hq#17892))
- Mention `CAP_NET_BIND_SERVICE` as an alternative to running Synapse as root in order to bind to a privileged port. ([\element-hq#18408](element-hq#18408))
- Surface hidden Admin API documentation regarding fetching of scheduled tasks. ([\element-hq#18516](element-hq#18516))
- Mark the new module APIs in this release as experimental. ([\element-hq#18536](element-hq#18536))

- Mark dehydrated devices in the [List All User Devices Admin API](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html#list-all-devices). ([\element-hq#18252](element-hq#18252))
- Reduce disk wastage by cleaning up `received_transactions` older than 1 day, rather than 30 days. ([\element-hq#18310](element-hq#18310))
- Distinguish all vs local events being persisted in the "Event Send Time Quantiles" graph (Grafana). ([\element-hq#18510](element-hq#18510))

- Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) In…

…vite Filtering. ([\element-hq#18288](element-hq#18288))

- Add experimental `user_may_send_state_event` module API callback. ([\element-hq#18455](element-hq#18455))
- Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size. ([\element-hq#18457](element-hq#18457))
- Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\element-hq#18458](element-hq#18458))
- Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\element-hq#18486](element-hq#18486))
- Support configuration of default and extra user types. ([\element-hq#18456](element-hq#18456))
- Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\element-hq#18521](element-hq#18521))
- Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`. ([\element-hq#18513](element-hq#18513))

- Remove destinations from sending if not whitelisted. ([\element-hq#18484](element-hq#18484))
- Fixed room summary API incorrectly returning that a room is private in the room summary response when the join rule is omitted by the remote server. Contributed by @nexy7574. ([\element-hq#18493](element-hq#18493))
- Prevent users from adding themselves to their own user ignore list. ([\element-hq#18508](element-hq#18508))

- Generate config documentation from JSON Schema file. ([\element-hq#17892](element-hq#17892))
- Mention `CAP_NET_BIND_SERVICE` as an alternative to running Synapse as root in order to bind to a privileged port. ([\element-hq#18408](element-hq#18408))
- Surface hidden Admin API documentation regarding fetching of scheduled tasks. ([\element-hq#18516](element-hq#18516))
- Mark the new module APIs in this release as experimental. ([\element-hq#18536](element-hq#18536))

- Mark dehydrated devices in the [List All User Devices Admin API](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html#list-all-devices). ([\element-hq#18252](element-hq#18252))
- Reduce disk wastage by cleaning up `received_transactions` older than 1 day, rather than 30 days. ([\element-hq#18310](element-hq#18310))
- Distinguish all vs local events being persisted in the "Event Send Time Quantiles" graph (Grafana). ([\element-hq#18510](element-hq#18510))

No significant changes since 1.131.0rc1.

- Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263). ([\element-hq#18180](element-hq#18180))
- Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\element-hq#18262](element-hq#18262))
- Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms). ([\element-hq#18318](element-hq#18318))
- Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam. ([\element-hq#18387](element-hq#18387))

- Prevent race-condition in `_maybe_retry_device_resync` entrance. ([\element-hq#18391](element-hq#18391))
- Fix the `tests.handlers.test_worker_lock.WorkerLockTestCase.test_lock_contention` test which could spuriously time out on RISC-V architectures due to performance differences. ([\element-hq#18430](element-hq#18430))
- Fix admin redaction endpoint not redacting encrypted messages. ([\element-hq#18434](element-hq#18434))

- Update `room_list_publication_rules` docs to consider defaults that changed in v1.126.0. Contributed by @HarHarLinks. ([\element-hq#18286](element-hq#18286))
- Add advice for upgrading between major PostgreSQL versions to the database documentation. ([\element-hq#18445](element-hq#18445))

- Fix a memory leak in `_NotifierUserStream`. ([\element-hq#18380](element-hq#18380))
- Fix a couple type annotations in the `RootConfig`/`Config`. ([\element-hq#18409](element-hq#18409))
- Explicitly enable PyPy builds in `cibuildwheel`s config to avoid it being disabled on a future upgrade to `cibuildwheel` v3. ([\element-hq#18417](element-hq#18417))
- Update the PR review template to remove an erroneous line break from the final bullet point. ([\element-hq#18419](element-hq#18419))
- Explain why we `flush_buffer()` for Python `print(...)` output. ([\element-hq#18420](element-hq#18420))
- Add lint to ensure we don't add a `CREATE/DROP INDEX` in a schema delta. ([\element-hq#18440](element-hq#18440))
- Allow checking only for the existence of a field in an SSO provider's response, rather than requiring the value(s) to check. ([\element-hq#18454](element-hq#18454))
- Add unit tests for homeserver usage statistics. ([\element-hq#18463](element-hq#18463))
- Don't move invited users to new room when shutting down room. ([\element-hq#18471](element-hq#18471))

