ESS Community Helm Chart 26.10.0 (2026-10-09)

Removed / Breaking Changes

• serverName is now required when matrixRTC.enabled=true, as the MatrixRTC Authorisation Service always runs as an application service.

  If initSecrets is disabled, matrixRTC.appserviceRegistration must now be provided. (#1626)

Changed

• Run the MatrixRTC Authorisation Service as an application service so that it can authenticate to Synapse on behalf of users, e.g. to manage their MSC4140 delayed leave events.

  When Synapse is deployed by the chart, the registration is generated by initSecrets and loaded by Synapse, which also gets the msc4502_enabled and msc4512_enabled experimental features.

  When Synapse is not deployed by the chart, the registration is also generated. Your homeserver must then load it, e.g. copied from the generated Secret. (#1626)

• Upgrade Element Admin to v0.1.15.

  Highlights:

  • Bump base image

  Full Changelogs:

  • v0.1.15

  (#1632)

• Use specific minor version for Postgres container image. (#1634)

• Use specific patch version for Valkey container image. (#1634)

• Use specific patch version for HAProxy container image. (#1634)

• Remove obsolete feature_new_room_decoration_ui setting from Element Web. (#1639)

• Upgrade MatrixRTC SFU to v1.13.9.

  Full Changelogs:

  • v1.13.8
  • v1.13.9

  (#1641)

• Route Synapse's /auth_metadata endpoint to the client-reader worker so that clients can refresh tokens while the main Synapse process is unavailable. (#1644)

• Upgrade MatrixRTC Authoriser to v0.8.0.

  Highlights:

  • Update the Client-Server and Server-Server /get_token endpoints to the latest MSC4195 format, replacing the member object with a flat member_id parameter
  • Remove the deprecated delay_timeout parameter from the Client-Server /delegate_delayed_leave endpoint. The service now looks up the delay itself
  • Validate the OpenID response in the deprecated /get_token and /sfu/get endpoints

  Full Changelogs

  • v0.8.0

  (#1645)

Fixed

• Fix the Matrix RTC SFU's multiplexed UDP port being exposed as TCP when using HostPort. (#1633)

Internal

• Introduce basic end-to-end playwright tests. (#1636, #1647, #1651, #1652, #1654)
• CI: Fix flakes when uploading media. (#1637)
• CI: Export kubectl top pods command result to exported logs. (#1640, #1642)
• CI: Export the docker containers attached to the k3d network and their logs, and skip with a warning k3d steps if k3d is not running. (#1646)
• CI: Implement a hack workaround of asyncio-cooperative hiding fixture errors. (#1650)