Synapse PyPI/pip installs are broken when installing both saml2 and oidc features

[TommyTran732]

Description

Synapse installation with PyPI started breaking after April 18th. Installations of Synapse v1.151.0 on April 18th and before worked fine. Installations of Synapse v1.151.0 starting April 19th will start breaking and throw errors. Synapse v1.152.0 did not fix this issue.

This is likely caused by a dependency.

Steps to reproduce

• Install Synapse from Pypi with Python 3.14
• Observe the error

Homeserver

metropolis.nexus

Synapse Version

v1.151.0 after April 18th and v1.152.0

Installation Method

pip (from PyPI)

Database

PostgreSQL 18

Workers

Multiple workers

Platform

Pypi install inside of Alpine container

Configuration

N/A

Relevant log output

Starting synapse with args -m synapse.app.homeserver --config-path=/data/homeserver.yaml --config-path=/data/configs
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/usr/local/lib/python3.14/site-packages/synapse/app/homeserver.py", line 27, in <module>
    from twisted.internet.tcp import Port
  File "/usr/local/lib/python3.14/site-packages/twisted/internet/tcp.py", line 40, in <module>
    from twisted.internet._newtls import (
    ...<3 lines>...
    )
  File "/usr/local/lib/python3.14/site-packages/twisted/internet/_newtls.py", line 18, in <module>
    from twisted.protocols.tls import TLSMemoryBIOFactory
  File "/usr/local/lib/python3.14/site-packages/twisted/protocols/tls.py", line 45, in <module>
    from OpenSSL.SSL import Connection, Error, SysCallError, WantReadError, ZeroReturnError
  File "/usr/local/lib/python3.14/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/local/lib/python3.14/site-packages/OpenSSL/crypto.py", line 1570, in <module>
    class X509StoreFlags(object):
    ...<19 lines>...
        CHECK_SS_SIGNATURE = _lib.X509_V_FLAG_CHECK_SS_SIGNATURE
  File "/usr/local/lib/python3.14/site-packages/OpenSSL/crypto.py", line 1589, in X509StoreFlags
    NOTIFY_POLICY = _lib.X509_V_FLAG_NOTIFY_POLICY
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_NOTIFY_POLICY'. Did you mean: 'X509_V_FLAG_EXPLICIT_POLICY'?

Anything else that would be useful to know?

No response

[reivilibre]

Is this happening from a fresh venv?

[TommyTran732]

Yes. Reproducible if you just pull python:3.14-alpine and do a pip install.

[reivilibre]

I am failing to reproduce, please could you (or someone else hitting this) provide some minimal step by step instructions to reproduce?

Here is a suggested starting point of what I tried:

$ podman run -it --rm python:3.14-alpine /bin/sh

# In the container now
/ # pip install matrix-synapse | tail
Successfully installed MarkupSafe-3.0.3 annotated-types-0.7.0 attrs-26.1.0 automat-25.4.16 bcrypt-5.0.0 bleach-6.3.0 canonicaljson-2.0.0 certifi-2026.4.22 cffi-2.0.0 charset_normalizer-3.4.7 constantly-23.10.4 cryptography-48.0.0 hyperlink-21.0.0 idna-3.13 ijson-3.5.0 immutabledict-4.3.1 incremental-24.11.0 jinja2-3.1.6 jsonschema-4.26.0 jsonschema-specifications-2025.9.1 matrix-common-1.3.0 matrix-synapse-1.152.0 msgpack-1.1.2 multipart-1.3.1 netaddr-1.3.0 packaging-26.2 phonenumbers-9.0.29 pillow-12.2.0 prometheus-client-0.25.0 pyasn1-0.6.3 pyasn1-modules-0.4.2 pycparser-3.0 pydantic-2.13.3 pydantic-core-2.46.3 pymacaroons-0.13.0 pynacl-1.6.2 pyopenssl-26.2.0 pyparsing-3.3.2 pyrsistent-0.20.0 python-multipart-0.0.27 pyyaml-6.0.3 referencing-0.37.0 requests-2.33.1 rpds-py-0.30.0 semantic_version-2.10.0 service-identity-24.2.0 setuptools-82.0.1 setuptools-rust-1.12.1 signedjson-1.1.4 six-1.17.0 sortedcontainers-2.4.0 treq-25.5.0 twisted-25.5.0 typing-extensions-4.15.0 typing-inspection-0.4.2 unpaddedbase64-2.1.0 urllib3-2.6.3 webencodings-0.5.1 zope-interface-8.4

# Check it's broken
# AFAICT this should trigger it, but I also tried `synctl start`
/ # python3 -c 'from OpenSSL import crypto, SSL'
<works for me>

