Fixes high severity vulnerability *exploited in the wild*!


# Synapse 1.127.1 (2025-03-26)

## Security
- Fix [CVE-2025-30355](https://www.cve.org/CVERecord?id=CVE-2025-30355) / [GHSA-v56r-hwv5-mxg6](GHSA-v56r-hwv5-mxg6). **High severity vulnerability affecting federation. The vulnerability has been exploited in the wild.**



# Synapse 1.127.0 (2025-03-25)

No significant changes since 1.127.0rc1.




# Synapse 1.127.0rc1 (2025-03-18)

### Features

- Update [MSC4140](matrix-org/matrix-spec-proposals#4140) implementation to no longer cancel a user's own delayed state events with an event type & state key that match a more recent state event sent by that user. ([\#17810](element-hq/synapse#17810))

### Improved Documentation

- Fixed a minor typo in the Synapse documentation. Contributed by @karuto12. ([\#18224](element-hq/synapse#18224))

### Internal Changes

- Remove undocumented `SYNAPSE_USE_FROZEN_DICTS` environment variable. ([\#18123](element-hq/synapse#18123))
- Fix detection of workflow failures in the release script. ([\#18211](element-hq/synapse#18211))
- Add caching support to media endpoints. ([\#18235](element-hq/synapse#18235))



### Updates to locked dependencies

* Bump anyhow from 1.0.96 to 1.0.97. ([\#18201](element-hq/synapse#18201))
* Bump bcrypt from 4.2.1 to 4.3.0. ([\#18207](element-hq/synapse#18207))
* Bump bytes from 1.10.0 to 1.10.1. ([\#18227](element-hq/synapse#18227))
* Bump http from 1.2.0 to 1.3.1. ([\#18245](element-hq/synapse#18245))
* Bump sentry-sdk from 2.19.2 to 2.22.0. ([\#18205](element-hq/synapse#18205))
* Bump serde from 1.0.218 to 1.0.219. ([\#18228](element-hq/synapse#18228))
* Bump serde_json from 1.0.139 to 1.0.140. ([\#18202](element-hq/synapse#18202))
* Bump ulid from 1.2.0 to 1.2.1. ([\#18246](element-hq/synapse#18246))

No significant changes since 1.127.0rc1.

- Update [MSC4140](matrix-org/matrix-spec-proposals#4140) implementation to no longer cancel a user's own delayed state events with an event type & state key that match a more recent state event sent by that user. ([\#17810](element-hq/synapse#17810))

- Fixed a minor typo in the Synapse documentation. Contributed by @karuto12. ([\#18224](element-hq/synapse#18224))

- Remove undocumented `SYNAPSE_USE_FROZEN_DICTS` environment variable. ([\#18123](element-hq/synapse#18123))
- Fix detection of workflow failures in the release script. ([\#18211](element-hq/synapse#18211))
- Add caching support to media endpoints. ([\#18235](element-hq/synapse#18235))

* Bump anyhow from 1.0.96 to 1.0.97. ([\#18201](element-hq/synapse#18201))
* Bump bcrypt from 4.2.1 to 4.3.0. ([\#18207](element-hq/synapse#18207))
* Bump bytes from 1.10.0 to 1.10.1. ([\#18227](element-hq/synapse#18227))
* Bump http from 1.2.0 to 1.3.1. ([\#18245](element-hq/synapse#18245))
* Bump sentry-sdk from 2.19.2 to 2.22.0. ([\#18205](element-hq/synapse#18205))
* Bump serde from 1.0.218 to 1.0.219. ([\#18228](element-hq/synapse#18228))
* Bump serde_json from 1.0.139 to 1.0.140. ([\#18202](element-hq/synapse#18202))
* Bump ulid from 1.2.0 to 1.2.1. ([\#18246](element-hq/synapse#18246))