## matrix-construct/tuwunel — v1.8.2…v1.8.3

_175+ commits._

### Features
- **main/runtime: Add support for tokio scheduler latency histograms.** (d27d60c)
- **core/utils: Add stack string formatting utilities.** (5f57b14)
- **Add spans for edu actions at debug_info level; misc span tweaks.** (dcc5db6)
- **admin: Add room-scoped policy recovery.** (6f179e6)
- **Add traefik to root domain delegation docs** (7e81096)
- **Add `admin users set-profile-key` command** (ebb81e7)
- **database: Support raw-key transaction deletion.** (18d61ba)
- **utils/result: Add ExpectUnchecked for Result.** (f2c046a)
- **matrix: Add an event ID sha256 codec and map hasher.** (c13ba03)
- **database: Add atomic write batches.** (0f146ba)
- **manager: Remove useless `ret` field; add `err` on start.** (712ab0a)
- **admin: Add 'query raw flush' for a RocksDB LSM memtable flush.** (9b1ae95)
- **Advertise MSC4108 QR login support.** (adfd3ee)

### Fixes
- **Merge remote-tracking branch 'obodnikov/fix/limits-unix-import-gates'** (6534f11)
- **restore a database backup at most once per process (regression c2ced2a8a)** (cd71003)
- **service/resolver: Fix unawaited future. (f75d9fa79)** (a8c175e)
- **Merge remote-tracking branch 'Xerusion/patch-1' into dev** (846eef2)
- **Merge remote-tracking branch 'obodnikov/fix/router-serve-unix-gating' into dev** (f7cef8d)
- **Merge remote-tracking branch 'obodnikov/fix/main-restart-import-gate' into dev** (9c75d42)
- **Merge remote-tracking branch 'obodnikov/fix/signals-unix-only-trace-import' into dev** (8a914b4)
- **Merge remote-tracking branch 'lhjt/fix/receipt-ordering' into dev** (5a8d58f)
- **Merge remote-tracking branch 'lhjt/fix/appservice-presence'** (50dde70)
- **Merge pull request #521 from lhjt/fix/thumbnail-exact-size-passthrough** (1aac629)
- **fix: skip thumbnail generation that reproduces the source** (c7fec97)
- **fix: prevent stale read receipt updates** (e38d8da)
- **fix: appservice presence** (d1633bf)