* Bump actions/setup-python from 5.5.0 to 5.6.0. ([\element-hq#18398](element-hq#18398))
* Bump authlib from 1.5.1 to 1.5.2. ([\element-hq#18452](element-hq#18452))
* Bump docker/build-push-action from 6.15.0 to 6.17.0. ([\element-hq#18397](element-hq#18397), [\element-hq#18449](element-hq#18449))
* Bump lxml from 5.3.0 to 5.4.0. ([\element-hq#18480](element-hq#18480))
* Bump mypy-zope from 1.0.9 to 1.0.11. ([\element-hq#18428](element-hq#18428))
* Bump pyo3 from 0.23.5 to 0.24.2. ([\element-hq#18460](element-hq#18460))
* Bump pyo3-log from 0.12.3 to 0.12.4. ([\element-hq#18453](element-hq#18453))
* Bump pyopenssl from 25.0.0 to 25.1.0. ([\element-hq#18450](element-hq#18450))
* Bump ruff from 0.7.3 to 0.11.11. ([\element-hq#18451](element-hq#18451), [\element-hq#18482](element-hq#18482))
* Bump tornado from 6.4.2 to 6.5.0. ([\element-hq#18459](element-hq#18459))
* Bump setuptools from 72.1.0 to 78.1.1. ([\element-hq#18461](element-hq#18461))
* Bump types-jsonschema from 4.23.0.20241208 to 4.23.0.20250516. ([\element-hq#18481](element-hq#18481))
* Bump types-requests from 2.32.0.20241016 to 2.32.0.20250328. ([\element-hq#18427](element-hq#18427))

- Add `msc4263_limit_key_queries_to_users_who_share_rooms` config opt…

…ion as per [MSC4263](matrix-org/matrix-spec-proposals#4263). ([\element-hq#18180](element-hq#18180))

- Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\element-hq#18262](element-hq#18262))
- Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms). ([\element-hq#18318](element-hq#18318))
- Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam. ([\element-hq#18387](element-hq#18387))

- Prevent race-condition in `_maybe_retry_device_resync` entrance. ([\element-hq#18391](element-hq#18391))
- Fix the `tests.handlers.test_worker_lock.WorkerLockTestCase.test_lock_contention` test which could spuriously time out on RISC-V architectures due to performance differences. ([\element-hq#18430](element-hq#18430))
- Fix admin redaction endpoint not redacting encrypted messages. ([\element-hq#18434](element-hq#18434))

- Update `room_list_publication_rules` docs to consider defaults that changed in v1.126.0. Contributed by @HarHarLinks. ([\element-hq#18286](element-hq#18286))
- Add advice for upgrading between major PostgreSQL versions to the database documentation. ([\element-hq#18445](element-hq#18445))

- Fix a memory leak in `_NotifierUserStream`. ([\element-hq#18380](element-hq#18380))
- Fix a couple type annotations in the `RootConfig`/`Config`. ([\element-hq#18409](element-hq#18409))
- Explicitly enable PyPy builds in `cibuildwheel`s config to avoid it being disabled on a future upgrade to `cibuildwheel` v3. ([\element-hq#18417](element-hq#18417))
- Update the PR review template to remove an erroneous line break from the final bullet point. ([\element-hq#18419](element-hq#18419))
- Explain why we `flush_buffer()` for Python `print(...)` output. ([\element-hq#18420](element-hq#18420))
- Add lint to ensure we don't add a `CREATE/DROP INDEX` in a schema delta. ([\element-hq#18440](element-hq#18440))
- Allow checking only for the existence of a field in an SSO provider's response, rather than requiring the value(s) to check. ([\element-hq#18454](element-hq#18454))
- Add unit tests for homeserver usage statistics. ([\element-hq#18463](element-hq#18463))
- Don't move invited users to new room when shutting down room. ([\element-hq#18471](element-hq#18471))

