[Wikitech-l] Security and maintenance release: 1.35.11 / 1.38.7 / 1.39.4

I would like to announce the release of MediaWiki 1.35.11, 1.38.7 and 1.39.4! These releases also serve as a maintenance release for these branches. The tarballs have already been uploaded as of this e-mail, and the git tags have been pushed. A "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions. All three fixes apply to the unreleased 1.40, and will be included in the 1.40.0 release. They will be merged into the REL1_40 branch later today. Various patches aimed at PHP 8.0, 8.1, and 8.2 support have been back-ported. This should fix a lot of log spam, and MediaWiki should work on both released versions (PHP 8.0 and 8.1). Reports of bugs with PHP 8.0, 8.1, or 8.2 support are particularly welcome, and fixes will be back-ported when possible. Please see https://phabricator.wikimedia.org/tag/php_8.0_support/, https://phabricator.wikimedia.org/tag/php_8.1_support/ and https://phabricator.wikimedia.org/tag/php_8.2_support/ for the relevant work boards. As a reminder, 1.38 becomes of life (EOL) today, June 30 2023. 1.38.7 is expected to be the last release for this branch. It is recommended to upgrade to 1.39 (the next LTS after 1.35), which will be supported until November 2025, or the newly released 1.40, which will be supported until June 2024. == Security fixes == * (T335203, CVE-2023-29197) Upgrade guzzlehttp/psr7 to >= 1.9.1/2.4.5. * (T335612, CVE-2023-36674) Manualthumb bypasses badFile lookup. * (T332889, CVE-2023-36675) XSS in BlockLogFormatter due to unsafe message use. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T335203 * https://phabricator.wikimedia.org/T335612 * https://phabricator.wikimedia.org/T333616 == Release notes == Full release notes for 1.35.11: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.35 Full release notes for 1.38.7: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_38/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.38 Full release notes for 1.39.4: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_39/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.39 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.11.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.11.zip Patch to previous version (1.35.10): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.11.tar.gz… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.11.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.11.patch.zip.s… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.tar.gz https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.7.tar.gz https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.7.zip Patch to previous version (1.38.6): https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.patch.gz https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.7.tar.gz.… https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.7.zip.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.zip.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.7.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.tar.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.4.tar.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.4.zip Patch to previous version (1.39.3): https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.patch.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.4.zip.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.zip.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.4.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html