IMPORTANT: We're pre-disclosing two high severity CVEs in Matrix's federation protocol, which will require a coordinated upgrade on July 22nd of all servers running in untrusted federations. Client developers may need to make minor changes too. Please see https://matrix.org/blog/2025/07/security-predisclosure/