MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

MediaWiki 1.35.0-rc.1 is ready for testing
by Sam Reed 07 Aug '20

07 Aug '20

I'm pleased to announce the immediate availability of MediaWiki 1.35.0-rc.1, the second release candidate for 1.35.x, the next LTS version to replace 1.31 which is due to go end of life in June 2021. Download links at the end of the e-mail. The tag has been signed and pushed to Git. Please note that the PHP version requirement has been raised from 7.2.9 in MediaWiki 1.34 (and 7.0 in MediaWiki 1.31), to 7.2.22 (this may change further, see below). This is not a final release and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As always please do try out the release candidate in a test environment and report any issues that you discover. Please use the #MW-1.35-Release [2] tag in Phabricator when reporting issues specific to this release. It is expected that MediaWiki 1.35 will become final in late August 2020, and will be supported for 3 years after that. Known/outstanding issues/things to test: * It has been proposed to require PHP 7.3 for MediaWiki 1.35, please discuss at <https://phabricator.wikimedia.org/T257879>. * Both the Vector skin and the underlying skin infrastructure are undergoing numerous changes, so there might be things broken that are already fixed in master and as such need backporting. * VisualEditor and Parsoid are now bundled in the tarball and no longer need a separate nodejs service. The documentation for this still needs to be updated, and in some cases, users are reporting HTTP 500 errors from RestBase <https://phabricator.wikimedia.org/T259693>. * Watchlist expiry (behind the $wgWatchlistExpiry flag) is currently experimental. It should be finished for the 1.35.0 final release. * If you're on Windows and use 7zip, you may experience issues extracting the tarball. This was noted in the last set of security releases. Try using a different decompression tool <https://phabricator.wikimedia.org/T257102>. Changes since 1.35.0-rc.0: * (T252136) Fix RecentChanges watchlist filters when WatchlistExpiry is off. * (T258662) Update time period for watchlist expiry pop-up. * (T258443) Fix expiry dropdown not getting disabled on edit page. * (T259398) Add license information for promise-polyfill. * Remove executable bit from scripts without shebang. * (T256526) Fix bold of watched items on Special:RecentChangesLinked. * (T259060) Edit page expiry dropdown should keep state after disabling/enabling. * (T259009) Translate expiry period in pop-up message for watchlist expiry. * (T258310) Add watchlist clock icon to RecentChanges. * (T259362) Permit temporary table writes on replica DB connections. * (T250214) Add UI support in Special:EditWatchlist for watchlist expiry. * (T72470) Disable wgLegacyJavaScriptGlobals by default. * (T130906) Add Edge to MediaWiki:Clearyourcache. * (T257279) Add mediawiki.ui Less variable deprecation note. * (T249521) Fixed reassignEdits.php to work with anonymous users. * (T259448) Fix Circular dependency when creating service in DBLoadBalancerFactory. * (T257259) Default to using watchlist expiry of old page when moving pages. Preliminary release notes: https://phabricator.wikimedia.org/source/mediawiki/browse/REL1_35/RELEASE-N… https://www.mediawiki.org/wiki/Release_notes/1.35 Open Bugs: [1] https://phabricator.wikimedia.org/project/board/4035/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.35-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.0-rc.1.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.0-rc.1.ta… Patch to previous version (1.35.0-rc.0): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.0-rc.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.0-rc.1.ta… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.0-rc.1.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html

