Bump matrix-synapse from 1.10.1 to 1.24.0 in /requirements

[dependabot]

Bumps matrix-synapse from 1.10.1 to 1.24.0.

Release notes

Sourced from matrix-synapse's releases.

v1.24.0

Synapse 1.24.0 (2020-12-09)

Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.

Security advisory

The following issues are fixed in v1.23.1 and v1.24.0.

• There is a denial of service attack (CVE-2020-26257) against the federation APIs in which future events will not be correctly sent to other servers over federation. This affects all servers that participate in open federation. (Fixed in #8776).

• Synapse may be affected by OpenSSL CVE-2020-1971. Synapse administrators should ensure that they have the latest versions of the cryptography Python package installed.

To upgrade Synapse along with the cryptography package:

• Administrators using the matrix.org Docker image or the Debian/Ubuntu packages from matrix.org should ensure that they have version 1.24.0 or 1.23.1 installed: these images include the updated packages.
• Administrators who have installed Synapse from source should upgrade the cryptography package within their virtualenv by running:

  <path_to_virtualenv>/bin/pip install 'cryptography>=3.3'

• Administrators who have installed Synapse from distribution packages should consult the information from their distributions.

Internal Changes

• Add a maximum version for pysaml2 on Python 3.5. (#8898)

v1.24.0rc2

Synapse 1.24.0rc2 (2020-12-04)

... (truncated)

Changelog

Sourced from matrix-synapse's changelog.

Synapse 1.24.0 (2020-12-09)

Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.

Security advisory

The following issues are fixed in v1.23.1 and v1.24.0.

• There is a denial of service attack (CVE-2020-26257) against the federation APIs in which future events will not be correctly sent to other servers over federation. This affects all servers that participate in open federation. (Fixed in #8776).

• Synapse may be affected by OpenSSL CVE-2020-1971. Synapse administrators should ensure that they have the latest versions of the cryptography Python package installed.

To upgrade Synapse along with the cryptography package:

• Administrators using the matrix.org Docker image or the Debian/Ubuntu packages from matrix.org should ensure that they have version 1.24.0 or 1.23.1 installed: these images include the updated packages.
• Administrators who have installed Synapse from source should upgrade the cryptography package within their virtualenv by running:

  <path_to_virtualenv>/bin/pip install 'cryptography>=3.3'

• Administrators who have installed Synapse from distribution packages should consult the information from their distributions.

Internal Changes

• Add a maximum version for pysaml2 on Python 3.5. (#8898)

Synapse 1.23.1 (2020-12-09)

Due to the two security issues highlighted below, server administrators are

... (truncated)

Commits

• 9b26a4a 1.24.0
• 1a95530 Fix installing pysaml2 on Python 3.5. (#8898)
• 2602514 Minor update to CHANGES.
• 693dab4 1.24.0rc2
• 22c6c19 Fix a regression that mapping providers should be able to redirect users. (#8...
• 295c209 Remove version pin prometheus_client dependency (#8875)
• e41720d Minor changes to the CHANGES doc.
• c67af84 Minor fixes to changelog.
• 53b1268 1.24.0rc1
• 8388384 Fix a regression when grandfathering SAML users. (#8855)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #18.