chore(deps): update ghcr.io/element-hq/synapse docker tag to v1.149.1

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/element-hq/synapse	minor	v1.147.0 → v1.149.1

---

Release Notes

element-hq/synapse (ghcr.io/element-hq/synapse)

v1.149.1

Compare Source

Synapse 1.149.1 (2026-03-11)

Internal Changes

• Bump matrix-synapse-ldap3 to 0.4.0 to support setuptools>=82.0.0. Fixes #​19541. (#​19543)

v1.149.0

Compare Source

Synapse 1.149.0 (2026-03-10)

No significant changes since 1.149.0rc1.

Synapse 1.149.0rc1 (2026-03-03)

Features

• Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#​19127)
• Add stable support for MSC4380 invite blocking. (#​19431)

Bugfixes

• Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#​18518)
• Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#​19460)

Internal Changes

• Add log to explain when and why we freeze objects in the garbage collector. (#​19440)
• Better instrument JoinRoomAliasServlet with tracing. (#​19461)
• Fix Complement CI not running against the code from our PRs. (#​19475)
• Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#​19480)
• Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#​19486)
• Add a log line when we delete devices. Contributed by @​bradtgmurray @​ Beeper. (#​19496)
• Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#​19498)
• Cancel long-running sync requests if the client has gone away. (#​19499)
• Try and reduce reactor tick times when under heavy load. (#​19507)
• Simplify Rust HTTP client response streaming and limiting. (#​19510)
• Replace deprecated collection import locations with current locations. (#​19515)
• Bump most locked Python dependencies to their latest versions. (#​19519)

v1.148.0

Compare Source

Synapse 1.148.0 (2026-02-24)

No significant changes since 1.148.0rc1.

Synapse 1.148.0rc1 (2026-02-17)

Features

• Support sending and receiving MSC4354 Sticky Event metadata. (#​19365)

Improved Documentation

• Fix reference to the experimental_features section of the configuration manual documentation. (#​19435)

Deprecations and Removals

• Remove support for MSC3244: Room version capabilities as the MSC was rejected. (#​19429)

Internal Changes

• Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. (#​19406)
• Push Synapse docker images to Element OCI Registry. (#​19420)
• Allow configuring the Rust HTTP client to use HTTP/2 only. (#​19457)
• Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. (#​19470)

v1.147.1

Compare Source

Synapse 1.147.1 (2026-02-12)

• Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670. (#​19459)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.