2025-07-01 00:00:19 -04:00
497 changed files with 11094 additions and 39272 deletions
--- a/.ci/before_build_wheel.sh
+++ b/.ci/before_build_wheel.sh
@ -1,10 +0,0 @@
-#!/bin/sh
-set -xeu
-
-# On 32-bit Linux platforms, we need libatomic1 to use rustup
-if command -v yum &> /dev/null; then
-   yum install -y libatomic
-fi
-
-# Install a Rust toolchain
-curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.82.0 -y --profile minimal
--- a/.ci/scripts/calculate_jobs.py
+++ b/.ci/scripts/calculate_jobs.py
@ -36,11 +36,11 @@ IS_PR = os.environ["GITHUB_REF"].startswith("refs/pull/")
 # First calculate the various trial jobs.
 #
 # For PRs, we only run each type of test with the oldest Python version supported (which
-# is Python 3.9 right now)
+# is Python 3.8 right now)

 trial_sqlite_tests = [
    {
-        "python-version": "3.9",
+        "python-version": "3.8",
        "database": "sqlite",
        "extras": "all",
    }
@ -53,14 +53,14 @@ if not IS_PR:
            "database": "sqlite",
            "extras": "all",
        }
-        for version in ("3.10", "3.11", "3.12", "3.13")
+        for version in ("3.9", "3.10", "3.11", "3.12", "3.13")
    )

 trial_postgres_tests = [
    {
-        "python-version": "3.9",
+        "python-version": "3.8",
        "database": "postgres",
-        "postgres-version": "13",
+        "postgres-version": "11",
        "extras": "all",
    }
 ]
@ -77,7 +77,7 @@ if not IS_PR:

 trial_no_extra_tests = [
    {
-        "python-version": "3.9",
+        "python-version": "3.8",
        "database": "sqlite",
        "extras": "",
    }
@ -99,24 +99,24 @@ set_output("trial_test_matrix", test_matrix)

 # First calculate the various sytest jobs.
 #
-# For each type of test we only run on bullseye on PRs
+# For each type of test we only run on focal on PRs


 sytest_tests = [
    {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "focal",
    },
    {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "focal",
        "postgres": "postgres",
    },
    {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "focal",
        "postgres": "multi-postgres",
        "workers": "workers",
    },
    {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "focal",
        "postgres": "multi-postgres",
        "workers": "workers",
        "reactor": "asyncio",
@ -127,11 +127,11 @@ if not IS_PR:
    sytest_tests.extend(
        [
            {
-                "sytest-tag": "bullseye",
+                "sytest-tag": "focal",
                "reactor": "asyncio",
            },
            {
-                "sytest-tag": "bullseye",
+                "sytest-tag": "focal",
                "postgres": "postgres",
                "reactor": "asyncio",
            },
--- a/.ci/scripts/check_lockfile.py
+++ b/.ci/scripts/check_lockfile.py
@ -11,12 +11,12 @@ with open("poetry.lock", "rb") as f:

 try:
    lock_version = lockfile["metadata"]["lock-version"]
-    assert lock_version == "2.1"
+    assert lock_version == "2.0"
 except Exception:
    print(
        """\
-    Lockfile is not version 2.1. You probably need to upgrade poetry on your local box
-    and re-run `poetry lock`. See the Poetry cheat sheet at
+    Lockfile is not version 2.0. You probably need to upgrade poetry on your local box
+    and re-run `poetry lock --no-update`. See the Poetry cheat sheet at
    https://element-hq.github.io/synapse/develop/development/dependencies.html
    """
    )
--- a/.ci/scripts/prepare_old_deps.sh
+++ b/.ci/scripts/prepare_old_deps.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# this script is run by GitHub Actions in a plain `jammy` container; it
+# this script is run by GitHub Actions in a plain `focal` container; it
 # - installs the minimal system requirements, and poetry;
 # - patches the project definition file to refer to old versions only;
 # - creates a venv with these old versions using poetry; and finally
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -9,4 +9,5 @@
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
  - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
-* [ ] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
+* [ ] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct
+  (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -14,26 +14,26 @@ permissions:
  id-token: write # needed for signing the images with GitHub OIDC Token
 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
    steps:
      - name: Set up QEMU
        id: qemu
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@v3

      - name: Inspect builder
        run: docker buildx inspect

      - name: Install Cosign
-        uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0
+        uses: sigstore/cosign-installer@v3.7.0

      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4

      - name: Extract version from pyproject.toml
        # Note: explicitly requesting bash will mean bash is invoked with `-eo pipefail`, see
@ -43,13 +43,13 @@ jobs:
          echo "SYNAPSE_VERSION=$(grep "^version" pyproject.toml | sed -E 's/version\s*=\s*["]([^"]*)["]/\1/')" >> $GITHUB_ENV

      - name: Log in to DockerHub
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@ -57,7 +57,7 @@ jobs:

      - name: Calculate docker image tag
        id: set-tag
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        uses: docker/metadata-action@master
        with:
          images: |
            docker.io/matrixdotorg/synapse
@ -72,7 +72,7 @@ jobs:

      - name: Build and push all platforms
        id: build-and-push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@v6
        with:
          push: true
          labels: |
--- a/.github/workflows/docs-pr-netlify.yaml
+++ b/.github/workflows/docs-pr-netlify.yaml
@ -14,7 +14,7 @@ jobs:
      # There's a 'download artifact' action, but it hasn't been updated for the workflow_run action
      # (https://github.com/actions/download-artifact/issues/60) so instead we get this mess:
      - name: 📥 Download artifact
-        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
        with:
          workflow: docs-pr.yaml
          run_id: ${{ github.event.workflow_run.id }}
@ -22,7 +22,7 @@ jobs:
          path: book

      - name: 📤 Deploy to Netlify
-        uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
+        uses: matrix-org/netlify-pr-preview@v3
        with:
          path: book
          owner: ${{ github.event.workflow_run.head_repository.owner.login }}
--- a/.github/workflows/docs-pr.yaml
+++ b/.github/workflows/docs-pr.yaml
@ -13,7 +13,7 @@ jobs:
    name: GitHub Pages
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
        with:
          # Fetch all history so that the schema_versions script works.
          fetch-depth: 0
@ -24,7 +24,7 @@ jobs:
          mdbook-version: '0.4.17'

      - name: Setup python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

@ -39,7 +39,7 @@ jobs:
          cp book/welcome_and_overview.html book/index.html

      - name: Upload Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
        with:
          name: book
          path: book
@ -50,7 +50,7 @@ jobs:
    name: Check links in documentation
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Setup mdbook
        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@ -50,7 +50,7 @@ jobs:
    needs:
      - pre
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
        with:
          # Fetch all history so that the schema_versions script works.
          fetch-depth: 0
@ -64,7 +64,7 @@ jobs:
        run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js

      - name: Setup python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

@ -78,18 +78,6 @@ jobs:
          mdbook build
          cp book/welcome_and_overview.html book/index.html

-      - name: Prepare and publish schema files
-        run: |
-          sudo apt-get update && sudo apt-get install -y yq
-          mkdir -p book/schema
-          # Remove developer notice before publishing.
-          rm schema/v*/Do\ not\ edit\ files\ in\ this\ folder
-          # Copy schema files that are independent from current Synapse version.
-          cp -r -t book/schema schema/v*/
-          # Convert config schema from YAML source file to JSON.
-          yq < schema/synapse-config.schema.yaml \
-            > book/schema/synapse-config.schema.json
-
      # Deploy to the target directory.
      - name: Deploy to gh pages
        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
--- a/.github/workflows/fix_lint.yaml
+++ b/.github/workflows/fix_lint.yaml
@ -13,22 +13,21 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master (rust 1.85.1)
+        uses: dtolnay/rust-toolchain@master
        with:
          # We use nightly so that `fmt` correctly groups together imports, and
          # clippy correctly fixes up the benchmarks.
          toolchain: nightly-2022-12-01
-          components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2

      - name: Setup Poetry
-        uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        uses: matrix-org/setup-python-poetry@v1
        with:
          install-project: "false"
-          poetry-version: "2.1.1"

      - name: Run ruff check
        continue-on-error: true
@ -44,6 +43,6 @@ jobs:
      - run: cargo fmt
        continue-on-error: true

-      - uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
+      - uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: "Attempt to fix linting"
--- a/.github/workflows/latest_deps.yml
+++ b/.github/workflows/latest_deps.yml
@ -39,17 +39,17 @@ jobs:
    if: needs.check_repo.outputs.should_run_workflow == 'true'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - name: Install Rust
-        uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2

      # The dev dependencies aren't exposed in the wheel metadata (at least with current
      # poetry-core versions), so we install with poetry.
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: "3.x"
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: "all"
      # Dump installed versions for debugging.
      - run: poetry run pip list > before.txt
@ -72,11 +72,11 @@ jobs:
            postgres-version: "14"

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2

      - run: sudo apt-get -qq install xmlsec1
      - name: Set up PostgreSQL ${{ matrix.postgres-version }}
@ -86,7 +86,7 @@ jobs:
            -e POSTGRES_PASSWORD=postgres \
            -e POSTGRES_INITDB_ARGS="--lc-collate C --lc-ctype C --encoding UTF8" \
            postgres:${{ matrix.postgres-version }}
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: pip install .[all,test]
@ -132,9 +132,9 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - sytest-tag: bullseye
+          - sytest-tag: focal

-          - sytest-tag: bullseye
+          - sytest-tag: focal
            postgres: postgres
            workers: workers
            redis: redis
@ -145,11 +145,11 @@ jobs:
      BLACKLIST: ${{ matrix.workers && 'synapse-blacklist-with-workers' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2

      - name: Ensure sytest runs `pip install`
        # Delete the lockfile so sytest will `pip install` rather than `poetry install`
@ -164,7 +164,7 @@ jobs:
        if: ${{ always() }}
        run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
      - name: Upload SyTest logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.*, ', ') }})
@ -192,15 +192,15 @@ jobs:
            database: Postgres

    steps:
-      - name: Check out synapse codebase
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run actions/checkout@v4 for synapse
+        uses: actions/checkout@v4
        with:
          path: synapse

      - name: Prepare Complement's Prerequisites
        run: synapse/.ci/scripts/setup_complement_prerequisites.sh

-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@v5
        with:
          cache-dependency-path: complement/go.sum
          go-version-file: complement/go.mod
@ -225,7 +225,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/poetry_lockfile.yaml
+++ b/.github/workflows/poetry_lockfile.yaml
@ -16,8 +16,8 @@ jobs:
    name: "Check locked dependencies have sdists"
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - run: pip install tomli
--- a/.github/workflows/push_complement_image.yml
+++ b/.github/workflows/push_complement_image.yml
@ -33,29 +33,29 @@ jobs:
      packages: write
    steps:
      - name: Checkout specific branch (debug build)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
        if: github.event_name == 'workflow_dispatch'
        with:
          ref: ${{ inputs.branch }}
      - name: Checkout clean copy of develop (scheduled build)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
        if: github.event_name == 'schedule'
        with:
          ref: develop
      - name: Checkout clean copy of master (on-push)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
        if: github.event_name == 'push'
        with:
          ref: master
      - name: Login to registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Work out labels for complement image
        id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/complement-synapse
          tags: |
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@ -27,8 +27,8 @@ jobs:
    name: "Calculate list of debian distros"
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - id: set-distros
@ -55,18 +55,18 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
        with:
          path: src

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@v3
        with:
          install: true

      - name: Set up docker layer caching
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
@ -74,7 +74,7 @@ jobs:
            ${{ runner.os }}-buildx-

      - name: Set up python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

@ -91,19 +91,10 @@ jobs:
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

-      - name: Artifact name
-        id: artifact-name
-        # We can't have colons in the upload name of the artifact, so we convert
-        # e.g. `debian:sid` to `sid`.
-        env:
-          DISTRO: ${{ matrix.distro }}
-        run: |
-          echo "ARTIFACT_NAME=${DISTRO#*:}" >> "$GITHUB_OUTPUT"
-
      - name: Upload debs as artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v3 # Don't upgrade to v4; broken: https://github.com/actions/upload-artifact#breaking-changes
        with:
-          name: debs-${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
+          name: debs
          path: debs/*

  build-wheels:
@ -111,7 +102,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        os: [ubuntu-22.04, macos-13]
+        os: [ubuntu-20.04, macos-12]
        arch: [x86_64, aarch64]
        # is_pr is a flag used to exclude certain jobs from the matrix on PRs.
        # It is not read by the rest of the workflow.
@ -121,29 +112,29 @@ jobs:
        exclude:
          # Don't build macos wheels on PR CI.
          - is_pr: true
-            os: "macos-13"
+            os: "macos-12"
          # Don't build aarch64 wheels on mac.
-          - os: "macos-13"
+          - os: "macos-12"
            arch: aarch64
          # Don't build aarch64 wheels on PR CI.
          - is_pr: true
            arch: aarch64

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@v5
        with:
          # setup-python@v4 doesn't impose a default python version. Need to use 3.x
          # here, because `python` on osx points to Python 2.7.
          python-version: "3.x"

      - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==2.23.0
+        run: python -m pip install cibuildwheel==2.19.1

      - name: Set up QEMU to emulate aarch64
        if: matrix.arch == 'aarch64'
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

@ -153,7 +144,7 @@ jobs:

      - name: Only build a single wheel on PR
        if: startsWith(github.ref, 'refs/pull/')
-        run: echo "CIBW_BUILD="cp39-manylinux_${{ matrix.arch }}"" >> $GITHUB_ENV
+        run: echo "CIBW_BUILD="cp38-manylinux_${{ matrix.arch }}"" >> $GITHUB_ENV

      - name: Build wheels
        run: python -m cibuildwheel --output-dir wheelhouse
@ -165,9 +156,9 @@ jobs:
          CARGO_NET_GIT_FETCH_WITH_CLI: true
          CIBW_ENVIRONMENT_PASS_LINUX: CARGO_NET_GIT_FETCH_WITH_CLI

-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@v3 # Don't upgrade to v4; broken: https://github.com/actions/upload-artifact#breaking-changes
        with:
-          name: Wheel-${{ matrix.os }}-${{ matrix.arch }}
+          name: Wheel
          path: ./wheelhouse/*.whl

  build-sdist:
@ -176,8 +167,8 @@ jobs:
    if: ${{ !startsWith(github.ref, 'refs/pull/') }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'

@ -186,7 +177,7 @@ jobs:
      - name: Build sdist
        run: python -m build --sdist

-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@v3 # Don't upgrade to v4; broken: https://github.com/actions/upload-artifact#breaking-changes
        with:
          name: Sdist
          path: dist/*.tar.gz
@ -203,23 +194,17 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Download all workflow run artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v3 # Don't upgrade to v4, it should match upload-artifact
      - name: Build a tarball for the debs
-        # We need to merge all the debs uploads into one folder, then compress
-        # that.
-        run: |
-          mkdir debs
-          mv debs*/* debs/
-          tar -cvJf debs.tar.xz debs
+        run: tar -cvJf debs.tar.xz debs
      - name: Attach to release
-        # Pinned to work around https://github.com/softprops/action-gh-release/issues/445
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v0.1.15
+        uses: softprops/action-gh-release@a929a66f232c1b11af63782948aa2210f981808a  # PR#109
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          files: |
            Sdist/*
-            Wheel*/*
+            Wheel/*
            debs.tar.xz
          # if it's not already published, keep the release as a draft.
          draft: true
--- a/.github/workflows/schema.yaml
+++ b/.github/workflows/schema.yaml
@ -1,57 +0,0 @@
-name: Schema
-
-on:
-  pull_request:
-    paths:
-      - schema/**
-      - docs/usage/configuration/config_documentation.md
-  push:
-    branches: ["develop", "release-*"]
-  workflow_dispatch:
-
-jobs:
-  validate-schema:
-    name: Ensure Synapse config schema is valid
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.x"
-      - name: Install check-jsonschema
-        run: pip install check-jsonschema==0.33.0
-
-      - name: Validate meta schema
-        run: check-jsonschema --check-metaschema schema/v*/meta.schema.json
-      - name: Validate schema
-        run: |-
-          # Please bump on introduction of a new meta schema.
-          LATEST_META_SCHEMA_VERSION=v1
-          check-jsonschema \
-            --schemafile="schema/$LATEST_META_SCHEMA_VERSION/meta.schema.json" \
-            schema/synapse-config.schema.yaml
-      - name: Validate default config
-      # Populates the empty instance with default values and checks against the schema.
-        run: |-
-          echo "{}" | check-jsonschema \
-            --fill-defaults --schemafile=schema/synapse-config.schema.yaml -
-
-  check-doc-generation:
-    name: Ensure generated documentation is up-to-date
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.x"
-      - name: Install PyYAML
-        run: pip install PyYAML==6.0.2
-
-      - name: Regenerate config documentation
-        run: |
-          scripts-dev/gen_config_documentation.py \
-            schema/synapse-config.schema.yaml \
-          > docs/usage/configuration/config_documentation.md
-      - name: Error in case of any differences
-      # Errors if there are now any modified files (untracked files are ignored).
-        run: 'git diff --exit-code'
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@ -23,7 +23,7 @@ jobs:
      linting: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.linting }}
      linting_readme: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.linting_readme }}
    steps:
-    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+    - uses: dorny/paths-filter@v3
      id: filter
      # We only check on PRs
      if: startsWith(github.ref, 'refs/pull/')
@ -83,14 +83,14 @@ jobs:
    if: ${{ needs.changes.outputs.linting == 'true' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: "3.x"
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: "all"
      - run: poetry run scripts-dev/generate_sample_config.sh --check
      - run: poetry run scripts-dev/config-lint.sh
@ -101,8 +101,8 @@ jobs:
    if: ${{ needs.changes.outputs.linting == 'true' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: "pip install 'click==8.1.1' 'GitPython>=3.1.20'"
@ -111,8 +111,8 @@ jobs:
  check-lockfile:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: .ci/scripts/check_lockfile.py
@ -124,12 +124,11 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4

      - name: Setup Poetry
-        uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        uses: matrix-org/setup-python-poetry@v1
        with:
-          poetry-version: "2.1.1"
          install-project: "false"

      - name: Run ruff check
@ -146,14 +145,14 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2

      - name: Setup Poetry
-        uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        uses: matrix-org/setup-python-poetry@v1
        with:
          # We want to make use of type hints in optional dependencies too.
          extras: all
@ -162,12 +161,11 @@ jobs:
          # https://github.com/matrix-org/synapse/pull/15376#issuecomment-1498983775
          # To make CI green, err towards caution and install the project.
          install-project: "true"
-          poetry-version: "2.1.1"

      # Cribbed from
      # https://github.com/AustinScola/mypy-cache-github-action/blob/85ea4f2972abed39b33bd02c36e341b28ca59213/src/restore.ts#L10-L17
      - name: Restore/persist mypy's cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@v4
        with:
          path: |
            .mypy_cache
@ -180,7 +178,7 @@ jobs:
  lint-crlf:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - name: Check line endings
        run: scripts-dev/check_line_terminators.sh

@ -188,11 +186,11 @@ jobs:
    if: ${{ (github.base_ref == 'develop'  || contains(github.base_ref, 'release-')) && github.actor != 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: "pip install 'towncrier>=18.6.0rc1'"
@ -206,15 +204,15 @@ jobs:
    if: ${{ needs.changes.outputs.linting == 'true' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2
+      - uses: matrix-org/setup-python-poetry@v1
        with:
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: "all"
      - run: poetry run scripts-dev/check_pydantic_models.py

@ -224,13 +222,13 @@ jobs:
    if: ${{ needs.changes.outputs.rust == 'true' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@0d72692bcfbf448b1e2afa01a67f71b455a9dcec # 1.86.0
+        uses: dtolnay/rust-toolchain@1.66.0
        with:
            components: clippy
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+      - uses: Swatinem/rust-cache@v2

      - run: cargo clippy -- -D warnings

@ -242,14 +240,14 @@ jobs:
    if: ${{ needs.changes.outputs.rust == 'true' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master (rust 1.85.1)
+        uses: dtolnay/rust-toolchain@master
        with:
-            toolchain: nightly-2025-04-23
+            toolchain: nightly-2022-12-01
            components: clippy
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+      - uses: Swatinem/rust-cache@v2

      - run: cargo clippy --all-features -- -D warnings

@ -259,15 +257,15 @@ jobs:
    if: ${{ needs.changes.outputs.rust == 'true' }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master (rust 1.85.1)
+        uses: dtolnay/rust-toolchain@master
        with:
          # We use nightly so that it correctly groups together imports
-          toolchain: nightly-2025-04-23
+          toolchain: nightly-2022-12-01
          components: rustfmt
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+      - uses: Swatinem/rust-cache@v2

      - run: cargo fmt --check

@ -278,8 +276,8 @@ jobs:
    needs: changes
    if: ${{ needs.changes.outputs.linting_readme == 'true' }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - run: "pip install rstcheck"
@ -303,7 +301,7 @@ jobs:
      - lint-readme
    runs-on: ubuntu-latest
    steps:
-      - uses: matrix-org/done-action@3409aa904e8a2aaf2220f09bc954d3d0b0a2ee67 # v3
+      - uses: matrix-org/done-action@v3
        with:
          needs: ${{ toJSON(needs) }}

@ -326,8 +324,8 @@ jobs:
    needs: linting-done
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - id: get-matrix
@ -347,7 +345,7 @@ jobs:
        job:  ${{ fromJson(needs.calculate-test-jobs.outputs.trial_test_matrix) }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - run: sudo apt-get -qq install xmlsec1
      - name: Set up PostgreSQL ${{ matrix.job.postgres-version }}
        if: ${{ matrix.job.postgres-version }}
@ -362,13 +360,13 @@ jobs:
            postgres:${{ matrix.job.postgres-version }}

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2

-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: ${{ matrix.job.python-version }}
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: ${{ matrix.job.extras }}
      - name: Await PostgreSQL
        if: ${{ matrix.job.postgres-version }}
@ -399,24 +397,24 @@ jobs:
    needs:
      - linting-done
      - changes
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2

      # There aren't wheels for some of the older deps, so we need to install
      # their build dependencies
      - run: |
          sudo apt-get -qq update
-          sudo apt-get -qq install build-essential libffi-dev python3-dev \
+          sudo apt-get -qq install build-essential libffi-dev python-dev \
            libxml2-dev libxslt-dev xmlsec1 zlib1g-dev libjpeg-dev libwebp-dev

-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@v5
        with:
-          python-version: '3.9'
+          python-version: '3.8'

      - name: Prepare old deps
        if: steps.cache-poetry-old-deps.outputs.cache-hit != 'true'
@ -460,17 +458,17 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        python-version: ["pypy-3.9"]
+        python-version: ["pypy-3.8"]
        extras: ["all"]

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      # Install libs necessary for PyPy to build binary wheels for dependencies
      - run: sudo apt-get -qq install xmlsec1 libxml2-dev libxslt-dev
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: ${{ matrix.python-version }}
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: ${{ matrix.extras }}
      - run: poetry run trial --jobs=2 tests
      - name: Dump logs
@ -514,13 +512,13 @@ jobs:
        job: ${{ fromJson(needs.calculate-test-jobs.outputs.sytest_test_matrix) }}

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - name: Prepare test blacklist
        run: cat sytest-blacklist .ci/worker-blacklist > synapse-blacklist-with-workers

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2

      - name: Run SyTest
        run: /bootstrap.sh synapse
@ -529,7 +527,7 @@ jobs:
        if: ${{ always() }}
        run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
      - name: Upload SyTest logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.job.*, ', ') }})
@ -559,11 +557,11 @@ jobs:
          --health-retries 5

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - run: sudo apt-get -qq install xmlsec1 postgresql-client
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: "postgres"
      - run: .ci/scripts/test_export_data_command.sh
        env:
@ -582,11 +580,11 @@ jobs:
    strategy:
      matrix:
        include:
-          - python-version: "3.9"
-            postgres-version: "13"
+          - python-version: "3.8"
+            postgres-version: "11"

-          - python-version: "3.13"
-            postgres-version: "17"
+          - python-version: "3.11"
+            postgres-version: "15"

    services:
      postgres:
@ -603,7 +601,7 @@ jobs:
          --health-retries 5

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - name: Add PostgreSQL apt repository
        # We need a version of pg_dump that can handle the version of
        # PostgreSQL being tested against. The Ubuntu package repository lags
@ -614,10 +612,10 @@ jobs:
          wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
          sudo apt-get update
      - run: sudo apt-get -qq install xmlsec1 postgresql-client
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: ${{ matrix.python-version }}
-          poetry-version: "2.1.1"
+          poetry-version: "1.3.2"
          extras: "postgres"
      - run: .ci/scripts/test_synapse_port_db.sh
        id: run_tester_script
@ -627,7 +625,7 @@ jobs:
          PGPASSWORD: postgres
          PGDATABASE: postgres
      - name: "Upload schema differences"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
        if: ${{ failure() && !cancelled() && steps.run_tester_script.outcome == 'failure' }}
        with:
          name: Schema dumps
@ -657,19 +655,19 @@ jobs:
            database: Postgres

    steps:
-      - name: Checkout synapse codebase
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run actions/checkout@v4 for synapse
+        uses: actions/checkout@v4
        with:
          path: synapse

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2

      - name: Prepare Complement's Prerequisites
        run: synapse/.ci/scripts/setup_complement_prerequisites.sh

-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@v5
        with:
          cache-dependency-path: complement/go.sum
          go-version-file: complement/go.mod
@ -692,11 +690,11 @@ jobs:
      - changes

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@c1678930c21fb233e4987c4ae12158f9125e5762 # 1.81.0
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@1.66.0
+      - uses: Swatinem/rust-cache@v2

      - run: cargo test

@ -710,13 +708,13 @@ jobs:
      - changes

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # master (rust 1.85.1)
+        uses: dtolnay/rust-toolchain@master
        with:
            toolchain: nightly-2022-12-01
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+      - uses: Swatinem/rust-cache@v2

      - run: cargo bench --no-run

@ -735,7 +733,7 @@ jobs:
      - linting-done
    runs-on: ubuntu-latest
    steps:
-      - uses: matrix-org/done-action@3409aa904e8a2aaf2220f09bc954d3d0b0a2ee67 # v3
+      - uses: matrix-org/done-action@v3
        with:
          needs: ${{ toJSON(needs) }}

--- a/.github/workflows/triage-incoming.yml
+++ b/.github/workflows/triage-incoming.yml
@ -6,7 +6,7 @@ on:

 jobs:
  triage:
-    uses: matrix-org/backend-meta/.github/workflows/triage-incoming.yml@18beaf3c8e536108bd04d18e6c3dc40ba3931e28 # v2.0.3
+    uses: matrix-org/backend-meta/.github/workflows/triage-incoming.yml@v2
    with:
      project_id: 'PVT_kwDOAIB0Bs4AFDdZ'
      content_id: ${{ github.event.issue.node_id }}
--- a/.github/workflows/triage_labelled.yml
+++ b/.github/workflows/triage_labelled.yml
@ -11,7 +11,7 @@ jobs:
    if: >
      contains(github.event.issue.labels.*.name, 'X-Needs-Info')
    steps:
-      - uses: actions/add-to-project@5b1a254a3546aef88e0a7724a77a623fa2e47c36 # main (v1.0.2 + 10 commits)
+      - uses: actions/add-to-project@main
        id: add_project
        with:
          project-url: "https://github.com/orgs/matrix-org/projects/67"
--- a/.github/workflows/twisted_trunk.yml
+++ b/.github/workflows/twisted_trunk.yml
@ -40,17 +40,16 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2

-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: "3.x"
          extras: "all"
-          poetry-version: "2.1.1"
      - run: |
          poetry remove twisted
          poetry add --extras tls git+https://github.com/twisted/twisted.git#${{ inputs.twisted_ref || 'trunk' }}
@ -65,18 +64,17 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - run: sudo apt-get -qq install xmlsec1

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2

-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+      - uses: matrix-org/setup-python-poetry@v1
        with:
          python-version: "3.x"
          extras: "all test"
-          poetry-version: "2.1.1"
      - run: |
          poetry remove twisted
          poetry add --extras tls git+https://github.com/twisted/twisted.git#trunk
@ -101,20 +99,20 @@ jobs:
    if: needs.check_repo.outputs.should_run_workflow == 'true'
    runs-on: ubuntu-latest
    container:
-      # We're using debian:bullseye because it uses Python 3.9 which is our minimum supported Python version.
+      # We're using ubuntu:focal because it uses Python 3.8 which is our minimum supported Python version.
      # This job is a canary to warn us about unreleased twisted changes that would cause problems for us if
      # they were to be released immediately. For simplicity's sake (and to save CI runners) we use the oldest
      # version, assuming that any incompatibilities on newer versions would also be present on the oldest.
-      image: matrixdotorg/sytest-synapse:bullseye
+      image: matrixdotorg/sytest-synapse:focal
      volumes:
        - ${{ github.workspace }}:/src

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable (rust 1.85.1)
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2

      - name: Patch dependencies
        # Note: The poetry commands want to create a virtualenv in /src/.venv/,
@ -138,7 +136,7 @@ jobs:
        if: ${{ always() }}
        run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
      - name: Upload SyTest logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.*, ', ') }})
@ -166,14 +164,14 @@ jobs:

    steps:
      - name: Run actions/checkout@v4 for synapse
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
        with:
          path: synapse

      - name: Prepare Complement's Prerequisites
        run: synapse/.ci/scripts/setup_complement_prerequisites.sh

-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@v5
        with:
          cache-dependency-path: complement/go.sum
          go-version-file: complement/go.mod
@ -183,11 +181,11 @@ jobs:
        run: |
          set -x
          DEBIAN_FRONTEND=noninteractive sudo apt-get install -yqq python3 pipx
-          pipx install poetry==2.1.1
+          pipx install poetry==1.3.2

          poetry remove -n twisted
          poetry add -n --extras tls git+https://github.com/twisted/twisted.git#trunk
-          poetry lock
+          poetry lock --no-update
        working-directory: synapse

      - run: |
@ -208,7 +206,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
      - uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/CHANGES.md
+++ b/CHANGES.md
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/LICENSE-AGPL-3.0
+++ b/LICENSE-AGPL-3.0
--- a/6
+++ b/6
@ -1,6 +0,0 @@
-Licensees holding a valid commercial license with Element may use this
-software in accordance with the terms contained in a written agreement
-between you and Element.
-
-To purchase a commercial license please contact our sales team at
-licensing@element.io
--- a/README.rst
+++ b/README.rst
@ -10,15 +10,14 @@ implementation, written and maintained by `Element <https://element.io>`_.
 `Matrix <https://github.com/matrix-org>`__ is the open standard for
 secure and interoperable real time communications. You can directly run
 and manage the source code in this repository, available under an AGPL
-license (or alternatively under a commercial license from Element).
-There is no support provided by Element unless you have a
-subscription from Element.
+license. There is no support provided from Element unless you have a
+subscription.

-Subscription
-============
+Subscription alternative
+========================

-For those that need an enterprise-ready solution, Element
-Server Suite (ESS) is `available via subscription <https://element.io/pricing>`_.
+Alternatively, for those that need an enterprise-ready solution, Element
+Server Suite (ESS) is `available as a subscription <https://element.io/pricing>`_.
 ESS builds on Synapse to offer a complete Matrix-based backend including the full
 `Admin Console product <https://element.io/enterprise-functionality/admin-console>`_,
 giving admins the power to easily manage an organization-wide
@ -250,22 +249,6 @@ Developers might be particularly interested in:
 Alongside all that, join our developer community on Matrix:
 `#synapse-dev:matrix.org <https://matrix.to/#/#synapse-dev:matrix.org>`_, featuring real humans!

-Copyright and Licensing
-=======================
-
-| Copyright 2014-2017 OpenMarket Ltd
-| Copyright 2017 Vector Creations Ltd
-| Copyright 2017-2025 New Vector Ltd
-|
-
-This software is dual-licensed by New Vector Ltd (Element). It can be used either:
-
-(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
-
-(2) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
-
-Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
-

 .. |support| image:: https://img.shields.io/badge/matrix-community%20support-success
  :alt: (get community support in #synapse:matrix.org)
--- a/build_rust.py
+++ b/build_rust.py
@ -1,10 +1,8 @@
 # A build script for poetry that adds the rust extension.

-import itertools
 import os
 from typing import Any, Dict

-from packaging.specifiers import SpecifierSet
 from setuptools_rust import Binding, RustExtension


@ -16,8 +14,6 @@ def build(setup_kwargs: Dict[str, Any]) -> None:
        target="synapse.synapse_rust",
        path=cargo_toml_path,
        binding=Binding.PyO3,
-        # This flag is a no-op in the latest versions. Instead, we need to
-        # specify this in the `bdist_wheel` config below.
        py_limited_api=True,
        # We force always building in release mode, as we can't tell the
        # difference between using `poetry` in development vs production.
@ -25,18 +21,3 @@ def build(setup_kwargs: Dict[str, Any]) -> None:
    )
    setup_kwargs.setdefault("rust_extensions", []).append(extension)
    setup_kwargs["zip_safe"] = False
-
-    # We lookup the minimum supported python version by looking at
-    # `python_requires` (e.g. ">=3.9.0,<4.0.0") and finding the first python
-    # version that matches. We then convert that into the `py_limited_api` form,
-    # e.g. cp39 for python 3.9.
-    py_limited_api: str
-    python_bounds = SpecifierSet(setup_kwargs["python_requires"])
-    for minor_version in itertools.count(start=8):
-        if f"3.{minor_version}.0" in python_bounds:
-            py_limited_api = f"cp3{minor_version}"
-            break
-
-    setup_kwargs.setdefault("options", {}).setdefault("bdist_wheel", {})[
-        "py_limited_api"
-    ] = py_limited_api
--- a/changelog.d/18070.feature
+++ b/changelog.d/18070.feature
@ -1 +0,0 @@
-Support for [MSC4235](https://github.com/matrix-org/matrix-spec-proposals/pull/4235): via query param for hierarchy endpoint. Contributed by Krishan (@kfiven).
--- a/changelog.d/18196.feature
+++ b/changelog.d/18196.feature
@ -1 +0,0 @@
-Add `forget_forced_upon_leave` capability as per [MSC4267](https://github.com/matrix-org/matrix-spec-proposals/pull/4267).
--- a/changelog.d/18241.feature
+++ b/changelog.d/18241.feature
@ -1 +0,0 @@
-Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper.
--- a/changelog.d/18509.bugfix
+++ b/changelog.d/18509.bugfix
@ -1 +0,0 @@
-Fix `KeyError` on background updates when using split main/state databases.
--- a/changelog.d/18573.misc
+++ b/changelog.d/18573.misc
@ -1 +0,0 @@
-Improve docstring on `simple_upsert_many`.
--- a/changelog.d/18582.bugfix
+++ b/changelog.d/18582.bugfix
@ -1 +0,0 @@
-Improve performance of device deletion by adding missing index.
--- a/changelog.d/18595.misc
+++ b/changelog.d/18595.misc
@ -1 +0,0 @@
-Better handling of ratelimited requests.
--- a/changelog.d/18600.misc
+++ b/changelog.d/18600.misc
@ -1 +0,0 @@
-Better handling of ratelimited requests.
--- a/changelog.d/18602.misc
+++ b/changelog.d/18602.misc
@ -1 +0,0 @@
-Speed up bulk device deletion.
--- a/changelog.d/18605.bugfix
+++ b/changelog.d/18605.bugfix
@ -1 +0,0 @@
-Ensure policy servers are not asked to scan policy server change events, allowing rooms to disable the use of a policy server while the policy server is down.
--- a/contrib/cmdclient/console.py
+++ b/contrib/cmdclient/console.py
@ -245,7 +245,7 @@ class SynapseCmd(cmd.Cmd):

        if "flows" not in json_res:
            print("Failed to find any login flows.")
-            return False
+            defer.returnValue(False)

        flow = json_res["flows"][0]  # assume first is the one we want.
        if "type" not in flow or "m.login.password" != flow["type"] or "stages" in flow:
@ -254,8 +254,8 @@ class SynapseCmd(cmd.Cmd):
                "Unable to login via the command line client. Please visit "
                "%s to login." % fallback_url
            )
-            return False
-        return True
+            defer.returnValue(False)
+        defer.returnValue(True)

    def do_emailrequest(self, line):
        """Requests the association of a third party identifier
--- a/contrib/cmdclient/http.py
+++ b/contrib/cmdclient/http.py
@ -78,7 +78,7 @@ class TwistedHttpClient(HttpClient):
            url, data, headers_dict={"Content-Type": ["application/json"]}
        )
        body = yield readBody(response)
-        return response.code, body
+        defer.returnValue((response.code, body))

    @defer.inlineCallbacks
    def get_json(self, url, args=None):
@ -88,7 +88,7 @@ class TwistedHttpClient(HttpClient):
            url = "%s?%s" % (url, qs)
        response = yield self._create_get_request(url)
        body = yield readBody(response)
-        return json.loads(body)
+        defer.returnValue(json.loads(body))

    def _create_put_request(self, url, json_data, headers_dict: Optional[dict] = None):
        """Wrapper of _create_request to issue a PUT request"""
@ -134,7 +134,7 @@ class TwistedHttpClient(HttpClient):
            response = yield self._create_request(method, url)

        body = yield readBody(response)
-        return json.loads(body)
+        defer.returnValue(json.loads(body))

    @defer.inlineCallbacks
    def _create_request(
@ -173,7 +173,7 @@ class TwistedHttpClient(HttpClient):
        if self.verbose:
            print("Status %s %s" % (response.code, response.phrase))
            print(pformat(list(response.headers.getAllRawHeaders())))
-        return response
+        defer.returnValue(response)

    def sleep(self, seconds):
        d = defer.Deferred()
--- a/contrib/docker/README.md
+++ b/contrib/docker/README.md
@ -30,6 +30,3 @@ docker-compose up -d
 ### More information

 For more information on required environment variables and mounts, see the main docker documentation at [/docker/README.md](../../docker/README.md)
-
-**For a more comprehensive Docker Compose example showcasing a full Matrix 2.0 stack, please see
-https://github.com/element-hq/element-docker-demo**
--- a/contrib/docker/docker-compose.yml
+++ b/contrib/docker/docker-compose.yml
@ -51,7 +51,7 @@ services:
      - traefik.http.routers.https-synapse.tls.certResolver=le-ssl

  db:
-    image: docker.io/postgres:15-alpine
+    image: docker.io/postgres:12-alpine
    # Change that password, of course!
    environment:
      - POSTGRES_USER=synapse
--- a/contrib/docker_compose_workers/README.md
+++ b/contrib/docker_compose_workers/README.md
@ -8,9 +8,6 @@ All examples and snippets assume that your Synapse service is called `synapse` i

 An example Docker Compose file can be found [here](docker-compose.yaml).

-**For a more comprehensive Docker Compose example, showcasing a full Matrix 2.0 stack (originally based on this
-docker-compose.yaml), please see https://github.com/element-hq/element-docker-demo**
-
 ## Worker Service Examples in Docker Compose

 In order to start the Synapse container as a worker, you must specify an `entrypoint` that loads both the `homeserver.yaml` and the configuration for the worker (`synapse-generic-worker-1.yaml` in the example below). You must also include the worker type in the environment variable `SYNAPSE_WORKER` or alternatively pass `-m synapse.app.generic_worker` as part of the `entrypoint` after `"/start.py", "run"`).
--- a/contrib/grafana/synapse.json
+++ b/contrib/grafana/synapse.json
@ -220,24 +220,29 @@
      "yBucketBound": "auto"
    },
    {
-      "datasource": {
-        "uid": "${DS_PROMETHEUS}",
-        "type": "prometheus"
-      },
      "aliasColors": {},
+      "bars": false,
      "dashLength": 10,
+      "dashes": false,
+      "datasource": {
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "description": "",
      "fieldConfig": {
        "defaults": {
          "links": []
        },
        "overrides": []
      },
+      "fill": 0,
+      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 12,
        "y": 1
      },
+      "hiddenSeries": false,
      "id": 152,
      "legend": {
        "avg": false,
@ -250,81 +255,71 @@
        "values": false
      },
      "lines": true,
+      "linewidth": 0,
+      "links": [],
      "nullPointMode": "connected",
      "options": {
        "alertThreshold": true
      },
      "paceLength": 10,
-      "pluginVersion": "10.4.3",
+      "percentage": false,
+      "pluginVersion": "9.2.2",
      "pointradius": 5,
+      "points": false,
      "renderer": "flot",
      "seriesOverrides": [
        {
          "alias": "Avg",
          "fill": 0,
-          "linewidth": 3,
-          "$$hashKey": "object:48"
+          "linewidth": 3
        },
        {
          "alias": "99%",
          "color": "#C4162A",
-          "fillBelowTo": "90%",
-          "$$hashKey": "object:49"
+          "fillBelowTo": "90%"
        },
        {
          "alias": "90%",
          "color": "#FF7383",
-          "fillBelowTo": "75%",
-          "$$hashKey": "object:50"
+          "fillBelowTo": "75%"
        },
        {
          "alias": "75%",
          "color": "#FFEE52",
-          "fillBelowTo": "50%",
-          "$$hashKey": "object:51"
+          "fillBelowTo": "50%"
        },
        {
          "alias": "50%",
          "color": "#73BF69",
-          "fillBelowTo": "25%",
-          "$$hashKey": "object:52"
+          "fillBelowTo": "25%"
        },
        {
          "alias": "25%",
          "color": "#1F60C4",
-          "fillBelowTo": "5%",
-          "$$hashKey": "object:53"
+          "fillBelowTo": "5%"
        },
        {
          "alias": "5%",
-          "lines": false,
-          "$$hashKey": "object:54"
+          "lines": false
        },
        {
          "alias": "Average",
          "color": "rgb(255, 255, 255)",
          "lines": true,
-          "linewidth": 3,
-          "$$hashKey": "object:55"
+          "linewidth": 3
        },
        {
-          "alias": "Local events being persisted",
-          "color": "#96d98D",
-          "points": true,
-          "yaxis": 2,
-          "zindex": -3,
-          "$$hashKey": "object:56"
-        },
-        {
-          "$$hashKey": "object:329",
+          "alias": "Events",
          "color": "#B877D9",
-          "alias": "All events being persisted",
+          "hideTooltip": true,
          "points": true,
          "yaxis": 2,
          "zindex": -3
        }
      ],
      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
      "targets": [
        {
          "datasource": {
@ -389,20 +384,7 @@
          },
          "expr": "sum(rate(synapse_http_server_response_time_seconds_sum{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) / sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size]))",
          "legendFormat": "Average",
-          "refId": "H",
-          "editorMode": "code",
-          "range": true
-        },
-        {
-          "datasource": {
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "expr": "sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size]))",
-          "hide": false,
-          "instant": false,
-          "legendFormat": "Local events being persisted",
-          "refId": "E",
-          "editorMode": "code"
+          "refId": "H"
        },
        {
          "datasource": {
@ -411,9 +393,8 @@
          "expr": "sum(rate(synapse_storage_events_persisted_events_total{instance=\"$instance\"}[$bucket_size]))",
          "hide": false,
          "instant": false,
-          "legendFormat": "All events being persisted",
-          "refId": "I",
-          "editorMode": "code"
+          "legendFormat": "Events",
+          "refId": "E"
        }
      ],
      "thresholds": [
@ -447,9 +428,7 @@
      "xaxis": {
        "mode": "time",
        "show": true,
-        "values": [],
-        "name": null,
-        "buckets": null
+        "values": []
      },
      "yaxes": [
        {
@ -471,20 +450,7 @@
      ],
      "yaxis": {
        "align": false
-      },
-      "bars": false,
-      "dashes": false,
-      "description": "",
-      "fill": 0,
-      "fillGradient": 0,
-      "hiddenSeries": false,
-      "linewidth": 0,
-      "percentage": false,
-      "points": false,
-      "stack": false,
-      "steppedLine": false,
-      "timeFrom": null,
-      "timeShift": null
+      }
    },
    {
      "aliasColors": {},
--- a/debian/build_virtualenv
+++ b/debian/build_virtualenv
@ -35,7 +35,7 @@ TEMP_VENV="$(mktemp -d)"
 python3 -m venv "$TEMP_VENV"
 source "$TEMP_VENV/bin/activate"
 pip install -U pip
-pip install poetry==2.1.1 poetry-plugin-export==1.9.0
+pip install poetry==1.3.2
 poetry export \
    --extras all \
    --extras test \
--- a/debian/changelog
+++ b/debian/changelog
@ -1,238 +1,3 @@
-matrix-synapse-py3 (1.133.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.133.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 24 Jun 2025 11:57:47 +0100
-
-matrix-synapse-py3 (1.132.0) stable; urgency=medium
-
-  * New Synapse release 1.132.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 17 Jun 2025 13:16:20 +0100
-
-matrix-synapse-py3 (1.132.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.132.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 10 Jun 2025 11:15:18 +0100
-
-matrix-synapse-py3 (1.131.0) stable; urgency=medium
-
-  * New Synapse release 1.131.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 03 Jun 2025 14:36:55 +0100
-
-matrix-synapse-py3 (1.131.0~rc1) stable; urgency=medium
-
-  * New synapse release 1.131.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 28 May 2025 10:25:44 +0000
-
-matrix-synapse-py3 (1.130.0) stable; urgency=medium
-
-  * New Synapse release 1.130.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 20 May 2025 08:34:13 -0600
-
-matrix-synapse-py3 (1.130.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.130.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 13 May 2025 10:44:04 +0100
-
-matrix-synapse-py3 (1.129.0) stable; urgency=medium
-
-  * New Synapse release 1.129.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 06 May 2025 12:22:11 +0100
-
-matrix-synapse-py3 (1.129.0~rc2) stable; urgency=medium
-
-  * New synapse release 1.129.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 30 Apr 2025 13:13:16 +0000
-
-matrix-synapse-py3 (1.129.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.129.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 15 Apr 2025 10:47:43 -0600
-
-matrix-synapse-py3 (1.128.0) stable; urgency=medium
-
-  * New Synapse release 1.128.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 08 Apr 2025 14:09:54 +0100
-
-matrix-synapse-py3 (1.128.0~rc1) stable; urgency=medium
-
-  * Update Poetry to 2.1.1.
-  * New synapse release 1.128.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 01 Apr 2025 14:35:33 +0000
-
-matrix-synapse-py3 (1.127.1) stable; urgency=medium
-
-  * New Synapse release 1.127.1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 26 Mar 2025 21:07:31 +0000
-
-matrix-synapse-py3 (1.127.0) stable; urgency=medium
-
-  * New Synapse release 1.127.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 25 Mar 2025 12:04:15 +0000
-
-matrix-synapse-py3 (1.127.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.127.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 18 Mar 2025 13:30:05 +0000
-
-matrix-synapse-py3 (1.126.0) stable; urgency=medium
-
-  * New Synapse release 1.126.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 11 Mar 2025 13:11:29 +0000
-
-matrix-synapse-py3 (1.126.0~rc3) stable; urgency=medium
-
-  * New Synapse release 1.126.0rc3.
-
- -- Synapse Packaging team <packages@matrix.org>  Fri, 07 Mar 2025 15:45:05 +0000
-
-matrix-synapse-py3 (1.126.0~rc2) stable; urgency=medium
-
-  * New Synapse release 1.126.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 05 Mar 2025 14:29:12 +0000
-
-matrix-synapse-py3 (1.126.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.126.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 04 Mar 2025 13:11:51 +0000
-
-matrix-synapse-py3 (1.125.0) stable; urgency=medium
-
-  * New Synapse release 1.125.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 25 Feb 2025 08:10:07 -0700
-
-matrix-synapse-py3 (1.125.0~rc1) stable; urgency=medium
-
-  * New synapse release 1.125.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 18 Feb 2025 13:32:49 +0000
-
-matrix-synapse-py3 (1.124.0) stable; urgency=medium
-
-  * New Synapse release 1.124.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 11 Feb 2025 11:55:22 +0100
-
-matrix-synapse-py3 (1.124.0~rc3) stable; urgency=medium
-
-  * New Synapse release 1.124.0rc3.
-
- -- Synapse Packaging team <packages@matrix.org>  Fri, 07 Feb 2025 13:42:55 +0000
-
-matrix-synapse-py3 (1.124.0~rc2) stable; urgency=medium
-
-  * New Synapse release 1.124.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 05 Feb 2025 16:35:53 +0000
-
-matrix-synapse-py3 (1.124.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.124.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 04 Feb 2025 11:53:05 +0000
-
-matrix-synapse-py3 (1.123.0) stable; urgency=medium
-
-  * New Synapse release 1.123.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 28 Jan 2025 08:37:34 -0700
-
-matrix-synapse-py3 (1.123.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.123.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 21 Jan 2025 14:39:57 +0100
-
-matrix-synapse-py3 (1.122.0) stable; urgency=medium
-
-  * New Synapse release 1.122.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 14 Jan 2025 14:14:14 +0000
-
-matrix-synapse-py3 (1.122.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.122.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Jan 2025 14:06:19 +0000
-
-matrix-synapse-py3 (1.121.1) stable; urgency=medium
-
-  * New Synapse release 1.121.1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 11 Dec 2024 18:24:48 +0000
-
-matrix-synapse-py3 (1.121.0) stable; urgency=medium
-
-  * New Synapse release 1.121.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 11 Dec 2024 13:12:30 +0100
-
-matrix-synapse-py3 (1.121.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.121.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 04 Dec 2024 14:47:23 +0000
-
-matrix-synapse-py3 (1.120.2) stable; urgency=medium
-
-  * New synapse release 1.120.2.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 03 Dec 2024 15:43:37 +0000
-
-matrix-synapse-py3 (1.120.1) stable; urgency=medium
-
-  * New synapse release 1.120.1.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 03 Dec 2024 09:07:57 +0000
-
-matrix-synapse-py3 (1.120.0) stable; urgency=medium
-
-  * New synapse release 1.120.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Tue, 26 Nov 2024 13:10:23 +0000
-
-matrix-synapse-py3 (1.120.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.120.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 20 Nov 2024 15:02:21 +0000
-
-matrix-synapse-py3 (1.119.0) stable; urgency=medium
-
-  * New Synapse release 1.119.0.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 13 Nov 2024 13:57:51 +0000
-
-matrix-synapse-py3 (1.119.0~rc2) stable; urgency=medium
-
-  * New Synapse release 1.119.0rc2.
-
- -- Synapse Packaging team <packages@matrix.org>  Mon, 11 Nov 2024 14:33:02 +0000
-
-matrix-synapse-py3 (1.119.0~rc1) stable; urgency=medium
-
-  * New Synapse release 1.119.0rc1.
-
- -- Synapse Packaging team <packages@matrix.org>  Wed, 06 Nov 2024 08:59:43 -0700
-
 matrix-synapse-py3 (1.118.0) stable; urgency=medium

  * New Synapse release 1.118.0.
--- a/demo/start.sh
+++ b/demo/start.sh
@ -138,13 +138,6 @@ for port in 8080 8081 8082; do
 			  per_user:
 			    per_second: 1000
 			    burst_count: 1000
-			rc_presence:
-			  per_user:
-			    per_second: 1000
-			    burst_count: 1000
-			rc_delayed_event_mgmt:
-			  per_second: 1000
-			  burst_count: 1000
 			RC
 			)
            echo "${ratelimiting}" >> "$port.config"
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@ -20,16 +20,45 @@
 # `poetry export | pip install -r /dev/stdin`, but beware: we have experienced bugs in
 # in `poetry export` in the past.

-ARG DEBIAN_VERSION=bookworm
-ARG PYTHON_VERSION=3.12
-ARG POETRY_VERSION=2.1.1
+ARG PYTHON_VERSION=3.11

 ###
 ### Stage 0: generate requirements.txt
 ###
-### This stage is platform-agnostic, so we can use the build platform in case of cross-compilation.
-###
-FROM --platform=$BUILDPLATFORM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS requirements
+# We hardcode the use of Debian bookworm here because this could change upstream
+# and other Dockerfiles used for testing are expecting bookworm.
+FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm AS requirements
+
+# RUN --mount is specific to buildkit and is documented at
+# https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/syntax.md#build-mounts-run---mount.
+# Here we use it to set up a cache for apt (and below for pip), to improve
+# rebuild speeds on slow connections.
+RUN \
+  --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt,sharing=locked \
+  apt-get update -qq && apt-get install -yqq \
+  build-essential curl git libffi-dev libssl-dev pkg-config \
+  && rm -rf /var/lib/apt/lists/*
+
+# Install rust and ensure its in the PATH.
+# (Rust may be needed to compile `cryptography`---which is one of poetry's
+# dependencies---on platforms that don't have a `cryptography` wheel.
+ENV RUSTUP_HOME=/rust
+ENV CARGO_HOME=/cargo
+ENV PATH=/cargo/bin:/rust/bin:$PATH
+RUN mkdir /rust /cargo
+
+RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain stable --profile minimal
+
+# arm64 builds consume a lot of memory if `CARGO_NET_GIT_FETCH_WITH_CLI` is not
+# set to true, so we expose it as a build-arg.
+ARG CARGO_NET_GIT_FETCH_WITH_CLI=false
+ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_NET_GIT_FETCH_WITH_CLI
+
+# We install poetry in its own build stage to avoid its dependencies conflicting with
+# synapse's dependencies.
+RUN --mount=type=cache,target=/root/.cache/pip \
+  pip install --user "poetry==1.3.2"

 WORKDIR /synapse

@ -46,30 +75,41 @@ ARG TEST_ONLY_SKIP_DEP_HASH_VERIFICATION
 # Instead, we'll just install what a regular `pip install` would from PyPI.
 ARG TEST_ONLY_IGNORE_POETRY_LOCKFILE

-# This silences a warning as uv isn't able to do hardlinks between its cache
-# (mounted as --mount=type=cache) and the target directory.
-ENV UV_LINK_MODE=copy
-
 # Export the dependencies, but only if we're actually going to use the Poetry lockfile.
 # Otherwise, just create an empty requirements file so that the Dockerfile can
 # proceed.
-ARG POETRY_VERSION
-RUN --mount=type=cache,target=/root/.cache/uv \
-  if [ -z "$TEST_ONLY_IGNORE_POETRY_LOCKFILE" ]; then \
-    uvx --with poetry-plugin-export==1.9.0 \
-        poetry@${POETRY_VERSION} export --extras all -o /synapse/requirements.txt ${TEST_ONLY_SKIP_DEP_HASH_VERIFICATION:+--without-hashes}; \
+RUN if [ -z "$TEST_ONLY_IGNORE_POETRY_LOCKFILE" ]; then \
+  /root/.local/bin/poetry export --extras all -o /synapse/requirements.txt ${TEST_ONLY_SKIP_DEP_HASH_VERIFICATION:+--without-hashes}; \
  else \
-    touch /synapse/requirements.txt; \
+  touch /synapse/requirements.txt; \
  fi

 ###
 ### Stage 1: builder
 ###
-FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS builder
+FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm AS builder
+
+# install the OS build deps
+RUN \
+  --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt,sharing=locked \
+  apt-get update -qq && apt-get install -yqq \
+  build-essential \
+  libffi-dev \
+  libjpeg-dev \
+  libpq-dev \
+  libssl-dev \
+  libwebp-dev \
+  libxml++2.6-dev \
+  libxslt1-dev \
+  openssl \
+  zlib1g-dev \
+  git \
+  curl \
+  libicu-dev \
+  pkg-config \
+  && rm -rf /var/lib/apt/lists/*

-# This silences a warning as uv isn't able to do hardlinks between its cache
-# (mounted as --mount=type=cache) and the target directory.
-ENV UV_LINK_MODE=copy

 # Install rust and ensure its in the PATH
 ENV RUSTUP_HOME=/rust
@ -79,6 +119,7 @@ RUN mkdir /rust /cargo

 RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain stable --profile minimal

+
 # arm64 builds consume a lot of memory if `CARGO_NET_GIT_FETCH_WITH_CLI` is not
 # set to true, so we expose it as a build-arg.
 ARG CARGO_NET_GIT_FETCH_WITH_CLI=false
@ -90,8 +131,8 @@ ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_NET_GIT_FETCH_WITH_CLI
 #
 # This is aiming at installing the `[tool.poetry.depdendencies]` from pyproject.toml.
 COPY --from=requirements /synapse/requirements.txt /synapse/
-RUN --mount=type=cache,target=/root/.cache/uv \
-  uv pip install --prefix="/install" --no-deps -r /synapse/requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+  pip install --prefix="/install" --no-deps --no-warn-script-location -r /synapse/requirements.txt

 # Copy over the rest of the synapse source code.
 COPY synapse /synapse/synapse/
@ -105,85 +146,41 @@ ARG TEST_ONLY_IGNORE_POETRY_LOCKFILE
 # Install the synapse package itself.
 # If we have populated requirements.txt, we don't install any dependencies
 # as we should already have those from the previous `pip install` step.
-RUN \
-  --mount=type=cache,target=/root/.cache/uv \
-  --mount=type=cache,target=/synapse/target,sharing=locked \
+RUN --mount=type=cache,target=/synapse/target,sharing=locked \
  --mount=type=cache,target=${CARGO_HOME}/registry,sharing=locked \
  if [ -z "$TEST_ONLY_IGNORE_POETRY_LOCKFILE" ]; then \
-    uv pip install --prefix="/install" --no-deps /synapse[all]; \
+  pip install --prefix="/install" --no-deps --no-warn-script-location /synapse[all]; \
  else \
-    uv pip install --prefix="/install" /synapse[all]; \
+  pip install --prefix="/install" --no-warn-script-location /synapse[all]; \
  fi

 ###
-### Stage 2: runtime dependencies download for ARM64 and AMD64
-###
-FROM --platform=$BUILDPLATFORM docker.io/library/debian:${DEBIAN_VERSION} AS runtime-deps
-
-# Tell apt to keep downloaded package files, as we're using cache mounts.
-RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
-
-# Add both target architectures
-RUN dpkg --add-architecture arm64
-RUN dpkg --add-architecture amd64
-
-# Fetch the runtime dependencies debs for both architectures
-# We do that by building a recursive list of packages we need to download with `apt-cache depends`
-# and then downloading them with `apt-get download`.
-RUN \
-  --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt,sharing=locked \
-  apt-get update -qq && \
-  apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances --no-pre-depends \
-      curl \
-      gosu \
-      libjpeg62-turbo \
-      libpq5 \
-      libwebp7 \
-      xmlsec1 \
-      libjemalloc2 \
-      libicu \
-    | grep '^\w' > /tmp/pkg-list && \
-  for arch in arm64 amd64; do \
-    mkdir -p /tmp/debs-${arch} && \
-    cd /tmp/debs-${arch} && \
-    apt-get -o APT::Architecture="${arch}" download $(cat /tmp/pkg-list); \
-  done
-
-# Extract the debs for each architecture
-RUN \
-  for arch in arm64 amd64; do \
-    mkdir -p /install-${arch}/var/lib/dpkg/status.d/ && \
-    for deb in /tmp/debs-${arch}/*.deb; do \
-      package_name=$(dpkg-deb -I ${deb} | awk '/^ Package: .*$/ {print $2}'); \
-      echo "Extracting: ${package_name}"; \
-      dpkg --ctrl-tarfile $deb | tar -Ox ./control > /install-${arch}/var/lib/dpkg/status.d/${package_name}; \
-      dpkg --extract $deb /install-${arch}; \
-    done; \
-  done
-
-
-###
-### Stage 3: runtime
+### Stage 2: runtime
 ###

-FROM docker.io/library/python:${PYTHON_VERSION}-slim-${DEBIAN_VERSION}
-
-ARG TARGETARCH
+FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm

 LABEL org.opencontainers.image.url='https://matrix.org/docs/projects/server/synapse'
 LABEL org.opencontainers.image.documentation='https://github.com/element-hq/synapse/blob/master/docker/README.md'
 LABEL org.opencontainers.image.source='https://github.com/element-hq/synapse.git'
 LABEL org.opencontainers.image.licenses='AGPL-3.0-or-later'

-# On the runtime image, /lib is a symlink to /usr/lib, so we need to copy the
-# libraries to the right place, else the `COPY` won't work.
-# On amd64, we'll also have a /lib64 folder with ld-linux-x86-64.so.2, which is
-# already present in the runtime image.
-COPY --from=runtime-deps /install-${TARGETARCH}/lib /usr/lib
-COPY --from=runtime-deps /install-${TARGETARCH}/etc /etc
-COPY --from=runtime-deps /install-${TARGETARCH}/usr /usr
-COPY --from=runtime-deps /install-${TARGETARCH}/var /var
+RUN \
+  --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt,sharing=locked \
+  apt-get update -qq && apt-get install -yqq \
+  curl \
+  gosu \
+  libjpeg62-turbo \
+  libpq5 \
+  libwebp7 \
+  xmlsec1 \
+  libjemalloc2 \
+  libicu72 \
+  libssl-dev \
+  openssl \
+  && rm -rf /var/lib/apt/lists/*
+
 COPY --from=builder /install /usr/local
 COPY ./docker/start.py /start.py
 COPY ./docker/conf /conf
--- a/docker/Dockerfile-workers
+++ b/docker/Dockerfile-workers
@ -2,38 +2,18 @@

 ARG SYNAPSE_VERSION=latest
 ARG FROM=matrixdotorg/synapse:$SYNAPSE_VERSION
-ARG DEBIAN_VERSION=bookworm
-ARG PYTHON_VERSION=3.12

-# first of all, we create a base image with dependencies which we can copy into the
+# first of all, we create a base image with an nginx which we can copy into the
 # target image. For repeated rebuilds, this is much faster than apt installing
 # each time.

-FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS deps_base
-
-    # Tell apt to keep downloaded package files, as we're using cache mounts.
-    RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
-
+FROM docker.io/library/debian:bookworm-slim AS deps_base
    RUN \
       --mount=type=cache,target=/var/cache/apt,sharing=locked \
       --mount=type=cache,target=/var/lib/apt,sharing=locked \
      apt-get update -qq && \
      DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
-          nginx-light
-
-    RUN \
-    # remove default page
-      rm /etc/nginx/sites-enabled/default && \
-    # have nginx log to stderr/out
-      ln -sf /dev/stdout /var/log/nginx/access.log && \
-      ln -sf /dev/stderr /var/log/nginx/error.log
-
-    # --link-mode=copy silences a warning as uv isn't able to do hardlinks between its cache
-    # (mounted as --mount=type=cache) and the target directory.
-    RUN --mount=type=cache,target=/root/.cache/uv \
-      uv pip install --link-mode=copy --prefix="/uv/usr/local" supervisor~=4.2
-
-    RUN mkdir -p /uv/etc/supervisor/conf.d
+          redis-server nginx-light

 # Similarly, a base to copy the redis server from.
 #
@ -41,21 +21,31 @@ FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS deps_base
 # which makes it much easier to copy (but we need to make sure we use an image
 # based on the same debian version as the synapse image, to make sure we get
 # the expected version of libc.
-FROM docker.io/library/redis:7-${DEBIAN_VERSION} AS redis_base
+FROM docker.io/library/redis:7-bookworm AS redis_base

 # now build the final image, based on the the regular Synapse docker image
 FROM $FROM

-    # Copy over dependencies
+    # Install supervisord with pip instead of apt, to avoid installing a second
+    # copy of python.
+    RUN --mount=type=cache,target=/root/.cache/pip \
+        pip install supervisor~=4.2
+    RUN mkdir -p /etc/supervisor/conf.d
+
+    # Copy over redis and nginx
    COPY --from=redis_base /usr/local/bin/redis-server /usr/local/bin
-    COPY --from=deps_base /uv /
+
    COPY --from=deps_base /usr/sbin/nginx /usr/sbin
    COPY --from=deps_base /usr/share/nginx /usr/share/nginx
    COPY --from=deps_base /usr/lib/nginx /usr/lib/nginx
    COPY --from=deps_base /etc/nginx /etc/nginx
-    COPY --from=deps_base /var/log/nginx /var/log/nginx
-    # chown to allow non-root user to write to http-*-temp-path dirs
-    COPY --from=deps_base --chown=www-data:root /var/lib/nginx /var/lib/nginx
+    RUN rm /etc/nginx/sites-enabled/default
+    RUN mkdir /var/log/nginx /var/lib/nginx
+    RUN chown www-data /var/lib/nginx
+
+    # have nginx log to stderr/out
+    RUN ln -sf /dev/stdout /var/log/nginx/access.log
+    RUN ln -sf /dev/stderr /var/log/nginx/error.log

    # Copy Synapse worker, nginx and supervisord configuration template files
    COPY ./docker/conf-workers/* /conf/
@ -74,4 +64,4 @@ FROM $FROM
    # Replace the healthcheck with one which checks *all* the workers. The script
    # is generated by configure_workers_and_start.py.
    HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
-        CMD ["/healthcheck.sh"]
+        CMD /bin/sh /healthcheck.sh
--- a/docker/README.md
+++ b/docker/README.md
@ -114,9 +114,6 @@ The following environment variables are supported in `run` mode:
  is set via `docker run --user`, defaults to `991`, `991`. Note that this user
  must have permission to read the config files, and write to the data directories.
 * `TZ`: the [timezone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) the container will run with. Defaults to `UTC`.
-* `SYNAPSE_HTTP_PROXY`: Passed through to the Synapse process as the `http_proxy` environment variable.
-* `SYNAPSE_HTTPS_PROXY`: Passed through to the Synapse process as the `https_proxy` environment variable.
-* `SYNAPSE_NO_PROXY`: Passed through to the Synapse process as `no_proxy` environment variable.

 For more complex setups (e.g. for workers) you can also pass your args directly to synapse using `run` mode. For example like this:

--- a/docker/complement/Dockerfile
+++ b/docker/complement/Dockerfile
@ -9,9 +9,6 @@
 ARG SYNAPSE_VERSION=latest
 # This is an intermediate image, to be built locally (not pulled from a registry).
 ARG FROM=matrixdotorg/synapse-workers:$SYNAPSE_VERSION
-ARG DEBIAN_VERSION=bookworm
-
-FROM docker.io/library/postgres:13-${DEBIAN_VERSION} AS postgres_base

 FROM $FROM
 # First of all, we copy postgres server from the official postgres image,
@ -23,9 +20,9 @@ FROM $FROM
 # the same debian version as Synapse's docker image (so the versions of the
 # shared libraries match).
 RUN adduser --system --uid 999 postgres --home /var/lib/postgresql
-COPY --from=postgres_base /usr/lib/postgresql /usr/lib/postgresql
-COPY --from=postgres_base /usr/share/postgresql /usr/share/postgresql
-COPY --from=postgres_base --chown=postgres /var/run/postgresql /var/run/postgresql
+COPY --from=docker.io/library/postgres:13-bookworm /usr/lib/postgresql /usr/lib/postgresql
+COPY --from=docker.io/library/postgres:13-bookworm /usr/share/postgresql /usr/share/postgresql
+RUN mkdir /var/run/postgresql && chown postgres /var/run/postgresql
 ENV PATH="${PATH}:/usr/lib/postgresql/13/bin"
 ENV PGDATA=/var/lib/postgresql/data

@ -58,4 +55,4 @@ ENTRYPOINT ["/start_for_complement.sh"]

 # Update the healthcheck to have a shorter check interval
 HEALTHCHECK --start-period=5s --interval=1s --timeout=1s \
-    CMD ["/healthcheck.sh"]
+    CMD /bin/sh /healthcheck.sh
--- a/docker/complement/conf/start_for_complement.sh
+++ b/docker/complement/conf/start_for_complement.sh
@ -5,12 +5,12 @@
 set -e

 echo "Complement Synapse launcher"
-echo "  Args: $*"
+echo "  Args: $@"
 echo "  Env: SYNAPSE_COMPLEMENT_DATABASE=$SYNAPSE_COMPLEMENT_DATABASE SYNAPSE_COMPLEMENT_USE_WORKERS=$SYNAPSE_COMPLEMENT_USE_WORKERS SYNAPSE_COMPLEMENT_USE_ASYNCIO_REACTOR=$SYNAPSE_COMPLEMENT_USE_ASYNCIO_REACTOR"

 function log {
-    d=$(printf '%(%Y-%m-%d %H:%M:%S)T,%.3s\n' ${EPOCHREALTIME/./ })
-    echo "$d $*"
+    d=$(date +"%Y-%m-%d %H:%M:%S,%3N")
+    echo "$d $@"
 }

 # Set the server name of the homeserver
@ -103,11 +103,12 @@ fi
 # Note that both the key and certificate are in PEM format (not DER).

 # First generate a configuration file to set up a Subject Alternative Name.
-echo "\
+cat > /conf/server.tls.conf <<EOF
 .include /etc/ssl/openssl.cnf

 [SAN]
-subjectAltName=DNS:${SERVER_NAME}" > /conf/server.tls.conf
+subjectAltName=DNS:${SERVER_NAME}
+EOF

 # Generate an RSA key
 openssl genrsa -out /conf/server.tls.key 2048
@ -122,12 +123,12 @@ openssl x509 -req -in /conf/server.tls.csr \
  -out /conf/server.tls.crt -extfile /conf/server.tls.conf -extensions SAN

 # Assert that we have a Subject Alternative Name in the certificate.
-# (the test will exit with 1 here if there isn't a SAN in the certificate.)
-[[ $(openssl x509 -in /conf/server.tls.crt -noout -text) == *DNS:* ]]
+# (grep will exit with 1 here if there isn't a SAN in the certificate.)
+openssl x509 -in /conf/server.tls.crt -noout -text | grep DNS:

 export SYNAPSE_TLS_CERT=/conf/server.tls.crt
 export SYNAPSE_TLS_KEY=/conf/server.tls.key

 # Run the script that writes the necessary config files and starts supervisord, which in turn
 # starts everything else
-exec /configure_workers_and_start.py "$@"
+exec /configure_workers_and_start.py
--- a/docker/complement/conf/workers-shared-extra.yaml.j2
+++ b/docker/complement/conf/workers-shared-extra.yaml.j2
@ -7,7 +7,6 @@
 #}

 ## Server ##
-public_baseurl: http://127.0.0.1:8008/
 report_stats: False
 trusted_key_servers: []
 enable_registration: true
@ -85,18 +84,6 @@ rc_invites:
  per_user:
    per_second: 1000
    burst_count: 1000
-  per_issuer:
-    per_second: 1000
-    burst_count: 1000
-
-rc_presence:
-  per_user:
-    per_second: 9999
-    burst_count: 9999
-
-rc_delayed_event_mgmt:
-  per_second: 9999
-  burst_count: 9999

 federation_rr_transactions_per_room_per_second: 9999

@ -117,18 +104,6 @@ experimental_features:
  msc3967_enabled: true
  # Expose a room summary for public rooms
  msc3266_enabled: true
-  # Send to-device messages to application services
-  msc2409_to_device_messages_enabled: true
-  # Allow application services to masquerade devices
-  msc3202_device_masquerading: true
-  # Sending device list changes, one-time key counts and fallback key usage to application services
-  msc3202_transaction_extensions: true
-  # Proxy OTK claim requests to exclusive ASes
-  msc3983_appservice_otk_claims: true
-  # Proxy key queries to exclusive ASes
-  msc3984_appservice_key_query: true
-  # Invite filtering
-  msc4155_enabled: true

 server_notices:
  system_mxid_localpart: _server
@ -145,9 +120,4 @@ caches:
  sync_response_cache_duration: 0


-# Complement assumes that it can publish to the room list by default.
-room_list_publication_rules:
-  - action: allow
-
-
 {% include "shared-orig.yaml.j2" %}
--- a/docker/conf-workers/nginx.conf.j2
+++ b/docker/conf-workers/nginx.conf.j2
@ -38,13 +38,10 @@ server {
 {% if using_unix_sockets %}
        proxy_pass http://unix:/run/main_public.sock;
 {% else %}
-        # note: do not add a path (even a single /) after the port in `proxy_pass`,
-        # otherwise nginx will canonicalise the URI and cause signature verification
-        # errors.
        proxy_pass http://localhost:8080;
 {% endif %}
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host:$server_port;
+        proxy_set_header Host $host;
    }
 }
--- a/docker/conf-workers/synapse.supervisord.conf.j2
+++ b/docker/conf-workers/synapse.supervisord.conf.j2
@ -1,6 +1,5 @@
 {% if use_forking_launcher %}
 [program:synapse_fork]
-environment=http_proxy="%(ENV_SYNAPSE_HTTP_PROXY)s",https_proxy="%(ENV_SYNAPSE_HTTPS_PROXY)s",no_proxy="%(ENV_SYNAPSE_NO_PROXY)s"
 command=/usr/local/bin/python -m synapse.app.complement_fork_starter
  {{ main_config_path }}
  synapse.app.homeserver
@ -21,7 +20,6 @@ exitcodes=0

 {% else %}
 [program:synapse_main]
-environment=http_proxy="%(ENV_SYNAPSE_HTTP_PROXY)s",https_proxy="%(ENV_SYNAPSE_HTTPS_PROXY)s",no_proxy="%(ENV_SYNAPSE_NO_PROXY)s"
 command=/usr/local/bin/prefix-log /usr/local/bin/python -m synapse.app.homeserver
  --config-path="{{ main_config_path }}"
  --config-path=/conf/workers/shared.yaml
@ -38,7 +36,6 @@ exitcodes=0

  {% for worker in workers %}
 [program:synapse_{{ worker.name }}]
-environment=http_proxy="%(ENV_SYNAPSE_HTTP_PROXY)s",https_proxy="%(ENV_SYNAPSE_HTTPS_PROXY)s",no_proxy="%(ENV_SYNAPSE_NO_PROXY)s"
 command=/usr/local/bin/prefix-log /usr/local/bin/python -m {{ worker.app }}
  --config-path="{{ main_config_path }}"
  --config-path=/conf/workers/shared.yaml
--- a/docker/configure_workers_and_start.py
+++ b/docker/configure_workers_and_start.py
@ -1,4 +1,4 @@
-#!/usr/local/bin/python
+#!/usr/bin/env python
 #
 # This file is licensed under the Affero General Public License (AGPL) version 3.
 #
@ -202,7 +202,6 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
        "app": "synapse.app.generic_worker",
        "listener_resources": ["federation"],
        "endpoint_patterns": [
-            "^/_matrix/federation/v1/version$",
            "^/_matrix/federation/(v1|v2)/event/",
            "^/_matrix/federation/(v1|v2)/state/",
            "^/_matrix/federation/(v1|v2)/state_ids/",
@ -352,11 +351,6 @@ def error(txt: str) -> NoReturn:


 def flush_buffers() -> None:
-    """
-    Python's `print()` buffers output by default, typically waiting until ~8KB
-    accumulates. This method can be used to flush the buffers so we can see the output
-    of any print statements so far.
-    """
    sys.stdout.flush()
    sys.stderr.flush()

@ -382,11 +376,9 @@ def convert(src: str, dst: str, **template_vars: object) -> None:
    #
    # We use append mode in case the files have already been written to by something else
    # (for instance, as part of the instructions in a dockerfile).
-    exists = os.path.isfile(dst)
    with open(dst, "a") as outfile:
        # In case the existing file doesn't end with a newline
-        if exists:
-            outfile.write("\n")
+        outfile.write("\n")

        outfile.write(rendered)

@ -612,7 +604,7 @@ def generate_base_homeserver_config() -> None:
    # start.py already does this for us, so just call that.
    # note that this script is copied in in the official, monolith dockerfile
    os.environ["SYNAPSE_HTTP_PORT"] = str(MAIN_PROCESS_HTTP_LISTENER_PORT)
-    subprocess.run([sys.executable, "/start.py", "migrate_config"], check=True)
+    subprocess.run(["/usr/local/bin/python", "/start.py", "migrate_config"], check=True)


 def parse_worker_types(
@ -1006,7 +998,6 @@ def generate_worker_files(
        "/healthcheck.sh",
        healthcheck_urls=healthcheck_urls,
    )
-    os.chmod("/healthcheck.sh", 0o755)

    # Ensure the logging directory exists
    log_dir = data_dir + "/logs"
@ -1108,13 +1099,6 @@ def main(args: List[str], environ: MutableMapping[str, str]) -> None:
    else:
        log("Could not find %s, will not use" % (jemallocpath,))

-    # Empty strings are falsy in Python so this default is fine. We just can't have these
-    # be undefined because supervisord will complain about our
-    # `%(ENV_SYNAPSE_HTTP_PROXY)s` usage.
-    environ.setdefault("SYNAPSE_HTTP_PROXY", "")
-    environ.setdefault("SYNAPSE_HTTPS_PROXY", "")
-    environ.setdefault("SYNAPSE_NO_PROXY", "")
-
    # Start supervisord, which will start Synapse, all of the configured worker
    # processes, redis, nginx etc. according to the config we created above.
    log("Starting supervisord")
--- a/docker/prefix-log
+++ b/docker/prefix-log
@ -10,9 +10,6 @@
 # '-W interactive' is a `mawk` extension which disables buffering on stdout and sets line-buffered reads on
 # stdin. The effect is that the output is flushed after each line, rather than being batched, which helps reduce
 # confusion due to to interleaving of the different processes.
-prefixer() {
-    mawk -W interactive '{printf("%s | %s\n", ENVIRON["SUPERVISOR_PROCESS_NAME"], $0); fflush() }'
-}
-exec 1> >(prefixer)
-exec 2> >(prefixer >&2)
+exec 1> >(awk -W interactive '{print "'"${SUPERVISOR_PROCESS_NAME}"' | "$0 }' >&1)
+exec 2> >(awk -W interactive '{print "'"${SUPERVISOR_PROCESS_NAME}"' | "$0 }' >&2)
 exec "$@"
--- a/docker/start.py
+++ b/docker/start.py
@ -22,11 +22,6 @@ def error(txt: str) -> NoReturn:


 def flush_buffers() -> None:
-    """
-    Python's `print()` buffers output by default, typically waiting until ~8KB
-    accumulates. This method can be used to flush the buffers so we can see the output
-    of any print statements so far.
-    """
    sys.stdout.flush()
    sys.stderr.flush()

--- a/docs/README.md
+++ b/docs/README.md
@ -63,18 +63,6 @@ mdbook serve

 The URL at which the docs can be viewed at will be logged.

-## Synapse configuration documentation
-
-The [Configuration
-Manual](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html)
-page is generated from a YAML file,
-[schema/synapse-config.schema.yaml](../schema/synapse-config.schema.yaml). To
-add new options or modify existing ones, first edit that file, then run
-[scripts-dev/gen_config_documentation.py](../scripts-dev/gen_config_documentation.py)
-to generate an updated Configuration Manual markdown file.
-
-Build the book as described above to preview it in a web browser.
-
 ## Configuration and theming

 The look and behaviour of the website is configured by the [book.toml](../book.toml) file
--- a/docs/SUMMARY.md
+++ b/docs/SUMMARY.md
@ -49,14 +49,11 @@
        - [Background update controller callbacks](modules/background_update_controller_callbacks.md)
        - [Account data callbacks](modules/account_data_callbacks.md)
        - [Add extra fields to client events unsigned section callbacks](modules/add_extra_fields_to_client_events_unsigned.md)
-        - [Media repository callbacks](modules/media_repository_callbacks.md)
-        - [Ratelimit callbacks](modules/ratelimit_callbacks.md)
        - [Porting a legacy module to the new interface](modules/porting_legacy_module.md)
    - [Workers](workers.md)
      - [Using `synctl` with Workers](synctl_workers.md)
      - [Systemd](systemd-with-workers/README.md)
  - [Administration](usage/administration/README.md)
-    - [Backups](usage/administration/backups.md)
    - [Admin API](usage/administration/admin_api/README.md)
      - [Account Validity](admin_api/account_validity.md)
      - [Background Updates](usage/administration/admin_api/background_updates.md)
@ -68,7 +65,6 @@
      - [Registration Tokens](usage/administration/admin_api/registration_tokens.md)
      - [Manipulate Room Membership](admin_api/room_membership.md)
      - [Rooms](admin_api/rooms.md)
-      - [Scheduled tasks](admin_api/scheduled_tasks.md)
      - [Server Notices](admin_api/server_notices.md)
      - [Statistics](admin_api/statistics.md)
      - [Users](admin_api/user_admin_api.md)
--- a/docs/admin_api/event_reports.md
+++ b/docs/admin_api/event_reports.md
@ -60,11 +60,10 @@ paginate through.
  anything other than the return value of `next_token` from a previous call. Defaults to `0`.
 * `dir`: string - Direction of event report order. Whether to fetch the most recent
  first (`b`) or the oldest first (`f`). Defaults to `b`.
-* `user_id`: optional string - Filter by the user ID of the reporter. This is the user who reported the event
-   and wrote the reason.
-* `room_id`: optional string - Filter by room id.
-* `event_sender_user_id`: optional string - Filter by the sender of the reported event. This is the user who 
-   the report was made against.
+* `user_id`: string - Is optional and filters to only return users with user IDs that
+  contain this value. This is the user who reported the event and wrote the reason.
+* `room_id`: string - Is optional and filters to only return rooms with room IDs that
+  contain this value.

 **Response**

--- a/docs/admin_api/experimental_features.md
+++ b/docs/admin_api/experimental_features.md
@ -5,7 +5,6 @@ basis. The currently supported features are:
 - [MSC3881](https://github.com/matrix-org/matrix-spec-proposals/pull/3881): enable remotely toggling push notifications
 for another client
 - [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575): enable experimental sliding sync support
- [MSC4222](https://github.com/matrix-org/matrix-spec-proposals/pull/4222): adding `state_after` to sync v2

 To use it, you will need to authenticate by providing an `access_token`
 for a server admin: see [Admin API](../usage/administration/admin_api/).
--- a/docs/admin_api/media_admin_api.md
+++ b/docs/admin_api/media_admin_api.md
@ -46,14 +46,6 @@ to any local media, and any locally-cached copies of remote media.

 The media file itself (and any thumbnails) is not deleted from the server.

-Since Synapse 1.128.0, hashes of uploaded media are tracked. If this media
-is quarantined, Synapse will:
-
- - Quarantine any media with a matching hash that has already been uploaded.
- - Quarantine any future media.
- - Quarantine any existing cached remote media.
- - Quarantine any future remote media.
-
 ## Quarantining media by ID

 This API quarantines a single piece of local or remote media.
--- a/docs/admin_api/rooms.md
+++ b/docs/admin_api/rooms.md
@ -385,13 +385,6 @@ The API is:
 GET /_synapse/admin/v1/rooms/<room_id>/state
 ```

-**Parameters**
-
-The following query parameter is available:
-
-* `type` - The type of room state event to filter by, eg "m.room.create". If provided, only state events
-    of this type will be returned (regardless of their `state_key` value).
-
 A response body like the following is returned:

 ```json
@ -794,7 +787,6 @@ A response body like the following is returned:
    "results": [
        {
            "delete_id": "delete_id1",
-            "room_id": "!roomid:example.com",
            "status": "failed",
            "error": "error message",
            "shutdown_room": {
@ -805,7 +797,6 @@ A response body like the following is returned:
            }
        }, {
            "delete_id": "delete_id2",
-            "room_id": "!roomid:example.com",
            "status": "purging",
            "shutdown_room": {
                "kicked_users": [
@ -844,8 +835,6 @@ A response body like the following is returned:
 ```json
 {
    "status": "purging",
-    "delete_id": "bHkCNQpHqOaFhPtK",
-    "room_id": "!roomid:example.com",
    "shutdown_room": {
        "kicked_users": [
            "@foobar:example.com"
@ -873,8 +862,7 @@ The following fields are returned in the JSON response body:
 - `results` - An array of objects, each containing information about one task.
  This field is omitted from the result when you query by `delete_id`.
  Task objects contain the following fields:
-  - `delete_id` - The ID for this purge
-  - `room_id` - The ID of the room being deleted
+  - `delete_id` - The ID for this purge if you query by `room_id`.
  - `status` - The status will be one of:
    - `shutting_down` - The process is removing users from the room.
    - `purging` - The process is purging the room and event data from database.
--- a/docs/admin_api/scheduled_tasks.md
+++ b/docs/admin_api/scheduled_tasks.md
@ -1,54 +0,0 @@
-# Show scheduled tasks
-
-This API returns information about scheduled tasks.
-
-To use it, you will need to authenticate by providing an `access_token`
-for a server admin: see [Admin API](../usage/administration/admin_api/).
-
-The api is:
-```
-GET /_synapse/admin/v1/scheduled_tasks
-```
-
-It returns a JSON body like the following:
-
-```json
-{
-    "scheduled_tasks": [
-        {
-            "id": "GSA124oegf1",
-            "action": "shutdown_room",
-            "status": "complete",
-            "timestamp_ms": 23423523,
-            "resource_id": "!roomid",
-            "result": "some result",
-            "error": null
-        }
-      ]
-}
-```
-
-**Query parameters:**
-
-* `action_name`: string - Is optional. Returns only the scheduled tasks with the given action name.
-* `resource_id`: string - Is optional. Returns only the scheduled tasks with the given resource id.
-* `status`: string - Is optional. Returns only the scheduled tasks matching the given status, one of
-    - "scheduled" - Task is scheduled but not active
-    - "active" - Task is active and probably running, and if not will be run on next scheduler loop run
-    - "complete" - Task has completed successfully
-    - "failed" - Task is over and either returned a failed status, or had an exception
-
-* `max_timestamp`: int - Is optional. Returns only the scheduled tasks with a timestamp inferior to the specified one.
-
-**Response**
-
-The following fields are returned in the JSON response body along with a `200` HTTP status code:
-
-* `id`: string - ID of scheduled task.
-* `action`: string - The name of the scheduled task's action.
-* `status`: string - The status of the scheduled task.
-* `timestamp_ms`: integer - The timestamp (in milliseconds since the unix epoch) of the given task - If the status is "scheduled" then this represents when it should be launched.
-  Otherwise it represents the last time this task got a change of state.
-* `resource_id`: Optional string - The resource id of the scheduled task, if it possesses one
-* `result`: Optional Json - Any result of the scheduled task, if given
-* `error`: Optional string - If the task has the status "failed", the error associated with this failure
--- a/docs/admin_api/user_admin_api.md
+++ b/docs/admin_api/user_admin_api.md
@ -40,7 +40,6 @@ It returns a JSON body like the following:
    "erased": false,
    "shadow_banned": 0,
    "creation_ts": 1560432506,
-    "last_seen_ts": 1732919539393,
    "appservice_id": null,
    "consent_server_notice_sent": null,
    "consent_version": null,
@ -56,8 +55,7 @@ It returns a JSON body like the following:
        }
    ],
    "user_type": null,
-    "locked": false,
-    "suspended": false
+    "locked": false
 }
 ```

@ -163,8 +161,7 @@ Body parameters:
 - `locked` - **bool**, optional. If unspecified, locked state will be left unchanged.
 - `user_type` - **string** or null, optional. If not provided, the user type will be
  not be changed. If `null` is given, the user type will be cleared.
-  Other allowed options are: `bot` and `support` and any extra values defined in the homserver
-  [configuration](../usage/configuration/config_documentation.md#user_types).
+  Other allowed options are: `bot` and `support`.

 ## List Accounts
 ### List Accounts (V2)
@ -415,32 +412,6 @@ The following actions are **NOT** performed. The list may be incomplete.
 - Remove from monthly active users
 - Remove user's consent information (consent version and timestamp)

-## Suspend/Unsuspend Account
-
-This API allows an admin to suspend/unsuspend an account. While an account is suspended, the user is 
-prohibited from sending invites, joining or knocking on rooms, sending messages, changing profile data, and redacting messages other than their own. 
-
-The api is:
-
-```
-PUT /_synapse/admin/v1/suspend/<user_id>
-```
-
-with a body of:
-
-```json
-{
-    "suspend": true
-}
-```
-
-To unsuspend a user, use the same endpoint with a body of:
-```json
-{
-  "suspend": false
-}
-```
-
 ## Reset password

 **Note:** This API is disabled when MSC3861 is enabled. [See #15582](https://github.com/matrix-org/synapse/pull/15582)
@ -505,9 +476,9 @@ with a body of:
 }
 ```

-## List joined rooms of a user
+## List room memberships of a user

-Gets a list of all `room_id` that a specific `user_id` is joined to and is a member of (participating in).
+Gets a list of all `room_id` that a specific `user_id` is member.

 The API is:

@ -544,73 +515,6 @@ The following fields are returned in the JSON response body:
 - `joined_rooms` - An array of `room_id`.
 - `total` - Number of rooms.

-## Get the number of invites sent by the user
-
-Fetches the number of invites sent by the provided user ID across all rooms
-after the given timestamp.
-
-```
-GET /_synapse/admin/v1/users/$user_id/sent_invite_count
-```
-
-**Parameters**
-
-The following parameters should be set in the URL:
-
-* `user_id`: fully qualified: for example, `@user:server.com`
-
-The following should be set as query parameters in the URL:
-
-* `from_ts`: int, required. A timestamp in ms from the unix epoch. Only
-   invites sent at or after the provided timestamp will be returned.
-   This works by comparing the provided timestamp to the `received_ts`
-   column in the `events` table.
-   Note: https://currentmillis.com/ is a useful tool for converting dates
-   into timestamps and vice versa.
-
-A response body like the following is returned:
-
-```json
-{
-  "invite_count": 30
-}
-```
-
-_Added in Synapse 1.122.0_
-
-## Get the cumulative number of rooms a user has joined after a given timestamp
-
-Fetches the number of rooms that the user joined after the given timestamp, even
-if they have subsequently left/been banned from those rooms.
-
-```
-GET /_synapse/admin/v1/users/$<user_id/cumulative_joined_room_count
-```
-
-**Parameters**
-
-The following parameters should be set in the URL:
-
-* `user_id`: fully qualified: for example, `@user:server.com`
-
-The following should be set as query parameters in the URL:
-
-* `from_ts`: int, required. A timestamp in ms from the unix epoch. Only
-   invites sent at or after the provided timestamp will be returned.
-   This works by comparing the provided timestamp to the `received_ts`
-   column in the `events` table.
-   Note: https://currentmillis.com/ is a useful tool for converting dates
-   into timestamps and vice versa.
-
-A response body like the following is returned:
-
-```json
-{
-  "cumulative_joined_room_count": 30
-}
-```
-_Added in Synapse 1.122.0_
-
 ## Account Data
 Gets information about account data for a specific `user_id`.

@ -955,8 +859,7 @@ A response body like the following is returned:
      "last_seen_ip": "1.2.3.4",
      "last_seen_user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0",
      "last_seen_ts": 1474491775024,
-      "user_id": "<user_id>",
-      "dehydrated": false
+      "user_id": "<user_id>"
    },
    {
      "device_id": "AUIECTSRND",
@ -964,8 +867,7 @@ A response body like the following is returned:
      "last_seen_ip": "1.2.3.5",
      "last_seen_user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0",
      "last_seen_ts": 1474491775025,
-      "user_id": "<user_id>",
-      "dehydrated": false
+      "user_id": "<user_id>"
    }
  ],
  "total": 2
@ -995,7 +897,6 @@ The following fields are returned in the JSON response body:
  - `last_seen_ts` - The timestamp (in milliseconds since the unix epoch) when this
    devices was last seen. (May be a few minutes out of date, for efficiency reasons).
  - `user_id` - Owner of  device.
-  - `dehydrated` - Whether the device is a dehydrated device.

 - `total` - Total number of user's devices.

@ -1464,9 +1365,6 @@ _Added in Synapse 1.72.0._

 ## Redact all the events of a user

-This endpoint allows an admin to redact the events of a given user. There are no restrictions on redactions for a 
-local user. By default, we puppet the user who sent the message to redact it themselves. Redactions for non-local users are issued using the admin user, and will fail in rooms where the admin user is not admin/does not have the specified power level to issue redactions. 
-
 The API is 
 ```
 POST /_synapse/admin/v1/user/$user_id/redact
@ -1498,13 +1396,13 @@ The following JSON body parameter must be provided:
 -  `rooms` - A list of rooms to redact the user's events in. If an empty list is provided all events in all rooms
  the user is a member of will be redacted

+_Added in Synapse 1.116.0._
+
 The following JSON body parameters are optional:

 - `reason` - Reason the redaction is being requested, ie "spam", "abuse", etc. This will be included in each redaction event, and be visible to users.
 - `limit` - a limit on the number of the user's events to search for ones that can be redacted (events are redacted newest to oldest) in each room, defaults to 1000 if not provided

-_Added in Synapse 1.116.0._
-

 ## Check the status of a redaction process

@ -1542,6 +1440,4 @@ The following fields are returned in the JSON response body:
 - `failed_redactions` - dictionary - the keys of the dict are event ids the process was unable to redact, if any, and the values are 
  the corresponding error that caused the redaction to fail

-_Added in Synapse 1.116.0._
-
-
+_Added in Synapse 1.116.0._
--- a/docs/changelogs/CHANGES-2023.md
+++ b/docs/changelogs/CHANGES-2023.md
--- a/docs/changelogs/CHANGES-2024.md
+++ b/docs/changelogs/CHANGES-2024.md
--- a/docs/development/contributing_guide.md
+++ b/docs/development/contributing_guide.md
@ -322,7 +322,7 @@ The following command will let you run the integration test with the most common
 configuration:

 ```sh
-$ docker run --rm -it -v /path/where/you/have/cloned/the/repository\:/src:ro -v /path/to/where/you/want/logs\:/logs matrixdotorg/sytest-synapse:bullseye
+$ docker run --rm -it -v /path/where/you/have/cloned/the/repository\:/src:ro -v /path/to/where/you/want/logs\:/logs matrixdotorg/sytest-synapse:focal
 ```
 (Note that the paths must be full paths! You could also write `$(realpath relative/path)` if needed.)

--- a/docs/development/database_schema.md
+++ b/docs/development/database_schema.md
@ -162,7 +162,7 @@ by a unique name, the current status (stored in JSON), and some dependency infor
 * Whether the update requires a previous update to be complete.
 * A rough ordering for which to complete updates.

-A new background update needs to be added to the `background_updates` table:
+A new background updates needs to be added to the `background_updates` table:

 ```sql
 INSERT INTO background_updates (ordering, update_name, depends_on, progress_json) VALUES
--- a/docs/development/dependencies.md
+++ b/docs/development/dependencies.md
@ -150,28 +150,6 @@ $ poetry shell
 $ poetry install --extras all
 ```

-If you want to go even further and remove the Poetry caches:
-
-```shell
-# Find your Poetry cache directory
-# Docs: https://github.com/python-poetry/poetry/blob/main/docs/configuration.md#cache-directory
-$ poetry config cache-dir
-
-# Remove packages from all cached repositories
-$ poetry cache clear --all .
-
-# Go completely nuclear and clear out everything Poetry cache related
-# including the wheel artifacts which is not covered by the above command
-# (see https://github.com/python-poetry/poetry/issues/10304)
-#
-# This is necessary in order to rebuild or fetch new wheels. For example, if you update
-# the `icu` library in on your system, you will need to rebuild the PyICU Python package
-# in order to incorporate the correct dynamically linked library locations otherwise you
-# will run into errors like: `ImportError: libicui18n.so.75: cannot open shared object file: No such file or directory`
-$ rm -rf $(poetry config cache-dir)
-```
-
-
 ## ...run a command in the `poetry` virtualenv?

 Use `poetry run cmd args` when you need the python virtualenv context.
@ -209,7 +187,7 @@ useful.
 ## ...add a new dependency?

 Either:
- manually update `pyproject.toml`; then `poetry lock`; or else
+- manually update `pyproject.toml`; then `poetry lock --no-update`; or else
 - `poetry add packagename`. See `poetry add --help`; note the `--dev`,
  `--extras` and `--optional` flags in particular.

@ -224,12 +202,12 @@ poetry remove packagename
 ```

 ought to do the trick. Alternatively, manually update `pyproject.toml` and
-`poetry lock`. Include the updated `pyproject.toml` and `poetry.lock`
+`poetry lock --no-update`. Include the updated `pyproject.toml` and `poetry.lock`
 files in your commit.

 ## ...update the version range for an existing dependency?

-Best done by manually editing `pyproject.toml`, then `poetry lock`.
+Best done by manually editing `pyproject.toml`, then `poetry lock --no-update`.
 Include the updated `pyproject.toml` and `poetry.lock` in your commit.

 ## ...update a dependency in the locked environment?
@ -255,7 +233,7 @@ poetry add packagename==1.2.3

 # Get poetry to recompute the content-hash of pyproject.toml without changing
 # the locked package versions.
-poetry lock
+poetry lock --no-update
 ```

 Either way, include the updated `poetry.lock` file in your commit.
--- a/docs/modules/media_repository_callbacks.md
+++ b/docs/modules/media_repository_callbacks.md
@ -1,66 +0,0 @@
-# Media repository callbacks
-
-Media repository callbacks allow module developers to customise the behaviour of the
-media repository on a per user basis. Media repository callbacks can be registered
-using the module API's `register_media_repository_callbacks` method.
-
-The available media repository callbacks are:
-
-### `get_media_config_for_user`
-
-_First introduced in Synapse v1.132.0_
-
-```python
-async def get_media_config_for_user(user_id: str) -> Optional[JsonDict]
-```
-
-**<span style="color:red">
-Caution: This callback is currently experimental . The method signature or behaviour
-may change without notice.
-</span>**
-
-Called when processing a request from a client for the
-[media config endpoint](https://spec.matrix.org/latest/client-server-api/#get_matrixclientv1mediaconfig).
-
-The arguments passed to this callback are:
-
-* `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`) making the request.
-
-If the callback returns a dictionary then it will be used as the body of the response to the
-client.
-
-If multiple modules implement this callback, they will be considered in order. If a
-callback returns `None`, Synapse falls through to the next one. The value of the first
-callback that does not return `None` will be used. If this happens, Synapse will not call
-any of the subsequent implementations of this callback.
-
-If no module returns a non-`None` value then the default media config will be returned.
-
-### `is_user_allowed_to_upload_media_of_size`
-
-_First introduced in Synapse v1.132.0_
-
-```python
-async def is_user_allowed_to_upload_media_of_size(user_id: str, size: int) -> bool
-```
-
-**<span style="color:red">
-Caution: This callback is currently experimental . The method signature or behaviour
-may change without notice.
-</span>**
-
-Called before media is accepted for upload from a user, in case the module needs to
-enforce a different limit for the particular user.
-
-The arguments passed to this callback are:
-
-* `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`) making the request.
-* `size`: The size in bytes of media that is being requested to upload.
-
-If the module returns `False`, the current request will be denied with the error code
-`M_TOO_LARGE` and the HTTP status code 413.
-
-If multiple modules implement this callback, they will be considered in order. If a callback
-returns `True`, Synapse falls through to the next one. The value of the first callback that
-returns `False` will be used. If this happens, Synapse will not call any of the subsequent
-implementations of this callback.
--- a/docs/modules/ratelimit_callbacks.md
+++ b/docs/modules/ratelimit_callbacks.md
@ -1,43 +0,0 @@
-# Ratelimit callbacks
-
-Ratelimit callbacks allow module developers to override ratelimit settings dynamically whilst
-Synapse is running. Ratelimit callbacks can be registered using the module API's
-`register_ratelimit_callbacks` method.
-
-The available ratelimit callbacks are:
-
-### `get_ratelimit_override_for_user`
-
-_First introduced in Synapse v1.132.0_
-
-```python
-async def get_ratelimit_override_for_user(user: str, limiter_name: str) -> Optional[synapse.module_api.RatelimitOverride]
-```
-
-**<span style="color:red">
-Caution: This callback is currently experimental . The method signature or behaviour
-may change without notice.
-</span>**
-
-Called when constructing a ratelimiter of a particular type for a user. The module can
-return a `messages_per_second` and `burst_count` to be used, or `None` if
-the default settings are adequate. The user is represented by their Matrix user ID
-(e.g. `@alice:example.com`). The limiter name is usually taken from the `RatelimitSettings` key
-value.
-
-The limiters that are currently supported are:
-
- `rc_invites.per_room`
- `rc_invites.per_user`
- `rc_invites.per_issuer`
-
-The `RatelimitOverride` return type has the following fields:
-
- `per_second: float`. The number of actions that can be performed in a second. `0.0` means that ratelimiting is disabled.
- `burst_count: int`. The number of actions that can be performed before being limited.
-
-If multiple modules implement this callback, they will be considered in order. If a
-callback returns `None`, Synapse falls through to the next one. The value of the first
-callback that does not return `None` will be used. If this happens, Synapse will not call
-any of the subsequent implementations of this callback. If no module returns a non-`None` value
-then the default settings will be used.
--- a/docs/modules/spam_checker_callbacks.md
+++ b/docs/modules/spam_checker_callbacks.md
@ -80,8 +80,6 @@ Called when processing an invitation, both when one is created locally or when
 receiving an invite over federation. Both inviter and invitee are represented by
 their Matrix user ID (e.g. `@alice:example.com`).

-Note that federated invites will call `federated_user_may_invite` before this callback.
-

 The callback must return one of:
  - `synapse.module_api.NOT_SPAM`, to allow the operation. Other callbacks may still 
@ -99,34 +97,6 @@ be used. If this happens, Synapse will not call any of the subsequent implementa
 this callback.


-### `federated_user_may_invite`
-
-_First introduced in Synapse v1.133.0_
-
-```python
-async def federated_user_may_invite(event: "synapse.events.EventBase") -> Union["synapse.module_api.NOT_SPAM", "synapse.module_api.errors.Codes", bool]
-```
-
-Called when processing an invitation received over federation. Unlike `user_may_invite`,
-this callback receives the entire event, including any stripped state in the `unsigned`
-section, not just the room and user IDs.
-
-The callback must return one of:
-  - `synapse.module_api.NOT_SPAM`, to allow the operation. Other callbacks may still 
-    decide to reject it.
-  - `synapse.module_api.errors.Codes` to reject the operation with an error code. In case
-    of doubt, `synapse.module_api.errors.Codes.FORBIDDEN` is a good error code.
-
-If multiple modules implement this callback, they will be considered in order. If a
-callback returns `synapse.module_api.NOT_SPAM`, Synapse falls through to the next one.
-The value of the first callback that does not return `synapse.module_api.NOT_SPAM` will
-be used. If this happens, Synapse will not call any of the subsequent implementations of
-this callback.
-
-If all of the callbacks return `synapse.module_api.NOT_SPAM`, Synapse will also fall
-through to the `user_may_invite` callback before approving the invite.
-
-
 ### `user_may_send_3pid_invite`

 _First introduced in Synapse v1.45.0_
@ -189,19 +159,12 @@ _First introduced in Synapse v1.37.0_

 _Changed in Synapse v1.62.0: `synapse.module_api.NOT_SPAM` and `synapse.module_api.errors.Codes` can be returned by this callback. Returning a boolean is now deprecated._ 

-_Changed in Synapse v1.132.0: Added the `room_config` argument. Callbacks that only expect a single `user_id` argument are still supported._
-
 ```python
-async def user_may_create_room(user_id: str, room_config: synapse.module_api.JsonDict) -> Union["synapse.module_api.NOT_SPAM", "synapse.module_api.errors.Codes", bool]
+async def user_may_create_room(user_id: str) -> Union["synapse.module_api.NOT_SPAM", "synapse.module_api.errors.Codes", bool]
 ```

 Called when processing a room creation request.

-The arguments passed to this callback are:
-
-* `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`).
-* `room_config`: The contents of the body of a [/createRoom request](https://spec.matrix.org/latest/client-server-api/#post_matrixclientv3createroom) as a dictionary.
-
 The callback must return one of:
  - `synapse.module_api.NOT_SPAM`, to allow the operation. Other callbacks may still 
    decide to reject it.
@ -276,48 +239,13 @@ be used. If this happens, Synapse will not call any of the subsequent implementa
 this callback.


-### `user_may_send_state_event`
-
-_First introduced in Synapse v1.132.0_
-
-```python
-async def user_may_send_state_event(user_id: str, room_id: str, event_type: str, state_key: str, content: JsonDict) -> Union["synapse.module_api.NOT_SPAM", "synapse.module_api.errors.Codes"]
-```
-
-**<span style="color:red">
-Caution: This callback is currently experimental . The method signature or behaviour
-may change without notice.
-</span>**
-
-Called when processing a request to [send state events](https://spec.matrix.org/latest/client-server-api/#put_matrixclientv3roomsroomidstateeventtypestatekey) to a room.
-
-The arguments passed to this callback are:
-
-* `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`) sending the state event.
-* `room_id`: The ID of the room that the requested state event is being sent to.
-* `event_type`: The requested type of event.
-* `state_key`: The requested state key.
-* `content`: The requested event contents.
-
-The callback must return one of:
-  - `synapse.module_api.NOT_SPAM`, to allow the operation. Other callbacks may still 
-    decide to reject it.
-  - `synapse.module_api.errors.Codes` to reject the operation with an error code. In case
-    of doubt, `synapse.module_api.errors.Codes.FORBIDDEN` is a good error code.
-
-If multiple modules implement this callback, they will be considered in order. If a
-callback returns `synapse.module_api.NOT_SPAM`, Synapse falls through to the next one.
-The value of the first callback that does not return `synapse.module_api.NOT_SPAM` will
-be used. If this happens, Synapse will not call any of the subsequent implementations of
-this callback.
-

 ### `check_username_for_spam`

 _First introduced in Synapse v1.37.0_

 ```python
-async def check_username_for_spam(user_profile: synapse.module_api.UserProfile, requester_id: str) -> bool
+async def check_username_for_spam(user_profile: synapse.module_api.UserProfile) -> bool
 ```

 Called when computing search results in the user directory. The module must return a
@ -336,8 +264,6 @@ The profile is represented as a dictionary with the following keys:
 The module is given a copy of the original dictionary, so modifying it from within the
 module cannot modify a user's profile when included in user directory search results.

-The requester_id parameter is the ID of the user that called the user directory API.
-
 If multiple modules implement this callback, they will be considered in order. If a
 callback returns `False`, Synapse falls through to the next one. The value of the first
 callback that does not return `False` will be used. If this happens, Synapse will not call
@ -425,8 +351,6 @@ callback returns `False`, Synapse falls through to the next one. The value of th
 callback that does not return `False` will be used. If this happens, Synapse will not call
 any of the subsequent implementations of this callback.

-Note that this check is applied to federation invites as of Synapse v1.130.0.
-

 ### `check_login_for_spam`

--- a/docs/openid.md
+++ b/docs/openid.md
@ -23,7 +23,6 @@ such as [Github][github-idp].
 [auth0]: https://auth0.com/
 [authentik]: https://goauthentik.io/
 [lemonldap]: https://lemonldap-ng.org/
-[pocket-id]: https://pocket-id.org/
 [okta]: https://www.okta.com/
 [dex-idp]: https://github.com/dexidp/dex
 [keycloak-idp]: https://www.keycloak.org/docs/latest/server_admin/#sso-protocols
@ -337,36 +336,6 @@ but it has a `response_types_supported` which excludes "code" (which we rely on,
 is even mentioned in their [documentation](https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow#login)),
 so we have to disable discovery and configure the URIs manually.

-### Forgejo
-
-Forgejo is a fork of Gitea that can act as an OAuth2 provider.
-
-The implementation of OAuth2 is improved compared to Gitea, as it provides a correctly defined `subject_claim` and `scopes`.
-
-Synapse config:
-
-```yaml
-oidc_providers:
-  - idp_id: forgejo
-    idp_name: Forgejo
-    discover: false
-    issuer: "https://your-forgejo.com/"
-    client_id: "your-client-id" # TO BE FILLED
-    client_secret: "your-client-secret" # TO BE FILLED
-    client_auth_method: client_secret_post
-    scopes: ["openid", "profile", "email", "groups"]
-    authorization_endpoint: "https://your-forgejo.com/login/oauth/authorize"
-    token_endpoint: "https://your-forgejo.com/login/oauth/access_token"
-    userinfo_endpoint: "https://your-forgejo.com/api/v1/user"
-    user_mapping_provider:
-      config:
-        subject_claim: "sub"
-        picture_claim: "picture"
-        localpart_template: "{{ user.preferred_username }}"
-        display_name_template: "{{ user.name }}"
-        email_template: "{{ user.email }}"
-```
-
 ### GitHub

 [GitHub][github-idp] is a bit special as it is not an OpenID Connect compliant provider, but
@ -625,32 +594,6 @@ oidc_providers:

 Note that the fields `client_id` and `client_secret` are taken from the CURL response above.

-### Pocket ID
-
-[Pocket ID][pocket-id] is a simple OIDC provider that allows users to authenticate with their passkeys.
-1. Go to `OIDC Clients`
-2. Click on `Add OIDC Client`
-3. Add a name, for example `Synapse`
-4. Add `"https://auth.example.org/_synapse/client/oidc/callback` to `Callback URLs`  # Replace `auth.example.org` with your domain
-5. Click on `Save`
-6. Note down your `Client ID` and `Client secret`, these will be used later
-
-Synapse config:
-
-```yaml
-oidc_providers:
-  - idp_id: pocket_id
-    idp_name: Pocket ID
-    issuer: "https://auth.example.org/" # Replace with your domain
-    client_id: "your-client-id" # Replace with the "Client ID" you noted down before
-    client_secret: "your-client-secret" # Replace with the "Client secret" you noted down before
-    scopes: ["openid", "profile"]
-    user_mapping_provider:
-      config:
-        localpart_template: "{{ user.preferred_username }}"
-        display_name_template: "{{ user.name }}"
-```
-
 ### Shibboleth with OIDC Plugin

 [Shibboleth](https://www.shibboleth.net/) is an open Standard IdP solution widely used by Universities.
--- a/docs/postgres.md
+++ b/docs/postgres.md
@ -100,18 +100,6 @@ database:
    keepalives_count: 3
 ```

-## Postgresql major version upgrades
-
-Postgres uses separate directories for database locations between major versions (typically `/var/lib/postgresql/<version>/main`).
-
-Therefore, it is recommended to stop Synapse and other services (MAS, etc) before upgrading Postgres major versions.
-
-It is also strongly recommended to [back up](./usage/administration/backups.md#database) your database beforehand to ensure no data loss arising from a failed upgrade.
-
-## Backups
-
-Don't forget to [back up](./usage/administration/backups.md#database) your database!
-
 ## Tuning Postgres

 The default settings should be fine for most deployments. For larger
--- a/docs/reverse_proxy.md
+++ b/docs/reverse_proxy.md
@ -5,10 +5,10 @@ It is recommended to put a reverse proxy such as
 [Apache](https://httpd.apache.org/docs/current/mod/mod_proxy_http.html),
 [Caddy](https://caddyserver.com/docs/quick-starts/reverse-proxy),
 [HAProxy](https://www.haproxy.org/) or
-[relayd](https://man.openbsd.org/relayd.8) in front of Synapse.
-This has the advantage of being able to expose the default HTTPS port (443) to Matrix
-clients without requiring Synapse to bind to a privileged port (port numbers less than
-1024), avoiding the need for `CAP_NET_BIND_SERVICE` or running as root.
+[relayd](https://man.openbsd.org/relayd.8) in front of Synapse. One advantage
+of doing so is that it means that you can expose the default https port
+(443) to Matrix clients without needing to run Synapse with root
+privileges.

 You should configure your reverse proxy to forward requests to `/_matrix` or
 `/_synapse/client` to Synapse, and have it set the `X-Forwarded-For` and
@ -74,7 +74,7 @@ server {
        proxy_pass http://localhost:8008;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host:$server_port;
+        proxy_set_header Host $host;

        # Nginx by default only allows file uploads up to 1M in size
        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
--- a/docs/setup/installation.md
+++ b/docs/setup/installation.md
@ -157,7 +157,7 @@ sudo pip install py-bcrypt

 #### Alpine Linux

-Jahway603 maintains [Synapse packages for Alpine Linux](https://pkgs.alpinelinux.org/packages?name=synapse&branch=edge) in the community repository. Install with:
+6543 maintains [Synapse packages for Alpine Linux](https://pkgs.alpinelinux.org/packages?name=synapse&branch=edge) in the community repository. Install with:

 ```sh
 sudo apk add synapse
@ -208,7 +208,7 @@ When following this route please make sure that the [Platform-specific prerequis
 System requirements:

 - POSIX-compliant system (tested on Linux & OS X)
- Python 3.9 or later, up to Python 3.13.
+- Python 3.8 or later, up to Python 3.11.
 - At least 1GB of free RAM if you want to join large public rooms like #matrix:matrix.org

 If building on an uncommon architecture for which pre-built wheels are
@ -310,18 +310,29 @@ sudo dnf install libtiff-devel libjpeg-devel libzip-devel freetype-devel \
 sudo dnf group install "Development Tools"
 ```

-##### Red Hat Enterprise Linux / Rocky Linux / Oracle Linux
+##### Red Hat Enterprise Linux / Rocky Linux

-*Note: The term "RHEL" below refers to Red Hat Enterprise Linux, Oracle Linux and Rocky Linux. The distributions are 1:1 binary compatible.*
+*Note: The term "RHEL" below refers to both Red Hat Enterprise Linux and Rocky Linux. The distributions are 1:1 binary compatible.*

 It's recommended to use the latest Python versions.

-RHEL 8 in particular ships with Python 3.6 by default which is EOL and therefore no longer supported by Synapse. RHEL 9 ships with Python 3.9 which is still supported by the Python core team as of this writing. However, newer Python versions provide significant performance improvements and they're available in official distributions' repositories. Therefore it's recommended to use them.
+RHEL 8 in particular ships with Python 3.6 by default which is EOL and therefore no longer supported by Synapse. RHEL 9 ship with Python 3.9 which is still supported by the Python core team as of this writing. However, newer Python versions provide significant performance improvements and they're available in official distributions' repositories. Therefore it's recommended to use them.

 Python 3.11 and 3.12 are available for both RHEL 8 and 9.

 These commands should be run as root user.

+RHEL 8
+```bash
+# Enable PowerTools repository
+dnf config-manager --set-enabled powertools
+```
+RHEL 9
+```bash
+# Enable CodeReady Linux Builder repository
+crb enable
+```
+
 Install new version of Python. You only need one of these:
 ```bash
 # Python 3.11
@ -645,10 +656,6 @@ This also requires the optional `lxml` python dependency to be  installed. This
 in turn requires the `libxml2` library to be available - on  Debian/Ubuntu this
 means `apt-get install libxml2-dev`, or equivalent for your OS.

-### Backups
-
-Don't forget to take [backups](../usage/administration/backups.md) of your new server!
-
 ### Troubleshooting Installation

 `pip` seems to leak *lots* of memory during installation. For instance, a Linux
--- a/docs/spam_checker.md
+++ b/docs/spam_checker.md
@ -63,7 +63,7 @@ class ExampleSpamChecker:
    async def user_may_invite(self, inviter_userid, invitee_userid, room_id):
        return True  # allow all invites

-    async def user_may_create_room(self, userid, room_config):
+    async def user_may_create_room(self, userid):
        return True  # allow all room creations

    async def user_may_create_room_alias(self, userid, room_alias):
@ -72,8 +72,8 @@ class ExampleSpamChecker:
    async def user_may_publish_room(self, userid, room_id):
        return True  # allow publishing of all rooms

-    async def check_username_for_spam(self, user_profile, requester_id):
-        return False  # allow all usernames regardless of requester
+    async def check_username_for_spam(self, user_profile):
+        return False  # allow all usernames

    async def check_registration_for_spam(
        self,
--- a/docs/sso_mapping_providers.md
+++ b/docs/sso_mapping_providers.md
@ -10,7 +10,7 @@ As an example, a SSO service may return the email address
 to turn that into a displayname when creating a Matrix user for this individual.
 It may choose `John Smith`, or `Smith, John [Example.com]` or any number of
 variations. As each Synapse configuration may want something different, this is
-where SSO mapping providers come into play.
+where SAML mapping providers come into play.

 SSO mapping providers are currently supported for OpenID and SAML SSO
 configurations. Please see the details below for how to implement your own.
--- a/docs/upgrade.md
+++ b/docs/upgrade.md
@ -117,107 +117,6 @@ each upgrade are complete before moving on to the next upgrade, to avoid
 stacking them up. You can monitor the currently running background updates with
 [the Admin API](usage/administration/admin_api/background_updates.html#status).

-# Upgrading to v1.130.0
-
-## Documented endpoint which can be delegated to a federation worker
-
-The endpoint `^/_matrix/federation/v1/version$` can be delegated to a federation
-worker. This is not new behaviour, but had not been documented yet. The 
-[list of delegatable endpoints](workers.md#synapseappgeneric_worker) has 
-been updated to include it. Make sure to check your reverse proxy rules if you
-are using workers. 
-
-# Upgrading to v1.126.0
-
-## Room list publication rules change
-
-The default [`room_list_publication_rules`] setting was changed to disallow
-anyone (except server admins) from publishing to the room list by default.
-
-This is in line with Synapse policy of locking down features by default that can
-be abused without moderation.
-
-To keep the previous behavior of allowing publication by default, add the
-following to the config:
-
-```yaml
-room_list_publication_rules:
-  - "action": "allow"
-```
-
-[`room_list_publication_rules`]: usage/configuration/config_documentation.md#room_list_publication_rules
-
-## Change of signing key expiry date for the Debian/Ubuntu package repository
-
-Administrators using the Debian/Ubuntu packages from `packages.matrix.org`,
-please be aware that we have recently updated the expiry date on the repository's GPG signing key,
-but this change must be imported into your keyring.
-
-If you have the `matrix-org-archive-keyring` package installed and it updates before the current key expires, this should
-happen automatically.
-
-Otherwise, if you see an error similar to `The following signatures were invalid: EXPKEYSIG F473DD4473365DE1`, you
-will need to get a fresh copy of the keys. You can do so with:
-
-```sh
-sudo wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
-```
-
-The old version of the key will expire on `2025-03-15`.
-
-# Upgrading to v1.122.0
-
-## Dropping support for PostgreSQL 11 and 12
-
-In line with our [deprecation policy](deprecation_policy.md), we've dropped
-support for PostgreSQL 11 and 12, as they are no longer supported upstream.
-This release of Synapse requires PostgreSQL 13+.
-
-# Upgrading to v1.120.0
-
-## Removal of experimental MSC3886 feature
-
-[MSC3886](https://github.com/matrix-org/matrix-spec-proposals/pull/3886)
-has been closed (and will not enter the Matrix spec). As such, we are
-removing the experimental support for it in this release.
-
-The `experimental_features.msc3886_endpoint` configuration option has
-been removed.
-
-## Authenticated media is now enforced by default
-
-The [`enable_authenticated_media`] configuration option now defaults to true.
-
-This means that clients and remote (federated) homeservers now need to use
-the authenticated media endpoints in order to download media from your
-homeserver.
-
-As an exception, existing media that was stored on the server prior to
-this option changing to `true` will still be accessible over the
-unauthenticated endpoints.
-
-The matrix.org homeserver has already been running with this option enabled
-since September 2024, so most common clients and homeservers should already
-be compatible.
-
-With that said, administrators who wish to disable this feature for broader
-compatibility can still do so by manually configuring
-`enable_authenticated_media: False`.
-
-[`enable_authenticated_media`]: usage/configuration/config_documentation.md#enable_authenticated_media
-
-
-# Upgrading to v1.119.0
-
-## Minimum supported Python version
-
-The minimum supported Python version has been increased from v3.8 to v3.9.
-You will need Python 3.9+ to run Synapse v1.119.0 (due out Nov 7th, 2024).
-
-If you use current versions of the Matrix.org-distributed Docker images, no action is required.
-Please note that support for Ubuntu `focal` was dropped as well since it uses Python 3.8.
-
-
 # Upgrading to v1.111.0

 ## New worker endpoints for authenticated client and federation media
--- a/docs/usage/administration/admin_faq.md
+++ b/docs/usage/administration/admin_faq.md
@ -160,7 +160,7 @@ Using the following curl command:
 ```console
 curl -H 'Authorization: Bearer <access-token>' -X DELETE https://matrix.org/_matrix/client/r0/directory/room/<room-alias>
 ```
-`<access-token>` - can be obtained in element by looking in All settings, clicking Help & About and down the bottom is:
+`<access-token>` - can be obtained in riot by looking in the riot settings, down the bottom is:
 Access Token:\<click to reveal\>

 `<room-alias>` - the room alias, eg. #my_room:matrix.org this possibly needs to be URL encoded also, for example  %23my_room%3Amatrix.org
@ -255,7 +255,7 @@ line to `/etc/default/matrix-synapse`:

    LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2

-*Note*: You may need to set `PYTHONMALLOC=malloc` to ensure that `jemalloc` can accurately calculate memory usage. By default, Python uses its internal small-object allocator, which may interfere with jemalloc's ability to track memory consumption correctly. This could prevent the [cache_autotuning](../configuration/config_documentation.md#caches) feature from functioning as expected, as the Python allocator may not reach the memory threshold set by `max_cache_memory_usage`, thus not triggering the cache eviction process.
+*Note*: You may need to set `PYTHONMALLOC=malloc` to ensure that `jemalloc` can accurately calculate memory usage. By default, Python uses its internal small-object allocator, which may interfere with jemalloc's ability to track memory consumption correctly. This could prevent the [cache_autotuning](../configuration/config_documentation.md#caches-and-associated-values) feature from functioning as expected, as the Python allocator may not reach the memory threshold set by `max_cache_memory_usage`, thus not triggering the cache eviction process.

 This made a significant difference on Python 2.7 - it's unclear how
 much of an improvement it provides on Python 3.x.
--- a/docs/usage/administration/backups.md
+++ b/docs/usage/administration/backups.md
@ -1,125 +0,0 @@
-# How to back up a Synapse homeserver
-
-It is critical to maintain good backups of your server, to guard against
-hardware failure as well as potential corruption due to bugs or administrator
-error.
-
-This page documents the things you will need to consider backing up as part of
-a Synapse installation.
-
-## Configuration files
-
-Keep a copy of your configuration file (`homeserver.yaml`), as well as any
-auxiliary config files it refers to such as the
-[`log_config`](../configuration/config_documentation.md#log_config) file,
-[`app_service_config_files`](../configuration/config_documentation.md#app_service_config_files).
-Often, all such config files will be kept in a single directory such as
-`/etc/synapse`, which will make this easier.
-
-## Server signing key
-
-Your server has a [signing
-key](../configuration/config_documentation.md#signing_key_path) which it uses
-to sign events and outgoing federation requests. It is easiest to back it up
-with your configuration files, but an alternative is to have Synapse create a
-new signing key if you have to restore.
-
-If you do decide to replace the signing key, you should add the old *public*
-key to
-[`old_signing_keys`](../configuration/config_documentation.md#old_signing_keys).
-
-## Database
-
-Synapse's support for SQLite is only suitable for testing purposes, so for the
-purposes of this document, we'll assume you are using
-[PostgreSQL](../../postgres.md).
-
-A full discussion of backup strategies for PostgreSQL is out of scope for this
-document; see the [PostgreSQL
-documentation](https://www.postgresql.org/docs/current/backup.html) for
-detailed information.
-
-### Synapse-specfic details
-
- * Be very careful not to restore into a database that already has tables
-   present. At best, this will error; at worst, it will lead to subtle database
-   inconsistencies.
-
- * The `e2e_one_time_keys_json` table should **not** be backed up, or if it is
-   backed up, should be
-   [`TRUNCATE`d](https://www.postgresql.org/docs/current/sql-truncate.html)
-   after restoring the database before Synapse is started.
-
-   [Background: restoring the database to an older backup can cause
-   used one-time-keys to be re-issued, causing subsequent [message decryption
-   errors](https://github.com/element-hq/element-meta/issues/2155). Clearing
-   all one-time-keys from the database ensures that this cannot happen, and
-   will prompt clients to generate and upload new one-time-keys.]
-
-### Quick and easy database backup and restore
-
-Typically, the easiest solution is to use `pg_dump` to take a copy of the whole
-database. We recommend `pg_dump`'s custom dump format, as it produces
-significantly smaller backup files.
-
-```shell
-sudo -u postgres pg_dump -Fc --exclude-table-data e2e_one_time_keys_json synapse > synapse.dump
-```
-
-There is no need to stop Postgres or Synapse while `pg_dump` is running: it
-will take a consistent snapshot of the databse.
-
-To restore, you will need to recreate the database as described in [Using
-Postgres](../../postgres.md#set-up-database),
-then load the dump into it with `pg_restore`:
-
-```shell
-sudo -u postgres createdb --encoding=UTF8 --locale=C --template=template0 --owner=synapse_user synapse
-sudo -u postgres pg_restore -d synapse < synapse.dump
-```
-
-(If you forgot to exclude `e2e_one_time_keys_json` during `pg_dump`, remember
-to connect to the new database and `TRUNCATE e2e_one_time_keys_json;` before
-starting Synapse.)
-
-To reiterate: do **not** restore a dump over an existing database.
-
-Again, if you plan to run your homeserver at any sort of production level, we
-recommend studying the PostgreSQL documentation on backup options.
-
-## Media store
-
-Synapse keeps a copy of media uploaded by users, including avatars and message
-attachments, in its [Media
-store](../configuration/config_documentation.md#media-store).
-
-It is a directory on the local disk, containing the following directories:
-
- * `local_content`: this is content uploaded by your local users. As a general
-   rule, you should back this up: it may represent the only copy of those
-   media files anywhere in the federation, and if they are lost, users will
-   see errors when viewing user or room avatars, and messages with attachments.
-
- * `local_thumbnails`: "thumbnails" of images uploaded by your users. If
-   [`dynamic_thumbnails`](../configuration/config_documentation.md#dynamic_thumbnails)
-   is enabled, these will be regenerated if they are removed from the disk, and
-   there is therefore no need to back them up.
-
-   If `dynamic_thumbnails` is *not* enabled (the default): although this can
-   theoretically be regenerated from `local_content`, there is no tooling to do
-   so. We recommend that these are backed up too.
-
- * `remote_content`: this is a cache of content that was uploaded by a user on
-    another server, and has since been requested by a user on your own server.
-
-    Typically there is no need to back up this directory: if a file in this directory
-    is removed, Synapse will attempt to fetch it again from the remote
-    server.
-
- * `remote_thumbnails`: thumbnails of images uploaded by users on other
-    servers. As with `remote_content`, there is normally no need to back this
-    up.
-
- * `url_cache`, `url_cache_thumbnails`: temporary caches of files downloaded
-   by the [URL previews](../../setup/installation.md#url-previews) feature.
-   These do not need to be backed up.
--- a/docs/usage/administration/monitoring/reporting_homeserver_usage_statistics.md
+++ b/docs/usage/administration/monitoring/reporting_homeserver_usage_statistics.md
@ -30,7 +30,7 @@ The following statistics are sent to the configured reporting endpoint:
 | `python_version`           | string | The Python version number in use (e.g "3.7.1"). Taken from `sys.version_info`.                                                                                                                                                                                                                  |
 | `total_users`              | int    | The number of registered users on the homeserver.                                                                                                                                                                                                                                               |
 | `total_nonbridged_users`   | int    | The number of users, excluding those created by an Application Service.                                                                                                                                                                                                                         |
-| `daily_user_type_native`   | int    | The number of native, non-guest users created in the last 24 hours.                                                                                                                                                                                                                                        |
+| `daily_user_type_native`   | int    | The number of native users created in the last 24 hours.                                                                                                                                                                                                                                        |
 | `daily_user_type_guest`    | int    | The number of guest users created in the last 24 hours.                                                                                                                                                                                                                                         |
 | `daily_user_type_bridged`  | int    | The number of users created by Application Services in the last 24 hours.                                                                                                                                                                                                                       |
 | `total_room_count`         | int    | The total number of rooms present on the homeserver.                                                                                                                                                                                                                                            |
@ -50,8 +50,8 @@ The following statistics are sent to the configured reporting endpoint:
 | `cache_factor`             | int    | The configured [`global factor`](../../configuration/config_documentation.md#caching) value for caching.                                                                                                                                                                                        |
 | `event_cache_size`         | int    | The configured [`event_cache_size`](../../configuration/config_documentation.md#caching) value for caching.                                                                                                                                                                                     |
 | `database_engine`          | string | The database engine that is in use. Either "psycopg2" meaning PostgreSQL is in use, or "sqlite3" for SQLite3.                                                                                                                                                                                   |
-| `database_server_version`  | string | The version of the database server. Examples being "10.10" for PostgreSQL server version 10.0, and "3.38.5" for SQLite 3.38.5 installed on the system.                                                                                                                                          |
-| `log_level`                | string | The log level in use. Examples are "INFO", "WARNING", "ERROR", "DEBUG", etc.                                                                                                                                                                                                                    |
+| `database_server_version` | string | The version of the database server. Examples being "10.10" for PostgreSQL server version 10.0, and "3.38.5" for SQLite 3.38.5 installed on the system.                                                                                                                                          |
+| `log_level` | string | The log level in use. Examples are "INFO", "WARNING", "ERROR", "DEBUG", etc.                                                                                                                                                                                                                    |


 [^1]: Native matrix users and guests are always counted. If the
--- a/docs/usage/configuration/config_documentation.md
+++ b/docs/usage/configuration/config_documentation.md
--- a/docs/workers.md
+++ b/docs/workers.md
@ -200,7 +200,6 @@ information.
    ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$

    # Federation requests
-    ^/_matrix/federation/v1/version$
    ^/_matrix/federation/v1/event/
    ^/_matrix/federation/v1/state/
    ^/_matrix/federation/v1/state_ids/
@ -250,14 +249,13 @@ information.
    ^/_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$
    ^/_matrix/client/(r0|v3|unstable)/capabilities$
    ^/_matrix/client/(r0|v3|unstable)/notifications$
-    ^/_synapse/admin/v1/rooms/

    # Encryption requests
    ^/_matrix/client/(r0|v3|unstable)/keys/query$
    ^/_matrix/client/(r0|v3|unstable)/keys/changes$
    ^/_matrix/client/(r0|v3|unstable)/keys/claim$
    ^/_matrix/client/(r0|v3|unstable)/room_keys/
-    ^/_matrix/client/(r0|v3|unstable)/keys/upload$
+    ^/_matrix/client/(r0|v3|unstable)/keys/upload/

    # Registration/login requests
    ^/_matrix/client/(api/v1|r0|v3|unstable)/login$
@ -275,6 +273,17 @@ information.
    ^/_matrix/client/(api/v1|r0|v3|unstable)/knock/
    ^/_matrix/client/(api/v1|r0|v3|unstable)/profile/

+    # Account data requests
+    ^/_matrix/client/(r0|v3|unstable)/.*/tags
+    ^/_matrix/client/(r0|v3|unstable)/.*/account_data
+
+    # Receipts requests
+    ^/_matrix/client/(r0|v3|unstable)/rooms/.*/receipt
+    ^/_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers
+
+    # Presence requests
+    ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/
+
    # User directory search requests
    ^/_matrix/client/(r0|v3|unstable)/user_directory/search$

@ -282,14 +291,6 @@ Additionally, the following REST endpoints can be handled for GET requests:

    ^/_matrix/client/(api/v1|r0|v3|unstable)/pushrules/
    ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events
-    ^/_matrix/client/(api/v1|r0|v3|unstable)/devices/
-
-    # Account data requests
-    ^/_matrix/client/(r0|v3|unstable)/.*/tags
-    ^/_matrix/client/(r0|v3|unstable)/.*/account_data
-
-    # Presence requests
-    ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/

 Pagination requests can also be handled, but all requests for a given
 room must be routed to the same instance. Additionally, care must be taken to
@ -323,15 +324,6 @@ For multiple workers not handling the SSO endpoints properly, see
 [#7530](https://github.com/matrix-org/synapse/issues/7530) and
 [#9427](https://github.com/matrix-org/synapse/issues/9427).

-Additionally, when MSC3861 is enabled (`experimental_features.msc3861.enabled`
-set to `true`), the following endpoints can be handled by the worker:
-
-    ^/_synapse/admin/v2/users/[^/]+$
-    ^/_synapse/admin/v1/username_available$
-    ^/_synapse/admin/v1/users/[^/]+/_allow_cross_signing_replacement_without_uia$
-    # Only the GET method:
-    ^/_synapse/admin/v1/users/[^/]+/devices$
-
 Note that a [HTTP listener](usage/configuration/config_documentation.md#listeners)
 with `client` and `federation` `resources` must be configured in the
 [`worker_listeners`](usage/configuration/config_documentation.md#worker_listeners)
--- a/flake.lock
+++ b/flake.lock
@ -56,6 +56,24 @@
        "type": "github"
      }
    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "gitignore": {
      "inputs": {
        "nixpkgs": [
@ -168,27 +186,27 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1729265718,
-        "narHash": "sha256-4HQI+6LsO3kpWTYuVGIzhJs1cetFcwT7quWCk/6rqeo=",
+        "lastModified": 1690535733,
+        "narHash": "sha256-WgjUPscQOw3cB8yySDGlyzo6cZNihnRzUwE9kadv/5I=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ccc0c2126893dd20963580b6478d1a10a4512185",
+        "rev": "8cacc05fbfffeaab910e8c2c9e2a7c6b32ce881a",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "master",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1728538411,
-        "narHash": "sha256-f0SBJz1eZ2yOuKUr5CA9BHULGXVSn6miBuUWdTyhUhU=",
+        "lastModified": 1681358109,
+        "narHash": "sha256-eKyxW4OohHQx9Urxi7TQlFBTDWII+F+x2hklDOQPB50=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b69de56fac8c2b6f8fd27f2eca01dcda8e0a4221",
+        "rev": "96ba1c52e54e74c3197f4d43026b3f3d92e83ff9",
        "type": "github"
      },
      "original": {
@ -231,19 +249,20 @@
        "devenv": "devenv",
        "nixpkgs": "nixpkgs_2",
        "rust-overlay": "rust-overlay",
-        "systems": "systems_2"
+        "systems": "systems_3"
      }
    },
    "rust-overlay": {
      "inputs": {
+        "flake-utils": "flake-utils_2",
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1731897198,
-        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "lastModified": 1693966243,
+        "narHash": "sha256-a2CA1aMIPE67JWSVIGoGtD3EGlFdK9+OlJQs0FOWCKY=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "rev": "a8b4bb4cbb744baaabc3e69099f352f99164e2c1",
        "type": "github"
      },
      "original": {
@ -281,6 +300,21 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -3,13 +3,13 @@
 # (https://github.com/matrix-org/complement) Matrix homeserver test suites are also
 # installed automatically.
 #
-# You must have already installed Nix (https://nixos.org/download/) on your system to use this.
-# Nix can be installed on any Linux distribiution or MacOS; NixOS is not required.
-# Windows is not directly supported, but Nix can be installed inside of WSL2 or even Docker
+# You must have already installed Nix (https://nixos.org) on your system to use this.
+# Nix can be installed on Linux or MacOS; NixOS is not required. Windows is not
+# directly supported, but Nix can be installed inside of WSL2 or even Docker
 # containers. Please refer to https://nixos.org/download for details.
 #
 # You must also enable support for flakes in Nix. See the following for how to
-# do so permanently: https://wiki.nixos.org/wiki/Flakes#Other_Distros,_without_Home-Manager
+# do so permanently: https://nixos.wiki/wiki/Flakes#Enable_flakes
 #
 # Be warned: you'll need over 3.75 GB of free space to download all the dependencies.
 #
@ -20,7 +20,7 @@
 # locally from "services", such as PostgreSQL and Redis.
 #
 # You should now be dropped into a new shell with all programs and dependencies
-# available to you!
+# availabile to you!
 #
 # You can start up pre-configured local Synapse, PostgreSQL and Redis instances by
 # running: `devenv up`. To stop them, use Ctrl-C.
@ -39,9 +39,9 @@

 {
  inputs = {
-    # Use the rolling/unstable branch of nixpkgs. Used to fetch the latest
+    # Use the master/unstable branch of nixpkgs. Used to fetch the latest
    # available versions of packages.
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
    # Output a development shell for x86_64/aarch64 Linux/Darwin (MacOS).
    systems.url = "github:nix-systems/default";
    # A development environment manager built on Nix. See https://devenv.sh.
@ -50,7 +50,7 @@
    rust-overlay.url = "github:oxalica/rust-overlay";
  };

-  outputs = { nixpkgs, devenv, systems, rust-overlay, ... } @ inputs:
+  outputs = { self, nixpkgs, devenv, systems, rust-overlay, ... } @ inputs:
    let
      forEachSystem = nixpkgs.lib.genAttrs (import systems);
    in {
@ -82,7 +82,7 @@
                  #
                  # NOTE: We currently need to set the Rust version unnecessarily high
                  # in order to work around https://github.com/matrix-org/synapse/issues/15939
-                  (rust-bin.stable."1.82.0".default.override {
+                  (rust-bin.stable."1.71.1".default.override {
                    # Additionally install the "rust-src" extension to allow diving into the
                    # Rust source code in an IDE (rust-analyzer will also make use of it).
                    extensions = [ "rust-src" ];
@ -126,7 +126,7 @@
                # Automatically activate the poetry virtualenv upon entering the shell.
                languages.python.poetry.activate.enable = true;
                # Install all extra Python dependencies; this is needed to run the unit
-                # tests and utilise all Synapse features.
+                # tests and utilitise all Synapse features.
                languages.python.poetry.install.arguments = ["--extras all"];
                # Install the 'matrix-synapse' package from the local checkout.
                languages.python.poetry.install.installRootPackage = true;
@ -163,8 +163,8 @@
                # Create a postgres user called 'synapse_user' which has ownership
                # over the 'synapse' database.
                services.postgres.initialScript = ''
-                  CREATE USER synapse_user;
-                  ALTER DATABASE synapse OWNER TO synapse_user;
+                CREATE USER synapse_user;
+                ALTER DATABASE synapse OWNER TO synapse_user;
                '';

                # Redis is needed in order to run Synapse in worker mode.
@ -205,7 +205,7 @@
                # corresponding Nix packages on https://search.nixos.org/packages.
                #
                # This was done until `./install-deps.pl --dryrun` produced no output.
-                env.PERL5LIB = "${with pkgs.perl538Packages; makePerlPath [
+                env.PERL5LIB = "${with pkgs.perl536Packages; makePerlPath [
                  DBI
                  ClassMethodModifiers
                  CryptEd25519
--- a/mypy.ini
+++ b/mypy.ini
@ -26,7 +26,7 @@ strict_equality = True

 # Run mypy type checking with the minimum supported Python version to catch new usage
 # that isn't backwards-compatible (types, overloads, etc).
-python_version = 3.9
+python_version = 3.8

 files =
  docker/,
--- a/poetry.lock
+++ b/poetry.lock
--- a/pyproject.toml
+++ b/pyproject.toml
@ -36,7 +36,7 @@

 [tool.ruff]
 line-length = 88
-target-version = "py39"
+target-version = "py38"

 [tool.ruff.lint]
 # See https://beta.ruff.rs/docs/rules/#error-e
@ -74,10 +74,6 @@ select = [
    "PIE",
    # flake8-executable
    "EXE",
-    # flake8-logging
-    "LOG",
-    # flake8-logging-format
-    "G",
 ]

 [tool.ruff.lint.isort]
@ -101,7 +97,7 @@ module-name = "synapse.synapse_rust"

 [tool.poetry]
 name = "matrix-synapse"
-version = "1.133.0rc1"
+version = "1.118.0"
 description = "Homeserver for the Matrix decentralised comms protocol"
 authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
 license = "AGPL-3.0-or-later"
@ -159,7 +155,7 @@ synapse_review_recent_signups = "synapse._scripts.review_recent_signups:main"
 update_synapse_database = "synapse._scripts.update_synapse_database:main"

 [tool.poetry.dependencies]
-python = "^3.9.0"
+python = "^3.8.0"

 # Mandatory Dependencies
 # ----------------------
@ -182,7 +178,7 @@ Twisted = {extras = ["tls"], version = ">=18.9.0"}
 treq = ">=15.1"
 # Twisted has required pyopenssl 16.0 since about Twisted 16.6.
 pyOpenSSL = ">=16.0.0"
-PyYAML = ">=5.3"
+PyYAML = ">=3.13"
 pyasn1 = ">=0.1.9"
 pyasn1-modules = ">=0.0.7"
 bcrypt = ">=3.1.7"
@ -245,7 +241,7 @@ authlib = { version = ">=0.15.1", optional = true }
 # `contrib/systemd/log_config.yaml`.
 # Note: systemd-python 231 appears to have been yanked from pypi
 systemd-python = { version = ">=231", optional = true }
-lxml = { version = ">=4.5.2", optional = true }
+lxml = { version = ">=4.2.0", optional = true }
 sentry-sdk = { version = ">=0.7.2", optional = true }
 opentracing = { version = ">=2.2.0", optional = true }
 jaeger-client = { version = ">=4.0.0", optional = true }
@ -324,7 +320,7 @@ all = [
 # failing on new releases. Keeping lower bounds loose here means that dependabot
 # can bump versions without having to update the content-hash in the lockfile.
 # This helps prevents merge conflicts when running a batch of dependabot updates.
-ruff = "0.11.11"
+ruff = "0.6.9"
 # Type checking only works with the pydantic.v1 compat module from pydantic v2
 pydantic = "^2"

@ -374,7 +370,7 @@ tomli = ">=1.2.3"
 # runtime errors caused by build system changes.
 # We are happy to raise these upper bounds upon request,
 # provided we check that it's safe to do so (i.e. that CI passes).
-requires = ["poetry-core>=1.1.0,<=1.9.1", "setuptools_rust>=1.3,<=1.10.2"]
+requires = ["poetry-core>=1.1.0,<=1.9.0", "setuptools_rust>=1.3,<=1.8.1"]
 build-backend = "poetry.core.masonry.api"


@ -382,22 +378,16 @@ build-backend = "poetry.core.masonry.api"
 # Skip unsupported platforms (by us or by Rust).
 # See https://cibuildwheel.readthedocs.io/en/stable/options/#build-skip for the list of build targets.
 # We skip:
-#  - CPython 3.6, 3.7 and 3.8: EOLed
-#  - PyPy 3.7 and 3.8: we only support Python 3.9+
+#  - CPython 3.6 and 3.7: EOLed
+#  - PyPy 3.7: we only support Python 3.8+
 #  - musllinux i686: excluded to reduce number of wheels we build.
 #    c.f. https://github.com/matrix-org/synapse/pull/12595#discussion_r963107677
 #  - PyPy on Aarch64 and musllinux on aarch64: too slow to build.
 #    c.f. https://github.com/matrix-org/synapse/pull/14259
-skip = "cp36* cp37* cp38* pp37* pp38* *-musllinux_i686 pp*aarch64 *-musllinux_aarch64"
-# Enable non-default builds.
-# "pypy" used to be included by default up until cibuildwheel 3.
-enable = "pypy"
+skip = "cp36* cp37* pp37* *-musllinux_i686 pp*aarch64 *-musllinux_aarch64"

-# We need a rust compiler.
-#
-# We temporarily pin Rust to 1.82.0 to work around
-# https://github.com/element-hq/synapse/issues/17988
-before-all =  "sh .ci/before_build_wheel.sh"
+# We need a rust compiler
+before-all =  "curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain stable -y --profile minimal"
 environment= { PATH = "$PATH:$HOME/.cargo/bin" }

 # For some reason if we don't manually clean the build directory we
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@ -7,7 +7,7 @@ name = "synapse"
 version = "0.1.0"

 edition = "2021"
-rust-version = "1.81.0"
+rust-version = "1.66.0"

 [lib]
 name = "synapse"
@ -30,27 +30,19 @@ http = "1.1.0"
 lazy_static = "1.4.0"
 log = "0.4.17"
 mime = "0.3.17"
-pyo3 = { version = "0.25.1", features = [
+pyo3 = { version = "0.21.0", features = [
    "macros",
    "anyhow",
    "abi3",
-    "abi3-py39",
+    "abi3-py38",
 ] }
-pyo3-log = "0.12.4"
-pythonize = "0.25.0"
+pyo3-log = "0.10.0"
+pythonize = "0.21.0"
 regex = "1.6.0"
 sha2 = "0.10.8"
 serde = { version = "1.0.144", features = ["derive"] }
 serde_json = "1.0.85"
 ulid = "1.1.2"
-reqwest = { version = "0.12.15", default-features = false, features = [
-    "http2",
-    "stream",
-    "rustls-tls-native-roots",
-] }
-http-body-util = "0.1.3"
-futures = "0.3.31"
-tokio = { version = "1.44.2", features = ["rt", "rt-multi-thread"] }

 [features]
 extension-module = ["pyo3/extension-module"]
--- a/rust/src/acl/mod.rs
+++ b/rust/src/acl/mod.rs
@ -32,14 +32,14 @@ use crate::push::utils::{glob_to_regex, GlobMatchType};

 /// Called when registering modules with python.
 pub fn register_module(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
-    let child_module = PyModule::new(py, "acl")?;
+    let child_module = PyModule::new_bound(py, "acl")?;
    child_module.add_class::<ServerAclEvaluator>()?;

    m.add_submodule(&child_module)?;

    // We need to manually add the module to sys.modules to make `from
    // synapse.synapse_rust import acl` work.
-    py.import("sys")?
+    py.import_bound("sys")?
        .getattr("modules")?
        .set_item("synapse.synapse_rust.acl", child_module)?;

--- a/rust/src/errors.rs
+++ b/rust/src/errors.rs
@ -58,15 +58,3 @@ impl NotFoundError {
        NotFoundError::new_err(())
    }
 }
-
-import_exception!(synapse.api.errors, HttpResponseException);
-
-impl HttpResponseException {
-    pub fn new(status: StatusCode, bytes: Vec<u8>) -> pyo3::PyErr {
-        HttpResponseException::new_err((
-            status.as_u16(),
-            status.canonical_reason().unwrap_or_default(),
-            bytes,
-        ))
-    }
-}
--- a/rust/src/events/filter.rs
+++ b/rust/src/events/filter.rs
@ -1,107 +0,0 @@
-/*
- * This file is licensed under the Affero General Public License (AGPL) version 3.
- *
- * Copyright (C) 2024 New Vector, Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * See the GNU Affero General Public License for more details:
- * <https://www.gnu.org/licenses/agpl-3.0.html>.
- */
-
-use std::collections::HashMap;
-
-use pyo3::{exceptions::PyValueError, pyfunction, PyResult};
-
-use crate::{
-    identifier::UserID,
-    matrix_const::{
-        HISTORY_VISIBILITY_INVITED, HISTORY_VISIBILITY_JOINED, MEMBERSHIP_INVITE, MEMBERSHIP_JOIN,
-    },
-};
-
-#[pyfunction(name = "event_visible_to_server")]
-pub fn event_visible_to_server_py(
-    sender: String,
-    target_server_name: String,
-    history_visibility: String,
-    erased_senders: HashMap<String, bool>,
-    partial_state_invisible: bool,
-    memberships: Vec<(String, String)>, // (state_key, membership)
-) -> PyResult<bool> {
-    event_visible_to_server(
-        sender,
-        target_server_name,
-        history_visibility,
-        erased_senders,
-        partial_state_invisible,
-        memberships,
-    )
-    .map_err(|e| PyValueError::new_err(format!("{e}")))
-}
-
-/// Return whether the target server is allowed to see the event.
-///
-/// For a fully stated room, the target server is allowed to see an event E if:
-///   - the state at E has world readable or shared history vis, OR
-///   - the state at E says that the target server is in the room.
-///
-/// For a partially stated room, the target server is allowed to see E if:
-///   - E was created by this homeserver, AND:
-///       - the partial state at E has world readable or shared history vis, OR
-///       - the partial state at E says that the target server is in the room.
-pub fn event_visible_to_server(
-    sender: String,
-    target_server_name: String,
-    history_visibility: String,
-    erased_senders: HashMap<String, bool>,
-    partial_state_invisible: bool,
-    memberships: Vec<(String, String)>, // (state_key, membership)
-) -> anyhow::Result<bool> {
-    if let Some(&erased) = erased_senders.get(&sender) {
-        if erased {
-            return Ok(false);
-        }
-    }
-
-    if partial_state_invisible {
-        return Ok(false);
-    }
-
-    if history_visibility != HISTORY_VISIBILITY_INVITED
-        && history_visibility != HISTORY_VISIBILITY_JOINED
-    {
-        return Ok(true);
-    }
-
-    let mut visible = false;
-    for (state_key, membership) in memberships {
-        let state_key = UserID::try_from(state_key.as_ref())
-            .map_err(|e| anyhow::anyhow!(format!("invalid user_id ({state_key}): {e}")))?;
-        if state_key.server_name() != target_server_name {
-            return Err(anyhow::anyhow!(
-                "state_key.server_name ({}) does not match target_server_name ({target_server_name})",
-                state_key.server_name()
-            ));
-        }
-
-        match membership.as_str() {
-            MEMBERSHIP_INVITE => {
-                if history_visibility == HISTORY_VISIBILITY_INVITED {
-                    visible = true;
-                    break;
-                }
-            }
-            MEMBERSHIP_JOIN => {
-                visible = true;
-                break;
-            }
-            _ => continue,
-        }
-    }
-
-    Ok(visible)
-}
--- a/rust/src/events/internal_metadata.rs
+++ b/rust/src/events/internal_metadata.rs
@ -41,11 +41,9 @@ use pyo3::{
    pybacked::PyBackedStr,
    pyclass, pymethods,
    types::{PyAnyMethods, PyDict, PyDictMethods, PyString},
-    Bound, IntoPyObject, PyAny, PyObject, PyResult, Python,
+    Bound, IntoPy, PyAny, PyObject, PyResult, Python,
 };

-use crate::UnwrapInfallible;
-
 /// Definitions of the various fields of the internal metadata.
 #[derive(Clone)]
 enum EventInternalMetadataData {
@ -62,59 +60,31 @@ enum EventInternalMetadataData {

 impl EventInternalMetadataData {
    /// Convert the field to its name and python object.
-    fn to_python_pair<'a>(&self, py: Python<'a>) -> (&'a Bound<'a, PyString>, Bound<'a, PyAny>) {
+    fn to_python_pair<'a>(&self, py: Python<'a>) -> (&'a Bound<'a, PyString>, PyObject) {
        match self {
-            EventInternalMetadataData::OutOfBandMembership(o) => (
-                pyo3::intern!(py, "out_of_band_membership"),
-                o.into_pyobject(py)
-                    .unwrap_infallible()
-                    .to_owned()
-                    .into_any(),
-            ),
-            EventInternalMetadataData::SendOnBehalfOf(o) => (
-                pyo3::intern!(py, "send_on_behalf_of"),
-                o.into_pyobject(py).unwrap_infallible().into_any(),
-            ),
-            EventInternalMetadataData::RecheckRedaction(o) => (
-                pyo3::intern!(py, "recheck_redaction"),
-                o.into_pyobject(py)
-                    .unwrap_infallible()
-                    .to_owned()
-                    .into_any(),
-            ),
-            EventInternalMetadataData::SoftFailed(o) => (
-                pyo3::intern!(py, "soft_failed"),
-                o.into_pyobject(py)
-                    .unwrap_infallible()
-                    .to_owned()
-                    .into_any(),
-            ),
-            EventInternalMetadataData::ProactivelySend(o) => (
-                pyo3::intern!(py, "proactively_send"),
-                o.into_pyobject(py)
-                    .unwrap_infallible()
-                    .to_owned()
-                    .into_any(),
-            ),
-            EventInternalMetadataData::Redacted(o) => (
-                pyo3::intern!(py, "redacted"),
-                o.into_pyobject(py)
-                    .unwrap_infallible()
-                    .to_owned()
-                    .into_any(),
-            ),
-            EventInternalMetadataData::TxnId(o) => (
-                pyo3::intern!(py, "txn_id"),
-                o.into_pyobject(py).unwrap_infallible().into_any(),
-            ),
-            EventInternalMetadataData::TokenId(o) => (
-                pyo3::intern!(py, "token_id"),
-                o.into_pyobject(py).unwrap_infallible().into_any(),
-            ),
-            EventInternalMetadataData::DeviceId(o) => (
-                pyo3::intern!(py, "device_id"),
-                o.into_pyobject(py).unwrap_infallible().into_any(),
-            ),
+            EventInternalMetadataData::OutOfBandMembership(o) => {
+                (pyo3::intern!(py, "out_of_band_membership"), o.into_py(py))
+            }
+            EventInternalMetadataData::SendOnBehalfOf(o) => {
+                (pyo3::intern!(py, "send_on_behalf_of"), o.into_py(py))
+            }
+            EventInternalMetadataData::RecheckRedaction(o) => {
+                (pyo3::intern!(py, "recheck_redaction"), o.into_py(py))
+            }
+            EventInternalMetadataData::SoftFailed(o) => {
+                (pyo3::intern!(py, "soft_failed"), o.into_py(py))
+            }
+            EventInternalMetadataData::ProactivelySend(o) => {
+                (pyo3::intern!(py, "proactively_send"), o.into_py(py))
+            }
+            EventInternalMetadataData::Redacted(o) => {
+                (pyo3::intern!(py, "redacted"), o.into_py(py))
+            }
+            EventInternalMetadataData::TxnId(o) => (pyo3::intern!(py, "txn_id"), o.into_py(py)),
+            EventInternalMetadataData::TokenId(o) => (pyo3::intern!(py, "token_id"), o.into_py(py)),
+            EventInternalMetadataData::DeviceId(o) => {
+                (pyo3::intern!(py, "device_id"), o.into_py(py))
+            }
        }
    }

@ -277,7 +247,7 @@ impl EventInternalMetadata {
    ///
    /// Note that `outlier` and `stream_ordering` are stored in separate columns so are not returned here.
    fn get_dict(&self, py: Python<'_>) -> PyResult<PyObject> {
-        let dict = PyDict::new(py);
+        let dict = PyDict::new_bound(py);

        for entry in &self.data {
            let (key, value) = entry.to_python_pair(py);
--- a/rust/src/events/mod.rs
+++ b/rust/src/events/mod.rs
@ -22,23 +22,21 @@

 use pyo3::{
    types::{PyAnyMethods, PyModule, PyModuleMethods},
-    wrap_pyfunction, Bound, PyResult, Python,
+    Bound, PyResult, Python,
 };

-pub mod filter;
 mod internal_metadata;

 /// Called when registering modules with python.
 pub fn register_module(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
-    let child_module = PyModule::new(py, "events")?;
+    let child_module = PyModule::new_bound(py, "events")?;
    child_module.add_class::<internal_metadata::EventInternalMetadata>()?;
-    child_module.add_function(wrap_pyfunction!(filter::event_visible_to_server_py, m)?)?;

    m.add_submodule(&child_module)?;

    // We need to manually add the module to sys.modules to make `from
    // synapse.synapse_rust import events` work.
-    py.import("sys")?
+    py.import_bound("sys")?
        .getattr("modules")?
        .set_item("synapse.synapse_rust.events", child_module)?;

--- a/rust/src/http.rs
+++ b/rust/src/http.rs
@ -70,7 +70,7 @@ pub fn http_request_from_twisted(request: &Bound<'_, PyAny>) -> PyResult<Request
    let headers_iter = request
        .getattr("requestHeaders")?
        .call_method0("getAllRawHeaders")?
-        .try_iter()?;
+        .iter()?;

    for header in headers_iter {
        let header = header?;
--- a/rust/src/http_client.rs
+++ b/rust/src/http_client.rs
@ -1,218 +0,0 @@
-/*
- * This file is licensed under the Affero General Public License (AGPL) version 3.
- *
- * Copyright (C) 2025 New Vector, Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * See the GNU Affero General Public License for more details:
- * <https://www.gnu.org/licenses/agpl-3.0.html>.
- */
-
-use std::{collections::HashMap, future::Future, panic::AssertUnwindSafe, sync::LazyLock};
-
-use anyhow::Context;
-use futures::{FutureExt, TryStreamExt};
-use pyo3::{exceptions::PyException, prelude::*, types::PyString};
-use reqwest::RequestBuilder;
-use tokio::runtime::Runtime;
-
-use crate::errors::HttpResponseException;
-
-/// The tokio runtime that we're using to run async Rust libs.
-static RUNTIME: LazyLock<Runtime> = LazyLock::new(|| {
-    tokio::runtime::Builder::new_multi_thread()
-        .worker_threads(4)
-        .enable_all()
-        .build()
-        .unwrap()
-});
-
-/// A reference to the `Deferred` python class.
-static DEFERRED_CLASS: LazyLock<PyObject> = LazyLock::new(|| {
-    Python::with_gil(|py| {
-        py.import("twisted.internet.defer")
-            .expect("module 'twisted.internet.defer' should be importable")
-            .getattr("Deferred")
-            .expect("module 'twisted.internet.defer' should have a 'Deferred' class")
-            .unbind()
-    })
-});
-
-/// A reference to the twisted `reactor`.
-static TWISTED_REACTOR: LazyLock<Py<PyModule>> = LazyLock::new(|| {
-    Python::with_gil(|py| {
-        py.import("twisted.internet.reactor")
-            .expect("module 'twisted.internet.reactor' should be importable")
-            .unbind()
-    })
-});
-
-/// Called when registering modules with python.
-pub fn register_module(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
-    let child_module: Bound<'_, PyModule> = PyModule::new(py, "http_client")?;
-    child_module.add_class::<HttpClient>()?;
-
-    // Make sure we fail early if we can't build the lazy statics.
-    LazyLock::force(&RUNTIME);
-    LazyLock::force(&DEFERRED_CLASS);
-
-    m.add_submodule(&child_module)?;
-
-    // We need to manually add the module to sys.modules to make `from
-    // synapse.synapse_rust import acl` work.
-    py.import("sys")?
-        .getattr("modules")?
-        .set_item("synapse.synapse_rust.http_client", child_module)?;
-
-    Ok(())
-}
-
-#[pyclass]
-#[derive(Clone)]
-struct HttpClient {
-    client: reqwest::Client,
-}
-
-#[pymethods]
-impl HttpClient {
-    #[new]
-    pub fn py_new(user_agent: &str) -> PyResult<HttpClient> {
-        // The twisted reactor can only be imported after Synapse has been
-        // imported, to allow Synapse to change the twisted reactor. If we try
-        // and import the reactor too early twisted installs a default reactor,
-        // which can't be replaced.
-        LazyLock::force(&TWISTED_REACTOR);
-
-        Ok(HttpClient {
-            client: reqwest::Client::builder()
-                .user_agent(user_agent)
-                .build()
-                .context("building reqwest client")?,
-        })
-    }
-
-    pub fn get<'a>(
-        &self,
-        py: Python<'a>,
-        url: String,
-        response_limit: usize,
-    ) -> PyResult<Bound<'a, PyAny>> {
-        self.send_request(py, self.client.get(url), response_limit)
-    }
-
-    pub fn post<'a>(
-        &self,
-        py: Python<'a>,
-        url: String,
-        response_limit: usize,
-        headers: HashMap<String, String>,
-        request_body: String,
-    ) -> PyResult<Bound<'a, PyAny>> {
-        let mut builder = self.client.post(url);
-        for (name, value) in headers {
-            builder = builder.header(name, value);
-        }
-        builder = builder.body(request_body);
-
-        self.send_request(py, builder, response_limit)
-    }
-}
-
-impl HttpClient {
-    fn send_request<'a>(
-        &self,
-        py: Python<'a>,
-        builder: RequestBuilder,
-        response_limit: usize,
-    ) -> PyResult<Bound<'a, PyAny>> {
-        create_deferred(py, async move {
-            let response = builder.send().await.context("sending request")?;
-
-            let status = response.status();
-
-            let mut stream = response.bytes_stream();
-            let mut buffer = Vec::new();
-            while let Some(chunk) = stream.try_next().await.context("reading body")? {
-                if buffer.len() + chunk.len() > response_limit {
-                    Err(anyhow::anyhow!("Response size too large"))?;
-                }
-
-                buffer.extend_from_slice(&chunk);
-            }
-
-            if !status.is_success() {
-                return Err(HttpResponseException::new(status, buffer));
-            }
-
-            let r = Python::with_gil(|py| buffer.into_pyobject(py).map(|o| o.unbind()))?;
-
-            Ok(r)
-        })
-    }
-}
-
-/// Creates a twisted deferred from the given future, spawning the task on the
-/// tokio runtime.
-///
-/// Does not handle deferred cancellation or contextvars.
-fn create_deferred<F, O>(py: Python, fut: F) -> PyResult<Bound<'_, PyAny>>
-where
-    F: Future<Output = PyResult<O>> + Send + 'static,
-    for<'a> O: IntoPyObject<'a>,
-{
-    let deferred = DEFERRED_CLASS.bind(py).call0()?;
-    let deferred_callback = deferred.getattr("callback")?.unbind();
-    let deferred_errback = deferred.getattr("errback")?.unbind();
-
-    RUNTIME.spawn(async move {
-        // TODO: Is it safe to assert unwind safety here? I think so, as we
-        // don't use anything that could be tainted by the panic afterwards.
-        // Note that `.spawn(..)` asserts unwind safety on the future too.
-        let res = AssertUnwindSafe(fut).catch_unwind().await;
-
-        Python::with_gil(move |py| {
-            // Flatten the panic into standard python error
-            let res = match res {
-                Ok(r) => r,
-                Err(panic_err) => {
-                    let panic_message = get_panic_message(&panic_err);
-                    Err(PyException::new_err(
-                        PyString::new(py, panic_message).unbind(),
-                    ))
-                }
-            };
-
-            // Send the result to the deferred, via `.callback(..)` or `.errback(..)`
-            match res {
-                Ok(obj) => {
-                    TWISTED_REACTOR
-                        .call_method(py, "callFromThread", (deferred_callback, obj), None)
-                        .expect("callFromThread should not fail"); // There's nothing we can really do with errors here
-                }
-                Err(err) => {
-                    TWISTED_REACTOR
-                        .call_method(py, "callFromThread", (deferred_errback, err), None)
-                        .expect("callFromThread should not fail"); // There's nothing we can really do with errors here
-                }
-            }
-        });
-    });
-
-    Ok(deferred)
-}
-
-/// Try and get the panic message out of the panic
-fn get_panic_message<'a>(panic_err: &'a (dyn std::any::Any + Send + 'static)) -> &'a str {
-    // Apparently this is how you extract the panic message from a panic
-    if let Some(str_slice) = panic_err.downcast_ref::<&str>() {
-        str_slice
-    } else if let Some(string) = panic_err.downcast_ref::<String>() {
-        string
-    } else {
-        "unknown error"
-    }
-}
--- a/rust/src/identifier.rs
+++ b/rust/src/identifier.rs
@ -1,252 +0,0 @@
-/*
- * This file is licensed under the Affero General Public License (AGPL) version 3.
- *
- * Copyright (C) 2024 New Vector, Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * See the GNU Affero General Public License for more details:
- * <https://www.gnu.org/licenses/agpl-3.0.html>.
- */
-
-//! # Matrix Identifiers
-//!
-//! This module contains definitions and utilities for working with matrix identifiers.
-
-use std::{fmt, ops::Deref};
-
-/// Errors that can occur when parsing a matrix identifier.
-#[derive(Clone, Debug, PartialEq)]
-pub enum IdentifierError {
-    IncorrectSigil,
-    MissingColon,
-}
-
-impl fmt::Display for IdentifierError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{self:?}")
-    }
-}
-
-/// A Matrix user_id.
-#[derive(Clone, Debug, PartialEq)]
-pub struct UserID(String);
-
-impl UserID {
-    /// Returns the `localpart` of the user_id.
-    pub fn localpart(&self) -> &str {
-        &self[1..self.colon_pos()]
-    }
-
-    /// Returns the `server_name` / `domain` of the user_id.
-    pub fn server_name(&self) -> &str {
-        &self[self.colon_pos() + 1..]
-    }
-
-    /// Returns the position of the ':' inside of the user_id.
-    /// Used when splitting the user_id into it's respective parts.
-    fn colon_pos(&self) -> usize {
-        self.find(':').unwrap()
-    }
-}
-
-impl TryFrom<&str> for UserID {
-    type Error = IdentifierError;
-
-    /// Will try creating a `UserID` from the provided `&str`.
-    /// Can fail if the user_id is incorrectly formatted.
-    fn try_from(s: &str) -> Result<Self, Self::Error> {
-        if !s.starts_with('@') {
-            return Err(IdentifierError::IncorrectSigil);
-        }
-
-        if s.find(':').is_none() {
-            return Err(IdentifierError::MissingColon);
-        }
-
-        Ok(UserID(s.to_string()))
-    }
-}
-
-impl TryFrom<String> for UserID {
-    type Error = IdentifierError;
-
-    /// Will try creating a `UserID` from the provided `&str`.
-    /// Can fail if the user_id is incorrectly formatted.
-    fn try_from(s: String) -> Result<Self, Self::Error> {
-        if !s.starts_with('@') {
-            return Err(IdentifierError::IncorrectSigil);
-        }
-
-        if s.find(':').is_none() {
-            return Err(IdentifierError::MissingColon);
-        }
-
-        Ok(UserID(s))
-    }
-}
-
-impl<'de> serde::Deserialize<'de> for UserID {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let s: String = serde::Deserialize::deserialize(deserializer)?;
-        UserID::try_from(s).map_err(serde::de::Error::custom)
-    }
-}
-
-impl Deref for UserID {
-    type Target = str;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl fmt::Display for UserID {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
-
-/// A Matrix room_id.
-#[derive(Clone, Debug, PartialEq)]
-pub struct RoomID(String);
-
-impl RoomID {
-    /// Returns the `localpart` of the room_id.
-    pub fn localpart(&self) -> &str {
-        &self[1..self.colon_pos()]
-    }
-
-    /// Returns the `server_name` / `domain` of the room_id.
-    pub fn server_name(&self) -> &str {
-        &self[self.colon_pos() + 1..]
-    }
-
-    /// Returns the position of the ':' inside of the room_id.
-    /// Used when splitting the room_id into it's respective parts.
-    fn colon_pos(&self) -> usize {
-        self.find(':').unwrap()
-    }
-}
-
-impl TryFrom<&str> for RoomID {
-    type Error = IdentifierError;
-
-    /// Will try creating a `RoomID` from the provided `&str`.
-    /// Can fail if the room_id is incorrectly formatted.
-    fn try_from(s: &str) -> Result<Self, Self::Error> {
-        if !s.starts_with('!') {
-            return Err(IdentifierError::IncorrectSigil);
-        }
-
-        if s.find(':').is_none() {
-            return Err(IdentifierError::MissingColon);
-        }
-
-        Ok(RoomID(s.to_string()))
-    }
-}
-
-impl TryFrom<String> for RoomID {
-    type Error = IdentifierError;
-
-    /// Will try creating a `RoomID` from the provided `String`.
-    /// Can fail if the room_id is incorrectly formatted.
-    fn try_from(s: String) -> Result<Self, Self::Error> {
-        if !s.starts_with('!') {
-            return Err(IdentifierError::IncorrectSigil);
-        }
-
-        if s.find(':').is_none() {
-            return Err(IdentifierError::MissingColon);
-        }
-
-        Ok(RoomID(s))
-    }
-}
-
-impl<'de> serde::Deserialize<'de> for RoomID {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let s: String = serde::Deserialize::deserialize(deserializer)?;
-        RoomID::try_from(s).map_err(serde::de::Error::custom)
-    }
-}
-
-impl Deref for RoomID {
-    type Target = str;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl fmt::Display for RoomID {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
-
-/// A Matrix event_id.
-#[derive(Clone, Debug, PartialEq)]
-pub struct EventID(String);
-
-impl TryFrom<&str> for EventID {
-    type Error = IdentifierError;
-
-    /// Will try creating a `EventID` from the provided `&str`.
-    /// Can fail if the event_id is incorrectly formatted.
-    fn try_from(s: &str) -> Result<Self, Self::Error> {
-        if !s.starts_with('$') {
-            return Err(IdentifierError::IncorrectSigil);
-        }
-
-        Ok(EventID(s.to_string()))
-    }
-}
-
-impl TryFrom<String> for EventID {
-    type Error = IdentifierError;
-
-    /// Will try creating a `EventID` from the provided `String`.
-    /// Can fail if the event_id is incorrectly formatted.
-    fn try_from(s: String) -> Result<Self, Self::Error> {
-        if !s.starts_with('$') {
-            return Err(IdentifierError::IncorrectSigil);
-        }
-
-        Ok(EventID(s))
-    }
-}
-
-impl<'de> serde::Deserialize<'de> for EventID {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let s: String = serde::Deserialize::deserialize(deserializer)?;
-        EventID::try_from(s).map_err(serde::de::Error::custom)
-    }
-}
-
-impl Deref for EventID {
-    type Target = str;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl fmt::Display for EventID {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@ -1,5 +1,3 @@
-use std::convert::Infallible;
-
 use lazy_static::lazy_static;
 use pyo3::prelude::*;
 use pyo3_log::ResetHandle;
@ -8,9 +6,6 @@ pub mod acl;
 pub mod errors;
 pub mod events;
 pub mod http;
-pub mod http_client;
-pub mod identifier;
-pub mod matrix_const;
 pub mod push;
 pub mod rendezvous;

@ -51,21 +46,7 @@ fn synapse_rust(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
    acl::register_module(py, m)?;
    push::register_module(py, m)?;
    events::register_module(py, m)?;
-    http_client::register_module(py, m)?;
    rendezvous::register_module(py, m)?;

    Ok(())
 }
-
-pub trait UnwrapInfallible<T> {
-    fn unwrap_infallible(self) -> T;
-}
-
-impl<T> UnwrapInfallible<T> for Result<T, Infallible> {
-    fn unwrap_infallible(self) -> T {
-        match self {
-            Ok(val) => val,
-            Err(never) => match never {},
-        }
-    }
-}
--- a/rust/src/matrix_const.rs
+++ b/rust/src/matrix_const.rs
@ -1,28 +0,0 @@
-/*
- * This file is licensed under the Affero General Public License (AGPL) version 3.
- *
- * Copyright (C) 2024 New Vector, Ltd
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * See the GNU Affero General Public License for more details:
- * <https://www.gnu.org/licenses/agpl-3.0.html>.
- */
-
-//! # Matrix Constants
-//!
-//! This module contains definitions for constant values described by the matrix specification.
-
-pub const HISTORY_VISIBILITY_WORLD_READABLE: &str = "world_readable";
-pub const HISTORY_VISIBILITY_SHARED: &str = "shared";
-pub const HISTORY_VISIBILITY_INVITED: &str = "invited";
-pub const HISTORY_VISIBILITY_JOINED: &str = "joined";
-
-pub const MEMBERSHIP_BAN: &str = "ban";
-pub const MEMBERSHIP_LEAVE: &str = "leave";
-pub const MEMBERSHIP_KNOCK: &str = "knock";
-pub const MEMBERSHIP_INVITE: &str = "invite";
-pub const MEMBERSHIP_JOIN: &str = "join";
--- a/rust/src/push/evaluator.rs
+++ b/rust/src/push/evaluator.rs
@ -167,7 +167,6 @@ impl PushRuleEvaluator {
    ///
    /// Returns the set of actions, if any, that match (filtering out any
    /// `dont_notify` and `coalesce` actions).
-    #[pyo3(signature = (push_rules, user_id=None, display_name=None))]
    pub fn run(
        &self,
        push_rules: &FilteredPushRules,
@ -237,7 +236,6 @@ impl PushRuleEvaluator {
    }

    /// Check if the given condition matches.
-    #[pyo3(signature = (condition, user_id=None, display_name=None))]
    fn matches(
        &self,
        condition: Condition,
--- a/Show More
+++ b/Show More
				`@ -1 +0,0 @@`
				`Support for [MSC4235](https://github.com/matrix-org/matrix-spec-proposals/pull/4235): via query param for hierarchy endpoint. Contributed by Krishan (@kfiven).`
				`@ -1 +0,0 @@`
				Add `forget_forced_upon_leave` capability as per [MSC4267](https://github.com/matrix-org/matrix-spec-proposals/pull/4267).
				`@ -1 +0,0 @@`
				Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper.
				`@ -1 +0,0 @@`
				Fix `KeyError` on background updates when using split main/state databases.
				`@ -1 +0,0 @@`
				`Improve performance of device deletion by adding missing index.`
				`@ -1 +0,0 @@`
				`Ensure policy servers are not asked to scan policy server change events, allowing rooms to disable the use of a policy server while the policy server is down.`