LoginSign Up
← Back to all sparks
D

Dendrite

COMMS
Velocity0.0

Second-generation Matrix homeserver written in Go.

matrix.org ↗

A forked, relicensed Dendrite spent its first year catching up on Matrix protocol and security debt

matrixhomeserverforkfederationprotocol-currency
◆Current state
The window opens with the first release after forking from matrix-org/dendrite under AGPLv3, which fixed long-standing state-reset bugs and added I2P and Onion listening. What follows is a security release closing a server-side request forgery vulnerability, then a release adding room version 12 support and two MSC implementations, and finally two quick patches for unresponsiveness, v12 room joins and malformed PDUs blocking whole transactions.
◆Where it's heading
This is a fork proving it can carry a homeserver. The order is telling: license and state correctness first, then a CVE, then protocol currency with room version 12, then the operational bugs that surface once people actually run it. Several fixes carry outside contributor credits, which is the fork's clearest sign of life.
◆Prediction
Expect continued protocol catch-up on newer MSCs and room versions plus operational fixes, since federation compatibility is the constraint that sets this project's agenda.

◆Recent moves

  1. 11mo ago

    Fixes startup crash on rooms lacking a create event

    A single fix for a crash on startup when room state lacks a create event. A quick follow-up two days after the previous patch.

    View source ↗
  2. 11mo ago

    Fixes v12 room joins, invites and stalled transactions

    Repairs multi-minute unresponsiveness, several v12 room join, invite and sync failures, and a malformed PDU that could block entire transactions. The operational tail of shipping room version 12 support the week before.

    View source ↗
  3. 11mo ago

    Room version 12 support and NATS refactoring

    Adds room version 12 and two MSC implementations in a release flagged as security-relevant, with NATS JetStream error handling refactored. Protocol currency is what keeps a homeserver federating.

    View source ↗
  4. 1y ago

    Fixes SSRF in gomatrixserverlib and speeds ACL loading

    Closes a server-side request forgery vulnerability that could serve content from private networks, with network blocking support added, and speeds up server ACL loading on large instances. Upgrading is flagged as highly recommended.

    View source ↗
  5. 1y ago

    First release after the fork, relicensed under AGPLv3

    ⚡ SPARK

    The fork's opening release: AGPLv3 licensing, fixes for long-standing state reset bugs, I2P and Onion support, and MSC4156 via parameters. Everything else in this window follows from this project taking over maintenance.

    View source ↗