# Please get the list of installed deps for reference
/ # pip freeze
annotated-types==0.7.0
attrs==26.1.0
Automat==25.4.16
bcrypt==5.0.0
bleach==6.3.0
canonicaljson==2.0.0
certifi==2026.4.22
cffi==2.0.0
charset-normalizer==3.4.7
constantly==23.10.4
cryptography==48.0.0
hyperlink==21.0.0
idna==3.13
ijson==3.5.0
immutabledict==4.3.1
Incremental==24.11.0
Jinja2==3.1.6
jsonschema==4.26.0
jsonschema-specifications==2025.9.1
MarkupSafe==3.0.3
matrix-common==1.3.0
matrix-synapse==1.152.0
msgpack==1.1.2
multipart==1.3.1
netaddr==1.3.0
packaging==26.2
phonenumbers==9.0.29
pillow==12.2.0
prometheus_client==0.25.0
pyasn1==0.6.3
pyasn1_modules==0.4.2
pycparser==3.0
pydantic==2.13.3
pydantic_core==2.46.3
pymacaroons==0.13.0
PyNaCl==1.6.2
pyOpenSSL==26.2.0
pyparsing==3.3.2
pyrsistent==0.20.0
python-multipart==0.0.27
PyYAML==6.0.3
referencing==0.37.0
requests==2.33.1
rpds-py==0.30.0
semantic-version==2.10.0
service-identity==24.2.0
setuptools==82.0.1
setuptools-rust==1.12.1
signedjson==1.1.4
six==1.17.0
sortedcontainers==2.4.0
treq==25.5.0
Twisted==25.5.0
typing-inspection==0.4.2
typing_extensions==4.15.0
unpaddedbase64==2.1.0
urllib3==2.6.3
webencodings==0.5.1
zope.interface==8.4

And if applicable, would be good to hear your arch/platform; I'm on Linux amd64 here.

[TommyTran732]

Hi,

I think the difference between us is that I am installing matrix-synapse[all] and you are installing matrix-synapse. Could you retry with matrix-synapse[all]?

I have my container build here which I use: https://github.com/Polarix-Containers/synapse/blob/main/latest/Dockerfile. As you can see, it's not doing anything fancy beyond just a pip install.

Here are the dependencies:

annotated-types==0.7.0
attrs==26.1.0
Authlib==1.7.0
Automat==25.4.16
bcrypt==5.0.0
bleach==6.3.0
canonicaljson==2.0.0
certifi==2026.4.22
cffi==2.0.0
charset-normalizer==3.4.7
constantly==23.10.4
cryptography==47.0.0
defusedxml==0.7.1
elementpath==4.8.0
hiredis==3.3.1
hyperlink==21.0.0
idna==3.13
ijson==3.5.0
immutabledict==4.3.1
Incremental==24.11.0
jaeger-client==4.8.0
Jinja2==3.1.6
joserfc==1.6.4
jsonschema==4.26.0
jsonschema-specifications==2025.9.1
ldap3==2.9.1
lxml==6.1.0
MarkupSafe==3.0.3
matrix-common==1.3.0
matrix-synapse==1.152.0
matrix-synapse-ldap3==0.4.0
msgpack==1.1.2
multipart==1.3.1
netaddr==1.3.0
opentracing==2.4.0
packaging==26.2
phonenumbers==9.0.29
pillow==12.2.0
prometheus_client==0.25.0
psycopg2==2.9.12
pyasn1==0.6.3
pyasn1_modules==0.4.2
pycparser==3.0
pydantic==2.13.3
pydantic_core==2.46.3
pymacaroons==0.13.0
Pympler==1.1
PyNaCl==1.6.2
pyOpenSSL==22.0.0
pyparsing==3.3.2
pyrsistent==0.20.0
pysaml2==7.5.4
python-dateutil==2.9.0.post0
python-multipart==0.0.27
pytz==2026.1.post1
PyYAML==6.0.3
referencing==0.37.0
requests==2.33.1
rpds-py==0.30.0
semantic-version==2.10.0
sentry-sdk==2.58.0
service-identity==24.2.0
setuptools==82.0.1
setuptools-rust==1.12.1
signedjson==1.1.4
six==1.17.0
sortedcontainers==2.4.0
threadloop==1.0.2
thrift==0.22.0
tornado==6.5.5
treq==25.5.0
Twisted==25.5.0
txredisapi==1.4.11
typing-inspection==0.4.2
typing_extensions==4.15.0
unpaddedbase64==2.1.0
urllib3==2.6.3
webencodings==0.5.1
xmlschema==2.5.1
zope.interface==8.4

Sure enough, I am getting the error:

docker run -it --entrypoint=/bin/ash ghcr.io/polarix-containers/synapse:latest
/ $ python3 -c 'from OpenSSL import crypto, SSL'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/local/lib/python3.14/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/local/lib/python3.14/site-packages/OpenSSL/crypto.py", line 1570, in <module>
    class X509StoreFlags(object):
    ...<19 lines>...
        CHECK_SS_SIGNATURE = _lib.X509_V_FLAG_CHECK_SS_SIGNATURE
  File "/usr/local/lib/python3.14/site-packages/OpenSSL/crypto.py", line 1589, in X509StoreFlags
    NOTIFY_POLICY = _lib.X509_V_FLAG_NOTIFY_POLICY
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_NOTIFY_POLICY'. Did you mean: 'X509_V_FLAG_EXPLICIT_POLICY'?
/ $

[reivilibre]

Confirmed; with the [all] extra, an old version of pyOpenSSL is selected.

The cause appears to be the combination of the saml2 extra and the oidc extra.

Reproducible with pip install matrix-synapse[oidc,saml2] -v --dry-run, which shows pyOpenSSL 22.0.0 being selected.

I am not yet sure why they interact in this way

For now, if you don't need one of SAML2 or OIDC support, I'd suggest selecting only the extras you need to work around this problem.

Some issues that seem related:

• pyOpenSSL not v26.0.0 (CVE-2026-27459) IdentityPython/pysaml2#1023
• Update cryptography dependency to ≥46.0.6 to fix the Security Vulnerability CVE-2026-26007 IdentityPython/pysaml2#1024