MediaWiki-announce October 2019

mediawiki-announce@lists.wikimedia.org

2 participants
4 discussions

MediaWiki 1.34.0-rc.0 is ready for testing

by Sam Reed

I'm pleased to announce the immediate availability of MediaWiki 1.34.0-rc.0, the first release candidate for 1.34.x. Download links at the end of the e-mail. The tag has been signed and pushed to Git. Please note that MediaWiki 1.34 no longer supports HHVM, and also the PHP version requirement has been raised from 7.0.13 in MediaWiki 1.33, to 7.2.9. This is not a final release and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As always please do try out the release candidate in a test environment and report any issues that you discover. Please use the #MW-1.34-Release [2] tag in Phabricator when reporting issues specific to this release. It is expected that MediaWiki 1.34 will become final in the second half of November 2019. Preliminary release notes: https://phabricator.wikimedia.org/source/mediawiki/browse/REL1_34/RELEASE-N… https://www.mediawiki.org/wiki/Release_notes/1.34 MediaWiki core with bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz Core only, no extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html Open Bugs: [1] https://phabricator.wikimedia.org/project/board/3386/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.34-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html

4 years, 6 months

Maintenance release: 1.31.5 and 1.32.5

by Sam Reed

Hi all, I would like to announce the release of MediaWiki 1.32.5 and 1.31.5. These releases primarily fix an issue in the backported security patch for T230402. This wasn't compatible with 1.32 and 1.31 as is, so modifications were required. It was fine for 1.33, hence no followup release for 1.33. Some other minor fixes are also included. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T230402 == Release notes == Full release notes for 1.31.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.31 Full release notes for 1.32.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_32/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.32 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.32/mediawiki-core-1.32.5.tar.gz Patch to previous version (1.32.4): https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.32/mediawiki-core-1.32.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.5.tar.gz Patch to previous version (1.31.4): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

4 years, 6 months

MediaWiki Extensions Security Release Supplement

by Scott Bassett

Greetings- With the security/maintenance release of MediaWiki 1.31.4 / 1.32.4 / 1.33.1 [0], we would also like to provide this supplementary announcement of wmf-deployed extensions [1] with now-public security patches and backports [2]: == MobileFrontend == * (T229541, CVE-2019-14807) - Javascript injection in edit summary on mobile site. <https://gerrit.wikimedia.org/r/q/I0cb918f8148d1782882e104d127f08cbfa23e542> * (T230576, CVE-2019-15124) - XSS in edit summary for ex:MobileFrontend Special:Watchlist <https://gerrit.wikimedia.org/r/q/If4e91093c676de3391e6dde415c8c91c1f582998> == CheckUser == * (T207094 [task to remain private], CVE-2019-16529) - Oversighted edit summaries still visible in CheckUser results <https://gerrit.wikimedia.org/r/q/I3d28bd9f14c1237a34afcd2e4479152f571e29a6> == AbuseFilter == * (T224203 [task to remain private], CVE-2019-16528) - Oversighting the user who performed an edit doesn't hide it from the abuse filter log <https://gerrit.wikimedia.org/r/q/If3d3256404d0f3dbde171831937d1a816b3e2734> The Wikimedia Security Team recommends updating these extensions to the current master branch or supported release branches [3] as soon as possible. As you may have noticed, some of the referenced Phabricator tasks above are still private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator. [0] https://lists.wikimedia.org/pipermail/wikitech-l/2019-October/092656.html [1] https://w.wiki/9hi [2] https://phabricator.wikimedia.org/T232113 [3] https://www.mediawiki.org/wiki/Version_lifecycle -- Scott Bassett sbassett(a)wikimedia.org

4 years, 6 months

Security and maintenance release: 1.31.4 / 1.32.4 / 1.33.1

by Sam Reed

4 years, 6 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce October 2019