Enable appservice mode for end-to-bridge encryption (MSC3202)

- Fix encryption with Synapse 1.141+ which blocks appservice users from /sync
- Set encryption.appservice=true in start.sh (all 3 occurrences)
- Bump version to 2.0.2

CHANGELOG.md

@@ -2,6 +2,35 @@
 
 All notable changes to this Cloudron package will be documented in this file.
 
+## [2.0.2] - 2026-01-16
+
+### Fixed
+- Enable appservice mode for end-to-bridge encryption (MSC3202)
+- Fixes encryption with Synapse 1.141+ which blocks appservice users from /sync
+
+## [2.0.1] - 2025-12-20
+
+### Updated
+- Updated mautrix-whatsapp to v0.2512.0 (v25.12 upstream release)
+
+### Changes in v0.2512.0
+- Pulls in upstream Docker base update to Alpine 3.23 for the container build
+- Fixes Matrix group member invites so number ghosts are correctly disinvited when redirected to the linked LID ghost
+- See https://github.com/mautrix/whatsapp/releases/tag/v0.2512.0 for the full upstream changelog
+
+## [2.0.0] - 2025-10-22
+
+### Updated
+- Updated mautrix-whatsapp to v0.2510.0 (latest release as of October 2025)
+- Major version bump due to upstream versioning scheme change (from v0.12.x to v0.2510.0)
+
+### Fixed
+- Improved registration file regex pattern from `.*` to `.+` for better user matching
+
+### Changes in v0.2510.0
+- This release includes all improvements and fixes from upstream mautrix-whatsapp v0.2510.0
+- See https://github.com/mautrix/whatsapp/releases/tag/v0.2510.0 for detailed upstream changes
+
 ## [1.2.2] - 2025-08-22
 
 ### Updated
@@ -42,4 +71,4 @@ All notable changes to this Cloudron package will be documented in this file.
 - Automatic homeserver domain detection from Cloudron environment
 - PostgreSQL connection string injection
 - Log file configuration
-- Registration file generation and management
+- Registration file generation and management

CloudronManifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.2.2",
+  "version": "2.0.2",
-  "upstreamVersion": "0.12.4",
+  "upstreamVersion": "0.2512.0",
   "id": "dev.maunium.whatsapp.cloudronapp",
   "title": "Matrix WhatsApp Bridge",
   "author": "Tulir Asokan <tulir@maunium.net>",
@@ -29,4 +29,4 @@
   "changelog": "file://CHANGELOG.md",
   "documentationUrl": "https://docs.mau.fi/bridges/go/whatsapp/index.html",
   "forumUrl": "https://matrix.to/#/#whatsapp:maunium.net"
-}
+}

Dockerfile.cloudron

@@ -27,7 +27,7 @@ RUN mkdir -p /app/code /app/pkg /app/data
 WORKDIR /app/code
 
 # Download and build mautrix-whatsapp
-RUN git clone --branch v0.12.4 https://github.com/mautrix/whatsapp.git . \
+RUN git clone --branch v0.2510.0 https://github.com/mautrix/whatsapp.git . \
     && go build -o /app/pkg/mautrix-whatsapp ./cmd/mautrix-whatsapp
 
 # Copy startup script

start.sh

@@ -81,7 +81,7 @@ if [ ! -f "$CONFIG_PATH" ]; then
             yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption allow"
             yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption default"
             yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption require"
-            yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption appservice"
+            yq -i -y '.encryption.appservice = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption appservice"
             yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption plaintext_mentions"
             yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_outbound_on_ack"
             yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption dont_store_outbound"
@@ -105,7 +105,7 @@ if [ ! -f "$CONFIG_PATH" ]; then
             echo "=> Fixing registration file regex patterns for domain: $BASE_DOMAIN"
             # Fix user regex patterns to use base domain instead of matrix subdomain
             yq -i -y '.namespaces.users[0].regex = "^@whatsappbot:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsappbot regex"
-            yq -i -y '.namespaces.users[1].regex = "^@whatsapp_.*:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsapp_.* regex"
+            yq -i -y '.namespaces.users[1].regex = "^@whatsapp_.+:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsapp_.+ regex"
             yq -i -y '.sender_localpart = "whatsappbot"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix sender_localpart"
         fi
         
@@ -179,7 +179,7 @@ else
                 yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption allow"
                 yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption default"
                 yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption require"
-                yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
+                yq -i -y '.encryption.appservice = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
                 yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption plaintext_mentions"
                 yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outbound_on_ack"
                 yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption dont_store_outbound"
@@ -209,7 +209,7 @@ else
         yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption allow"
         yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption default"
         yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption require"
-        yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
+        yq -i -y '.encryption.appservice = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
         yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption plaintext_mentions"
         yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outbound_on_ack"
         yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption dont_store_outbound"
@@ -228,7 +228,7 @@ else
             yq -i -y '.url = "https://'"$CLOUDRON_APP_DOMAIN"'"' "$REGISTRATION_PATH" 2>/dev/null || true
             # Fix user regex patterns to use base domain instead of matrix subdomain
             yq -i -y '.namespaces.users[0].regex = "^@whatsappbot:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsappbot regex"
-            yq -i -y '.namespaces.users[1].regex = "^@whatsapp_.*:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsapp_.* regex"
+            yq -i -y '.namespaces.users[1].regex = "^@whatsapp_.+:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsapp_.+ regex"
             yq -i -y '.sender_localpart = "whatsappbot"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix sender_localpart"
         fi