# Matrix 2.0 nears release as eight MSCs accepted; Synapse 1.164.1 patches dependency security flaws

> **Key takeaway:** The Matrix specification's major 2.0 revision is imminent after a conference-driven push accepted eight core MSCs, while the reference Synapse homeserver released security fixes for pillow, msgpack, and compromised CA certificates.

**Published:** 2026-10-30T15:25:32+00:00 
**Source:** Matrix.org Open Communications 
**Category:** decentralized-p2p 
**Canonical URL:** https://fosswire.org/news/matrix-20-nears-release-as-eight-mscs-accepted-synapse-11641.html 

## Summary
The Matrix protocol ecosystem advanced on two fronts this week: specification and implementation. At the specification level, the Matrix 2.0 initiative reached its final stages with eight MSCs accepted during the Matrix Conference hackathon, covering Sliding Sync extensions (receipts, account data, end-to-end encryption, to-device messages), Sticky Events, and the complete MatrixRTC real-time communication stack including LiveKit transport and a voice/video calling application. Only MSC4480 and MSC4075 remain before Matrix 2.0 can ship. On the implementation side, Element's Synapse homeserver released version 1.164.1 with critical security patches for dependencies including pillow (media handling), msgpack (memory exhaustion via public room list API), and certifi/rustls-webpki (distrusting compromised eMudhra intermediate CA certificates). Synapse also added advertised support for Matrix spec versions 1.16 and 1.17, improved experimental implementations of delayed and sticky events, fixed orphaned media upload files, and continued Rustification work with a new database pool foundation and Rust clock source.

Beyond the core server, PolicyServ v1.8.0 refactored its moderation taxonomy to use MSC4456 harms classification with MSC4387 M_SAFETY error codes, and the iamb terminal client reached v0.0.13 with poll rendering, pinned events, and improved room list navigation. The Bolt/Lightning bridge ecosystem also saw v0.9.7 with rewritten Matrix support handling custom stickers, emoji, and per-message profiles.

## Matrix 2.0 specification and Synapse security fixes
- **Matrix 2.0 MSC batch:** Eight MSCs accepted in one week, all related to the Matrix 2.0 push: Sliding Sync Extensions for receipts (MSC4551), account data (MSC4548), E2EE (MSC4543), and to-device messages (MSC4538); Sticky Events (MSC4354); and the full MatrixRTC stack including the base protocol (MSC4143), LiveKit transport (MSC4195), and voice/video calling application (MSC4196).
- **Remaining blockers:** MSC4480 and MSC4075 are the only MSCs still pending before the Spec Core Team can finalize Matrix 2.0 for release.
- **Synapse security patches:** Version 1.164.1 addresses dependency advisories for pillow (media processing), msgpack (memory exhaustion through public room list API), and certifi/rustls-webpki (removing trust for compromised eMudhra intermediate CA certificates).
- **Synapse protocol support:** The server now advertises compatibility with Matrix specification versions 1.16 and 1.17.
- **Synapse Rustification:** Foundation work laid for a Rust-backed database pool and a Rust-side clock source, continuing the incremental rewrite from Python.

## Why it matters
The imminent Matrix 2.0 release represents a significant protocol milestone that will affect all homeserver operators, client developers, and end users by modernizing synchronization, real-time communication, and encryption foundations. For Linux distribution maintainers and system administrators running Synapse, the dependency security patches in 1.164.1 require prompt deployment due to the remote-exploitable msgpack memory exhaustion and the compromised CA certificate chain. The MatrixRTC stack acceptance also positions Matrix as a more complete open alternative to proprietary real-time communication infrastructure, relevant to European public sector deployments highlighted in recent coverage.