Update request: matrix-synapse 1.92.3 (security)

[pacien]

This week we released Synapse 1.92.3 in response to CVE-2023-4863,
a critical vulnerability in libwebp.
Server administrators are encouraged to upgrade as soon as possible.

I'm not sure whether our libwebp used by Pillow is patched in another way.

---

• Package name: matrix-synapse

• Latest released version: 1.92.3

• Current version on the unstable channel: 1.92.1

• Current version on the stable/release channel: 1.92.1

• Checked the nixpkgs pull requests

Notify maintainers

@Ma27
@fadenb
@mguentner
@Ralith
@dandellion
@sumnerevans
@NickCao

---

Note for maintainers: Please tag this issue in your PR.

[pacien]

Related to: #254798

[Ma27]

This only updates the version constraint in pyproject.toml / poetry[1]. We however use pillow provided by our python package-set. In other words, the changes in 1.92.3 are not relevant for us which is why I didn't do the upgrade (and I guess the same applies to the other maintainers).

In fact we aren't even impacted by pillow 10.0.0 being vulnerable because we use the distribution's libwebp rather than the one bundled with pillow: #255858 (comment)

Closing since I don't think there's anything actionable (or even security-relevant) here. (On a personal note I think that this is primarily an example of why it's good to not use vendored dependencies)

[1] matrix-org/synapse@v1.92.2...v1.92.3