code-tool · shcherbak · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026
diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-VERSION=v1.151.0
+VERSION=v1.155.0
 
 .PHONY: all build-main push-main build-e2e push-e2e test-lua
 

diff --git a/README.md b/README.md
@@ -81,7 +81,7 @@ Worker reference table
 | receipts                               | stream writer | yes      | round-robin          | yes  |
 | device_lists                           | stream writer | yes      | round-robin          | yes  |
 | thread_subscriptions                   | stream writer | yes      | round-robin          | yes  |
-| quarantined_media                      | stream writer | yes      | round-robin          | yes  |
+| quarantined_media_changes              | stream writer | yes      | round-robin (?)      | yes  |
 | events (persister)                     | stream writer | yes      | shard by room_id     | yes  |
 | media_repository                       | app           | yes      | least_conn           | yes  |
 | media_instance_running_background_jobs | app           | no       | -                    | no   |

diff --git a/build/Dockerfile b/build/Dockerfile
@@ -1,4 +1,4 @@
-ARG SYNAPSE_PKG_VER="v1.151.0"
+ARG SYNAPSE_PKG_VER="v1.155.0"
 ARG PYTHON_PKG_VER="3.13"
 
 # stage 1 : build pip

diff --git a/charts/synapse/Chart.yaml b/charts/synapse/Chart.yaml
@@ -2,4 +2,4 @@ apiVersion: v2
 appVersion: 1.151.0
 description: matrix synapse kubernetes deployment
 name: synapse
-version: 2.7.0
+version: 2.8.0
diff --git a/charts/synapse/templates/_helpers.tpl b/charts/synapse/templates/_helpers.tpl
@@ -38,6 +38,14 @@ app: synapse
 component: synapse-federation-reader
 {{- end }}
 
+{{/*
+Selector labels
+*/}}
+{{- define "synapse-quarantined-media-changes.selectorLabels" -}}
+app: synapse
+component: synapse-quarantined-media-changes
+{{- end }}
+
 {{/*
 Selector labels
 */}}

diff --git a/charts/synapse/templates/envoy-configmap.yaml b/charts/synapse/templates/envoy-configmap.yaml
@@ -175,6 +175,16 @@ data:
                                 cluster: httpd-media-repository
                             {{- end }}
 
+                            {{- range $route := .Values.ingress.quarantineMediaChangesRoutes }}
+                            - match:
+                                safe_regex:
+                                  regex: {{ printf "^%s" $route | squote }}
+                              route:
+                                timeout: 300s
+                                auto_host_rewrite: true
+                                cluster: httpd-quarantined-media-changes
+                            {{- end }}
+
                             {{- range $route := .Values.ingress.toDeviceRoutes }}
                             - match:
                                 safe_regex:
@@ -921,6 +931,33 @@ data:
                         socket_address:
                           address: synapse-media-repository
                           port_value: 8008
+        - name: httpd-quarantined-media-changes
+          connect_timeout: 1.00s
+          type: STRICT_DNS
+          dns_lookup_family: V4_ONLY
+          ignore_health_on_host_removal: true
+          lb_policy: LEAST_REQUEST
+          least_request_lb_config:
+            choice_count: 2
+          circuit_breakers:
+            thresholds:
+              - priority: DEFAULT
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+              - priority: HIGH
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+          load_assignment:
+            cluster_name: httpd-quarantined-media-changes
+            endpoints:
+              - lb_endpoints:
+                  - endpoint:
+                      address:
+                        socket_address:
+                          address: synapse-quarantined-media-changes-headless
+                          port_value: 8008
 
   synapse.lua: |
     {{- .Files.Get "scripts/synapse.lua" | nindent 4 }}
diff --git a/charts/synapse/templates/synapse-secret.yaml b/charts/synapse/templates/synapse-secret.yaml
@@ -4,9 +4,9 @@
 {{- $clientFedWorkers   := list "master" "room" }}
 {{- $noHttpWorkers      := list "background_worker" "pusher" }}
 {{- $streamWritersLocks := list "account_data"}}
-{{- $streamWriters      := list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" }}
-{{- $replicationWorkers := list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" "federation_sender" }}
-{{- $clientOnlyWorkers  := list "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" "sync" "client_reader" "client_keys" "user_dir" }}
+{{- $streamWriters      := list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media_changes" "event_persister" }}
+{{- $replicationWorkers := list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media_changes" "event_persister" "federation_sender" }}
+{{- $clientOnlyWorkers  := list "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media_changes" "event_persister" "sync" "client_reader" "client_keys" "user_dir" }}
 