* Bump actions/setup-python from 5.5.0 to 5.6.0. ([\element-hq#18398](element-hq#18398))
* Bump authlib from 1.5.1 to 1.5.2. ([\element-hq#18452](element-hq#18452))
* Bump docker/build-push-action from 6.15.0 to 6.17.0. ([\element-hq#18397](element-hq#18397), [\element-hq#18449](element-hq#18449))
* Bump lxml from 5.3.0 to 5.4.0. ([\element-hq#18480](element-hq#18480))
* Bump mypy-zope from 1.0.9 to 1.0.11. ([\element-hq#18428](element-hq#18428))
* Bump pyo3 from 0.23.5 to 0.24.2. ([\element-hq#18460](element-hq#18460))
* Bump pyo3-log from 0.12.3 to 0.12.4. ([\element-hq#18453](element-hq#18453))
* Bump pyopenssl from 25.0.0 to 25.1.0. ([\element-hq#18450](element-hq#18450))
* Bump ruff from 0.7.3 to 0.11.11. ([\element-hq#18451](element-hq#18451), [\element-hq#18482](element-hq#18482))
* Bump tornado from 6.4.2 to 6.5.0. ([\element-hq#18459](element-hq#18459))
* Bump setuptools from 72.1.0 to 78.1.1. ([\element-hq#18461](element-hq#18461))
* Bump types-jsonschema from 4.23.0.20241208 to 4.23.0.20250516. ([\element-hq#18481](element-hq#18481))
* Bump types-requests from 2.32.0.20241016 to 2.32.0.20250328. ([\element-hq#18427](element-hq#18427))

- Fix startup being blocked on creating a new index that was introduc…

…ed in v1.130.0rc1. ([\element-hq#18439](element-hq#18439))

- Fix the ordering of local messages in rooms that were affected by [GHSA-v56r-hwv5-mxg6](GHSA-v56r-hwv5-mxg6). ([\element-hq#18447](element-hq#18447))

- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks`  to fetch scheduled tasks. ([\element-hq#18214](element-hq#18214))
- Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\element-hq#18300](element-hq#18300))
- Add support for handling `GET /devices/` on workers. ([\element-hq#18355](element-hq#18355))

- Fix a longstanding bug where Synapse would immediately retry a failing push endpoint when a new event is received, ignoring any backoff timers. ([\element-hq#18363](element-hq#18363))
- Pass leave from remote invite rejection down Sliding Sync. ([\element-hq#18375](element-hq#18375))

- In `configure_workers_and_start.py`, use the same absolute path of Python in the interpreter shebang, and invoke child Python processes with `sys.executable`. ([\element-hq#18291](element-hq#18291))
- Optimize the build of the workers image. ([\element-hq#18292](element-hq#18292))
- In `start_for_complement.sh`, replace some external program calls with shell builtins. ([\element-hq#18293](element-hq#18293))
- When generating container scripts from templates, don't add a leading newline so that their shebangs may be handled correctly. ([\element-hq#18295](element-hq#18295))

- Improve formatting of the README file. ([\element-hq#18218](element-hq#18218))
- Add documentation for configuring [Pocket ID](https://github.com/pocket-id/pocket-id) as an OIDC provider. ([\element-hq#18237](element-hq#18237))
- Fix typo in docs about the `push` config option. Contributed by @HarHarLinks. ([\element-hq#18320](element-hq#18320))
- Add `/_matrix/federation/v1/version` to list of federation endpoints that can be handled by workers. ([\element-hq#18377](element-hq#18377))
- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks`  to fetch scheduled tasks. ([\element-hq#18384](element-hq#18384))

- Return specific error code when adding an email address / phone number to account is not supported ([MSC4178](matrix-org/matrix-spec-proposals#4178)). ([\element-hq#17578](element-hq#17578))
- Stop auto-provisionning missing users & devices when delegating auth to Matrix Authentication Service. Requires MAS 0.13.0 or later. ([\element-hq#18181](element-hq#18181))
- Apply file hashing and existing quarantines to media downloaded for URL previews. ([\element-hq#18297](element-hq#18297))
- Allow a few admin APIs used by matrix-authentication-service to run on workers. ([\element-hq#18313](element-hq#18313))
- Apply `should_drop_federated_event` to federation invites. ([\element-hq#18330](element-hq#18330))
- Allow `/rooms/` admin API to be run on workers. ([\element-hq#18360](element-hq#18360))
- Minor performance improvements to the notifier. ([\element-hq#18367](element-hq#18367))
- Slight performance increase when using the ratelimiter. ([\element-hq#18369](element-hq#18369))
- Don't validate the `at_hash` (access token hash) field in OIDC ID Tokens if we don't end up actually using the OIDC Access Token. ([\element-hq#18374](element-hq#18374), [\element-hq#18385](element-hq#18385))
- Fixed test failures when using authlib 1.5.2. ([\element-hq#18390](element-hq#18390))
- Refactor [MSC4186](matrix-org/matrix-spec-proposals#4186) Simplified Sliding Sync room list tests to cover both new and fallback logic paths. ([\element-hq#18399](element-hq#18399))

