MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

331 discussions

MediaWiki 1.27 now available!
by Chad Horohoe 29 Jun '16

29 Jun '16

Hello everyone, I am happy to announce the availability the general release of MediaWiki 1.27! MediaWiki 1.27 includes all changes released in the smaller 1.27.0-wmf.* software deployments to Wikimedia sites over six months, totaling approximately 2800+ commits by around 165 authors. This is a large release that contains many new features and bug fixes. This will be a LTS release, supported until 2019 with security fixes. This is a summary of the major changes of interest to users and administrators: * https://www.mediawiki.org/wiki/MediaWiki_1.27 Of special note is AuthManager, which I explained in detail with second release candidate: * https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-June/000190.h… You can always consult the RELEASE-NOTES-1.27 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.27 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0.tar.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0.tar.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

Second release candidate for 1.27 (1.27.0-rc.1)
by Chad Horohoe 15 Jun '16

15 Jun '16

Hello everyone, I am happy to announce the availability of the second release candidate of the new MediaWiki 1.27 series! AuthManager has been backported!!! Since the first release candidate support for the new authentication/ authorization framework (AuthManager) was merged from master. This is a large architectural change, but users should hopefully see few changes. If you have extensions that make use of authentication or authorization hooks you will need to upgrade those as well to their REL1_27 versions or master branch (both available via Git or Extension Distributor). For a high level overview please see: * https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager If you have an extension that you maintain and will be updating: * https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager/Updati… As a result of this large change, I'm going to let the RC.1 stir around in the wild for 2 weeks before we do the final release. I know this is a delay for some, but I really think 1.27 will be a better release as a result. June 28th sounds like a fun day :) Now for the usual fun boilerplate: MediaWiki 1.27 includes all changes released in the smaller 1.27.0-wmf.* software deployments to Wikimedia sites over six months, totaling approximately 2800+ commits by around 165 authors. This is a large release that contains many new features and bug fixes. This will be a LTS release, supported until 2019 with security fixes. This is a summary of the major changes of interest to users and administrators: https://www.mediawiki.org/wiki/MediaWiki_1.27 You can always consult the RELEASE-NOTES-1.27 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.27 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.tar.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.patch.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.1.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.patch.g… https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.1.ta… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

First release candidate for 1.27 (1.27.0-rc.0)
by Chad Horohoe 01 Jun '16

01 Jun '16

Hello everyone, I am happy to announce the availability of the first release candidate of the new MediaWiki 1.27 series! MediaWiki 1.27 includes all changes released in the smaller 1.27.0-wmf.* software deployments to Wikimedia sites over six months, totaling approximately 2800+ commits by around 165 authors. This is a large release that contains many new features and bug fixes. This will be a LTS release, supported until 2019 with security fixes. This is a summary of the major changes of interest to users and administrators: https://www.mediawiki.org/wiki/MediaWiki_1.27 You can always consult the RELEASE-NOTES-1.27 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.27 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.0.tar.gz http://download.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.0.tar… GPG signatures: http://download.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.0.tar… http://download.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.0.tar.gz.s… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

Security Release: 1.26.3, 1.25.6, and 1.23.14
by Chad 20 May '16

20 May '16

I would like to announce the release of MediaWiki 1.26.3, 1.25.6 and 1.23.14. These releases fix sixteen security issues in core, one issue in the bundled extension SyntaxHighlight_GeSHi and one issue in the non-bundled extension Scribunto. Download links are given at the end of this email. == Security fixes == * T122056: Old tokens are remaining valid within a new session * T127114: Login throttle can be tricked using non-canonicalized usernames * T123653: Cross-domain policy regexp is too narrow * T123071: Incorrectly identifying http link in a's href attributes, due to m modifier in regex * T129506: MediaWiki:Gadget-popups.js isn't renderable * T125283: Users occasionally logged in as different users after SessionManager deployment * T103239: Patrol allows click catching and patrolling of any page * T122807: [tracking] Check php crypto primatives * T98313: Graphs can leak tokens, leading to CSRF * T130947: Diff generation should use PoolCounter * T133507: Careless use of $wgExternalLinkTarget is insecure * T132874: API action=move is not rate limited This fix affects both core and SyntaxHighlight_GeSHi: * T110143: strip markers can be used to get around html attribute escaping in (many?) parser tags These two fixes are not applicable to 1.23.14 as the 1.23 branch does not contain pbkdf2 support. * T116030: Increase pbkdf2 parameter strengths * T127420: Pbkdf2Password does not check if hash_pbkdf2() succeeded This fix is already in master and the 1.27 release branch, and is just being backported to 1.23 and 1.25: * T126685: Globally throttle password attempts == Links to all mentioned tasks == https://phabricator.wikimedia.org/T122056 https://phabricator.wikimedia.org/T127114 https://phabricator.wikimedia.org/T123653 https://phabricator.wikimedia.org/T123071 https://phabricator.wikimedia.org/T129506 https://phabricator.wikimedia.org/T125283 https://phabricator.wikimedia.org/T103239 https://phabricator.wikimedia.org/T122807 https://phabricator.wikimedia.org/T98313 https://phabricator.wikimedia.org/T130947 https://phabricator.wikimedia.org/T133507 https://phabricator.wikimedia.org/T132874 https://phabricator.wikimedia.org/T110143 https://phabricator.wikimedia.org/T116030 https://phabricator.wikimedia.org/T127420 https://phabricator.wikimedia.org/T126685 == Release notes == Full release notes for 1.26.3: <https://www.mediawiki.org/wiki/Release_notes/1.26> Full release notes for 1.25.6: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.23.14: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.26.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.25.6 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.14 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz… Public keys: https://www.mediawiki.org/keys/keys.html -Chad H. & Chris S.

