## matrix-construct/tuwunel — v1.9.0…v1.9.1

_281+ commits._

### Features
- **docker: Add a seccomp profile generator permitting io_uring.** (aa9a99c)
- **debian: Add an AppArmor profile for the packaged server.** (23dc30d)
- **add a thumbnail animation preference and its classification** (8109554)
- **Add a debug message.** (64bf4ca)

### Fixes
- **appservice: Confine MSC3984 queries to exclusive users. (regression 290c81e16)** (22ed0d5)
- **api/client: Retain roots with only ignored replies. (regression 74d64fa4a)** (0ea5de0)
- **server: Return forbidden for refused membership events. (regression c244cc3cc)** (e27c805)
- **Merge remote-tracking branch 'mindroom-ai/fix/device-key-read-errors'** (3a3b195)
- **Merge pull request #579 from tototomate123/fix/571-storage-sync-output.** (1695945)
- **add media regression harnesses for the client, bridge and federation surfaces** (8bbe7de)
- **service: Preserve LDAP principals and reap drivers. (regression 1fac5ea88)** (90fdf2d)
- **api: Deliver server-user to-device events. (regression 637ebcc20)** (ad1ed82)
- **Merge pull request #574 from mindroom-ai/fix/messages-pagination-bounds** (9d0fff2)
- **Merge pull request #564 from ruka-hamanasu/syncv3-busy-unread-bug** (3cf19ff)