* Bump actions/add-to-project from 280af8ae1f83a494cfad2cb10f02f6d13529caa9 to 5b1a254a3546aef88e0a7724a77a623fa2e47c36. ([\element-hq#18365](element-hq#18365))
* Bump actions/download-artifact from 4.2.1 to 4.3.0. ([\element-hq#18364](element-hq#18364))
* Bump actions/setup-go from 5.4.0 to 5.5.0. ([\element-hq#18426](element-hq#18426))
* Bump anyhow from 1.0.97 to 1.0.98. ([\element-hq#18336](element-hq#18336))
* Bump packaging from 24.2 to 25.0. ([\element-hq#18393](element-hq#18393))
* Bump pillow from 11.1.0 to 11.2.1. ([\element-hq#18429](element-hq#18429))
* Bump pydantic from 2.10.3 to 2.11.4. ([\element-hq#18394](element-hq#18394))
* Bump pyo3-log from 0.12.2 to 0.12.3. ([\element-hq#18317](element-hq#18317))
* Bump pyopenssl from 24.3.0 to 25.0.0. ([\element-hq#18315](element-hq#18315))
* Bump sha2 from 0.10.8 to 0.10.9. ([\element-hq#18395](element-hq#18395))
* Bump sigstore/cosign-installer from 3.8.1 to 3.8.2. ([\element-hq#18366](element-hq#18366))
* Bump softprops/action-gh-release from 1 to 2. ([\element-hq#18264](element-hq#18264))
* Bump stefanzweifel/git-auto-commit-action from 5.1.0 to 5.2.0. ([\element-hq#18354](element-hq#18354))
* Bump txredisapi from 1.4.10 to 1.4.11. ([\element-hq#18392](element-hq#18392))
* Bump types-jsonschema from 4.23.0.20240813 to 4.23.0.20241208. ([\element-hq#18305](element-hq#18305))
* Bump types-psycopg2 from 2.9.21.20250121 to 2.9.21.20250318. ([\element-hq#18316](element-hq#18316))

- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` …

…to fetch scheduled tasks. ([\element-hq#18214](element-hq#18214))

- Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\element-hq#18300](element-hq#18300))
- Add support for handling `GET /devices/` on workers. ([\element-hq#18355](element-hq#18355))

- Fix a longstanding bug where Synapse would immediately retry a failing push endpoint when a new event is received, ignoring any backoff timers. ([\element-hq#18363](element-hq#18363))
- Pass leave from remote invite rejection down Sliding Sync. ([\element-hq#18375](element-hq#18375))

- In `configure_workers_and_start.py`, use the same absolute path of Python in the interpreter shebang, and invoke child Python processes with `sys.executable`. ([\element-hq#18291](element-hq#18291))
- Optimize the build of the workers image. ([\element-hq#18292](element-hq#18292))
- In `start_for_complement.sh`, replace some external program calls with shell builtins. ([\element-hq#18293](element-hq#18293))
- When generating container scripts from templates, don't add a leading newline so that their shebangs may be handled correctly. ([\element-hq#18295](element-hq#18295))

- Improve formatting of the README file. ([\element-hq#18218](element-hq#18218))
- Add documentation for configuring [Pocket ID](https://github.com/pocket-id/pocket-id) as an OIDC provider. ([\element-hq#18237](element-hq#18237))
- Fix typo in docs about the `push` config option. Contributed by @HarHarLinks. ([\element-hq#18320](element-hq#18320))
- Add `/_matrix/federation/v1/version` to list of federation endpoints that can be handled by workers. ([\element-hq#18377](element-hq#18377))
- Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks`  to fetch scheduled tasks. ([\element-hq#18384](element-hq#18384))

