## matrix-construct/tuwunel — v1.8.3…v1.9.0

_216+ commits._

### Features
- **support forced config replacement on macos** (18b8c63)
- **database/engine: Add max_compaction_bytes support and descriptor defaults.** (853a6e5)
- **config: Add schema-driven regeneration.** (1f73d97)
- **docker: Add cargo flags and dynamic nightly rustflags.** (6c18f16)
- **database: Add column-specific memtable flush applied by migrations.** (5b24dda)

### Fixes
- **client/directory: Mask only a remote publicRooms failure. (regression 9a879776c)** (760dbd3)
- **Merge remote-tracking branch 'obodnikov/fix/storage-sysfs-unix-gating'** (61677cd)
- **Merge remote-tracking branch 'obodnikov/fix/journald-unix-socket-gate'** (7d33a20)
- **Merge remote-tracking branch 'obodnikov/fix/media-symlink-platform-neutral'** (5219ef8)
- **oidc: Reject dotless native redirect schemes. (regression b9abdc225)** (cd2c6bd)
- **migrations: Abort Conduit media import on storage errors. (regression 2eef5f4eb)** (0282290)
- **account: Complete logged-out email password resets. (regression 202adc3b8)** (5884489)
- **threepid: Make registration email proofs single-use. (regression 202adc3b8)** (2409d56)
- **ask bug reporters which server their database was migrated from** (222f8bb)
- **database: Fix compression settings opt-out for uncompressed columns.** (ecf6d6f)
- **auth_chain: Never cache chains from incomplete walks. (regression 944f16520)** (b4e9454)
- **server: Bind federation events to requested rooms. (regression ee8e72f7a)** (39c0d36)

### Backend
- **Bump 1.9.0.** (5b36691)
- **Streamline the locked check and config replacement additions.** (9b6d790)
- **preserve acls and xattrs across forced config replacement on macos** (1931e91)
- **link the copr repository in the getting started list** (4bbe06f)
- **use the raw renameat2 syscall so the config exchange links on musl** (eec822b)
- **reject logins for locked accounts** (93b6f66)
- **packaging: Declare the rpm's CA bundle requirement. (3992e8097)** (144480c)
- **client/search: Cap the event context returned per search result.** (44632fb)
- **account_data: Preserve a disabled push rule through a room copy.** (55a09e6)
- **pdu_metadata: Strip another sender's transaction ID from a bundled edit.** (c11a2c2)
- **return 401 for a locked account** (03d92b2)
- **ignore leading whitespace when detecting admin commands** (59a59c9)
- **raise the report reason length limit to 2000** (6acf703)
- **report a successful media deletion as output instead of an error** (e3d4801)
- **client/summary: Move the room out of the hierarchy response.** (e935b3a)
- **client/summary: Say when no via servers were provided for a room. (#470)** (6aadfbe)
- **client/space: Seed the hierarchy root via from invites for a v12 room.** (3f8ba80)
- **sending: Fail a push transaction when its notifications fail. (fixes #543)** (6c6731e)
- **sending: Retry a failed push destination on a timer. (#543)** (22d70a2)
- **sending: Report push transaction failures to the operator. (#543)** (5c44b93)
- **pusher: Trace the push decision and raise pusher removal to error. (#543)** (9480466)
- **pusher: Tolerate the removed push actions at both notify sites. (#543)** (a7a5c33)
- **pusher: Anchor the gateway path strip to the end of the URL. (#543)** (6ba1a29)
- **tests: Group push gateway stub options. (#543)** (b347937)
- **pusher: Drop a failed push dispatch instead of panicking. (#543)** (d91e989)
- **deps: Update h2 to 0.4.16 for the audit gate.** (cacf855)
- **database/engine: Log the status of a RocksDB background error.** (aca5963)
- **database: Log write-ahead-log flush and sync failures on uncork.** (9a253b5)
- **core: Drop the duplicative prefix from the poison error text.** (b8e2f57)
- **core: Recover the sequence counter from a poisoned lock.** (92c81ea)
- **Tweak block cache and scalar defaults; reduce tcache_max.** (3b46425)
- **config: Warn when fallocate is enabled on btrfs or ZFS. (#535)** (5cbd762)
- **config: Mask the OIDC registration access token in show-config.** (61e7c61)
- **oidc: Warn that a registration access token blocks every client.** (56fabfa)
- **session: Refuse LDAP login into a deactivated account. (bf1ba04eb)** (b1eee03)
- **database: Restore dedicated block caches on the hot FIFO columns. (94195c48c)** (7fe6adf)
- **state_accessor: Compose the erasure gate on futures.** (139b299)
- **database/engine: Share block caches for FIFO columns; tweak cache defaults.** (94195c4)
- **oauth: Adopt migrated provider subjects.** (e397c76)
- **appservice: Gate registration on the boot-time registry load.** (d5207d4)
- **sys/storage: Sharpen the non-unix arms' doc accuracy.** (ee56281)
- **log/journald: Tighten the non-unix stand-in's doc and impl style.** (7748dc3)
- **media/migrations: Use the sanctioned bare discard spelling.** (bacd0a3)
- **sys/storage: gate the sysfs device discovery to unix** (e3cd1c0)
- **log/journald: gate the unix datagram socket to unix** (34a73fc)
- **media/migrations: use a platform-neutral file symlink helper** (18d55a1)
- **keys: Restrict accepted key signature relationships. (#552)** (4a50d3c)
- **keys: Verify uploaded key signatures before storing them. (fixes #552)** (8d89e4f)
- **keys: Report rejected signatures in the upload response. (#552)** (9be1710)
- **users: Create the signatures map when signing a key that has none. (#552)** (dd552f5)
- **resolver: Exempt the configured proxy from the CIDR denylist. (fixes #554)** (ba97ed9)
- **pusher: Log the full error chain on push-gateway failures.** (480065b)
- **migrations: Preserve source scan errors. (136d605a8)** (7f9f3f8)
- **uiaa: Remove the sentinel password authentication bypass.** (c564d9e)
- **sending: Reap the suppressed push flush tasks.** (73915b6)
- **docker: Advance the Complement fork past the guest access expectation.** (c24b7ac)
- **timeline: Allocate the short event id only on the append path.** (be6a894)
- **client/state: Dedup an identical state put only for a joined sender.** (839dd58)
- **state_accessor: Show a departed member shared history up to their leave.** (b7d08f1)
- **federation: Bound the get_missing_events walk independently of the limit.** (35655a8)
- **bump rust-rocksdb for the netbsd crc32c probe** (3c19820)
- **correct what the software crc32c path actually covers** (43e07de)
- **confirm the tuned amd64 build on netbsd and openbsd** (479e050)
- **document the bsd deployment pages on amd64** (b6d154b)