### Backend
- **Bump 1.9.1.** (114bc23)
- **database: Warn when the pool exceeds the container task limit.** (ab388e9)
- **retention: Store original events and expiry indexes atomically.** (33e41aa)
- **users: Create users with disabled passwords atomically.** (cc018f6)
- **sending: Replay retained active events before queued successors.** (e689937)
- **threads: Keep updates within one room and transaction.** (8e0cb9d)
- **redaction: Reject permission checks for another room's event.** (230f0e7)
- **core/alloc/je: Disable background threads by default.** (efbc71f)
- **receipts: Reject private markers for events in another room.** (da12c89)
- **deps: Advance the Ruma and admin API forks.** (86a6d03)
- **bump the jevmalloc and rust-rocksdb pins** (02b8821)
- **build our pinned jemalloc rather than substituting nixpkgs** (a35ff67)
- **export the allocator config under the prefixed symbol name too** (80d209b)
- **recommend target-cpu when compiling from source** (b63d6c1)
- **document building tuwunel on alpine** (64bc6aa)
- **bump the synapse-admin-api pin** (cc0246c)
- **bump the ruma and synapse-admin-api pins** (7fd8565)
- **oidc: Hand off browser callbacks outside form navigation. (fixes #573)** (e840cbe)
- **users: Erase contact bindings during account erasure.** (090e420)
- **Merge PR #585: leave rooms on Synapse user deactivation.** (ab233e8)
- **Merge PR #584: leave rooms on Synapse account deactivation.** (43bcec6)
- **Merge PR #583: include quiet rooms in full-state sync.** (b046861)
- **Merge PR #576: isolate default test databases.** (5de94bb)
- **client: Bound room initial sync snapshots.** (af5f27d)
- **router: Preserve safe request failure diagnostics.** (89afea2)
- **admin: Refine terminal output formatting.** (5ed50fc)
- **client/presence: Serve a default status for a user without presence state.** (3f7869b)
- **sync: Correct left-room incremental state anchor.** (83b6253)
- **transaction_ids: Scope room send transaction IDs.** (99908c1)
- **client/admin: Complete server notice behavior.** (868b846)
- **docker: Advance complement-crypto for proxy startup deadline.** (e5647cd)
- **core/math: Centralize bounded UInt conversion.** (9ce9468)
- **database: Reap every dropped column before failing.** (4f6b4e6)
- **client/admin: Leave the user's rooms when deactivating through the user update endpoint.** (e50b270)
- **client/admin: Leave the user's rooms on the Synapse deactivate endpoint.** (da501bb)
- **database: Share environment ownership with the restore fixture.** (98dea29)
- **users: Canonicalize signatures and keep foreign updates private.** (e87a9aa)
- **client/keys: Validate cross-signing key structure.** (1cd92aa)
- **sync: include quiet rooms in full-state responses** (eef601a)
- **pusher: Preserve unread replies on thread-root receipts.** (bffd8e6)
- **tests: isolate default test databases** (fce511c)
- **database: Restore descriptor profile names.** (b7cb72c)
- **admin: Remove feds version class columns.** (ca903f3)
- **admin: Pad terminal table cells.** (9a7845d)
- **media: Refine preview language tests and spacing.** (984a34a)
- **media: Configure Accept-Language for URL previews. (closes #575)** (022322d)
- **fixup! media: Organize thumbnail implementation units.** (993263a)
- **timeline: Confirm federated timestamp targets before returning.** (b138959)
- **service/fetcher: Separate incompatible single-flight requests.** (35fc5c1)
- **service/event_handler: Make previous-event recovery width reloadable.** (14bf02d)
- **admin: Summarize storage sync output. (fixes #571)** (81b9f56)
- **media: Organize thumbnail implementation units.** (4a5e768)
- **media: Admit animated thumbnail sources before loading. (087ced6b6)** (6af8136)
- **drop a build arg the test image never declares** (bffdb64)
- **give each server-booting test its own database and port** (5eb71d7)
- **cover a peer that answers with a location** (a62c6d5)
- **walk a generated thumbnail's container once** (ae35087)
- **walk a fetched picture's container once** (cd7bc67)
- **rate MSC2705 as implemented in the compliance table** (c0c86dc)
- **ask a peer for a legacy thumbnail at the size it is cached under** (29c8b07)
- **ask a peer for a thumbnail at the size it is cached under** (27637d3)
- **fetch the original where a request names it** (48d3389)
- **cover a peer that mislabels the picture it answers with** (59e2e75)
- **bound how many animated thumbnail encodes run at once** (087ced6)
- **store a proxied thumbnail under the type its own bytes name** (d3672c8)
- **withhold an animation no thumbnail could be derived from** (65326b0)
- **name the container walk for the answer it now gives** (44bc9c2)
- **release the thumbnail variant a request did not ask for** (d9d14f0)
- **state which thumbnail variant a request prefers** (f519af1)
- **generate both thumbnail variants for a source that animates** (0df3eb1)
- **store an original under the type its own container names** (ca5ef2f)
- **name a container only when the walk settles** (44c5a43)
- **settle the frame caps before a frame is decoded** (fb6d69b)
- **split the animated encoder into its own module** (3932753)
- **generate animated thumbnails when the client asks for one** (2d6ee4d)
- **fetch the original by the key already in hand** (840469d)
- **withhold a WebP whose opening chunk names no form we know** (657b65b)
- **split the container sniff into its own module** (6e6f5ba)
- **stand a still in at the original's own dimensions** (2cc46d8)
- **judge a stored thumbnail by its picture, not its stored type** (faf2983)
- **read animation from the picture rather than its declared type** (83e0492)
- **cover a picture whose declared type contradicts its bytes** (7d5ef0c)
- **decode a repaired thumbnail from the stored bytes** (0430abf)
- **honor the animated parameter on thumbnail requests** (ffc5adb)
- **count animation frames from the sequence rather than the decoder** (44c8afa)
- **fail the deb build on a cargo-deb warning** (b7e2f9e)
- **drop $auto from the deb dependencies** (ede888c)
- **install the socket unit where systemd reads it** (ccf724e)
- **state res: Complete the local state builder.** (45e22a0)
- **backup: Serialize key backup mutations.** (4106440)
- **migrations: Make forbidden-name scans interruptible.** (032248e)
- **privacy: Close login and thread erasure leaks.** (942bf2a)
- **service: Bound pre-authentication rate-limit maps.** (f1bff86)
- **backup: Validate versions and advance deletion etags.** (1dd1b12)
- **docker: Preserve Playwright artifacts across retry passes.** (cacdaa4)
- **deps: Remove obsolete Cargo configuration.** (542d89b)
- **deps: Remove resolved quick-xml audit exceptions.** (56760e4)
- **docker: Check the installed RPM service path.** (dacd099)
- **main: Reject empty runtime histogram bucket sets.** (9b3f0aa)
- **main: Evaluate console state outside the cfg predicate.** (41997c9)
- **database: Close partial pools after worker spawn failure.** (6eaf467)
- **core: Correct outbound timeout and direct TLS documentation.** (2fcd6c2)
- **core: Zero-pad fractional duration output.** (d5348db)
- **core: Join error chains without intermediate allocations.** (9e126ce)
- **core: Return 403 for MSC3823 account suspension.** (bc1c4b8)
- **client: Complete the merged PR follow-ups.** (bf99483)
- **api/client: preserve device keys on read errors** (b6f5263)
- **Merge pull request #566 from ruka-hamanasu/read-marker-backfilled** (5a12138)
- **tests: Drop the ad-hoc unread-receipt repro script.** (7abc8dd)
- **tests: Pin the busy-round zero notification count in sync v3.** (ae8b123)
- **sync: Reconcile a cached notification count on an initial sync.** (78db06d)
- **sync: Construct the thread-read fixture in the gate test.** (1d4a7ce)
- **api/client: clamp message pagination bounds** (7cbcbe5)
- **read_marker: Tolerate backfilled events in private read markers** (ceeb5e6)
- **Send 0 notification counts unconditionally in sync v3** (661f0e9)
- **docker: Lower the Argon2id cost in the interoperability test images.** (3d8267c)
- **config: Make the Argon2id password-hash cost configurable.** (0635833)
- **migrations: Stop hashing the sentinel password for its log line.** (cb75a47)
- **sync: Quiet the state-horizon miss at a room's first event.** (0bfad1c)
- **state: Preserve authoritative invite state. (31c547f3)** (49f9d0e)
- **sync: Detect state-resolution changes. (3a9f9c42)** (f432be1)
- **profile: Order profile updates and surface failures. (24a21d81, 5ccca732)** (1271bb0)
- **migrations: Preserve startup safety on errors. (ea5a7698)** (5af95c4)
- **utils/result: Adapt a not-found error into an absent value.** (64ba6bb)
- **state_cache: Withhold an ignored sender's invite instead of dropping it.** (a107046)

### Docs
- **docs: Document container security profiles and task limits.** (dda88c6)
- **docs: Correct Alpine allocator configuration guidance.** (2bac142)
- **docs: Validate link fragments.** (de83e4f)
- **docs: Correct how the Complement interop jobs are enabled.** (96b2101)
- **docs: Refresh MSC implementation scores.** (696c7db)
- **docs: Clarify Complement result retention.** (0d298fe)

### Chore
- **ci: Probe a seeded builder cache and cold-start when it is torn.** (731136a)
- **ci: Narrow the Playwright read-receipts exclusion.** (a93b666)
- **build: Restore custom configuration checks.** (728f3bc)
- **ci: Require successful initialization before packaging.** (8cc49ca)
- **chore: fix current nightly lints** (958a091)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/matrix-construct/tuwunel?utm_source=github-action)._