Bump matrix-synapse from 1.10.1 to 1.47.1 in /requirements

[dependabot]

Bumps matrix-synapse from 1.10.1 to 1.47.1.

Release notes

Sourced from matrix-synapse's releases.

v1.47.1

Synapse 1.47.1 (2021-11-23)

This release fixes a security issue in the media store, affecting all prior releases of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild.

Server administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below.

Security advisory

The following issue is fixed in 1.47.1.

• GHSA-3hfw-x7gx-437c / CVE-2021-41281: Path traversal when downloading remote media.

  Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.

  The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.

  Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.

  Fixed by 91f2bd090.

v1.47.0

Synapse 1.47.0 (2021-11-17)

No significant changes since 1.47.0rc3.

Synapse 1.47.0rc3 (2021-11-16)

Bugfixes

• Fix a bug introduced in 1.47.0rc1 which caused worker processes to not halt startup in the presence of outstanding database migrations. (#11346)
• Fix a bug introduced in 1.47.0rc1 which prevented the 'remove deleted devices from device_inbox column' background process from running when updating from a recent Synapse version. (#11303, #11353)

Synapse 1.47.0rc2 (2021-11-10)

This fixes an issue with publishing the Debian packages for 1.47.0rc1. It is otherwise identical to 1.47.0rc1.

Synapse 1.47.0rc1 (2021-11-09)

Deprecations and Removals

... (truncated)

Changelog

Sourced from matrix-synapse's changelog.

Synapse 1.47.1 (2021-11-23)

This release fixes a security issue in the media store, affecting all prior releases of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild.

Server administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below.

Security advisory

The following issue is fixed in 1.47.1.

• GHSA-3hfw-x7gx-437c / CVE-2021-41281: Path traversal when downloading remote media.

  Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.

  The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.

  Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.

  Fixed by 91f2bd090.

Synapse 1.47.0 (2021-11-17)

No significant changes since 1.47.0rc3.

Synapse 1.47.0rc3 (2021-11-16)

Bugfixes

• Fix a bug introduced in 1.47.0rc1 which caused worker processes to not halt startup in the presence of outstanding database migrations. (#11346)
• Fix a bug introduced in 1.47.0rc1 which prevented the 'remove deleted devices from device_inbox column' background process from running when updating from a recent Synapse version. (#11303, #11353)

Synapse 1.47.0rc2 (2021-11-10)

This fixes an issue with publishing the Debian packages for 1.47.0rc1. It is otherwise identical to 1.47.0rc1.

Synapse 1.47.0rc1 (2021-11-09)

Deprecations and Removals

... (truncated)

Commits

• 8fa8399 Add CVE number
• 9c21a68 Refer to 1.47.1 without the v
• 8d4dcac Update 1.47.1 release date in CHANGES.md
• 97a4023 1.47.1
• 91f2bd0 Prevent the media store from writing outside of the configured directory
• 9f9d82a 1.47.0
• 7baa671 fix up changelog language
• 729acd8 mark the migration file migration as a bug
• edcdc5f 1.47.0rc3
• 6e084b6 Rename remove_deleted_devices_from_device_inbox to ensure it is always run ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #65.