ESS Pro release notes

ESS Pro 26.10.2 (2026-10-16)

Fri, 16 Oct 2026 00:00:00 +0000

Added

Add support for Content Scanner deployment.

Deploying the Content Scanner will block by default all unscanned media endpoint. This will prevent clients not configured to use the Content Scanner to upload or download any media. If you want to change this behaviour, you can set contentScanner.blockUnscannedMediaEndpoints: false.

Changed

MatrixRTC: exposed Services' ipFamilyPolicy now follows networking.ipFamily (ipv4, ipv6 or dual-stack) by default.

This can be overridden on a per exposed Service basis by explicitly setting ipFamilyPolicy on it.

ipFamilies is also now configurable on a per exposed Service basis. It defaults to unset (as before) and so allows the cluster to maintain it
HAProxy: Configure grace and hard-stop-after to avoid routing errors to terminated haproxy pods.
Add preStop configuration to all non-singleton containers to sleep on shutdown, to avoid routing errors to terminated pods.
Upgrade Synapse Pro Worker.
Upgrade Element Web to v1.12.32.

Highlights:
- Remove support for NEB starter links in messages. Fixes GHSA-x2rg-2g77-mx2w
- Remove support for guest_access_token & guest_user_id. Fixes GHSA-c88w-7h6p-27xr
Full Changelogs:
- v1.12.32

Fixed

Synapse: Fix an issue where the rust federation-reader could not connect to the internal Valkey instance.

ESS Pro 26.10.1 (2026-10-15)

Thu, 15 Oct 2026 00:00:00 +0000

Removed / Breaking Changes

MatrixRTC deployments with an external SFU now need to set matrixRTC.sfu.url to the web sockets URL of their SFU.

This replaces setting matrixRTC.extraEnv with an entry for LIVEKIT_URL.

Changed

Update registration URL for Advanced Identity Management to be a fully qualified cluster address.
Update registration URL for Supervision to be a fully qualified cluster address.
Update registration URL for Auditbot to be a fully qualified cluster address.
Upgrade Element Admin to v0.1.16.

Highlights:
- Retry transient failures during login discovery
Full Changelogs:
- v0.1.16
Configure Synapse with the MatrixRTC SFU URL if MatrixRTC is enabled.
Upgrade Element Web to v1.12.31.

Highlights:
- Add a Markdown viewer for .md attachments in the right panel
- Add PDF viewer zoom buttons
- Offer 'Sign out' on the verification page instead of 'Remove this device'
Full Changelogs:
- v1.12.31
Upgrade MatrixRTC authoriser to v0.9.0.

Highlights:
- Verify room membership on the standalone endpoints when matrixRTC.restrictRoomCreationToLocalUsers: true
Full Changelogs:
- v0.9.0
Hookshot registration files provided as Helm values are now templated.
Change permissions of mounted ConfigMaps and Secrets to deny Read-Write access from others, and only give Read access to owners and groups.
Upgrade Matrix Authentication Service to v1.27.0.

Highlights:
- Allow password reset while signed in
- Remember which username was chosen when doing a registration through a social-login provider
Full Changelogs:
- v1.27.0
Upgrade to matrix-tools 0.20.5.

Highlights:
- Refresh dependencies
Upgrade MatrixRTC SFU to v1.13.10.

Full Changelogs:
- v1.13.10
Upgrade Valkey Exporter to v1.94.0.

Full Changelogs - v1.93.0 - v1.94.0
Upgrade Synapse to v1.163.0.

Highlights:
- Advertise support for Matrix v1.14 and v1.15
- Add push rules for MSC4075: MatrixRTC invites and notifications
Full Changelogs:
- v1.163.0
Upgrade HAProxy to v3.4.7.

ESS Pro 26.10.0 (2026-10-09)

Fri, 09 Oct 2026 00:00:00 +0000

Removed / Breaking Changes

serverName is now required when matrixRTC.enabled=true, as the MatrixRTC Authorisation Service always runs as an application service.

If initSecrets is disabled, matrixRTC.appserviceRegistration must now be provided.

Changed

Upgrade Adminbot and Supervision to v6.9.0.

Highlights:
- Supervision: Allow disabling encryption for the bot user.
Upgrade matrix-tools to v0.20.4.
Upgrade Postgres Exporter.
Upgrade Element Admin to v0.1.15.

Highlights:
- Bump base image
Full Changelogs:
- v0.1.15
Upgrade Synapse Pro worker.
Enable Telemetry in the all-enabled and default-enabled values files.
Upgrade Telemetry to v2.1.1.

Highlights:
- Update dependencies
Upgrade Advanced Identity and Access Management to v0.23.0.

Highlights:
- Align Virtru gate mappings with security labeling Synapse module.
- Update Debian base images to address CVE-2026-75804 and CVE-2026-84782.
- Allow configuring spaces to preserve elevated power levels.
Upgrade Matrix Authentication Service Connector to v2.46.0.

Full Changelogs:
- v2.46.0
Upgrade MatrixRTC SFU to v1.13.9.

Full Changelogs:
- v1.13.8
- v1.13.9
Remove obsolete feature_new_room_decoration_ui setting from Element Web.
Use specific minor version for Postgres container image.
Use specific patch version for HAProxy container image.
Run the MatrixRTC Authorisation Service as an application service so that it can authenticate to Synapse on behalf of users, e.g. to manage their MSC4140 delayed leave events.

When Synapse is deployed by the chart, the registration is generated by initSecrets and loaded by Synapse, which also gets the msc4502_enabled and msc4512_enabled experimental features.

When Synapse is not deployed by the chart, the registration is also generated. Your homeserver must then load it, e.g. copied from the generated Secret.
Use specific patch version for Valkey container image.
Route Synapse's /auth_metadata endpoint to the client-reader worker so that clients can refresh tokens while the main Synapse process is unavailable.
Upgrade MatrixRTC Authoriser to v0.8.0.

Highlights:
- Update the Client-Server and Server-Server /get_token endpoints to the latest MSC4195 format, replacing the member object with a flat member_id parameter
- Remove the deprecated delay_timeout parameter from the Client-Server /delegate_delayed_leave endpoint. The service now looks up the delay itself
- Validate the OpenID response in the deprecated /get_token and /sfu/get endpoints
Full Changelogs - v0.8.0

Fixed

Fix the Matrix RTC SFU's multiplexed UDP port being exposed as TCP when using HostPort.

ESS Pro 26.9.5 (2026-09-30)

Wed, 30 Sep 2026 00:00:00 +0000

Changed

Use a distinct Service for Hookshot's app service port.

This allows restricting of Service.spec.publishNotReadyAddresses: true to just the app service traffic.
Upgrade Synapse to v1.162.0.

Highlights:
- Raise default room version to "12"
- Fix flawed MSC4311 partial implementation introduced in Synapse v1.136.0 for invites/knocks: client-side API's like /sync use stripped state events and we now send full PDUs on the federation-side
- Add a rate limit on the client profile lookup endpoints, configurable via rc_profile
Full Changelogs:
- v1.162.0
Upgrade Matrix Authentication Service to v1.26.0.

Highlights:
- Rate limit device code link attempts
- Show the reason on the policy violation page for admin scopes and disallowed clients
- Add MSC4198 login_hint_types_supported discovery metadata
Full Changelogs:
- v1.26.0
Upgrade Element Web to v1.12.30.

Highlights:
- Room list: improve performance
- Handle M_INVITE_BLOCKED when an invite is rejected
- Remove legacy Module & Customisation API
Full Changelogs:
- v1.12.30
Upgrade Redis/Valkey Exporter to v1.92.1.

Full Changelogs:
- v1.92.0
- v1.92.1

Documentation

Add FAQ section to the README.

ESS Pro 26.9.4 (2026-09-23)

Wed, 23 Sep 2026 00:00:00 +0000

Fixed

Fix extra quoting of the Redis password in the Synapse Pro configuration.
Fix syn2mas failing if the Synapse check config hook is disabled.

ESS Pro 26.9.3 (2026-09-22)

Tue, 22 Sep 2026 00:00:00 +0000

Added

Add the ability to configure dnsConfig on components that make outbound requests.
Allow configuration of a global nodeSelector.

The existing per-component nodeSelector values take precedence if configured and the two are not merged.

This allows administrators to set a common, default nodeSelector rather than having to reconfigure it in every component.

Changed

Upgrade Element Web to v1.12.29.

Highlights:
- Fix GHSA-wqmv-r2qj-2j9p
- Room list: add an Invites section
- Room list: add a People section
- Add user status in timeline pills
- Add a wait for first sync before showing the Home screen
- Update modules in container image
Full Changelogs:
- v1.12.28
- v1.12.29
Update Synapse to v1.161.0.

Highlights:
- MSC4140: Cancellable delayed events: Add an endpoint for getting a single delayed event
- Add experimental support for letting application services proxy namespaces in the C-S and S-S API as per MSC4512
- Add experimental support for sending federation requests from application services as per MSC4512
- Add a config option that limits the time period in which local users can redact their own messages
Full Changelogs:
- v1.161.0
Upgrade Adminbot and Supervision to v6.8.1.

Highlights:
- Improve compatibility with Synapse v1.161.0
Allow Hookshot with encryption to be started up with Matrix Authentication Service.

This is still an experimental configuration.
Upgrade Matrix Authentication Service to v1.25.1.

Highlights:
- Return M_APPSERVICE_LOGIN_UNSUPPORTED for m.login.application_service logins
- Fix template rendering errors when no state parameter given or an empty code field
Full Changelogs:
- v1.25.0
- v1.25.1
Ensure registration files match the template when running initSecrets.
Upgrade Element Admin to v0.1.14.

Highlights:
- Fix the personal token expiry display and the expiry input
- Fix scheduled room deletion timestamp display
Full Changelogs:
- v0.1.14
Upgrade Hookshot to v7.5.0.

Highlights:
- Fix compatibility with Synapse v1.161.0 / stable MSC3202 support
Full Changelogs:
- v7.5.0

Fixed

Fix Pro Federation reader worker not picking up external Redis or Valkey configuration.

ESS Pro 26.9.2 (2026-09-17)

Thu, 17 Sep 2026 00:00:00 +0000

Added

Allow additional callback URIs to be configured per LDAP provider with authentication.ldap[].additionalRedirectUris.
Add the ability to configure dnsPolicy on components that make outbound requests.

Changed

Add fragments for Element Pro map tiler & well-known configuration.
Support configMapKeyRef in {component}.extraEnv.valueFrom.
Default the MatrixRTC SFU to dnsPolicy: ClusterFirstWithHostNet when running with hostNetwork: true.
Unify hostAliases handling in supported components.
Allow configuration of hostAliases on the MatrixRTC SFU.

It now makes outbound requests to Redis and the MatrixRTC authoriser.
Upgrade MatrixRTC Authoriser to v0.7.0.

Highlights:
- Rewrite in Rust to improve the service's resource footprint and simplifies future changes
- Check the user rather than the server room membership in the federation /get_token endpoint
Full Changelogs - v0.7.0
Upgrade Redis Exporter to v1.91.1.

Full Changelogs:
- v1.91.0
- v1.91.1
Allow the syn2mas migration process to stay in stage 2 for multiple deployments.

The actual syn2mas Helm hooks will keep running but will not doing anything until matrixAuthenticationService.syn2mas.enabled: false and the migration is finalised.
Always use HTTPS when redirecting to Element Web from unknown paths on serverName.
Extend MatrixRTC Redis support to include an external Redis/Valkey with matrixRTC.redisOrValkey.

Unlike with other components configuring via matrixRTC.redis is not supported as <component>.redis is deprecated.

If both the MatrixRTC Authoriser and SFU are configured with an external Redis/Valkey, the in-chart Valkey is not constructed for the purposes of MatrixRTC (it may still be constructed for Synapse and/or Hookshot).
Always run a syn2mas migrate --dry-run before doing a real migration.

We also move the syn2mas check under matrix-tools control too so that we can skip it in the next commit.
Improve the clarity of the deployment markers logic.
Upgrade MatrixRTC SFU to v1.13.7.

Full Changelogs:
- v1.13.7
Validate that the in-chart Synapse is enabled if syn2mas has been enabled.
Upgrade Matrix Authentication Service Connector to v2.45.1.

Full Changelogs:
- v2.43.0
- v2.43.1
- v2.44.0
- v2.45.0
- v2.45.1

Disallow users from deactivating their accounts in Matrix Authentication Service by default.

This can be changed with e.g.

matrixAuthenticationService:
  additional:
    allowAccountDeactivation:
      config: |
        account:
          account_deactivation_allowed: true

Fixed

Fix ${thing} within an environment variable that is used as a replacement not being preserved.

ESS Pro 26.9.1 (2026-09-04)

Fri, 04 Sep 2026 00:00:00 +0000

Deprecated

Synapse: Drop synapse.ephemeralStorages.media as non-media processes now mount the media store in /tmp.

Changed

Change the Redis Deployment to be a StatefulSet after the Valkey migration.
Replace Redis with Valkey.

The redis key at the top-level in the values file is deprecated. It is replaced by the top-level valkey key. The schema is identical apart from redis.redisExporter which is replaced by valkey.valkeyExporter.

Values from redis are merged into valkey to control deployment of Valkey

The top-level redis key will be removed in a later release and any user set values under redis should be moved to valkey.

The external Redis keys in hookshot, synapse and matrixRTC.sfu have replacements for redis in the form of redisOrValkey. Values from {hookshot,synapse,matrixRTC.sfu}.redis should be move to {hookshot,synapse,matrixRTC.sfu}.redisOrValkey. {hookshot,synapse,matrixRTC.sfu}.redis will be removed in a later release.
Upgrade Advanced Identity Management to v0.21.0.
- Allow configuring power level content overrides for maintained spaces and rooms.
Upgrade Synapse to v1.160.0.

Highlights:
- Add optional support for MSC4262: Profile Updates for Sliding Sync
- Fix a bug where stream positions (presence, to-device message, etc.) could stop being sent to clients
- Speed up the conversion of device list changes into outbound federation pokes
Full Changelogs:
- v1.160.0
Upgrade Matrix Authentication Service to v1.24.0.

Highlights:
- Update h2 to address security vulnerability (RUSTSEC-2026-0258)
- Translation updates
Full Changelogs:
- v1.24.0
Upgrade Element Admin to v0.1.13.

Highlights:
- Add a dedicated page to manage user devices and applications being used
- Fix the accessibility issues the new test suite found
Full Changelogs:
- v0.1.13

Fixed

Fix there being multiple independent Redis Pods running during upgrades.
Synapse: Restore the /tmp directory.

Fix an issue where media uploads larger than 100KB would failed due to missing a tmp directory available for writing buffered files.
- synapse.ephemeralStorages.nonMediaTmp handles the /tmp directory properties of non-media workers.
- synapse.media.ephemeralStorages.media.tmp handles the /tmp directory properties of media workers.

ESS Pro 26.9.0 (2026-09-02)

Wed, 02 Sep 2026 00:00:00 +0000

Removed / Breaking Changes

Restrict MatrixRTC authoriser to 1 replica for reliable delayed events support.

Added

Add support for emptyDir.medium configurability.
Add ephemeralStorages configuration to all components having emptyDir volumes. This allows to configure sizeLimit for all of those volumes.

Note that matrixTools related volumes like rendered-config are handled globally at matrixTools.ephemeralStorages.renderedConfig, while ca-trust-store are handled globally at matrixTools.ephemeralStorages.sslCertificates.

Changed

matrix-tools: Update to 0.19.1. Introduces a new randbytes init-secrets generator, which replaces the hex32 generator.
TI-Messenger: Update SBG module configuration to always return a 404 to media preview endpoints to align with the TI-Messenger spec.
Upgrade HAProxy to v3.4.

Full Changelogs:
- v3.4
Upgrade MatrixRTC SFU to v1.13.6.

Full Changelogs:
- v1.13.6
Upgrade matrix-tools to to 0.20.0.
- Introduces a new randbytes init-secrets generator, which replaces the hex32 generator.
- Introduces a new x25519 init-secrets generator, supporting der and paddedBase64 outputs.
Upgrade Postgres Exporter to v0.20.1.

Full Changelogs:
- v0.19.0
- v0.19.1
- v0.20.0
- v0.20.1
Remove /tmp emptyDir from Synapse pods. If your modules or configuration need a read-write access to /tmp, you should now use synapse.extraVolumes and synapse.extraVolumeMounts to add this mount point.
Make clearer which requests and limits are set by default vs omitted by default.
Upgrade Redis Exporter to v1.90.0.

Full Changelogs:
- v1.85.0
- v1.86.0
- v1.87.0
- v1.88.0
- v1.89.0
- v1.90.0
Configure Redis against the MatrixRTC SFU given it is now deployed for MatrixRTC.
Make the dbid Synapse uses in Redis explicit.
Upgrade Element Web to v1.12.27.

Highlights:
- Room list: add settings to consider activity as unread
- Render knock membership events in notifications
Full Changelogs:
- v1.12.27
Move Hookshot to a distinct dbid on the shared Redis.
Configure Redis against the MatrixRTC authoriser to prevent calls from failing after restarting it.

Using an external Redis with the MatrixRTC authoriser is not yet supported.

Fixed

Fix manifests rendering empty annotations fields when no pod annotations are configured.

ESS Pro 26.8.1 (2026-08-21)

Fri, 21 Aug 2026 00:00:00 +0000

Removed / Breaking Changes

Move auditbot.backupPassphrase to auditbot.encryption.backupPassphrase.

This makes it consistent with Supervision and allows for other encryption related properties to be grouped together.

Any auto-generated backup passphrases (if you haven't explicitly configured auditbot.backupPassphrase) are maintained.
Removed matrixRTC.livekitAuth.keysYaml in favour of matrixRTC.livekitAuth.{key,secret}.

Both were previously available. keysYaml gave the impression of allowing multiple keys but this was not functional.

Changed

Warning about using requires_element_pro in the Element configuration JSON.

Matrix Authentication Service's allowed_client_uris functionality should be used instead as per https://docs.element.io/latest/element-server-suite-pro/configuring-components/authentication/configuring/#restricting-allowed-clients
Allow configuration of privilege in each container's securityContext.

The implicit default of false is maintained and made explicit.
Allow ${NAME} literals in the rendered configuration by escaping.

e.g. \${NAME} would render to ${NAME} rather than looking for an environment variable named NAME to replace with.
Telemetry persist init job has been renamed and is now suffixed with a hash of the job spec.

It forces a recreation of the job every time we change its spec, avoiding immutable spec issues.

The job gets ArgoCD annotations by default, which allows it to appear as synced despite having a TTL of 1 second.
Default the Telemetry persistence CronJob to enabled.

The CronJob will run by default at 5am UTC everyday and save to a PersistentVolumeClaim.

It can be disabled again with telemetry.persistHistoricalTelemetry.enabled: false.
Allow configuring Supervision and Auditbot with what action to take if pre-existing Secret Storage or cross-signing secrets fail to be recovered.
Update Supervision and Auditbot to allow using a recovery key created out-of-band (such as those prepared by Element Web).
Upgrade MatrixRTC Authoriser to v0.6.0.

Highlights:
- Log the errors that cause "Unable to create room on SFU"
- Delegated MatrixRTC leave events via delayed events (MSC4140)
Full Changelogs:
- v0.5.0
- v0.6.0
Upgrade Synapse to v1.159.0.

Highlights:
- Add optional support for MSC4429: Profile Updates for Legacy Sync
- Fix the quarantined_media replication stream never being sent when the configured quarantined_media_changes stream writer is a worker.
Full Changelogs:
- v1.159.0
Upgrade Element Web to v1.12.26.

Highlights:
- Tell the user when registration is being rate limited
- Room list: persist section state (expanded/collapsed)
Full Changelogs:
- v1.12.26
Upgrade Matrix Authentication Service to v1.23.0.

Highlights:
- Remove the GraphQL playground
- Translations updates
Full Changelogs:
- v1.23.0
Upgrade MatrixRTC SFU to v1.13.5.

Full Changelogs:
- No v1.13.0
- v1.13.1
- v1.13.2
- v1.13.3
- v1.13.4
- v1.13.5
Keep client-server API requests to Synapse from the MatrixRTC authoriser internal to the cluster where possible.

ESS Pro LTS 26.4.10 (2026-08-14)

Fri, 14 Aug 2026 00:00:00 +0000

Changed

Upgrade Matrix Authentication Service to v1.18.0.

Highlights:
- Remove URL fragments set by upstream identity providers when redirecting to clients
- Experimental session hard-limits in non-interactive contexts
- Disable the device code auto-filling by default
- Add oauth.device_code_grant_enabled configuration option
Full Changelogs:
- v1.17.0
- v1.18.0

Fixed

Ensure AWS_CA_BUNDLE is correctly set on the media cleanup sidecar.

This is to allow cleanup against S3 endpoints with TLS certificates signed by custom certificate authorities.

ESS Pro 26.8.0 (2026-08-05)

Wed, 05 Aug 2026 00:00:00 +0000

Added

Allow defining metricRelabelings configuration for all ServiceMonitors.

Changed

Upgrade Synapse to v1.158.0.

Highlights:
- Change default room version to 11, implementing MSC4239 as part of Matrix v1.14
- Return M_USER_LIMIT_EXCEEDED error code for media upload limits from MSC4335
- Fix /createRoom intermittently failing with a 500 error in version 12 rooms when the same user creates several rooms at once, due to colliding room IDs
Full Changelogs:
- v1.158.0
Ensure Synapse Ingresses have the k8s.element.io/synapse-instance like other kinds.
Upgrade Matrix Authentication Service to v1.22.0.

Highlights:
- Accept [ and ~ in OAuth 2.0 scope tokens
- Keep the auth action context when changing accounts
Full Changelogs:
- v1.22.0
Upgrade Telemetry to v2.1.0.

Highlights:
- Fix Telemetry user metrics being empty in certain Synapse worker configurations
Upgrade Hookshot to v7.4.4.

Highlights:
- Do not log webhook URLs to prometheus metrics. Fixes GHSA-5c49-6fvm-2xvc
Full Changelog:
- v7.4.4
Upgrade Element Web to v1.12.25.

Highlights:
- Collapse left panel during calls
- Collapsed URL previews in timeline
Full Changelogs:
- v1.12.25

Fixed

Fix matrixRTC.sfu.exposedServices.*.portType wrongfully keeping nodePort and externalTrafficPolicy when set to ClusterIP.
Ensure AWS_CA_BUNDLE is correctly set on the media cleanup sidecar.

This is to allow cleanup against S3 endpoints with TLS certificates signed by custom certificate authorities.
Advanced Identity Management: reprovision LDAP users on changes to any synced user attribute.
Advanced Identity Management: Fix a bug where SCIM filters would not parse correctly.

ESS Pro 26.7.2 (2026-07-28)

Tue, 28 Jul 2026 00:00:00 +0000

Security

Upgrade to Synapse v1.157.2-pro.2.

This security release addresses several vulnerabilities. Please upgrade when you can, particularly if your homeserver participates in open federation and/or has untrusted local users.

Security Fixes

High severity:
- Fix ELEMENTSEC-2026-1071
- Fix ELEMENTSEC-2024-1520
- Fix ELEMENTSEC-2026-1717
- Fix ELEMENTSEC-2026-1721
- Fix ELEMENTSEC-2026-1729
- Fix ELEMENTSEC-2026-1740
Moderate severity:
- Fix ELEMENTSEC-2026-1714
- Fix ELEMENTSEC-2026-1718
- Fix ELEMENTSEC-2026-1751
Low severity:
- Fix ELEMENTSEC-2026-1703
- Fix ELEMENTSEC-2026-1760
Full Changelogs:
- v1.157.2

Changed

Changed default frequency of automatic reporting of Telemetry to Element to 1 day (down from 5 minutes).
Update TI-Messenger sidecar to version 1.12.2.

Highlights:
- Fix a bug where a JWK's algorithm would only be sourced from the JWK itself, not the containing JWT's header.

Documentation

Fix internal sample all-static workers were missing event-persisting-stream.

ESS Pro LTS 25.10.14 (2026-07-28)

Tue, 28 Jul 2026 00:00:00 +0000

Security

Upgrade to Synapse v1.141.0-lts.8.

This security release addresses several vulnerabilities. Please upgrade when you can, particularly if your homeserver participates in open federation and/or has untrusted local users.

Security Fixes

High severity:
- Fix ELEMENTSEC-2026-1071
- Fix ELEMENTSEC-2024-1520
- Fix ELEMENTSEC-2026-1717
- Fix ELEMENTSEC-2026-1721
- Fix ELEMENTSEC-2026-1729
- Fix ELEMENTSEC-2026-1740
Moderate severity:
- Fix ELEMENTSEC-2026-1714
- Fix ELEMENTSEC-2026-1718
- Fix ELEMENTSEC-2026-1751
Low severity:
- Fix ELEMENTSEC-2026-1703
- Fix ELEMENTSEC-2026-1760

ESS Pro LTS 26.4.9 (2026-07-28)

Tue, 28 Jul 2026 00:00:00 +0000

Security

Upgrade to Synapse v1.152.1-lts.3.

This security release addresses several vulnerabilities. Please upgrade when you can, particularly if your homeserver participates in open federation and/or has untrusted local users.

Security Fixes

High severity:
- Fix ELEMENTSEC-2026-1071
- Fix ELEMENTSEC-2024-1520
- Fix ELEMENTSEC-2026-1717
- Fix ELEMENTSEC-2026-1721
- Fix ELEMENTSEC-2026-1729
- Fix ELEMENTSEC-2026-1740
Moderate severity:
- Fix ELEMENTSEC-2026-1714
- Fix ELEMENTSEC-2026-1718
- Fix ELEMENTSEC-2026-1751
Low severity:
- Fix ELEMENTSEC-2026-1703
- Fix ELEMENTSEC-2026-1760

ESS Pro LTS 26.4.8 (2026-07-27)

Mon, 27 Jul 2026 00:00:00 +0000

Added

Allow configuring Telemetry to save snapshots to persistent storage.

This can be enabled with telemetry.persistHistoricalTelemetry.enabled. A new PersistentVolumeClaim is either created or an existing PersistentVolumeClaim name is provided to store the Telemetry snapshots in.

Snapshots are taken daily at 00:05 UTC by default.

Changed

Changed default frequency of automatic reporting of Telemetry to Element to 1 day (down from 5 minutes).
Update TI-Messenger sidecar to version 1.12.2.

Highlights:
- Fix a bug where a JWK's algorithm would only be sourced from the JWK itself, not the containing JWT's header.

ESS Pro 26.7.1 (2026-07-24)

Fri, 24 Jul 2026 00:00:00 +0000

Added

Add support for configuring affinity (nodeAffinity, podAffinity and podAntiAffinity) on component workloads, along with a global affinity applied to all components. Each affinity type is resolved independently: a component that sets one type overrides only that type, inheriting the others from the global affinity, and a type can be blanked out per-component by setting it to {}.
Add matrixRTC.sfu.nodeIPSource to select which Kubernetes downward API field populates the SFU public IP (NODE_IP) when useStunToDiscoverPublicIP is false and no manualIP is provided. Valid values: hostIP (default, previous behaviour) and podIP.
Allow customising the response headers of the /.well-known/matrix/* endpoints via wellKnownDelegation.headers. The well-known responses now return Cache-Control: public, max-age=3600 by default.
Add support for configuring schedulerName and runtimeClassName on component workloads, along with global schedulerName and runtimeClassName values applied to all components (a per-component value overrides the global one).
Allow configuring Telemetry to save snapshots to persistent storage.

This can be enabled with telemetry.persistHistoricalTelemetry.enabled. A new PersistentVolumeClaim is either created or an existing PersistentVolumeClaim name is provided to store the Telemetry snapshots in.

Snapshots are taken daily at 00:05 UTC by default.
Add support for horizontal autoscaling to Matrix Authentication Service.
Add support for setting portType in matrixRTC.sfu.exposedServices to ClusterIP.

Changed

Configure Matrix Authentication Service to communicate with any Synapse worker, not only the main process.
Upgrade Hookshot to v7.4.3.

Highlights:
- Fix GitHub messages being inlined incorrectly in some cases
- Fix requests to GET /oauth endpoints (Jira, GitHub, OpenProject) throwing an error when required query parameters are missing
Full Changelogs:
- v7.4.3
Upgrade Element Web to v1.12.24.

Element Call is now the default calling solution in upstream Element Web. It was already the default calling solution in ESS Community. The setting in the Element Web configuration to disable Element Call has changed. It was features.feature_group_calls: false. It is now element_call.disable: true. element_call.use_exclusively still controls whether legacy voice and video is enabled or not.

Highlights:
- Remove legacy room list
- Adapt OAuth2 implementation to Matrix Spec v1.18
- Allow disabling legacy calls and make Voice & Video settings Legacy Voice & Video
Full Changelogs:
- v1.12.24
Upgrade Synapse to v1.157.1.

Highlights - Support MSC4446 for moving fully read markers backwards - Add before and after time filters to the 'Redact events of a user' Admin API - Add an exclude_rooms_from_presence configuration option to stop presence being routed between users solely because they share one of the listed rooms

Full Changelogs:
- v1.157.0
- v1.157.1
Upgrade Matrix Authentication Service to v1.21.0.

Highlights:
- Don't show client URI on consent screen for Device Authorization Grant
- Translations updates
Full Changelogs:
- v1.21.0

Fixed

Fix the configuration of Supervision's Element Web that prevented it from loading.
Load balance createRoom API around available workers instead of a single-one.
Fix an issue where HAProxy could not route to more than 20 instances of a worker.

ESS Pro LTS 26.4.7 (2026-07-21)

Tue, 21 Jul 2026 00:00:00 +0000

Added

Build and publish a matrix-tools debug variant.

Changed

Add support for configuring 0 replicas on any workload.
Improved Telemetry engine to be more successful in data collection. Telemetry engine will now also collect the total number of registered users.

Fixed

Fix federation sender and pusher functionalities not being configured in Synapse correctly in some worker configurations.
Fix incorrect name being set for worker handling background processes in some worker configurations.

ESS Pro 26.7.0 (2026-07-10)

Fri, 10 Jul 2026 00:00:00 +0000

Added

Add support for configuring the priorityClassName on component workloads, along with a global priorityClassName applied to all components (a per-component value overrides the global one).

Changed

Ensure consistent setup of SCIM in Advanced Identity Management values files examples.
Improved Telemetry engine to be more successful in data collection. Telemetry engine will now also collect the total number of registered users.
Upgrade Element Web to v1.12.22.

Highlights:
- Room list: add notifications to section headers
- Disable URL previews per-message when the message provides a hint
Full Changelogs:
- v1.12.22
Add support for configuring 0 replicas on any workload.
Upgrade Element Admin to v0.1.12.

Highlights:
- Add Federation tab
Full Changelogs:
- v0.1.12
Reduce Synapse liveness and readiness probe timeouts from 30s to 12s by default.
Tweak startupProbe.failureThreshold for Synapse Pro workers to be the same as other Synapse workers.
Upgrade Element Web to v1.12.23.

Highlights:
- Move room list sections out of labs
Full Changelogs:
- v1.12.23

Add session limits to Matrix Authentication Service by default.

Configure Matrix Authentication Services with soft and hard limits of 50 sessions by default. This applies to both interactive and non-interactive sessions.

The defaults can be raised, to e.g. 75, with

matrixAuthenticationService:
  additional:
    session-limits:
      config: |
        experimental:
          session_limit:
            soft_limit: 75
            hard_limit: 75

The limits can be removed with

matrixAuthenticationService:
  additional:
    session-limits:
      config: |
        experimental:
          session_limit: null

Upgrade Synapse to v1.156.0.

Highlights:
- Expose MSC4354 Sticky Events over MSC4186 (Simplified) Sliding Sync
- Include allowed_room_ids in the /summary client-server API response for rooms with restricted join rules, as required by Matrix 1.15
- Add experimental support for MSC4491: Invite reasons in room creation
Full Changelogs:
- v1.156.0
Upgrade Matrix Authentication Service to v1.20.0.

Highlights:
- Admin API: allow listing and viewing of OAuth 2.0 clients
- Infer an initial name for the device for the device auth grant
Full Changelogs - v1.20.0
Introduce elementProConfig which is exposed at <synapse.ingress.host>/_synapse/ess/element-pro/config for compatibility with updated ElementX clients.

This is a replacement for wellKnownDelegation.additional.element which was exposed at <server name>/.well-known/element/element.json. Setting either value will be exposed in both places, with elementProConfig taking precedence if both are set. wellKnownDelegation.additional.element and <server name>/.well-known/element/element.json will be removed in 26.10 LTS.
Element Web: Configure presence indicator for local homeserver depending on presence worker being enabled.

Fixed

Fix federation sender and pusher functionalities not being configured in Synapse correctly in some worker configurations.
Fix incorrect name being set for worker handling background processes in some worker configurations.

ESS Pro LTS 26.4.6 (2026-06-30)

Tue, 30 Jun 2026 00:00:00 +0000

Added

Allow to configure Advanced Identity Management user localpart. Note that this should not be changed past initial setup, at the risk of breaking spaces and rooms ownership when they were created by the Advanced Identity Management bot user.

Changed

Ensure consistent setup of SCIM in Advanced Identity Management values files examples.

Fixed

Fix an issue where configuring Advanced Access and Identity Management without SCIM or LDAP Authentication would result in a null source in its configuration.
Synapse: Fix access token cache not being invalidated for sessions using refresh tokens.

ESS Pro 26.6.3 (2026-06-23)

Tue, 23 Jun 2026 00:00:00 +0000

Added

Allow to configure Advanced Identity Management user localpart. Note that this should not be changed past initial setup, at the risk of breaking spaces and rooms ownership when they were created by the Advanced Identity Management bot user.

Fixed

Fix an issue where configuring Advanced Access and Identity Management without SCIM or LDAP Authentication would result in a null source in its configuration.

ESS Pro 26.6.2 (2026-06-17)

Wed, 17 Jun 2026 00:00:00 +0000

Added

Add support for configuring PersistentVolumeClaim selector properties.
Add support for configuring PersistentVolumeClaim volumeName property.

Changed

Upgrade Hookshot to v7.4.2.

Highlights:
- You can now add hints to Hookshot messages to disable URL previews on clients. Uses MSC4095.
Full Changelogs:
- v7.4.0
- v7.4.1
- v7.4.2
Have Synapse calculate MAU metrics.
Element Web now disables/enables link preview toggles based on Synapse configuration.
Upgrade Matrix Authentication Service to v1.19.0.

Highlights:
- Set X-Frame-Options header to DENY for human facing screens
- Support per-provider registration token requirements
Full Changelogs - v1.19.0
Upgrade Synapse to v1.155.0.

Highlights:
- Port the Python Event classes to Rust
- Fix the /capabilities endpoint returning a 500 error on non-media workers when MSC4452: Preview URL capabilities API is enabled.
Full Changelogs:
- v1.155.0

Fixed

Advanced Identity Management: don't skip applying templated mappings of LDAP user attributes when no LDAP admin attribute mapping is configured.

ESS Pro LTS 26.4.5 (2026-06-17)

Wed, 17 Jun 2026 00:00:00 +0000

Fixed

Fix an issue where a custom appservice registration file configured for Hookshot would not be mounted properly into Synapse pods.

ESS Pro LTS 26.4.4 (2026-06-12)

Fri, 12 Jun 2026 00:00:00 +0000

Added

Add support for configuring PersistentVolumeClaim volumeName property.

Fixed

Advanced Identity Management: don't skip applying templated mappings of LDAP user attributes when no LDAP admin attribute mapping is configured.

ESS Pro LTS 26.4.3 (2026-06-10)

Wed, 10 Jun 2026 00:00:00 +0000

Added

Add restrictToFossImageFunctionality to allow the chart to run with FOSS images.

This does not automatically change the chart to using FOSS images. It validates that:
- components that have no FOSS image aren't enabled
- chart functionality that relies on Pro matrix-tools isn't used
And also customises the rendered manifests for FOSS image variants.
Advanced Identity Management: map the LDAP email user attribute configured by authentication.ldap[0].attributesMapping.email.

Changed

Advanced Identity Management: apply templated mappings of LDAP user attributes configured by authentication.ldap[0].attributesMapping.*.template, which was previously supported only by Matrix Authentication Service.

ESS Pro 26.6.1 (2026-06-09)

Tue, 09 Jun 2026 00:00:00 +0000

Changed

Revert "Element Web now disables/enables link preview toggles based on Synapse configuration".

In deployments with specific sets of Synapse workers enabled, the relevant Synapse configuration causes the capabilities API in Synapse v1.154 to fail.

ESS Pro 26.6.0 (2026-06-09)

Tue, 09 Jun 2026 00:00:00 +0000

Added

Build and publish a matrix-tools debug variant.
Advanced Identity Management: map the LDAP email user attribute configured by authentication.ldap[0].attributesMapping.email.
Support monitoring Redis.

Deploys a Redis Exporter sidecar and adds ServiceMonitor support.

Changed

Increased default MatrixRTC authoriser resources for increased stability.
Advanced Identity Management: apply templated mappings of LDAP user attributes configured by authentication.ldap[0].attributesMapping.*.template, which was previously supported only by Matrix Authentication Service.
Upgrade Element Web to v1.12.21.

Highlights:
- Incoming Element Calls now trigger a regular OS notification
- Redesign user menu
- Add support for m.recent_emoji account data event
Full Changelogs:
Synapse: add index label to metrics.
Upgrade MatrixRTC SFU to v1.12.0.

Highlights:
- Fix UDP Turn URLs when ipv6 is enabled
- Fix local ip filtering from ICE candidates
Full Changelogs:
- v1.11.0
- v1.12.0
Element Web now disables/enables link preview toggles based on Synapse configuration.
Upgrade Synapse to v1.154.0.

Highlights:
- Add support for MSC4452: Preview URL capabilities API
Full Changelogs:
- v1.154.0
Upgrade Matrix Authentication Service Pro to v1.18.0.

Highlights:
- Disable the device code auto-filling by default
- Add oauth.device_code_grant_enabled configuration option
- Add support for disabling logins for legacy clients
- Add support for restricting login from next-generation clients
Full Changelogs:
- v1.18.0
Update Supervision and Auditbot to resolve &GHSA-wfq4-36m3-9g42 / CVE-2026-45056.

Allow turning off of QR code login on deployments with Matrix Authentication Service.

Synapse additional configuration turning off the experimental feature is required:

synapse:
  additional:
    disable-qr-code-login.yaml:
      config: |
        experimental_features:
          msc4108_enabled: false

Fixed

Ensure HAProxy restarts when restrictToFossImageFunctionality: true to update the chart version in /_synapse/ess/version.

ESS Pro LTS 25.10.13 (2026-06-09)

Tue, 09 Jun 2026 00:00:00 +0000

Added

Advanced Identity Management: map the LDAP email user attribute configured by authentication.ldap[0].attributesMapping.email.

Changed

Advanced Identity Management: allow logging settings to control the display of log messages generated by the matrix-bot-sdk backend.
Advanced Identity Management: apply templated mappings of LDAP user attributes configured by authentication.ldap[0].attributesMapping.*.template, which was previously supported only by Matrix Authentication Service.

ESS Pro 26.5.1 (2026-05-20)

Wed, 20 May 2026 00:00:00 +0000

Added

Add restrictToFossImageFunctionality to allow the chart to run with FOSS images.

This does not automatically change the chart to using FOSS images. It validates that:
- components that have no FOSS image aren't enabled
- chart functionality that relies on Pro matrix-tools isn't used
And also customises the rendered manifests for FOSS image variants.

Changed

Rebuild matrix-tools on Golang 1.26.
Upgrade Element Web to v1.12.18.

Highlights:
- Promote "Share encrypted history" from labs
- Confirm before inviting unknown users to a DM/room
Full Changelogs:
- v1.12.17
- v1.12.18
Ensure consistency of the volumeMounts for custom Certificate Authorities.
Upgrade Hookshot to v7.3.3.

Highlights:
- Fix Matrix reply messages being skipped if the reply message could not be read.
- Fix a bug where a webhook URL could be randomly regenerated on startup if storage is not available.
Full Changelogs:
- v7.3.3
Upgrade Synapse to v1.153.0.

Highlights:
- Make ACLs apply to EDUs per MSC4163
- Stabilize MSC3266: Room summary API
- Allow self-requested user erasure (upon account deactivation) to succeed even if Synapse has disabled profile changes
Full Changelogs:
- v1.153.0
Upgrade Matrix Authentication Service to v1.17.0.

Highlights:
- Remove URL fragments set by upstream identity providers when redirecting to clients
- Experimental session hard-limits in non-interactive contexts
Full Changelogs:
- v1.17.0

Fixed

Fix S3 media cleanup sidecar not being able to connect to Synapse's database.
Fixed error when fetching server keys using the Pro federation reader worker.
Ensure no TI-Messenger sidecar manifests are rendered if the Secure Border Gateway is disabled.
TI-Messenger: Fix an issue where Synapse would be denied access to the Federation List Service.
Ensure turn.external_tls is correctly set in the Matrix RTC SFU configuration depending on matrixRTC.sfu.exposedServices.turnTLS.tlsTerminationOnPod.
Fixed matrixRTC.sfu.exposedServices.rtpUdp not documenting externalTrafficPolicy or internalTrafficPolicy.
Fix an issue where a custom appservice registration file configured for Hookshot would not be mounted properly into Synapse pods.

ESS Pro LTS 26.4.2 (2026-05-18)

Mon, 18 May 2026 00:00:00 +0000

Changed

Ensure consistency of the volumeMounts for custom Certificate Authorities.

Fixed

Fix S3 media cleanup sidecar not being able to connect to Synapse's database.
Fixed error when fetching server keys using the Pro federation reader worker.
Ensure turn.external_tls is correctly set in the Matrix RTC SFU configuration depending on matrixRTC.sfu.exposedServices.turnTLS.tlsTerminationOnPod.
Ensure no TI-Messenger sidecar manifests are rendered if the Secure Border Gateway is disabled.
Fixed matrixRTC.sfu.exposedServices.rtpUdp not documenting externalTrafficPolicy or internalTrafficPolicy.
TI-Messenger: Fix an issue where Synapse would be denied access to the Federation List Service.

ESS Pro 26.5.0 (2026-05-08)

Fri, 08 May 2026 00:00:00 +0000

Removed / Breaking Changes

Disallow the sso-login-api-requests functionality on workers in Synapse when Matrix Authentication Service is in use or about to be migrated to.

Added

Add example values file fragment for configuring a custom identity provider app in Element Pro.
Introduce the mas-helper-api-requests functionality to Synapse workers to support the Matrix Authentication Service admin API endpoints in Synapse.

A default-disabled worker (mas-helper) is present if this functionality wants to be handled by a discrete worker.

Changed

LTS releases will have version numbers ending in +lts.
Upgrade Synapse to v1.152.1.

Highlights:
- Prevent CPU starvation (Denial of Service) under worker lock contention, additionally capping the WorkerLock time out interval to a maximum of 60 seconds. Contributed by Famedly. (#19394, ELEMENTSEC-2026-1706, GHSA-8q93-326v-3m7g, CVE pending)
- Prevent pagination ending when a page is full of rejected events. (ELEMENTSEC-2025-1636, GHSA-6qf2-7x63-mm6v, CVE pending)
Full Changelogs:
- v1.152.1

Fixed

Fix various Synapse Admin APIs relating to users being incorrectly routed to workers if Matrix Authentication Service is enabled.

ESS Pro LTS 25.10.12 (2026-05-07)

Thu, 07 May 2026 00:00:00 +0000

Changed

LTS releases will have version numbers ending in +lts.
Upgrade Synapse to v1.141.0-lts.7.

Highlights:
- Prevent CPU starvation (Denial of Service) under worker lock contention, additionally capping the WorkerLock time out interval to a maximum of 60 seconds. Contributed by Famedly. (#19394, ELEMENTSEC-2026-1706, GHSA-8q93-326v-3m7g, CVE pending)
- Prevent pagination ending when a page is full of rejected events. (ELEMENTSEC-2025-1636, GHSA-6qf2-7x63-mm6v, CVE pending)

ESS Pro LTS 26.4.1 (2026-05-07)

Thu, 07 May 2026 00:00:00 +0000

Changed

LTS releases will have version numbers ending in +lts.
Upgrade Synapse to v1.152.1-lts.1.

Highlights:
- Prevent CPU starvation (Denial of Service) under worker lock contention, additionally capping the WorkerLock time out interval to a maximum of 60 seconds. Contributed by Famedly. (#19394, ELEMENTSEC-2026-1706, GHSA-8q93-326v-3m7g, CVE pending)
- Prevent pagination ending when a page is full of rejected events. (ELEMENTSEC-2025-1636, GHSA-6qf2-7x63-mm6v, CVE pending)
Full Changelogs:
- v1.152.1

ESS Pro 26.4.0 (2026-05-01)

Fri, 01 May 2026 00:00:00 +0000

Removed / Breaking Changes

Convert Secure Border Gateway (SBG) to use the render-config container pattern.

SBG now uses render-config init containers to merge YAML configuration fragments.

Breaking changes:
- secureBorderGateway.additional and secureBorderGateway.additionalModules are now maps with keys config, configSecret, and configSecretKey instead of YAML strings
- Removed secureBorderGateway.existingConfigMap and secureBorderGateway.customConfigMapName

Added

Allow providing additional configuration to Supervision's Element Web.
Allow configuration of the image for any Synapse Pro worker with synapse.proImage.

The image can be overridden on a per-worker basis with synapse.workers.<worker name>.image.

Changed

Support more flexible workers.

Workers can now have arbitrary names and configure the functionality available on them.

The functionalities can be configured with
```
synapse:
  workers:
    <worker name>:
      functionality: [<functionalities>]
```
All the existing workers are still present in the values with equivalent functionality to before if they're enabled. Alternatively custom worker types can be created that combine multiple functionalities into a single runtime process.
Improve validation on the Telemetry automatic reporting credentials.
Upgrade Telemetry to v1.2.0.

Highlights:
- Support sending Telemetry to Element automatically over HTTPS.
Upgrade TI-Messenger sidecar to v1.12.1.

Highlights - Additionally support elliptic-curve key and certificate for mTLS client authentication against a Sectoral IdP.
Simplify a pair of single conditional and checks.
Configure the HAProxy to speak HTTP2 to the Synapse Pro Federation Reader.
Upgrade Synapse Pro Federation Reader.

Highlights:
- Updated dependencies
Configure Element Web and Element Desktop in Synapse as able to skip an OIDC confirmation screen.
Construct PodDisruptionBudgets in a consistent manner.
Construct VerticalPodAutoscalers in a consistent manner.
The Telemetry component is now enabled by default.

It can be disabled with telemetry.enabled: false.

This change relates to the local component that allows extracting telemetry data from the running stack. Automatic sending of telemetry data to Element has not yet been enabled with this change. The Telemetry data is present in the cluster at Secret/<release-name>-telemetry-data. It can be viewed with kubectl --namespace <namespace> get secrets <your-helm-release>-telemetry-data --output jsonpath='{.data.telemetry\.json}' | base64 --decode

For more details please see https://docs.element.io/latest/element-server-suite-pro/telemetry.
Use HTTP2 for Synapse to Matrix Authentication Service traffic.

This reduces the overhead of token introspection, as Synapse will be able to use a single HTTP/2 connection to Matrix Authentication Service.
Configure web_client_location in Synapse with the URL of the Element Web.
Improve the schema validation for chart credentials.
Upgrade Element Web to v1.12.16.

Highlights:
- Improve performance of the room list
- Hide the names of banned users behind a spoiler tag
- Hide spoilers from desktop notifications
- Update URL Preview settings
Full Changelogs:
- v1.12.14
- v1.12.15
- v1.12.16
Upgrade Matrix Authentication Service to v1.16.0.

Highlights:
- Fix scheduled jobs automatic cleanup not working in some conditions
- Translation updates
- Dependency updates
Full Changelogs:
- v1.15.0
- v1.16.0
Upgrade Synapse to v1.152.0.

If upgrading directly from ESS Pro 25.12.1 or earlier, ESS LTS 25.10.3 or earlier, or ESS LTS 25.4.14 or earlier, the event_resign background update will need to be manually run. If ESS Pro 25.12.2 to 26.3.3, ESS LTS 25.10.4 to 25.10.11, or ESS LTS 25.4.15 to 25.4.18 have been run on a deployment with initSecrets enabled (the default), this background update does not need to be manually run. If upgrading from ESS Pro 25.12.1 or earlier, ESS LTS 25.10.3 or earlier, or ESS LTS 25.4.14 or earlier, or initSecrets was later disabled, full instructions are available

Highlights:
- Add stable support for MSC4284 Policy Servers
- Update and stabilize support for MSC2666: Get rooms in common with another user
- Allow Synapse to start up even when discovery fails for an OpenID Connect provider
- Add a "Listing quarantined media changes" Admin API for retrieving a paginated record of when media became (un)quarantined
- Add a way to re-sign local events with a new signing key
- Reduce database disk space usage by pruning old rows from device_lists_changes_in_room
Full Changelogs:
- v1.151.0
- v1.152.0
Improve the schema validation for HorizontalPodAutoscalers.
Update Synapse worker values to show examples for worker types rather than duplicating values for each worker type.
Improved validation of authentication.oidc[*].endpointsDiscoveryidTokenSigningAlgValuesSupported as to whether it should be set or not based on clientAuthMethod.
Allow configuration of the name override for Synapse workers whose names won't always fit into Kubernetes naming limits.
Allow changing of the Synapse database keepalive settings that the chart configures.
Default Synapse's URL preview support to on when Secure Border Gateway is disabled.
Upgrade MatrixRTC Authoriser to v0.4.4.

Highlights:
- Update MSC4195 identity hash to latest update
- Update MSC4195 JSON signature to latest update
- Update dependencies for security updates
Full Changelogs - v0.4.3 - v0.4.4
Upgrade MatrixRTC SFU to v1.10.1.

Highlights:
- Fix TURN URL IP addresses
Full Changelogs:
- v1.10.1
Validate that additional configuration supplied directly to the chart is valid YAML/JSON.

Additional configuration loaded from a Secret in the cluster can only be validated at runtime.
Use unified Synapse Pro container image.

Support a Synapse worker configuration using the federation API paths that the Synapse Pro federation reader does not yet support.

Example:

synapse:
  workers:
    foss-federation-reader:
      enabled: true
      nameOverride: foss-fed-read
      functionality:
      - federation-api-requests

Individual workers can now override the container image used.
Support configuring a test worker for Synapse with the no-op functionality.

synapse.workers.test-worker has this functionality by default and can simply be enabled.

The test worker's primary purpose is to allow for testing of new container images prior to updating all Synapse container images.
Allow configuring MAS OIDC upstream accountName claims import.
Allow MAS upstream IdP endpointsDiscovery.jwksUri to be optional when discovery is disabled and openid isn't configured as a scope.
Update Supervision and Auditbot so that their management bots verify their own devices via cross-signing.
Advanced Identity Management: allow logging settings to control the display of log messages generated by the matrix-bot-sdk backend.
Default Element Web's URL previews in all rooms to on.
Enable MSC4450: Identity Provider selection for User-Interactive Authentication with Legacy Single Sign-On support.

Fixed

Correct the default URL for Telemetry automatic reporting.
Ensure the Telemetry automatic reporting container has the appropriate environment variables.
Fix the mounting of certificate authorities in Telemetry when it is configured for automatic reporting.
Fix Telemetry automatic reporting not knowing the ESS edition or version.
Give all containers in the Telemetry Pod unique names.
Give all containers in the Telemetry Pod unique port numbers.
Make it possible to set podDisruptionBudget.maxUnavailable to 0.
Fix HAProxy verticalAutoscaling.containerPolicies.maxAllowed.memory not being set correctly.
Fix SecureBorderGateway verticalAutoscaling.containerPolicies.maxAllowed.memory not being set correctly.
Fix HAProxy VerticalPodAutoscaler not checking whether its HorizontalPodAutoscaler is also being controlled by Pod memory.
Fix extra quotes being added around the Redis password in the Hookshot configuration.
Add missing credential checks for Hookshot credentials and Synapse external Redis.
Fix chart schema for HorizontalPodAutoscalers such that both targetCPUUtilizationPercentage and targetMemoryUtilizationPercentage can be set at the same time, whilst still requiring one of them to be set.
Fix password for external Redis being omitted from the Synapse configuration in some scenarios.
Correctly set the external Redis password in Hookshot if configured.
Fixed the location of scripts in the Helm tarball to match the documentation.
Fix validations not being applied for adminUser and telemetry values.

ESS Pro LTS 25.10.11 (2026-04-08)

Wed, 08 Apr 2026 00:00:00 +0000

Changed

Upgrade TI-Messenger sidecar to v1.12.1.

Highlights - Additionally support elliptic-curve key and certificate for mTLS client authentication against a Sectoral IdP.

ESS Pro 26.3.3 (2026-04-01)

Wed, 01 Apr 2026 00:00:00 +0000

Added

Telemetry: Add support for automatic reporting. Disabled by default, enable with telemetry.automaticReporting.enabled: true.
Allow configuration of storage.storageClassName and storage.resourcePolicy as defaults across all constructed PersistentVolumeClaims.

The individual values can still be overridden on a per-PersistentVolumeClaim basis as before.

Changed

Upgrade Matrix RTC SFU to 1.10.0.

Resolves CVE-2026-33186.

Full Changelogs:
- v1.10.0
Upgrade Matrix RTC LiveKit JWT Service to v0.4.2.

Resolves CVE-2026-26014 and CVE-2026-33186.

Full Changelogs:
- v0.4.2
Configure Synapse to use the system CA trust store for Postgres connections if sslMode: verify-full.

Documentation

Improve developer documentation on how to update component versions with cached digests.

ESS Pro 26.3.2 (2026-03-25)

Wed, 25 Mar 2026 00:00:00 +0000

Changed

Synapse: Change database.args.database and replace with database.args.dbname. In tenant mode, requires synapse-shards chart version 1.0.3.
matrix-tools: Errors occurring while setting the display name are now considered non-critical and will not cause a chart deployment failure.
Raise the default size of Synapse's connection pool.

Goes from 3-5 (min-max) to 5-10. These settings can be overridden with additional Synapse configuration.
Upgrade Synapse to v1.150.0.

Highlights:
- When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse
- Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory
- Allow caching of the /versions and /auth_metadata public endpoints
Full Changelogs:
- v1.150.0
Allow configuration of the resources for Synapse's check config Job.

Rather than using the resources for the Synapse main process.
Upgrade Element Web to v1.12.13.

Highlights:
- Upgrade Element Call for new picture-in-picture designs
- Fix "key storage out of sync" appearing when key storage is actually fine
Full Changelogs:
- v1.12.13
Upgrade Element Admin to v0.1.11.

Highlights:
- Rename Moderation to Supervision
- Use upstream nginx configuration
Full Changelogs:
- v0.1.11
Upgrade Matrix Authentication Service to v1.14.0.

Highlights:
- Synchronise the user locked flag to Synapse
- Respect HTTP Proxy environment variables in outgoing HTTP requests
Full Changelogs:
- v1.14.0

Fixed

Fix extra quotes being added around the Redis password in the Synapse configuration template.
Fix Synapse admin API IP restrictions not working in all scenarios.

Documentation

Migration: Adjust Migrating documentation to use the new ess-pro-migration-tool command.
Improve developer documentation.

ESS Pro LTS 25.10.10 (2026-03-25)

Wed, 25 Mar 2026 00:00:00 +0000

Changed

Upgrade Synapse to v1.141.0-lts.6.

Highlights:
- Fix /sync missing membership in state_after

Fixed

Fix Synapse admin API IP restrictions not working in all scenarios.

ESS Pro 26.3.1 (2026-03-18)

Wed, 18 Mar 2026 00:00:00 +0000

Removed / Breaking Changes

Matrix RTC: Change the default ports to move them to the proper default Kubernetes static range.

Kubernetes default static range contains ports 30000-30085. The new Matrix RTC exposed services have been moved to:
- Matrix RTC TCP: 30001
- Matrix RTC UDP: 30002
- Matrix RTC Turn TLS: 30003
- Matrix RTC Turn: 30004
If you want to keep using the previously set static ports, you can do so by adding the following to your values files:
```
matrixRTC:
  sfu:
    exposedServices:
      rtcTcp:
        port: 30881
      rtcMuxedUdp:
        port: 30882
      turnTLS:
        port: 31443
      turn:
        port: 31748
```
Matrix Authentication Service ingress.host is now mandatory.

If it isn't set and both Element Web and Matrix Authentication Service are enabled, MAS will be using the host of Element Web. In this case, to avoid disruption to user clients:
- MAS ingress.host must be set to the same value as Element Web ingress.host.
- The new MAS basePath configuration option must be set to /account.

Added

Advanced Identity Management: allow specifying external groups or user attributes that will set bridged members as Synapse/MAS administrators.
It is now possible to mount Matrix Authentication Service to a sub path.

Note that changing the location of MAS for existing installations is discouraged.
Added support for external Redis configuration (synapse.redis, hookshot.redis) allowing use of managed Redis services (AWS Elasticache, Azure Cache for Redis, etc.) instead of the internal Redis deployment. Each Redis-using component uses the chart Redis unless it has been independently configured with an external Redis. When external Redis is configured for all components, the internal Redis Deployment, Service, ConfigMap, and ServiceAccount are automatically skipped.

Changed

Add optional file pattern argument to scripts/ct-lint.sh to allow selective linting of files, similar to scripts/assemble_ci_values_files_from_fragments.sh.
Matrix Authentication Service: Remove hardcoded kid from secret keys in the config file, and let Matrix Authentication Service automatically derive them.

Matrix Authentication Service includes the kid it used when signing JWTs, like id_tokens, which helps consumers verify using the right key. The Matrix specifications doesn't make use of id_tokens, so there is no impact changing the kid and letting it derive one automatically at runtime.
Remove unstable MSC2965 details from Well Known Files.

Native OIDC (Matrix Authentication Service) support is advertised through /auth_metadata availability.

The classic Element applications need to be upgraded to the following versions:
- Element Android: v1.6.50
- Element iOS: v1.11.34
matrix-tools: Upgrade to 0.17.5.

Fixes:
- Only set the user display name if the argument is passed to the command.
Changes:
- Support injecting environment variables in Synapse pro config file.
Upgrade MatrixRTC authoriser to v0.4.1 for MSC4195 compliance.

Highlights:
- Introduces the new MSC4195-compliant request flow
Full Changelogs:
- v0.4.0
- v0.4.1
Upgrade Synapse to v1.149.1.

Highlights:
- Add stable support for MSC4380 invite blocking
- Add experimental support for MSC4388: Secure out-of-band channel for sign in with QR
- Fix /sync missing membership event in state_after (experimental MSC4222 implementation) in some scenarios
Full Changelogs:
- v1.149.0
- v1.149.1
Upgrade Matrix Authentication Service to v1.13.0.

Highlights:
- Support MSC4198 login_hint in account management URI
Full Changelogs:
- v1.13.0
Upgrade Element Web to v1.12.12.

Highlights:
- Add stable support for MSC4380 invite blocking
- Hide the names of banned users behind a spoiler tag
Full Changelogs:
- v1.12.12
Update the Synapse Pro Federation Reader to be able to consume multiple signing keys like Python Synapse.
Upgrade Matrix RTC SFU to 1.9.12.

Full Changelogs:
- v1.9.2
- v1.9.3
- v1.9.4
- v1.9.6
- v1.9.7
- v1.9.8
- v1.9.9
- v1.9.10
- v1.9.11
- v1.9.12

Fixed

Fix an issue where the chart would reset a user display name when no display name was passed to the matrix-user command.
Fix HAProxy memory leak in dual-stack clusters.

In dual-stack clusters the IP of the backend server for each Synapse Pod flaps between the IPv4 & IPv6 address every second or so. This causes a memory leak.

Configure HAProxy to only use the IPv4 or IPv6 address based on the value of networking.ipFamily. In the case of dual-stack (the default value), the IPv4 address is used. As such IPv6 only clusters must now set networking.ipFamily: ipv6.
Fix Hookshot not starting in an IPv6 only cluster.
Fix Element Admin not starting in an IPv6 only cluster.

ESS Pro 26.3.0 (2026-03-06)

Fri, 06 Mar 2026 00:00:00 +0000

Removed / Breaking Changes

Removed authentication.oidc[*].allowExistingUsers in favour of authentication.oidc[*].claimImports.localpart.onConflict.

As announced in 26.1.0 authentication.oidc[*].claimImports.localpart.onConflict should be used instead.

Added

Postgres: Add postgres.additionalDBCredentials to provision additional databases and users in the ESS Pro Postgres server.

Changed

Use double quotes string-scalar in Chart.yaml for consistency with CI values files.

Fixed

Matrix RTC: Fix an issue where LiveKit would crash if setting exposedServices.turnTLS.port to 443 when not using HostPort portType.
Synapse: Fix no_proxy variable is misconfigured.

ESS Pro LTS 25.10.9 (2026-03-05)

Thu, 05 Mar 2026 00:00:00 +0000

Fixed

Synapse: Fix no_proxy variable is misconfigured.

ESS Pro 26.2.4 (2026-02-26)

Thu, 26 Feb 2026 00:00:00 +0000

Added

Add tlsTerminationOnPod property to matrix-rtc TURN TLS service for external TLS termination support.

Changed

Upgrade Matrix Authentication Service to v1.12.0.

Highlights:
- Allow + in usernames, as per the Matrix spec
- Fix compat token refresh giving back a consumed token
- Add a default Message-ID when sending emails
Full Changelogs:
- v1.12.0
Upgrade Synapse to v1.148.0.

Highlights:
- Support sending and receiving MSC4354 Sticky Event metadata
Full Changelogs:
- v1.148.0
Upgrade Element Web to v1.12.11.

Highlights:
- Update the room list visuals in order to have better contrast
- Remove server acl status/summaries from timeline
Full Changelogs:
- v1.12.11

Fixed

Fix Synapse Pro Federation Reader's connection to Redis being incorrect.
Ensure all Deployments and StatefulSets have restartPolicy: Always in their spec.template.spec so that their Pods are always correctly restarted.
Don't wait for the chart Synapse to be available to start Hookshot when an external Synapse is used.
Correct Secure Border Gateway configuration when Synapse is not deployed.
Ensure all Jobs have restartPolicy: Never in their spec.template.spec so that failed Pods are kept around.

ESS Pro 26.2.3 (2026-02-18)

Wed, 18 Feb 2026 00:00:00 +0000

Changed

Synapse: In tenant mode, configure the Synapse shard version which should run the tenant. Requires the shards-controller chart 1.0.0.

Disable presence by default unless a presence-writer worker is configured.

This can be overridden with

synapse:
  additional:
    enabled-presence.yaml:
      config: |
        presence:
          enabled: true

Upgrade Matrix Authentication Service to v1.11.0.

Highlights:
- Make the compat login SSO redirect query parameters ignore invalid values
- Clean up unsupported threepids from already deactivated users
- Cleanup finished OAuth 2.0 sessions
- Cleanup finished user/browser sessions
- Clear out last active IP on each session after 30 days
Full Changelogs:
- v1.11.0
Update matrix-tools base image to Debian 13.

For compatibility with syn2mas v1.11

Fixed

Use the Distroless Redis image again after accidental switch to non-Distroless.

Introduced in ESS Pro 26.1.1.

ESS Pro LTS 25.10.8 (2026-02-17)

Tue, 17 Feb 2026 00:00:00 +0000

Changed

Synapse: Upgrade to v1.141.0-lts.5.

Highlights:
- Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670.

ESS Pro 26.2.2 (2026-02-13)

Fri, 13 Feb 2026 00:00:00 +0000

Changed

Upgrade Element Web to v1.12.10.

Highlights:
- Allow Element Call widgets to receive sticky events
- Add option for sorting by rooms with unread messages in the room list view
Full Changelogs:
- v1.12.10
Upgrade Synapse to v1.147.1.

