Merge branch 'main' into remove-secret-psql-hostname

Author: jessebot

.github/workflows/cd-helm-release.yml

@@ -42,7 +42,7 @@ jobs:
 
       - name: Run chart-releaser
         id: helm-release
-        uses: helm/chart-releaser-action@v1.6.0
+        uses: helm/chart-releaser-action@v1.7.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           CR_GENERATE_RELEASE_NOTES: true

.github/workflows/ci-helm-lint-test.yml

@@ -29,7 +29,7 @@ jobs:
           helm repo add matrix-authentication-service https://small-hack.github.io/matrix-authentication-service-chart
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.6.1
+        uses: helm/chart-testing-action@v2.7.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed

.github/workflows/renovate.yml

@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
   schedule:
     # This should be every hour
-    - cron: '0 * * * *'
+    - cron: '55 * * * *'
   push:
     branches:
       - main
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Get token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           private-key: ${{ secrets.PRIVATE_KEY }}
           app-id: ${{ secrets.APP_ID }}
@@ -27,7 +27,7 @@ jobs:
         uses: actions/[email protected]
 
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v41.0.13
+        uses: renovatebot/github-action@v42.0.4
         with:
           token: '${{ steps.app-token.outputs.token }}'
           configurationFile: .github/renovate-config.json

README.md

@@ -208,7 +208,7 @@ matrix:
   experimental_features:
     msc3861:
       # Likely needed if using OIDC on synapse and you want to allow usage of Element-X (the beta of element)
-      enabled: false
+      enabled: true
       # -- Synapse will call `{issuer}/.well-known/openid-configuration` to get the OIDC configuration
       issuer: http://my-mas-domain.com/
       # -- Matches the `mas.mas.client_id` in the auth service config

charts/matrix/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: postgresql
   repository: oci://registry-1.docker.io/bitnamicharts
-  version: 16.3.1
+  version: 16.7.10
 - name: coturn
   repository: https://small-hack.github.io/coturn-chart
-  version: 7.1.0
+  version: 8.1.1
 - name: matrix-authentication-service
   repository: https://small-hack.github.io/matrix-authentication-service-chart
-  version: 1.3.1
-digest: sha256:6b0142f382eb3594972bb20f9b355bcc3ae1469b394577691a9724fbd4157e9e
-generated: "2025-01-19T15:10:37.052774754Z"
+  version: 1.6.0
+digest: sha256:936cb363ea2af9f2ed2481b6b332cfa0d9c9b857e831b053948aea52770b6646
+generated: "2025-06-07T20:51:06.810460075Z"

charts/matrix/Chart.yaml

@@ -8,28 +8,28 @@ sources:
 
 type: application
 
-version: 18.4.1
+version: 19.10.1
 
 # renovate: image=ghcr.io/element-hq/synapse
-appVersion: v1.122.0
+appVersion: v1.131.0
 
 maintainers:
   - name: "jessebot"
     url: "https://github.com/jessebot"
 
 dependencies:
   - name: postgresql
-    version: 16.3.1
+    version: 16.7.10
     repository: oci://registry-1.docker.io/bitnamicharts
     condition: postgresql.enabled
 
   - name: coturn
-    version: 7.1.0
+    version: 8.1.1
     repository: https://small-hack.github.io/coturn-chart
     condition: coturn.enabled
 
   - name: matrix-authentication-service
     alias: mas
-    version: 1.3.1
+    version: 1.6.0
     repository: https://small-hack.github.io/matrix-authentication-service-chart
     condition: mas.enabled

charts/matrix/README.md

@@ -1,6 +1,6 @@
 # matrix
 
-![Version: 18.4.0](https://img.shields.io/badge/Version-18.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.122.0](https://img.shields.io/badge/AppVersion-v1.122.0-informational?style=flat-square)
+![Version: 19.10.0](https://img.shields.io/badge/Version-19.10.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.131.0](https://img.shields.io/badge/AppVersion-v1.131.0-informational?style=flat-square)
 