1 0

MediaWiki 1.35.0-rc.0 is ready for testing
by Sam Reed 31 Jul '20

31 Jul '20

I'm pleased to announce the immediate availability of MediaWiki 1.35.0-rc.0, the first release candidate for 1.35.x, the next LTS version to replace 1.31 which is due to go end of life in June 2021. Download links at the end of the e-mail. The tag has been signed and pushed to Git. Please note that the PHP version requirement has been raised from 7.2.9 in MediaWiki 1.34 (and 7.0 in MediaWiki 1.31), to 7.2.22 (this may change further, see below). This is not a final release and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As always please do try out the release candidate in a test environment and report any issues that you discover. Please use the #MW-1.35-Release [2] tag in Phabricator when reporting issues specific to this release. It is expected that MediaWiki 1.35 will become final in late August 2020, and will be supported for 3 years after that. Known/outstanding issues/things to test: * It has been proposed to require PHP 7.3 for MediaWiki 1.35, please discuss at <https://phabricator.wikimedia.org/T257879>. * Both the Vector skin and the underlying skin infrastructure are undergoing numerous changes, so there might be things broken that are already fixed in master and as such need backporting. * VisualEditor and Parsoid are now bundled in the tarball and no longer need a separate nodejs service. * Watchlist expiry (behind the $wgWatchlistExpiry flag) is currently experimental. It should be finished for the 1.35.0 final release. * If you're on Windows and use 7zip, you may experience issues extracting the tarball. This was noted in the last set of security releases. Try using a different decompression tool <https://phabricator.wikimedia.org/T257102>. Preliminary release notes: https://phabricator.wikimedia.org/source/mediawiki/browse/REL1_35/RELEASE-N… https://www.mediawiki.org/wiki/Release_notes/1.35 Open Bugs: [1] https://phabricator.wikimedia.org/project/board/4035/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.35-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.0-rc.0.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.0-rc.0.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.0-rc.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.31.8/1.33.4/1.34.2)
by Scott Bassett 25 Jun '20

25 Jun '20

Greetings- With the security/maintenance release of MediaWiki 1.31.8/1.33.4/1.34.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == CentralAuth == + (T250594, CVE-2020-12051) - globaluserinfo api allows access to information about hidden users < https://gerrit.wikimedia.org/r/#/q/I3c80641dc1202df7428714f0ca44717a51ff6021 > The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-June/000252.h… [1] https://phabricator.wikimedia.org/T248542 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

1 0

MediaWiki 1.33 is End of Life
by Sam Reed 24 Jun '20

24 Jun '20

As per the MediaWiki version lifecycle [1], I would like to announce the formal end of life (EOL) of MediaWiki 1.33 as of next week, Tuesday June 30, 2020. This means that MediaWiki 1.33 will no longer receive maintenance or security backports (barring an unforseen issues with the 1.33.4 release today). It is therefore strongly discouraged that you continue to use it. It is recommended to upgrade to MediaWiki 1.34 (due to become EOL in November 2020). The current Long Term Support (LTS) version of MediaWiki, MediaWiki 1.31, is however older (and downgrading is not supported. The delayed next LTS (MediaWiki 1.35) is currently due to be released in early August 2020, and will be supported until at least June 2023. MediaWiki 1.34 bumps the required PHP version from 7.0 in 1.33 (which is unsupported upstream), to PHP 7.2.9 or later. Thanks! Sam Reed [1] https://www.mediawiki.org/wiki/Version_lifecycle

1 0

Security and maintenance release: 1.31.8 / 1.33.4 / 1.34.2
by Sam Reed 24 Jun '20

24 Jun '20

I would like to announce the release of MediaWiki 1.34.2, 1.33.4 and 1.31.8! These releases also serve as a maintenance release for these branches. We've noted that this is minor, and as such you don't need to apply them as quickly as with other security releases, if you're unable to do so, or if you're not running a private wiki. We therefore decided to continue with getting the security (and maintenance) release out for this quarter as planned, even with the global situation as is. While tarballs have already been uploaded, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" email will follow this one. As mentioned in the pre-release announcement, this will be the final release of the MediaWiki 1.33 branch, barring any unforeseen issues. If you are currently running 1.33, you are advised to upgrade to a newer, supported version of MediaWiki, which as of writing is MediaWiki 1.34 (as 1.35 has not been released yet). MediaWiki 1.34 will be supported until November 2020. A separate notification of this will be sent out too. == Security fixes == * (T248947) img_auth.php may leak private extension images into the public cache. CVE-2020-15005 == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T248947 == Release notes == Full release notes for 1.31.8: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.31 Full release notes for 1.33.4: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_33/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.33 Full release notes for 1.34.2: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_34/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.34 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.8.tar.gz Patch to previous version (1.31.7): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.8.tar.gz.… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.33/mediawiki-1.33.4.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.33/mediawiki-core-1.33.4.tar.gz Patch to previous version (1.33.3): https://releases.wikimedia.org/mediawiki/1.33/mediawiki-1.33.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.33/mediawiki-core-1.33.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.33/mediawiki-1.33.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.33/mediawiki-1.33.4.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.2.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.2.tar.gz Patch to previous version (1.34.1): https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.2.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.2.tar.gz.… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.2.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.2.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

