There is an updated pull request by ndowens against master on the void-packages repository

https://github.com/ndowens/void-packages python-bleach
https://github.com/void-linux/void-packages/pull/26468

python3-bleach: update to 3.2.1
Fixes CVE-2020-6816

Synapse seemed to run fine with this version and also tested against another python package that uses this as a checkdepend and tests ran fine.

A patch file from https://github.com/void-linux/void-packages/pull/26468.patch is attached