 {{- $registration_shared_secret := .Values.registration_shared_secret }}
 {{- $form_secret := .Values.form_secret }}
@@ -196,6 +196,11 @@ stringData:
         host: synapse-federation-sender-{{ . }}.synapse-federation-sender
         port: 9093
       {{- end }}
+      {{- range until ( $workers.quarantined_media_changes.replicas | int) }}
+      synapse-quarantined-media-changes-{{ . }}:
+        host: synapse-quarantined-media-changes-{{ . }}.synapse-quarantined-media-changes
+        port: 9093
+      {{- end }}
     stream_writers:
       typing:
         - synapse-typing-0
@@ -225,6 +230,10 @@ stringData:
         {{- range until ( $workers.event_persister.replicas | int) }}
         - synapse-event-persister-{{ . }}
         {{- end }}
+      quarantined_media_changes:
+        {{- range until ( $workers.quarantined_media_changes.replicas | int) }}
+        - synapse-quarantined-media-changes-{{ . }}
+        {{- end }}
     start_pushers: false
     pusher_instances:
       {{- range until ( $workers.pusher.replicas | int) }}

diff --git a/charts/synapse/templates/synapse-service.yaml b/charts/synapse/templates/synapse-service.yaml
@@ -122,3 +122,23 @@ spec:
       targetPort: 8008
   selector:
     {{- include "synapse-federation-reader.selectorLabels" . | nindent 6 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: synapse-quarantined-media-changes-headless
+  {{- with $.Values.synapse.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "synapse-quarantined-media-changes.selectorLabels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8008
+      targetPort: 8008
+  selector:
+    {{- include "synapse-quarantined-media-changes.selectorLabels" . | nindent 6 }}
diff --git a/charts/synapse/tests/golden/fixtures/test-envoy-configmap-msc4306.golden.yaml b/charts/synapse/tests/golden/fixtures/test-envoy-configmap-msc4306.golden.yaml
@@ -274,18 +274,18 @@ data:
                                 cluster: httpd-media-repository
                             - match:
                                 safe_regex:
-                                  regex: '^/_synapse/admin/v1/quarantine_media/.*'
+                                  regex: '^/_synapse/admin/v1/users/.*/media'
                               route:
                                 timeout: 300s
                                 auto_host_rewrite: true
                                 cluster: httpd-media-repository
                             - match:
                                 safe_regex:
-                                  regex: '^/_synapse/admin/v1/users/.*/media'
+                                  regex: '^/_synapse/admin/v1/quarantine_media/.*'
                               route:
                                 timeout: 300s
                                 auto_host_rewrite: true
-                                cluster: httpd-media-repository
+                                cluster: httpd-quarantined-media-changes
                             - match:
                                 safe_regex:
                                   regex: '^/_matrix/client/(r0|v3|unstable)/sendToDevice/.*'
@@ -1535,6 +1535,33 @@ data:
                         socket_address:
                           address: synapse-media-repository
                           port_value: 8008
+        - name: httpd-quarantined-media-changes
+          connect_timeout: 1.00s
+          type: STRICT_DNS
+          dns_lookup_family: V4_ONLY
+          ignore_health_on_host_removal: true
+          lb_policy: LEAST_REQUEST
+          least_request_lb_config:
+            choice_count: 2
+          circuit_breakers:
+            thresholds:
+              - priority: DEFAULT
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+              - priority: HIGH
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+          load_assignment:
+            cluster_name: httpd-quarantined-media-changes
+            endpoints:
+              - lb_endpoints:
+                  - endpoint:
+                      address:
+                        socket_address:
+                          address: synapse-quarantined-media-changes-headless
+                          port_value: 8008
 
   synapse.lua: |
     local room_id_pattern = "(![A-Za-z0-9._=%%%-/]+:[A-Za-z0-9.%-]+)"

diff --git a/charts/synapse/tests/golden/fixtures/test-envoy-configmap-no-mas.golden.yaml b/charts/synapse/tests/golden/fixtures/test-envoy-configmap-no-mas.golden.yaml
@@ -295,18 +295,18 @@ data:
                                 cluster: httpd-media-repository
                             - match:
                                 safe_regex:
-                                  regex: '^/_synapse/admin/v1/quarantine_media/.*'
+                                  regex: '^/_synapse/admin/v1/users/.*/media'
                               route:
                                 timeout: 300s
                                 auto_host_rewrite: true
                                 cluster: httpd-media-repository
                             - match:
                                 safe_regex:
-                                  regex: '^/_synapse/admin/v1/users/.*/media'
+                                  regex: '^/_synapse/admin/v1/quarantine_media/.*'
                               route:
                                 timeout: 300s
                                 auto_host_rewrite: true
-                                cluster: httpd-media-repository
+                                cluster: httpd-quarantined-media-changes
                             - match:
                                 safe_regex:
                                   regex: '^/_matrix/client/(r0|v3|unstable)/sendToDevice/.*'
@@ -1495,6 +1495,33 @@ data:
                         socket_address:
                           address: synapse-media-repository
                           port_value: 8008
+        - name: httpd-quarantined-media-changes
+          connect_timeout: 1.00s
+          type: STRICT_DNS
+          dns_lookup_family: V4_ONLY
+          ignore_health_on_host_removal: true
+          lb_policy: LEAST_REQUEST
+          least_request_lb_config:
+            choice_count: 2
+          circuit_breakers:
+            thresholds:
+              - priority: DEFAULT
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+              - priority: HIGH
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+          load_assignment:
+            cluster_name: httpd-quarantined-media-changes
+            endpoints:
+              - lb_endpoints:
+                  - endpoint:
+                      address:
+                        socket_address:
+                          address: synapse-quarantined-media-changes-headless
+                          port_value: 8008
 