- **retry a foreign import when an account row cannot be read** (136d605)
- **adopt foreign email bindings on import** (d60b4ab)
- **share the already-bound-elsewhere check between its callers** (a6e9aff)
- **adopt foreign deactivation and passwordless account states on import** (1f5520b)
- **keep url previews playable when the video is an embed page (ae94957f1)** (a90b0a8)
- **service/membership: Take federation mutex before state mutex in remote join.** (4e8fdc9)
- **Bump jevmalloc and rust-rocksdb.** (439bb9d)
- **injectivity: Report per-family scan counters at info.** (15ce111)
- **migrations: Split migrations into individual modules.** (1cbf716)
- **update the ruma and synapse-admin-api pins** (8e73e2c)
- **drop the rocksdb workaround from the bsd build recipes** (3373800)
- **bump rust-rocksdb for the bsd arm64 crc32c include fixes** (b1599da)
- **document building and running on freebsd, netbsd and openbsd** (4740e13)
- **document the openbsd available_parallelism arm** (a1b9a1a)
- **apply the html response headers by media type** (6abd7b5)
- **match a content type by its media type alone** (d2a5c09)
- **record the io_uring, time_t and ARMv6 results for 32-bit ARM** (f42166c)
- **document building and running on 32-bit ARM** (2726b2f)
- **withhold a remote server's error code from the local client** (6fa7f18)
- **assert the unit's programs exist after installing the package** (276a682)
- **run the package install checks wherever packages are built** (85cd01c)
- **document what an unset well_known.client costs** (f18c157)
- **cover the MSC3664 push condition end to end (#544)** (0a04994)
- **bound the size and number of push rules an account may hold** (422d313)
- **move the serialized length counter into core utils** (2b43235)
- **evaluate the MSC3664 related_event_match push condition (#544)** (9cb7d01)
- **document building and running on RISC-V** (1e454c4)
- **document url previews for operators** (fe93f70)
- **skip og:video and og:audio that declare a non-media type** (ae94957)
- **recover youtube previews through oembed and a consent cookie** (0a9a6fc)
- **apply the url preview user agents per request** (db28791)
- **read up to 768 KiB when spidering a page for previews** (042b71d)
- **hide force_migration and delay startup with a warning when it is set** (adfbaaa)
- **note why the runtime image carries procps** (29e25bb)
- **resolve dependencies in the deb and rpm install checks** (b464b02)
- **document the platform fallback rlimit stubs** (b86a861)
- **spaces: wait for first successful instead of first finished request in remote space summary** (c5976c3)
- **auth_chain: Tweak cached-chain RAM to disk ratio.** (4ff1bce)
- **injectivity: Clear cached auth chains once on upgrade.** (375b608)
- **auth_chain: Retire the shorteventid_authchain column.** (1438b1b)
- **injectivity: Flag malformed chain rows.** (17c7e09)
- **deps: Advance jemalloc to 5.3.1-2.** (d1a594e)
- **short: Complete torn short id writes instead of refusing them.** (a8039d3)
- **event_handler: Soft-fail current-state auth failures per spec check 6.** (c244cc3)
- **event_handler: Label positional and current-state auth failures separately.** (ac4d9ea)
- **event_handler: Avoid panics on non-state auth events.** (44c2874)
- **server: Gate federation timestamp lookups by room access.** (3373dca)
- **ldap: Don't lookup by givenName, remove now unused name_attribute config** (3c21790)
- **deps: Switch to upstream ldap3.** (49a5b28)
- **deps: Advance RocksDB to 11.8.1 and jemalloc to 5.3.1.** (da351fb)
- **small token refactor** (fb3f2b0)
- **Update jsonwebtoken** (547ece9)
- **client/room: Copy predecessor push rules for the room creator.** (e5f6cd4)
- **docker: Enable shared-secret registration in Complement.** (9f85415)
- **key_backups: Commit content and etags atomically.** (1a2b59e)
- **state_cache: Commit invite routing hints atomically.** (754efb2)
- **media: Commit metadata rows atomically.** (7c642d1)

### Docs
- **docs: Update MSC3939 compliance for the locked login gate.** (82e2a9a)
- **docs: Stop naming a stale rust-rocksdb revision as the FreeBSD pin.** (365b3fd)
- **docs: Explain MatrixRTC transport discovery for external well-known.** (ac8ce52)
- **docs: Document LDAP login against existing local accounts.** (7e9f275)
- **docs: Document LDAP certificate verification.** (d8e5fac)
- **docs: Correct the scope of the LDAP local-password fallback.** (0185aef)
- **docs: Correct the admin token claim on /_synapse/admin/. (regression c6cb17266)** (97c7d1e)
- **docs: Document configuration regeneration.** (2591631)
- **docs: Tabulate the MAS provisioning API.** (185d0b0)
- **docs: Correct NetBSD arm64 CRC detection. (3c19820ce)** (53dfd4c)
- **docs: Expand the MAS integration guide.** (6d014ad)
- **docs: Move module documentation into source files.** (c62f485)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/matrix-construct/tuwunel?utm_source=github-action)._