### Backend
- **Bump 1.8.3.** (27140e0)
- **database: Hold the rocksdb environment in one process-global slot.** (dc77854)
- **service: Report the configuration reload outcome under systemd.** (003bc8a)
- **log: Suppress ANSI escapes when submitting to journald. (f106305da)** (8fe0478)
- **router: Skip a defaulted address that fails to bind. (c3fc31de3)** (2cfef73)
- **admin query users iter-users "--historical"** (2e02dd6)
- **short: Serialize allocation so one identity keeps one short id.** (5cff8b8)
- **sys/limits: gate the nix imports and page_size to unix** (f0fe70d)
- **document supplying a video decoder to a container** (35a7116)
- **allow the pipe syscalls a video thumbnail program needs** (8f598d6)
- **generate video thumbnails with an external program (closes #397)** (4406981)
- **serve a generated thumbnail as the png it is** (909e697)
- **bound thumbnail decoding by a configured pixel budget** (f6a2f60)
- **simplify token creation** (82b8536)
- **get_all_user_mxcs: consume entire db key** (626f949)
- **skip the admin console when standard input is not a terminal** (38b0e8f)
- **keep left rooms in sync when their cached leave state is foreign** (a9f734f)
- **log appservice response body read failures** (b9a38f4)
- **refuse the restore backup option outside its own argument** (8e3e339)
- **replay the startup command line on configuration reload** (b362006)
- **document configuration reload and systemd credentials** (d864e3b)
- **refresh systemd credentials on reload in the arch unit** (17c0d7e)
- **wire systemctl reload into the debian and red hat units** (b39b5f4)
- **report the configuration reload outcome to the service manager** (e4c850f)
- **resolve the turn and registration secrets at each use** (1ed77a2)
- **document systemd socket activation** (c5f214f)
- **ship a socket unit for systemd socket activation** (3cbc9eb)
- **bind configured addresses before serving them** (c3fc31d)
- **strip socket activation variables from an in-place restart** (289cd50)
- **record tracing fields as journal fields** (a2601d6)
- **submit journald entries with the console message and severity** (f106305)
- **tests: Isolate atomic state count allocation.** (9750963)
- **pusher: Hook badge refresh into read paths.** (c992008)
- **sending: Recover queued badge refreshes at startup.** (4c3eda9)
- **sending: Refresh the push badge on demand.** (1e3e6ae)
- **sending: Reject stale queue wakes.** (0bb099e)
- **pusher: Test account-wide unread badge delivery.** (2464a25)
- **pusher: Send the account-wide unread count.** (3ef0ea1)
- **ci/publish: Keep the apt job from delaying or blocking delivery.** (12c9252)
- **ci/publish: Require the apt job for delivery.** (adf1c0b)
- **ci/publish: Source the apt ssh destination and host key from variables.** (a93476c)
- **config: Warn when mas_secret is set without a MAS identity provider.** (3e36374)
- **service/oauth: Default the authorization scope for MAS providers. (fixes #530)** (e210731)
- **Cargo: Normalize feature list ordering and formatting.** (46e7951)
- **sending: Spread the retry wake across the backoff interval.** (2600024)
- **service/resolver: Format federation ports without allocating.** (9e587e1)
- **service/resolver: Cleanup and de-indent actual destination unit.** (b9cffa6)
- **admin: Move rebuild- admin commands from `!admin server` to debug suite.** (ffbb43c)
- **core: Reap keyed mutex entries on every release path.** (a2bac8d)
- **core: Document debug and utility APIs.** (cc93232)
- **core: Guard unchecked float conversion.** (1ad1f67)
- **Merge remote-tracking branch 'byteflavour/journald-logging' into dev** (41ee189)
- **admin/debug: Error per-column rather than panic on invalid property name.** (9a4b5b0)
- **complement: Skip the unstable to-device burst test.** (14ddde2)
- **admin: Clear the retry backoff during policy recovery.** (1490820)
- **event_handler: Re-evaluate a soft-failed event on redelivery.** (5b1fc2d)
- **event_handler: Keep a soft-failed state event out of current state.** (cb03606)
- **event_handler: Filter forward extremities before owning them.** (af49e80)
- **policy_server: Correct refusal handling.** (6651f9e)
- **timeline: Mark the sender's own send read without publishing it.** (d06bc7f)
- **read_receipt: Make private read markers monotonic.** (70a692b)
- **read_receipt: Enforce monotonic public receipts. (fixes #516)** (e817688)
- **logging: Submit events natively to journald under systemd.** (a9c0cf3)
- **signals: gate the trace import to unix** (0d62d05)
- **router/serve: restore the cfg(unix) gating the listener refactor dropped** (fee9b46)
- **main: gate the restart import to unix** (a87588a)
- **read_receipt: Bound the receipt sweep by the encoded room prefix.** (7190ab8)
- **nix: Serialize test compilation and execution.** (360daf6)
- **search: Purge room tokens atomically. (59d722457)** (423fbce)
- **state-res: Retain convergent pending prefixes.** (638fca0)
- **database: Expand codec benchmarks.** (c17be6b)
- **state: Persist short hashes with their state diffs.** (fc853f3)
- **client/sync: Contain corrupt state-after rooms.** (b565d92)
- **harden ldap login errors, timeouts, and password-file IO** (f9ab56c)
- **reject non-ldap-origin and deactivated accounts on ldap login** (8a0775a)
- **escape ldap bind dn metacharacters in the login localpart** (37473f1)
- **reject empty passwords before the ldap bind** (66b3151)
- **escape ldap filter metacharacters in the login localpart** (3e0e987)
- **return a generic error when notifying an appservice of an invite fails** (c38eb28)
- **only handle incoming to-device events for local active or appservice recipients** (637ebcc)
- **fall back to twitter card meta tags for url previews** (f2dfb01)
- **Bump ruma, drop unused features** (24c34aa)
- **Room info command** (78e1fc0)
- **Drop MSC4373 endpoint** (7c100cd)
- **cleanup api router imports, rename rendezvous handlers** (6ff9391)
- **deps: Ignore the unmaintained smallstr advisory.** (a016620)
- **presence: Pass activity context through ping arguments.** (b48ffbc)
- **state_res: Look up mainline positions from a map.** (758dcc8)
- **state_res: Hash the auth difference and conflicted set by event ID.** (a2191f2)
- **state_res: Rework the conflicted-subgraph walker.** (80973ba)
- **state_res: Pop the conflicted-subgraph path on non-descending steps.** (f2904f3)
- **search: Purge room tokenids by shortroomid prefix.** (59d7224)
- **database: Migrate raw batch writes to Txn.** (490fcbe)
- **deps: Advance rust-rocksdb for column family ids.** (c95ffc3)
- **appservice: Implement MSC3983 and MSC3984 key proxies.** (290c81e)
- **user_directory: Exclude appservice users from search.** (df405cc)
- **appservice: Retry stalled transactions after ping.** (d05ea03)
- **complement: Advance the complemau harness.** (5f41a42)
- **Cleanup headers** (9bace37)
- **pdu_metadata: Split metadata features into modules.** (e527192)
- **appservice: Implement third-party network lookup forwarding.** (c418005)
- **core/config: Relax pool thread and cache defaults.** (488d491)
- **service: Adapt to ruma 0.16 signing, UIAA, and outgoing-request APIs.** (47b5fea)
- **log: Split subscriber init into per-feature layer builders.** (65bbc26)
- **oidc: Serve native account management with no identity provider.** (4e61c17)
- **oidc: Accept the RFC 6749 scope charset in device ids. (48729a66b)** (8228810)
- **router: Replace from_fn middleware with a bespoke tower layer.** (b61d569)
- **oidc: Serve native account login for the device authorization grant.** (978a0ee)
- **api: Implement MSC4388 rendezvous transport.** (79cfc8a)
- **Implement MSC4108 rendezvous sessions for QR login.** (7f38027)
- **reject remote aliases in the directory admin commands (7beddda11)** (2154b1a)
- **preserve the published alias when a client sets the room public (7beddda11)** (8c9d465)
- **storage: Convert device major/minor for the BSD builds.** (05e140e)

### Docs
- **docs: Document the btrfs WAL fallocate disk usage interaction. (#535)** (73c69e7)
- **docs: Add a Matrix Authentication Service provider guide.** (0f14014)
- **docs: Tweak partnership wording.** (6374da0)
- **docs: Normalize the Traefik delegation example.** (a54b90b)
- **docs: Stop advertising the removed MSC4373 endpoint. (7c100cdf7)** (348bfbf)
- **docs: Add Complement-family compliance pages.** (6e8ab2e)
- **docs: Use absolute rendered-docs links in the packaging READMEs.** (282e0b0)

### Chore
- **ci: Enable URL previews in the Playwright testee config.** (1e00adb)
- **style: Enforce concise first doc paragraphs.** (65b1cf7)
- **ci: Introduce Complemau.** (1e9b179)
- **ci: Shorten build-layer cache keepDuration to 12h.** (2e2ba80)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/matrix-construct/tuwunel?utm_source=github-action)._