   synapse.lua: |
     local room_id_pattern = "(![A-Za-z0-9._=%%%-/]+:[A-Za-z0-9.%-]+)"

diff --git a/charts/synapse/tests/golden/fixtures/test-envoy-configmap.golden.yaml b/charts/synapse/tests/golden/fixtures/test-envoy-configmap.golden.yaml
@@ -260,18 +260,18 @@ data:
                                 cluster: httpd-media-repository
                             - match:
                                 safe_regex:
-                                  regex: '^/_synapse/admin/v1/quarantine_media/.*'
+                                  regex: '^/_synapse/admin/v1/users/.*/media'
                               route:
                                 timeout: 300s
                                 auto_host_rewrite: true
                                 cluster: httpd-media-repository
                             - match:
                                 safe_regex:
-                                  regex: '^/_synapse/admin/v1/users/.*/media'
+                                  regex: '^/_synapse/admin/v1/quarantine_media/.*'
                               route:
                                 timeout: 300s
                                 auto_host_rewrite: true
-                                cluster: httpd-media-repository
+                                cluster: httpd-quarantined-media-changes
                             - match:
                                 safe_regex:
                                   regex: '^/_matrix/client/(r0|v3|unstable)/sendToDevice/.*'
@@ -1494,6 +1494,33 @@ data:
                         socket_address:
                           address: synapse-media-repository
                           port_value: 8008
+        - name: httpd-quarantined-media-changes
+          connect_timeout: 1.00s
+          type: STRICT_DNS
+          dns_lookup_family: V4_ONLY
+          ignore_health_on_host_removal: true
+          lb_policy: LEAST_REQUEST
+          least_request_lb_config:
+            choice_count: 2
+          circuit_breakers:
+            thresholds:
+              - priority: DEFAULT
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+              - priority: HIGH
+                max_connections: 30000
+                max_requests: 8192
+                max_retries: 3
+          load_assignment:
+            cluster_name: httpd-quarantined-media-changes
+            endpoints:
+              - lb_endpoints:
+                  - endpoint:
+                      address:
+                        socket_address:
+                          address: synapse-quarantined-media-changes-headless
+                          port_value: 8008
 
   synapse.lua: |
     local room_id_pattern = "(![A-Za-z0-9._=%%%-/]+:[A-Za-z0-9.%-]+)"

diff --git a/charts/synapse/tests/golden/fixtures/test-envoy-deployment.golden.yaml b/charts/synapse/tests/golden/fixtures/test-envoy-deployment.golden.yaml
@@ -24,12 +24,12 @@ spec:
         app: synapse
         component: synapse-client-reader-envoy
       annotations:
-        checksum/config: 869b2ce1fd7683ee515f7d6d20ed26cda2dff095448a9425f73627c0768c4f40
+        checksum/config: 9d638ffa8fe8adfd5d59a0178fdb455821ac57f2f3e1f217d20d4dd78cafd53f
     spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: envoy
-          image: envoyproxy/envoy:v1.36.6
+          image: envoyproxy/envoy:v1.37.4
           imagePullPolicy: IfNotPresent
           args:
             - -c

diff --git a/charts/synapse/tests/golden/fixtures/test-matrix-auth-deployment.golden.yaml b/charts/synapse/tests/golden/fixtures/test-matrix-auth-deployment.golden.yaml
@@ -29,7 +29,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: main
-          image: ghcr.io/element-hq/matrix-authentication-service:1.15.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: "MAS_CONFIG"

diff --git a/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-config-sync-helm.golden.yaml b/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-config-sync-helm.golden.yaml
@@ -15,7 +15,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: config-sync
-          image: ghcr.io/element-hq/matrix-authentication-service:1.15.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: "MAS_CONFIG"

diff --git a/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-config-sync-prune.golden.yaml b/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-config-sync-prune.golden.yaml
@@ -15,7 +15,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: config-sync
-          image: ghcr.io/element-hq/matrix-authentication-service:1.15.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: "MAS_CONFIG"

diff --git a/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-config-sync.golden.yaml b/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-config-sync.golden.yaml
@@ -15,7 +15,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: config-sync
-          image: ghcr.io/element-hq/matrix-authentication-service:1.15.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: "MAS_CONFIG"

diff --git a/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-db-migration-helm.golden.yaml b/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-db-migration-helm.golden.yaml
@@ -15,7 +15,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: db-migration
-          image: ghcr.io/element-hq/matrix-authentication-service:1.15.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: "MAS_CONFIG"

diff --git a/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-db-migration.golden.yaml b/charts/synapse/tests/golden/fixtures/test-matrix-auth-job-db-migration.golden.yaml
@@ -15,7 +15,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: db-migration
-          image: ghcr.io/element-hq/matrix-authentication-service:1.15.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
           imagePullPolicy: IfNotPresent
           env:
             - name: "MAS_CONFIG"