I would like to announce the release of MediaWiki 1.43.10, 1.45.5 and 1.46.1!

These releases serve as security and maintenance releases for these branches.

The tarballs have already been uploaded as of this email, and the git tags will be pushed shortly.

A "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions.

Reports of bugs with PHP 8.1 to 8.6 support are particularly welcome, and fixes will be back-ported when possible. If you find issues that haven't been backported, please report these too, referring to the relevant supported release.

PHP 8.x workboards: * https://phabricator.wikimedia.org/tag/php_8.1_support/ * https://phabricator.wikimedia.org/tag/php_8.2_support/ * https://phabricator.wikimedia.org/tag/php_8.3_support/ * https://phabricator.wikimedia.org/tag/php_8.4_support/ * https://phabricator.wikimedia.org/tag/php_8.5_support/ * https://phabricator.wikimedia.org/tag/php_8.6_support/

As a reminder, MediaWiki 1.39 became EOL in December 2025, MediaWiki 1.42 became EOL in June 2025 and MediaWiki 1.44 became EOL at the end of July 2026.

== Security fixes ==

* (T432551, CVE-2026-102966) SECURITY: Fix deleted edit summary leak in page history feeds. * (T431819, CVE-2026-102967) SECURITY: SpecialUpload: Prevent Open Redirect using wpDestUrl. * (T431819, CVE-2026-102968) SECURITY: NoLocalSettings: Fixes a potential path traversal. * (T434189, CVE-2026-102969) SECURITY: Check the authority of selser data when html is supplied. * (T434278, CVE-2026-102970) SECURITY: APIComparePages should preserve revision visibility. * (T434521, CVE-2026-102971) SECURITY: PageContentHelper: Respect visibility of user_id in output. * (T120386, CVE-2026-102972) SECURITY: Disallow raw action for Special:MyPage. * (T435022, CVE-2026-102973) SECURITY: ApiEmailUser: Check authorizeSend() instead of canSend() before sending an email. * (T435026, CVE-2026-102975) SECURITY: ApiRevisionDelete: Check permissions when unsuppressing. * (T435457, CVE-2026-102974) SECURITY: Run ImageRedirectConstraint with post-PST content. * (T434372, CVE-2026-102977) SECURITY: Conceal inaccessible hit counts when sorting filters on Special:AbuseFilter.

== Links to all mentioned tasks ==

* https://phabricator.wikimedia.org/T120386 * https://phabricator.wikimedia.org/T431819 * https://phabricator.wikimedia.org/T431819 * https://phabricator.wikimedia.org/T432551 * https://phabricator.wikimedia.org/T434189 * https://phabricator.wikimedia.org/T434278 * https://phabricator.wikimedia.org/T434372 * https://phabricator.wikimedia.org/T434521 * https://phabricator.wikimedia.org/T435022 * https://phabricator.wikimedia.org/T435026 * https://phabricator.wikimedia.org/T435457

== Release notes ==

Full release notes for 1.43.10: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_43/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.43

Full release notes for 1.45.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_45/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.45

Full release notes for 1.46.1: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_46/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.46

For information about how to upgrade, see https://www.mediawiki.org/wiki/Manual:Upgrading

********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.tar.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.zip

Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.tar.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.zip

Patch to previous version (1.43.9): https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.zip

GPG signatures: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.tar.gz.... https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.zip.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.zip.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.zip.si...

Public keys: https://www.mediawiki.org/keys/keys.html

********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.tar.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.zip

Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.tar.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.zip

Patch to previous version (1.45.4): https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.zip

GPG signatures: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.zip.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.zip.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.zip.sig

Public keys: https://www.mediawiki.org/keys/keys.html

********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.tar.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.zip

Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.tar.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.zip

Patch to previous version (1.46.0): https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.zip

GPG signatures: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.zip.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.zip.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.zip.sig

Public keys: https://www.mediawiki.org/keys/keys.html