 A Helm chart to deploy a Matrix homeserver stack on Kubernetes
 
@@ -20,9 +20,9 @@ A Helm chart to deploy a Matrix homeserver stack on Kubernetes
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://small-hack.github.io/coturn-chart | coturn | 7.1.0 |
-| https://small-hack.github.io/matrix-authentication-service-chart | mas(matrix-authentication-service) | 1.3.1 |
-| oci://registry-1.docker.io/bitnamicharts | postgresql | 16.3.1 |
+| https://small-hack.github.io/coturn-chart | coturn | 8.1.1 |
+| https://small-hack.github.io/matrix-authentication-service-chart | mas(matrix-authentication-service) | 1.6.0 |
+| oci://registry-1.docker.io/bitnamicharts | postgresql | 16.7.10 |
 
 ## Values
 
@@ -284,7 +284,7 @@ A Helm chart to deploy a Matrix homeserver stack on Kubernetes
 | bridges.hookshot.existingSecret.registration | string | `""` | optionally use existing kubernetes Secret for registration |
 | bridges.hookshot.image.pullPolicy | string | `"IfNotPresent"` | hookshot bridge docker image pull policy. If tag is "latest", set tag to "Always" |
 | bridges.hookshot.image.repository | string | `"halfshot/matrix-hookshot"` | hookshot bridge docker image |
-| bridges.hookshot.image.tag | string | `"6.0.1"` | hookshot bridge docker image tag |
+| bridges.hookshot.image.tag | string | `"7.0.0"` | hookshot bridge docker image tag |
 | bridges.hookshot.passkey | string | `""` | If bridges.hookshot.passkey AND bridges.hookshot.existingSecret.passkey are BOTH empty strings, we will generate a passkey for you. To Generate yourself: openssl genpkey -out passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096 |
 | bridges.hookshot.podSecurityContext | object | `{}` | hookshot pod security context |
 | bridges.hookshot.registration.existingSecret | string | `""` |  |
@@ -365,6 +365,7 @@ A Helm chart to deploy a Matrix homeserver stack on Kubernetes
 | coturn.coturn.realm | string | `"turn.example.com"` | hostname for the coturn server realm |
 | coturn.enabled | bool | `false` | Set to false to disable the included deployment of Coturn |
 | coturn.existingSecret | string | `""` | Optional: name of an existingSecret with key for sharedSecret |
+| coturn.external | bool | `false` | Set to true to use an external Coturn deployment |
 | coturn.externalDatabase.database | string | `""` | database to create, ignored if existingSecret is passed in |
 | coturn.externalDatabase.enabled | bool | `false` | enables the use of postgresql instead of the default sqlite for coturn to use the bundled subchart, enable this, and postgresql.enable |
 | coturn.externalDatabase.existingSecret | string | `""` | name of existing Secret to use for postgresql credentials |
@@ -417,7 +418,7 @@ A Helm chart to deploy a Matrix homeserver stack on Kubernetes
 | element.enabled | bool | `true` | Set to false to disable a deployment of Element. Users will still be able to connect via any other instances of Element e.g. https://app.element.io, Element Desktop, or any other Matrix clients |
 | element.image.pullPolicy | string | `"IfNotPresent"` | pullPolicy to use for element image, set to Always if using latest tag |
 | element.image.repository | string | `"vectorim/element-web"` | registry and repository to use for element docker image |
-| element.image.tag | string | `"v1.11.90"` | tag to use for element docker image |
+| element.image.tag | string | `"v1.11.96"` | tag to use for element docker image |
 | element.ingress.annotations."cert-manager.io/cluster-issuer" | string | `"letsencrypt-staging"` | required for TLS certs issued by cert-manager |
 | element.ingress.annotations."nginx.ingress.kubernetes.io/configuration-snippet" | string | `"proxy_intercept_errors off;\n"` |  |
 | element.ingress.className | string | `"nginx"` | ingressClassName for the k8s ingress |