build(deps): bump maunium.net/go/mautrix from 0.27.0 to 0.29.0

[dependabot]

Bumps maunium.net/go/mautrix from 0.27.0 to 0.29.0.

Release notes

Sourced from maunium.net/go/mautrix's releases.

v0.29.0

• (client) Added support for OAuth login and refresh tokens.
• (bridgev2) Added WebAuthn login type.
• (bridgev2) Added hook for fetching full portal key when uncertain portal key isn't found.
• (bridgev2) Added option to force sending edit as the original sender.
• (bridgev2) Changed send message error to use latest bridge state message instead of a generic "you're not logged in" if applicable.

v0.28.1

• (pushrules) Removed deprecated NotifySpecified field in Should().
• (pushrules) Deprecated ActionDontNotify and ActionCoalesce constants.
• (client) Added wrapper for /search endpoint.
• (client) Added wrappers for the /enabled and /actions sub-endpoints for modifying push rules.
• (bridgev2/commands) Added warning when using the login command in a non-management room.
• (bridgev2/matrix) Added ParseContentURI method for parsing a mxc:// URI previously generated for direct media.
• (bridgev2/provisioning) Changed request handling to allow retrying requests.
  • Requests can be retried as long as the next step hasn't been completed.
  • Cancellation is now done with a separate API call.
• (bridgev2/provisioning) Changed group creation to ignore self in participants list instead of rejecting the request.
• (bridgev2/provisioning) Changed error responses to include internal error in a separate field.
• (bridgev2) Fixed m.bridge event in child portals not being updated when the parent portal name or avatar changes.
• (client) Fixed request retry trigger not working correctly in some cases.

v0.28.0

• Breaking change (federation) Changed NewClient to take HTTP client settings as an extra parameter.
• (federation) Changed client to block requests to private IPs by default.
  • The AllowIP method can be changed to adjust the blocking behavior.
• (federation) Added DownloadMedia method.
• (event) Added Extra field to FileInfo to allow easily adding custom fields.
• (event) Added sticker source info to events (both [MSC4459] and a custom format for bridges).
• (client) Added support for server parameter in /publicRooms (thanks to @​zluudg in #497).
• (client) Added RequestRetryTrigger event, which can be used to force all in-flight requests to be interrupted and retried (e.g. in case the network connection changed).
• (crypto) Added support for bundled device keys in Olm messages introduced in Matrix v1.15.
• (crypto/canonicaljson) Added jsonv2-based implementation, which replaces the old gjson/sjson-based implementation when jsonv2 is enabled.
• (bridgev2) Added interface for importing image packs from remote networks.
• (bridgev2) Added more detail to "not logged in" error messages.
• (bridgev2) Expanded bridge_matrix_leave option to cover invite rejections in addition to actual leaves.
• (bridgev2) Changed group creation error messages to be clearer when there aren't enough members to create a group.
• (bridgev2/matrix) Changed message sending to never send unencrypted messages if encryption.require is set true even if the room is unencrypted.
• (crypto) Changed trust resolution to not trust own cross-signing master key unless the private key is available or the public key is signed by the device key.
• (bridgev2) Fixed event power levels being set incorrectly in some cases if events_default or state_default is changed in the same event.
• (bridgev2) Fixed portal deletion always failing due to context cancellation.
• (bridgev2) Fixed per-message profile fallbacks being added for events that shouldn't have it, like stickers.
• (bridgev2) Fixed some cases where backfill would start from a non-latest message.
• (crypto) Fixed dehydrated devices not passing device key validation.
• (federation/pdu) Fixed canonicalizing JSON which contains keys with code points between \uF000 and \uFFFF by switching to the crypto/canonicaljson package instead of jsonv2's standard RFC 8785 canonicalization.
• (federation/eventauth) Fixed restricted join checks (thanks to @​timedoutuk in #491).
• (federation/eventauth) Fixed creator join check in v10 rooms (thanks to @​timedoutuk in #496).
• (crypto/goolm) Fixed various small issues.

Changelog

Sourced from maunium.net/go/mautrix's changelog.

v0.29.0 (2026-07-16)

• (client) Added support for OAuth login and refresh tokens.
• (bridgev2) Added WebAuthn login type.
• (bridgev2) Added hook for fetching full portal key when uncertain portal key isn't found.
• (bridgev2) Added option to force sending edit as the original sender.
• (bridgev2) Changed send message error to use latest bridge state message instead of a generic "you're not logged in" if applicable.

v0.28.1 (2026-06-16)

• (pushrules) Removed deprecated NotifySpecified field in Should().
• (pushrules) Deprecated ActionDontNotify and ActionCoalesce constants.
• (client) Added wrapper for /search endpoint.
• (client) Added wrappers for the /enabled and /actions sub-endpoints for modifying push rules.
• (bridgev2/commands) Added warning when using the login command in a non-management room.
• (bridgev2/matrix) Added ParseContentURI method for parsing a mxc:// URI previously generated for direct media.
• (bridgev2/provisioning) Changed request handling to allow retrying requests.
  • Requests can be retried as long as the next step hasn't been completed.
  • Cancellation is now done with a separate API call.
• (bridgev2/provisioning) Changed group creation to ignore self in participants list instead of rejecting the request.
• (bridgev2/provisioning) Changed error responses to include internal error in a separate field.
• (bridgev2) Fixed m.bridge event in child portals not being updated when the parent portal name or avatar changes.
• (client) Fixed request retry trigger not working correctly in some cases.

v0.28.0 (2026-05-16)

• Breaking change (federation) Changed NewClient to take HTTP client settings as an extra parameter.
• (federation) Changed client to block requests to private IPs by default.
  • The AllowIP method can be changed to adjust the blocking behavior.
• (federation) Added DownloadMedia method.
• (event) Added Extra field to FileInfo to allow easily adding custom fields.
• (event) Added sticker source info to events (both [MSC4459] and a custom format for bridges).
• (client) Added support for server parameter in /publicRooms (thanks to [@​zluudg] in #497).
• (client) Added RequestRetryTrigger event, which can be used to force all in-flight requests to be interrupted and retried (e.g. in case the network connection changed).
• (crypto) Added support for bundled device keys in Olm messages introduced in Matrix v1.15.

... (truncated)

Commits

• 28acf6a Bump version to v0.29.0
• 54826cf bridgev2/provisioning: fix log line
• cf620e6 oauth: trim out useless fields in server metadata
• 77f3852 client: distinguish stream parsing error
• f653177 oauth: add more buffer for refreshing tokens with long lifetimes
• 0be5a70 oauth: fix get authorization code response
• 2afa486 client: add support for oauth login
• a4d13dc event/poll: split poll structs
• 415264e bridgev2/portal: ensure portal create events aren't backgrounded
• d9c352f versions: add v1.19
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}