1 0

MediaWiki Maintenance Releases: 1.26.2, 1.25.5, 1.24.6 and 1.23.13
by Chad 21 Dec '15

21 Dec '15

1 0

Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12
by Chad 18 Dec '15

18 Dec '15

I would like to announce the release of MediaWiki 1.26.1, 1.25.4, 1.24.5, and 1.23.12. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an error (T119309) SECURITY: Use hash_compare() for edit token comparison (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads (T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki == Note about EOL of 1.24.x == Please note that 1.24.5 marks the end of support for the 1.24.x series of releases. Technically this ended a few weeks ago with the release of 1.26.0 but we dropped one final release of 1.24.x here to give it a nicer send off for those who have not yet upgraded. == Release notes == Full release notes for 1.26.1: <https://www.mediawiki.org/wiki/Release_notes/1.26> Full release notes for 1.25.4: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.5: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.12: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.26.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-i18n-1.26.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.25.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.24.5 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.12 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.12.patch.… GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz… Public keys: https://www.mediawiki.org/keys/keys.html -Chad H. & Chris S.

1 0

Announcement: Security Release Tomorrow
by Chad 17 Dec '15

17 Dec '15

Hi all, Tomorrow we will be issuing a security release for all branches of MediaWiki 1.23 and beyond. The new releases will be: 1.23.12 1.24.5 1.25.4 1.26.1 Fixes will be available in the affected release branches and master. Tarballs will be uploaded for the indicated point releases as well. This release encompasses 6 fixes for core only, no bundled extensions are impacted. Have a great day, Chad H. & Chris S.

1 0

MediaWiki 1.26 Now Available
by Chad 25 Nov '15

25 Nov '15

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.26 series. MediaWiki 1.26 includes all changes released in the smaller 1.26wmf* software deployments to Wikimedia sites over six months, totaling approximately 3000+ commits by around 120 authors. This is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users and administrators: https://www.mediawiki.org/wiki/MediaWiki_1.26 You can always consult the RELEASE-NOTES-1.26 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_26/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.26 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.26/mediawiki-1.26.0.tar.gz http://download.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.0.tar.gz.s… http://download.wikimedia.org/mediawiki/1.26/mediawiki-1.26.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

End of HTTP support for InstantCommons
by Gergo Tisza 27 Oct '15

27 Oct '15

Wikimedia has recently switched to HTTPS [1]; due to some unexpected problems this caused for third-party wikis, the domains used by the InstantCommons [2] feature continued to support HTTP. That ends now; in a few day, these connections will be redirected to HTTPS. MediaWiki was updated to correctly deal with this in 1.25.2, 1.24.3, and 1.23.10 [3]; if you use InstantCommons with an older version of MediaWiki, you should upgrade. The latest version (1.25.3, 1.24.4 and 1.23.11 [4]) includes some improvements to MediaWiki's HTTPS support on platforms where cURL is not available; if you are encountering problems, make sure you use this version. If you absolutely cannot upgrade, you can find workarounds in T102566 [5]. [1] http://blog.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/ [2] https://www.mediawiki.org/wiki/InstantCommons [3] https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179… [4] https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/00018… [5] https://phabricator.wikimedia.org/T102566

1 0

Extension Security Release: OAuth, Echo, PageTriage
by Chad 17 Oct '15

17 Oct '15

Hi all, In addition to the security release for MediaWiki core earlier today, I'd like to announce security fixes available for the following 3 extensions: * Extension:PageTriage - MediaWiki user Grunny discovered a DOM-based XSS in the way the extension handled page titles. <https://phabricator.wikimedia.org/T111029> * Extension:Echo - Internal review discovered that Echo could display deleted or suppressed usernames when the username was previously used to Thank users. <https://phabricator.wikimedia.org/T110553> * Extension:OAuth - Wikipedia user Sitic discovered that the OAuth extension did not correctly enforce the IP restrictions of a Consumer when using previously negotiated credentials. <https://phabricator.wikimedia.org/T103022> * Extension:OAuth - Wikipedia user Sitic discovered that OAuth would accept a valid signature from any Consumer when checking the authorization signature. This allowed a registered Consumer who gained access to another Consumer's users access tokens and secrets to use those credentials. <https://phabricator.wikimedia.org/T103023> ********************************************************************** Extension:PageTriage ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:PageTriage ********************************************************************** Extension:Echo ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Echo ********************************************************************** Extension:OAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:OAuth None of these extensions are bundled but they are in use on Wikimedia sites hence the announcement. Fixes are in all supported branches in Git and are thus available from ExtensionDistributor. -Chad

1 0

← Newer
1
...
12
13
14
15
16
17
18
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce