Update ghcr.io/element-hq/synapse Docker tag to v1.154.0

matrix_livekit_jwt_service_container_repo_version interpolated
livekit_server_version (the LiveKit Server role's version) instead of
this role's own matrix_livekit_jwt_service_version, so self-builds
checked out the wrong git tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/update-translations.yml

@@ -32,7 +32,7 @@ jobs:
 
       # Setting up recommended prerequisites
       # See: i18n/README.md
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: astral-sh/setup-uv@v8.2.0
       - uses: extractions/setup-just@v4
 
       # TODO: optimize when we start publishing translations and integrate a Weblate instance

docs/howto-server-delegation.md

@@ -23,7 +23,7 @@ Both methods have their place and will continue to do so. You only need to use j
 
 For simplicity reasons, this playbook recommends you to set up server delegation via a `/.well-known/matrix/server` file. However, that method may have some downsides that are not to your liking. Hence this guide about alternative ways to set up Server Delegation.
 
-**Note**: as an alternative, it is possible to install the server such that it uses only the `matrix.example.com` domain (instead of identifying as the shorter base domain — `example.com`). This should be helpful if you are not in control of anything on the base domain (`example.com`). In this case, you would not need to configure server delegation, but you would need to add other configuration. For more information, see [How do I install on matrix.example.com without involving the base domain?](faq.md#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain) on our FAQ.
+**Note**: as an alternative, it is possible to install the server such that it uses only the `matrix.example.com` domain (instead of identifying as the shorter base domain — `example.com`). This should be helpful if you are not in control of anything on the base domain (`example.com`). In this case, you would not need to configure server delegation, but you would need to add other configuration. For more information, see [How do I install on matrix.example.com without involving the base domain?](faq.md#how-do-i-install-on-matrixexamplecom-without-involving-the-base-domain) on our FAQ.
 
 ## Server Delegation via a well-known file
 

group_vars/matrix_servers

@@ -6235,8 +6235,6 @@ matrix_livekit_jwt_service_environment_variable_livekit_key: "{{ (matrix_homeser
 
 matrix_livekit_jwt_service_environment_variable_livekit_secret: "{{ (matrix_homeserver_generic_secret_key + ':lk.secret') | hash('sha512') | to_uuid }}"
 
-matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list: ["{{ matrix_domain }}"]
-
 ########################################################################
 #                                                                      #
 # /matrix-livekit-jwt-service                                          #

i18n/requirements.txt

@@ -4,7 +4,7 @@ certifi==2026.5.20
 charset-normalizer==3.4.7
 click==8.4.1
 docutils==0.23
-idna==3.17
+idna==3.18
 imagesize==2.0.0
 Jinja2==3.1.6
 linkify-it-py==2.1.0
@@ -18,7 +18,7 @@ Pygments==2.20.0
 PyYAML==6.0.3
 requests==2.34.2
 setuptools==82.0.1
-snowballstemmer==3.1.0
+snowballstemmer==3.1.1
 Sphinx==9.1.0
 sphinx-intl==2.3.2
 sphinx-markdown-builder==0.6.10

mise.toml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
 [tools]
-prek = "0.4.3"
+prek = "0.4.4"
 
 [settings]
 yes = true

roles/custom/matrix-alertmanager-receiver/defaults/main.yml

@@ -11,7 +11,7 @@
 matrix_alertmanager_receiver_enabled: true
 
 # renovate: datasource=docker depName=docker.io/metio/matrix-alertmanager-receiver
-matrix_alertmanager_receiver_version: 2026.5.20
+matrix_alertmanager_receiver_version: 2026.6.3
 
 matrix_alertmanager_receiver_scheme: https
 

roles/custom/matrix-authentication-service/defaults/main.yml

@@ -22,7 +22,7 @@ matrix_authentication_service_container_repo_version: "{{ 'main' if matrix_authe
 matrix_authentication_service_container_src_files_path: "{{ matrix_base_data_path }}/matrix-authentication-service/container-src"
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/matrix-authentication-service
-matrix_authentication_service_version: 1.17.0
+matrix_authentication_service_version: 1.18.0
 matrix_authentication_service_container_image_registry_prefix: "{{ 'localhost/' if matrix_authentication_service_container_image_self_build else matrix_authentication_service_container_image_registry_prefix_upstream }}"
 matrix_authentication_service_container_image_registry_prefix_upstream: "{{ matrix_authentication_service_container_image_registry_prefix_upstream_default }}"
 matrix_authentication_service_container_image_registry_prefix_upstream_default: "ghcr.io/"

roles/custom/matrix-bot-baibot/defaults/main.yml

@@ -17,7 +17,7 @@ matrix_bot_baibot_container_repo_version: "{{ 'main' if matrix_bot_baibot_versio
 matrix_bot_baibot_container_src_files_path: "{{ matrix_base_data_path }}/baibot/container-src"
 
 # renovate: datasource=docker depName=ghcr.io/etkecc/baibot
-matrix_bot_baibot_version: v1.19.3
+matrix_bot_baibot_version: v1.20.0
 matrix_bot_baibot_container_image: "{{ matrix_bot_baibot_container_image_registry_prefix }}etkecc/baibot:{{ matrix_bot_baibot_version }}"
 matrix_bot_baibot_container_image_registry_prefix: "{{ 'localhost/' if matrix_bot_baibot_container_image_self_build else matrix_bot_baibot_container_image_registry_prefix_upstream }}"
 matrix_bot_baibot_container_image_registry_prefix_upstream: "{{ matrix_bot_baibot_container_image_registry_prefix_upstream_default }}"

roles/custom/matrix-livekit-jwt-service/defaults/main.yml

@@ -1,6 +1,6 @@
 # SPDX-FileCopyrightText: 2022 MDAD project contributors
 # SPDX-FileCopyrightText: 2024 wjbeckett
-# SPDX-FileCopyrightText: 2024 - 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -25,11 +25,11 @@ matrix_livekit_jwt_service_container_additional_networks_auto: []
 matrix_livekit_jwt_service_container_additional_networks_custom: []
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/lk-jwt-service
-matrix_livekit_jwt_service_version: 0.4.4
+matrix_livekit_jwt_service_version: 0.5.0
 
 matrix_livekit_jwt_service_container_image_self_build: false
 matrix_livekit_jwt_service_container_repo: "https://github.com/element-hq/lk-jwt-service.git"
-matrix_livekit_jwt_service_container_repo_version: "{{ 'main' if matrix_livekit_jwt_service_version == 'latest' else ('v' + livekit_server_version) }}"
+matrix_livekit_jwt_service_container_repo_version: "{{ 'main' if matrix_livekit_jwt_service_version == 'latest' else ('v' + matrix_livekit_jwt_service_version) }}"
 matrix_livekit_jwt_service_container_src_files_path: "{{ matrix_livekit_jwt_service_base_path }}/container-src"
 
 matrix_livekit_jwt_service_container_image: "{{ matrix_livekit_jwt_service_container_image_registry_prefix }}element-hq/lk-jwt-service:{{ matrix_livekit_jwt_service_container_image_tag }}"
@@ -86,12 +86,20 @@ matrix_livekit_jwt_service_environment_variable_livekit_url: ""
 # Controls the LIVEKIT_SECRET environment variable
 matrix_livekit_jwt_service_environment_variable_livekit_secret: ""
 
-# Controls the LIVEKIT_FULL_ACCESS_HOMESERVERS environment variable
+# Controls the LIVEKIT_FULL_ACCESS_HOMESERVERS environment variable.
 # Comma-separated list of Matrix homeservers whose users are authorized with full access to LiveKit SFU features
-# (supports * as a wildcard to allow all homeservers).
+# (like creating rooms on the SFU).
+#
+# This is a required setting and the service refuses to start without it.
+# Setting it to `*` grants full access to any federated Matrix user, but listing only the homeserver(s)
+# you intend to serve is strongly recommended.
+#
+# To add additional homeservers, use `matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom`.
 matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers: "{{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list | join(',') }}"
-
-matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list: ["*"]
+matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list: "{{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom }}"
+matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default: ["{{ matrix_domain }}"]
+matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto: []
+matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom: []
 
 # Additional environment variables to pass to the container.
 #

roles/custom/matrix-livekit-jwt-service/tasks/validate_config.yml

@@ -1,6 +1,6 @@
 # SPDX-FileCopyrightText: 2022 MDAD project contributors
 # SPDX-FileCopyrightText: 2024 wjbeckett
-# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -27,3 +27,4 @@
     - {'name': 'matrix_livekit_jwt_service_environment_variable_livekit_key', when: true}
     - {'name': 'matrix_livekit_jwt_service_environment_variable_livekit_url', when: true}
     - {'name': 'matrix_livekit_jwt_service_environment_variable_livekit_secret', when: true}
+    - {'name': 'matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers', when: true}

roles/custom/matrix-synapse/defaults/main.yml

@@ -16,7 +16,7 @@ matrix_synapse_enabled: true
 matrix_synapse_github_org_and_repo: element-hq/synapse
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/synapse
-matrix_synapse_version: v1.153.0
+matrix_synapse_version: v1.154.0
 
 matrix_synapse_username: ''
 matrix_synapse_uid: ''