Upgrading or creating rooms in a space uses v9 instead of Synapse's default (v10)

[progval]

Steps to reproduce

1. Go to app.element.io
2. Login with a matrix.org account
3. Navigate to a private space
4. Create a room

Outcome

What did you expect?

It should create a v10 room, which is the default for Synapse: https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#default_room_version

What happened instead?

It creates a v9 room

Here is an example request sent by Eleweb:

{"name":"test2","preset":"private_chat","visibility":"private","initial_state":[{"type":"m.room.guest_access","state_key":"","content":{"guest_access":"can_join"}},{"type":"m.room.encryption","state_key":"","content":{"algorithm":"m.megolm.v1.aes-sha2"}},{"type":"m.space.parent","content":{"via":["matrix.org"],"canonical":true},"state_key":"!GkxzCXcFwWPrGYDCLQ:matrix.org"},{"type":"m.room.join_rules","content":{"join_rule":"restricted","allow":[{"type":"m.room_membership","room_id":"!GkxzCXcFwWPrGYDCLQ:matrix.org"}]}},{"type":"m.room.history_visibility","content":{"history_visibility":"invited"}}],"room_version":"9"} 

I was told by the security team this version number comes from https://github.com/matrix-org/matrix-react-sdk/blob/2a3fd93afaf7b1f11c3e831541d7252a09985af0/src/utils/PreferredRoomVersions.ts#L25-L39

Operating system

No response

Browser information

No response

URL for webapp

app.element.io

Application version

No response

Homeserver

matrix.org

Will you send logs?

No

[t3chguy]

We previously used matrix-org/matrix-spec-proposals#3244 to have the server tell us its preferred version for the feature needed (knocking in this case) but that MSC died. So now clients must hardcode a version they think has wide enough support for a given version, often and in this case, this will be the very first version to support the given feature.

It should create a v10 room, which is the default for Synapse: matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#default_room_version

There's no way for a client to know what a server's default room version is NOR what that version is capable of (e.g. can it handle knocking) - room versions are not ordered as per the spec

There is no implicit ordering or hierarchy to room versions, and their principles are immutable once placed in the specification.