Security pre-release announcement: 1.31.8 / 1.33.4 / 1.34.2
by Sam Reed 23 Jun '20

23 Jun '20

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.34.2 - 1.33.4 - 1.31.8 This will resolve one minor issue in MediaWiki core, and also includes some fixes previously committed to git, including minor security and hardening patches along with bug fixes included for maintenance reasons. We've noted that these issues are minor, and as such you don't need to apply them as quickly as with other security releases, if you're unable to do so. We therefore decided to continue with getting the security (and maintenance) release out for this quarter as planned, even with the global situation as is. We will make the fixes available in these respective release branches, and also master. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow. As per the MediaWiki Version lifecycle [1], June 2020 is the scheduled EOL date for the REL1_33. 1.33.4 will therefore be the final release of the MediaWiki 1.33 branch, barring any unforeseen issues. [1] https://www.mediawiki.org/wiki/Version_lifecycle Thanks! Sam

1 0

MediaWiki 1.35 Branch Cut and Release
by Cindy Cicalese 02 Jun '20

02 Jun '20

On March 30, we announced that we were temporarily pushing back the release of MediaWiki 1.35 due to uncertainty resulting from the COVID-19 pandemic. We are now ready to begin the process of moving forward with the release. The first step is cutting the release branch, REL1_35, which will occur on Monday, July 13. We will then be in "pencils down" mode: developers will stop targeting MediaWiki 1.35 for new features. Instead, any new features would continue to be applied to master and would target MediaWiki 1.36 or later. The only work that would continue towards MediaWIki 1.35 would be blockers - critical bug fixes or features close to completion that need to make it into the release. This would happen by merging those patches into master and then backporting them to the REL1_35 branch. We anticipate that MediaWiki 1.35 will be released at the beginning of August. We appreciate your patience in these difficult times. Wishing you safety and health, Cindy

1 0

Delay in MediaWIki 1.35 Release and Branch Cut
by Cindy Cicalese 30 Mar '20

30 Mar '20

Due to the uncertainty resulting from the COVID-19 pandemic, we have decided to temporarily push back the release of MediaWiki 1.35. Especially since MediaWiki 1.35 is a long term support (LTS) release, we want to take the time to give the release appropriate resources and attention. We will not be cutting the REL1_35 branch on April 7 as we had previously announced. We will be making another announcement no later than Friday, May 29 giving an update on when we will be cutting the REL1_35 branch and moving towards the release of MediaWiki 1.35. We appreciate your patience in these difficult times. Wishing you health, Cindy ______________________________ Cindy Cicalese Product Manager, MediaWiki Platform Wikimedia Foundation

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.31.7/1.33.3/1.34.1)
by Scott Bassett 26 Mar '20

26 Mar '20

Greetings- With the security/maintenance release of MediaWiki 1.31.7/1.33.3/1.34.1 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == MobileFrontend == + (T240502, No CVE) - List known raw html messages <https://gerrit.wikimedia.org/r/q/I301aee4093fe2b0e8f6dfe5422226bb80af1de2> == WikibaseMediaInfo == + (T240773, CVE-2020-6163) - Escape labels in HTML output <https://gerrit.wikimedia.org/r/q/If47903f11645e52d56a875be4c03de47400cef0> == Widgets == + (T245850, CVE-2020-9382) - Title::newFromText() is not safe for user input <https://gerrit.wikimedia.org/r/q/I953e060bc6994ffdba9f380c98173f53f8ca1ea8> == GlobalBlocking == + (T229731, CVE-2020-10534) - Apply most specific global block <https://gerrit.wikimedia.org/r/q/I9cc5fb2c08c78bbd797a5fc6d89f4577c8cc118> The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.html [1] https://phabricator.wikimedia.org/T240400 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

1 0

Security and maintenance release: 1.31.7 / 1.33.3 / 1.34.1
by Sam Reed 26 Mar '20

26 Mar '20

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce