chore(deps): update dependency element-hq/synapse to v1.141.0 (2/main)

[renovate]

This PR contains the following updates:

Package	Update	Change
element-hq/synapse	minor	v1.140.0 -> v1.141.0

---

Pre-merge checks for Synapse or MAS workloads

• The Release Notes do not describe any breaking changes.

• The Upgrade document does not describe any breaking changes.

---

Release Notes

element-hq/synapse (element-hq/synapse)

v1.141.0

Compare Source

Synapse 1.141.0 (2025-10-29)

Deprecation of MacOS Python wheels

The team has decided to deprecate and eventually stop publishing python wheels
for MacOS. This is a burden on the team, and we're not aware of any parties
that use them. Synapse docker images will continue to work on MacOS, as will
building Synapse from source (though note this requires a Rust compiler).

Publishing MacOS Python wheels will continue for the next few releases. If you
do make use of these wheels downstream, please reach out to us in
#synapse-dev:matrix.org. We'd
love to hear from you!

Docker images now based on Debian trixie with Python 3.13

The Docker images are now based on Debian trixie and use Python 3.13. If you
are using the Docker images as a base image you may need to e.g. adjust the
paths you mount any additional Python packages at.

No significant changes since 1.141.0rc2.

Synapse 1.141.0rc2 (2025-10-28)

Bugfixes

• Fix users being unable to log in if their password, or the server's configured pepper, was too long. (#​19101)

Synapse 1.141.0rc1 (2025-10-21)

Features

• Allow using MSC4190 behavior without the opt-in registration flag. Contributed by @​tulir @​ Beeper. (#​19031)
• Stabilized support for MSC4326: Device masquerading for appservices. Contributed by @​tulir @​ Beeper. (#​19033)

Bugfixes

• Fix a bug introduced in 1.136.0 that would prevent Synapse from being able to be reload-ed more than once when running under systemd. (#​19060)
• Fix a bug introduced in 1.140.0 where an internal server error could be raised when hashing user passwords that are too long. (#​19078)

Updates to the Docker image

• Update docker image to use Debian trixie as the base and thus Python 3.13. (#​19064)

Internal Changes

• Move unique snowflake homeserver background tasks to start_background_tasks (the standard pattern for this kind of thing). (#​19037)
• Drop a deprecated field of the PyGitHub dependency in the release script and raise the dependency's minimum version to 1.59.0. (#​19039)
• Update TODO list of conflicting areas where we encounter metrics being clobbered (ApplicationService). (#​19040)

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Unused entries in .trivyignore

Image: ghcr.io/canonical/synapse:6dd4f788679545cde09ab3f12a3fadc8393d7826-_3.0_amd64

The following CVEs are in .trivyignore but not ignored by Trivy anymore:

• CVE-2025-59420
• CVE-2025-61920

[github-actions]

Unused entries in .trivyignore

Image: ghcr.io/canonical/synapse:6dd4f788679545cde09ab3f12a3fadc8393d7826-_3.0_amd64

The following CVEs are in .trivyignore but not ignored by Trivy anymore:

• CVE-2025-59420
• CVE-2025-61920