Highlights:
- Don't retry joining partial state rooms all at once on startup.
- Block federation requests and events authenticated using a known insecure signing key. See CVE-2026-24044 / ELEMENTSEC-2025-1670.
Full Changelogs:
- v1.147.0

Documentation

Document how to manually fix CVE-2026-24044/ELEMENTSEC-2025-1670.

ESS Pro 26.2.1 (2026-02-10)

Tue, 10 Feb 2026 00:00:00 +0000

Added

matrix-tools: Add support for setting the display name of created matrix users.

Changed

Rename adminbot to supervision.

Values file adminbot component is now named supervision. If you enabled adminbot before, you will need to adjust your values files and rename the top-level key to supervision.

The chart will automatically adjust most related Kubernetes resources names as required. No manual intervention in cluster is required.

The bot user joining the rooms, by default:
- will keep the localpart adminbot
- will be set "Supervision Bot" as display name

Fixed

Fix Matrix Authentication Service wrong configuration key when configuring display name claim import in authentication values.

ESS Pro 26.2.0 (2026-02-05)

Thu, 05 Feb 2026 00:00:00 +0000

Added

Advanced Identity Management: directly support SCIM configuration in the chart through advancedIdentityManagement.scim

Example configuration:

advancedIdentityManagement:
  scim:
    enabled: true
    client:
      id: 'element-ad'
      attributeMapping:
        username: 'externalId'
      rbac:
      - token:
          value: CHANGEME-fPtJc0A2inDPWyRduzjMMRlSYtqK6l59
        roles: ['*:*']
      - token:
          value: CHANGEME-oogie6pai2boph0ouch8Eikaez7siequ
        roles: ['read:*']
      - token:
          value: CHANGEME-na7mohsoki7aiy2EeJ2oeGhai6oobeew
        roles: ['write:*']

Added authentication.oidc[].fetchUserInfo to control whether user claims are fetched from the userinfo endpoint or not.

Defaults to fetch_userinfo: false for Matrix Authentication Service and user_profile_method: auto in Synapse if not provided, which is the previous behaviour. true will map to user_profile_method: userinfo_endpoint in Synapse if configured.
Added authentication.oidc[].forwardLoginHint to control whether the login_hint should be forwarded to the provider in the authorization request.

Defaults to forward_login_hint: false for Matrix Authentication Service. Ignored by Synapse.
Added authentication.oidc[].responseMode to control how OIDC IdPs are requested to send the callback response.

Defaults to query if not set. Ignored by Synapse.

Synapse: Add support for synapse.media.s3.serverSideEncryption configuration.

Example configuration:

synapse:
  media:
    s3:
      serverSideEncryption:
        enabled: true
        customerKey:
          value: CHANGEME-phajoo3AhxahbahfieThiemoo2koiTh3

Changed

Mark the chart created Admin User as a support user so that it is hidden from the user directory.

Set default permissions on Hookshot so that local users only have permissions to manage integrations and connections.

Permissions should be adjusted to give specific users the ability to administer integrations, e.g.

hookshot:
  additional:
    permissions.yaml:
      config: |
        permissions:
        - actor: {{ $.Values.serverName | quote }}
          services:
          - service: "*"
            level: manageConnections
        - action: "@an-admin-user:{{ $.Values.serverName }}"
          services:
          - service: "*"
            level: admin

Update the test cluster values so that Hookshot can make requests to cluster-internal IP addresses.
Admin User Job: Set backoffLimit to 5 as it can take a while for Synapse to stabilize when the Vertical Pod Autoscaler is enabled.

Fixed

Correct the schema for the adminbot.encryption value.
Fix Hookshot widgets not being available when using the Synapse Ingress / not having a dedicated Hookshot Ingress.
Synapse As Tenants: Extra secrets label must be plural.
Fixed documentation around authentication.oidc[].endpointsDiscovery.idTokenSigningAlgValuesSupported.

ESS Pro LTS 25.10.7 (2026-02-05)

Thu, 05 Feb 2026 00:00:00 +0000

Fixed

Synapse As Tenants: Extra secrets label must be plural.

ESS Pro 26.1.3 (2026-01-28)

Wed, 28 Jan 2026 00:00:00 +0000

Changed

Upgrade Matrix Authentication Service to v1.10.0.

Highlights:
- Support for stable MSC3824 (OAuth 2.0 API aware clients) values
- Support for stable MSC4191 account management actions
- Cleanup various old, soft-deleted entities from the database.
Full Changelogs:
- v1.10.0
Upgrade Element Web to v1.12.9.

Highlights:
- Allow local log downloads instead of a bug report endpoint URL.
- Support for stable MSC4191 account management action parameter
- Support for stable m.oauth UIA stage from MSC4312
Full Changelogs:
- v1.12.9
Upgrade Synapse to v1.146.0.

Highlights:
- Stabilise support for MSC4312's m.oauth User-Interactive Auth stage for resetting cross-signing identity with the OAuth 2.0 API.
- Fix joining a restricted v12 room locally when no local room creator is present but local users with sufficient power levels are.
- Fixed parallel calls to /_matrix/media/v1/create being rate-limited for appservices even if rate_limited: false was set in the registration.
Full Changelogs:
- v1.146.0
Configure bug reporting in Element Web to allow local downloading of reports by default.

This is to prevent unexpected data leaks as the previous default submitted to Element's bug reporting endpoint. An example of how the previous behaviour can be restored can be found in charts/matrix-stack/ci/fragments/element-web-bugreports.yaml.

ESS Pro 26.1.2 (2026-01-27)

Tue, 27 Jan 2026 00:00:00 +0000

Added

Allow defining relabeling configuration for all service monitors.
Add support for configuring internalTrafficPolicy for services behind ingresses.
Add support for configuring internalTrafficPolicy to exposedServices.
Add support to customize nodePort of exposed services.

nodePort property of exposedServices.* is now a string template taking two parameters:

- context: The exposed service values context *.exposedServices.<svc> - root: The helm $ root values context

On Matrix RTC values, the nodePort template defaults to {{ .context.port }} so that the nodePort is the same as port. Setting the template to an empty string will skip setting nodePort on the service.
Add support for configuring externalTrafficPolicy for NodePort and LoadBalancer services behind ingresses.
Add support for configuring externalTrafficPolicy to exposedServices.
Add support for configuring annotations of Ingress services.
Add support for configuring externalIPs of Ingress services.
Add support for configuring externalIPs of exposed services.

Changed

Hookshot: Use appservice fully qualified domain name in the registration file.
Hookshot: Enable adding widgets in rooms where it is invited by default.
Hookshot: Disable encryption by default as it is still experimental.
Change default externalTrafficPolicy for the SFU exposed services from Local to Kubernetes defaults Cluster.
Hookshot: Publish service unready address.
Update Hookshot to 7.3.1.

Highlights:
- Add generic webhook transformation JS snippet which can handle GitLab Pipeline payloads under contrib/jsTransformationFunctions/gitlab-pipeline.js
- Add generic webhook transformation JS snippet to format text as code block under contrib/jsTransformationFunctions/format-as-code.js
- Fix the !hookshot help command not working
Full Changelogs:
- 7.3.1

Fixed

Matrix RTC: Fix a templating issue when turn was enabled with a cert-manager issuer to generate the tls secret.
Hookshot: Fix a templating issue when Matrix Authentication Service is enabled if Hookshot was enabled without an Ingress.

Documentation

Document how to setup and configure Hookshot.

ESS Pro release notes

ESS Pro 26.10.2 (2026-10-16)

Added

Changed

Fixed

ESS Pro 26.10.1 (2026-10-15)

Removed / Breaking Changes

Changed

ESS Pro 26.10.0 (2026-10-09)

Removed / Breaking Changes

Changed

Fixed

ESS Pro 26.9.5 (2026-09-30)

Changed

Documentation

ESS Pro 26.9.4 (2026-09-23)

Fixed

ESS Pro 26.9.3 (2026-09-22)

Added

Changed

Fixed

ESS Pro 26.9.2 (2026-09-17)

Added

Changed

Fixed

ESS Pro 26.9.1 (2026-09-04)

Deprecated

Changed

Fixed

ESS Pro 26.9.0 (2026-09-02)

Removed / Breaking Changes

Added

Changed

Fixed

ESS Pro 26.8.1 (2026-08-21)

Removed / Breaking Changes

Changed

ESS Pro LTS 26.4.10 (2026-08-14)

Changed

Fixed

ESS Pro 26.8.0 (2026-08-05)

Added

Changed

Fixed

ESS Pro 26.7.2 (2026-07-28)

Security

Security Fixes

Changed

Documentation

ESS Pro LTS 25.10.14 (2026-07-28)

Security

Security Fixes

ESS Pro LTS 26.4.9 (2026-07-28)

Security

Security Fixes

ESS Pro LTS 26.4.8 (2026-07-27)

Added

Changed

ESS Pro 26.7.1 (2026-07-24)

Added

Changed

Fixed

ESS Pro LTS 26.4.7 (2026-07-21)

Added

Changed

Fixed

ESS Pro 26.7.0 (2026-07-10)

Added

Changed

Fixed

ESS Pro LTS 26.4.6 (2026-06-30)

Added

Changed

Fixed

ESS Pro 26.6.3 (2026-06-23)

Added

Fixed

ESS Pro 26.6.2 (2026-06-17)

Added

Changed