Synapse 1.149.0rc1 (2026-03-03)

Features

Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR. (#19127)
Add stable support for MSC4380 invite blocking. (#19431)

Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. (#18518)
Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios. (#19460)

Add log to explain when and why we freeze objects in the garbage collector. (#19440)
Better instrument JoinRoomAliasServlet with tracing. (#19461)
Fix Complement CI not running against the code from our PRs. (#19475)
Log docker system info in CI so we have a plain record of how GitHub runners evolve over time. (#19480)
Rename the test_disconnect test helper so that pytest doesn't see it as a test. (#19486)
Add a log line when we delete devices. Contributed by @bradtgmurray @ Beeper. (#19496)
Pre-allocate the buffer based on the expected Content-Length with the Rust HTTP client. (#19498)
Cancel long-running sync requests if the client has gone away. (#19499)
Try and reduce reactor tick times when under heavy load. (#19507)
Simplify Rust HTTP client response streaming and limiting. (#19510)
Replace deprecated collection import locations with current locations. (#19515)
Bump most locked Python dependencies to their latest versions. (#19519)