Correction:

MediaWiki 1.46 is due to be supported until the end of *July 2027*.

On Tue, Jun 30, 2026 at 6:14 PM Mateus Santos msantos@wikimedia.org wrote:

I am happy to announce the availability of the general release of MediaWiki 1.46!

Tarballs have already been uploaded, and the git tag has been pushed.

Thanks to everyone who helped out with this release, especially thanks to those who tested out the release candidate and provided feedback, as well as the developers who worked on fixes for the 1.46 final release. To see what's changed in 1.46, see the release notes file.[0] If you encounter any issues, please file a task.[1] You can see open tasks for the branch on Phabricator.[2]

MediaWiki 1.46 is due to be supported until the end of July 2026.

It's important to note that 1.46.0 is shipped with the changes released on the current security and maintenance release.

=== Changes since MediaWiki 1.46.0-rc.0 ===

• (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry

parameters [CVE-2026-58025]

• (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format

is no longer raw HTML [CVE-2026-58037]

• (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in

more places [CVE-2026-58029]

• (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in

ApiUserrights [CVE-2026-58024]

• (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's

being transcluded is includable [CVE-2026-58026]

• (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat

formatversion=1 as text [CVE-2026-58032]

• (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from

distinct authors query [CVE-2026-58033]

• (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print

api.php responses [CVE-2026-58028]

• (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of

private user conditions for user [CVE-2026-58036]

• (T428809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html

instead of using v-html

• (T423617) Check the target url for redirects are allowed
• (T383047) Mail: Log PHP mail() send failures with recipient count
• (T429720) FileRepo: Fix typos in schema compatibility checks
• (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send()
• (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3
• (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1
• (T428406) LocalFileMoveBatch: Also update fr_archive_name when moving

file

• (T424462) tests: Limit ResourcesTest::testRespond to general-purpose

skins

• (T424462) tests: loop modules inside ResourcesTest::testRespond
• (T428289) Email confirmation banner: Remove Test Kitchen A/B test

scaffolding

• (T421366) Email confirmation banner: Remove obsolete arm_b variant
• (T427622) Store indicators in ContentHolder: forward compatibility
• changePassword: Add reason option for password change
• (T425818) changePassword: Log password change to authentication log

Release notes: [0] https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/R...

Bug report form: [1] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.46-R...

Open Bugs: [2] https://phabricator.wikimedia.org/tag/mw-1.46-release/

---

Download: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip

Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip

Patch to previous version (1.46.0-rc.0): https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip

GPG signatures for the above:

https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.sig

https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip.sig

Public keys: https://www.mediawiki.org/keys/keys.html