Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at https://spec.matrix.org/proposals.
This big news this week is the Project Hydra coordinated security release. On August 11th, 2025, updated homeserver implementations were put out to address the vulnerabilities. And the following Thursday, August 14th, the associated spec updates were put out as well (which divulge further details).
The largest part of this is the new Room Version 12, which had a spec PR merged on the same. It explains the changes servers and clients need to make to address the vulnerabilities.
The relevant MSCs and spec PRs were merged and homeserver and client implementations should have already (or should do now if they haven't) updated to support the new changes. However, the changes to the spec won't actually appear in a new spec release until the next release cycle, keeping in line with the usual spec process. The next release is due to go out in the next few weeks as we approach the end of Q3 2025.
Please join us in welcoming < polycule >, a geeky and efficient Matrix client, as the newest Ecosystem Member of the Foundation! ✨
Does your community use Matrix? Or do you maintain a community project that builds on Matrix? Join the Foundation as a member! This helps us demonstrate the breadth of the ecosystem, and all members are entitled to participate in our Governing Board elections.
On Wednesday we pre-disclosed a major security update on the horizon (codename Hydra) to improve state resets and related federation issues in Matrix. This requires a coordinated security release across all Matrix servers, so that servers running in untrusted federations (e.g. the public Matrix network) can speak the upcoming new room version (v12).
We have just pushed back the date for the coordinated security release to Aug 11th 2025, as we've heard a lot of feedback that 6 days wasn't enough for clients/bots/bridge/tooling developers to test the changes introduced by room v12, and that it also doesn't give enough time for community admins to prepare for the necessary room upgrades. Underestimating the time needed here for client/community testing is entirely our fault, due to being overfocused on coordinating the significant serverside work needed. Pushing back the release date by 3 weeks gives everyone more time to test and prepare. We've also opened up registration on the beta.matrix.org homeserver, which is already running v12 rooms by default, to make it easier for client developers to test their clients. We've also made one clarification below for client developers, explaining the new permissions needed to send m.room.tombstone events.
Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at https://spec.matrix.org/proposals.
🔗MSC highlight: Room IDs as hashes of the create event
You may have noticed some placeholder MSCs being opened in the past half a year. One of them has now received content ahead of the others:
MSC4291 redefines room IDs to be the hash of the m.room.create event. As a part of the change, the server name component is being removed. If any software you maintain assumes that the server name is present in room IDs, you should stop parsing room IDs or at least fail gracefully if the server name isn't there.
We're going to propose FCP on MSC4291 in the next few days and a new stable room version including that and other security-sensitive changes from the placeholder MSCs is expected to follow relatively soon as well.
This week we're thrilled to welcome Rocket.Chat as the newest Silver Member of the Foundation! We're grateful to say they are also sponsoring The Matrix Conference this year.
Matrix 1.15 is the latest release of the spec, bringing next-gen auth via OIDC, rich room topics, and room summaries to the ecosystem. All of these features have existed for quite a while in practice, but took a while to get through the final design and proposal stages. We're glad they're here though, and improving Matrix for everyone along the way.
Typically when a user is banned for 'spam', a bot or human operator will go forth and redact pretty much everything that user has ever sent in the room, so why not make that happen automatically? MSC4293: Redact on ban does just that, and was put up for proposed final comment period (FCP) this week. At this stage in the process the Spec Core Team (SCT) will be giving it more thorough review with an aim of including it in a future version of the spec - if you haven't already reviewed it, now would be a great time 🙂
Voting for the Governing Board elections begins this weekend! 🎉 Watch your email inbox if you're an Individual Member, or the point of contact for a Silver, Gold, or Associate Member, as that's where your ballot will be sent. Visit our election center for more information.
I have decided that I will not stand for re-election in the upcoming Governing Board elections, however I have made a few endorsements for candidates. See my endorsement blog post.
If you are interested in lending a hand, volunteer to help us organize the conference, or join the Events WG!
We're grateful to Element for committing to being our Anchor Sponsor for the Matrix Conference 2025. To make this an excellent event, we are looking for further sponsors! Many opportunities are still available, including booths to present your product, live stream and video recording for worldwide recognition, food, and more! Your ideas are possible; contact us at conference@foundation.matrix.org!
We are excited to announce that The Matrix Conference will happen in Strasbourg from October 15 to 18!
Following last year's success, we bumped our capacity to accept more than 300 attendees this year.
The nomination period for this years's governing board electionsends tonight (UTC)! If you're an Individual, Silver, Gold, or Associate member, submit your nomination here!
Tomorrow (UTC), the 2 week campaigning period begins officially, but you are already allowed to campaign, for example in the official Governing Board campaigning rooms.
It's time for our annual Governing Board elections!
This year we're electing representatives from Individual Members, Associate Members, Gold Members, and Silver Members.
Nominations open at midnight UTC as we move from Friday to Saturday, May 3rd.
Learn more in our election announcement blog post.
Please join me in welcoming Filament and infra.run as the newest Silver Members of the Foundation!
The financial support we receive from members like them helps us steward the Matrix protocol as an unfragmented standard, facilitate open governance, and advance the state of Trust & Safety for the benefit of the entire ecosystem.
We're grateful for the outpouring of support from across the ecosystem. We still need a few larger organisations to step up. Do you rely on Matrix? Join us as a funding member.
We are delighted announce that LiveKit is the newest Silver Member of the Foundation!
The LiveKit Project is an open source project that does everything Matrix needs for native group calls, and the company behind the project is donating their LiveKit Cloud services to help us provide that functionality to users on the Matrix.org homeserver.
We're grateful for their support and look forward to announcing 2-3 more new Silver Members in the coming weeks 🚀
Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at https://spec.matrix.org/proposals.
The update above is actually from the last 21 days to make up for the lack of spec updates recently (I've been travelling!).
In my opinion, the most interesting part to talk about above is MSC4284: Policy Servers. If you haven't already, read the matrix.org blog post on Introducing Policy Servers. In short, they're servers on the internet where you can send events to and have them be checked for spam/illegal imagery/etc. before allowing the event to be sent down to your users. You can think of them like a SpamChecker Synapse module, but homeserver implementation agnostic.
This is a pretty interesting idea, and one can host their own policy server to keep the network decentralised. If you're interested in weighing in on the topic, please do so on the MSC!
Note: the idea of a "policy server" is not new. This MSC attempts to bring the concept in to the Matrix ecosystem specifically for Trust & Safety purposes. But the APIs could be used to enforce any policy (security, enterprise use cases, etc.).
