Synapse 1.94.0 (2023-10-10)

No significant changes since 1.94.0rc1.
However, please take note of the security advisory that follows.

Security advisory

The following issue is fixed in 1.94.0 (and RC).

GHSA-5chr-wjw5-3gq4 / CVE-2023-45129 — Moderate Severity
A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service.
Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected.

See the advisory for more details. If you have any questions, email security@matrix.org.

Render plain, CSS, CSV, JSON and common image formats in the browser (inline) when requested through the /download endpoint. (#15988)
Add experimental support for MSC4028 to push all encrypted events to clients. (#16361)
Minor performance improvement when sending presence to federated servers. (#16385)
Minor performance improvement by caching server ACL checking. (#16360)

Add developer documentation concerning gradual schema migrations with column alterations. (#15691)
Improve documentation of the user directory search algorithm. (#16320)
Fix rendering of user admin API documentation around deactivation. This was broken in Synapse 1.91.0. (#16355)
Update documentation around message retention policies. (#16382)
Add note to federation_domain_whitelist config option to clarify its usage. (#16416)
Improve legacy release notes. (#16418)

Avoid running CI steps when the files they check have not been changed. (#14745, #16387)
Improve type hints. (#14911, #16350, #16356, #16395)
Added support for pydantic v2 in addition to pydantic v1. Contributed by Maxwell G (@gotmax23). (#16332)
Get CI to check PRs have been signed-off. (#16348)
Add missing licence header. (#16359)
Improve type hints, and bump types-psycopg2 from 2.9.21.11 to 2.9.21.14. (#16381)
Improve comments in StateGroupBackgroundUpdateStore. (#16383)
Update maturin configuration. (#16394)
Downgrade replication stream time out error log lines to warning. (#16401)