- Return specific error code when adding an email address / phone number to account is not supported ([MSC4178](matrix-org/matrix-spec-proposals#4178)). ([\element-hq#17578](element-hq#17578))
- Stop auto-provisionning missing users & devices when delegating auth to Matrix Authentication Service. Requires MAS 0.13.0 or later. ([\element-hq#18181](element-hq#18181))
- Apply file hashing and existing quarantines to media downloaded for URL previews. ([\element-hq#18297](element-hq#18297))
- Allow a few admin APIs used by matrix-authentication-service to run on workers. ([\element-hq#18313](element-hq#18313))
- Apply `should_drop_federated_event` to federation invites. ([\element-hq#18330](element-hq#18330))
- Allow `/rooms/` admin API to be run on workers. ([\element-hq#18360](element-hq#18360))
- Minor performance improvements to the notifier. ([\element-hq#18367](element-hq#18367))
- Slight performance increase when using the ratelimiter. ([\element-hq#18369](element-hq#18369))
- Don't validate the `at_hash` (access token hash) field in OIDC ID Tokens if we don't end up actually using the OIDC Access Token. ([\element-hq#18374](element-hq#18374), [\element-hq#18385](element-hq#18385))
- Fixed test failures when using authlib 1.5.2. ([\element-hq#18390](element-hq#18390))
- Refactor [MSC4186](matrix-org/matrix-spec-proposals#4186) Simplified Sliding Sync room list tests to cover both new and fallback logic paths. ([\element-hq#18399](element-hq#18399))

* Bump actions/add-to-project from 280af8ae1f83a494cfad2cb10f02f6d13529caa9 to 5b1a254a3546aef88e0a7724a77a623fa2e47c36. ([\element-hq#18365](element-hq#18365))
* Bump actions/download-artifact from 4.2.1 to 4.3.0. ([\element-hq#18364](element-hq#18364))
* Bump actions/setup-go from 5.4.0 to 5.5.0. ([\element-hq#18426](element-hq#18426))
* Bump anyhow from 1.0.97 to 1.0.98. ([\element-hq#18336](element-hq#18336))
* Bump packaging from 24.2 to 25.0. ([\element-hq#18393](element-hq#18393))
* Bump pillow from 11.1.0 to 11.2.1. ([\element-hq#18429](element-hq#18429))
* Bump pydantic from 2.10.3 to 2.11.4. ([\element-hq#18394](element-hq#18394))
* Bump pyo3-log from 0.12.2 to 0.12.3. ([\element-hq#18317](element-hq#18317))
* Bump pyopenssl from 24.3.0 to 25.0.0. ([\element-hq#18315](element-hq#18315))
* Bump sha2 from 0.10.8 to 0.10.9. ([\element-hq#18395](element-hq#18395))
* Bump sigstore/cosign-installer from 3.8.1 to 3.8.2. ([\element-hq#18366](element-hq#18366))
* Bump softprops/action-gh-release from 1 to 2. ([\element-hq#18264](element-hq#18264))
* Bump stefanzweifel/git-auto-commit-action from 5.1.0 to 5.2.0. ([\element-hq#18354](element-hq#18354))
* Bump txredisapi from 1.4.10 to 1.4.11. ([\element-hq#18392](element-hq#18392))
* Bump types-jsonschema from 4.23.0.20240813 to 4.23.0.20241208. ([\element-hq#18305](element-hq#18305))
* Bump types-psycopg2 from 2.9.21.20250121 to 2.9.21.20250318. ([\element-hq#18316](element-hq#18316))

No significant changes since 1.129.0rc2.

Synapse 1.129.0rc1 was never formally released due to regressions discovered during the release process. 1.129.0rc2 fixes those regressions by reverting the affected PRs.

- Revert the slow background update introduced by [\element-hq#18068](element-hq#18068) in v1.128.0. ([\element-hq#18372](element-hq#18372))
- Revert "Add total event, unencrypted message, and e2ee event counts to stats reporting", added in v1.129.0rc1. ([\element-hq#18373](element-hq#18373))

- Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\element-hq#18232](element-hq#18232))
- Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\element-hq#18260](element-hq#18260))

- Fix `force_tracing_for_users` config when using delegated auth. ([\element-hq#18334](element-hq#18334))
- Fix the token introspection cache logging access tokens when MAS integration is in use. ([\element-hq#18335](element-hq#18335))
- Stop caching introspection failures when delegating auth to MAS. ([\element-hq#18339](element-hq#18339))
- Fix `ExternalIDReuse` exception after migrating to MAS on workers with a high traffic. ([\element-hq#18342](element-hq#18342))
- Fix minor performance regression caused by tracking of room participation. Regressed in v1.128.0. ([\element-hq#18345](element-hq#18345))

- Optimize the build of the complement-synapse image. ([\element-hq#18294](element-hq#18294))

- Disable statement timeout during room purge. ([\element-hq#18133](element-hq#18133))
- Add cache to storage functions used to auth requests when using delegated auth. ([\element-hq#18337](element-hq#18337))