July 2025 - MediaWiki-Debian - lists.wikimedia.org

Bug#1109578: ITP: mediawiki-extension-openidconnect -- MediaWiki extension for authentication using OpenID Connect
by Taavi Väänänen 20 Jul '25

20 Jul '25

Package: wnpp Severity: wishlist Owner: Taavi Väänänen <taavi(a)debian.org> X-Debbugs-Cc: debian-devel(a)lists.debian.org, mediawiki-debian(a)lists.wikimedia.org * Package name : mediawiki-extension-openidconnect Version : 8.3.0 Upstream Contact: Cindy Cicalese <cindom(a)gmail.com> * URL : https://www.mediawiki.org/wiki/Extension:OpenID_Connect * License : Expat Programming Lang: PHP Description : MediaWiki extension for authentication using OpenID Connect The OpenID Connect MediaWiki extension extends the PluggableAuth extension to provide authentication using OpenID Connect. This will be packaged within the MediaWiki packaging team.

1 0

Bug#1109528: ITP: mediawiki-extension-pluggableauth -- Framework for creating MediaWiki authentication and authorization extensions
by Taavi Väänänen 19 Jul '25

19 Jul '25

Package: wnpp Severity: wishlist Owner: Taavi Väänänen <taavi(a)debian.org> X-Debbugs-Cc: debian-devel(a)lists.debian.org, mediawiki-debian(a)lists.wikimedia.org * Package name : mediawiki-extension-pluggableauth Version : 7.5.0 Upstream Contact: Cindy Cicalese <cindom(a)gmail.com> * URL : https://www.mediawiki.org/wiki/Extension:PluggableAuth * License : Expat Programming Lang: PHP Description : Framework for creating MediaWiki authentication and authorization extensions PluggableAuth extension provides a framework for creating authentication and authorization extensions in MediaWiki. This will be packaged within the MediaWiki packaging team.

1 0

mediawiki 1:1.43.3+dfsg-1 MIGRATED to testing
by Debian testing watch 13 Jul '25

13 Jul '25

FYI: The status of the mediawiki source package in Debian's testing distribution has changed. Previous version: 1:1.43.1+dfsg-2 Current version: 1:1.43.3+dfsg-1 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information.

1 0

Bug#1108865: unblock: mediawiki/1:1.43.3+dfsg-1
by Salvatore Bonaccorso 06 Jul '25

06 Jul '25

Package: release.debian.org Severity: normal X-Debbugs-Cc: mediawiki(a)packages.debian.org, team(a)security.debian.org, Taavi Väänänen <taavi(a)debian.org>, carnil(a)debian.org Control: affects -1 + src:mediawiki User: release.debian.org(a)packages.debian.org Usertags: unblock Hi Release team, hi Taavi, mediawiki was affected by some CVEs, namely: * New upstream version 1.43.3, fixing CVE-2025-6926, CVE-2025-6927, CVE-2025-6589, CVE-2025-6590, CVE-2025-6591, CVE-2025-6592, CVE-2025-6593, CVE-2025-6594, CVE-2025-6595, CVE-2025-6596, CVE-2025-6597. corresponding DSA was released some days ago: https://lists.debian.org/debian-security-announce/2025/msg00121.html Can you consider lowering the migration time for mediawiki itself? (Otherwise it should be fine, it has autopkgtsts, is not a key package and should go in as well at given time). Regards, Salvatore

1 0

Bug#1108851: unblock: mediawiki/1:1.43.3+dfsg-1
by Taavi Väänänen 06 Jul '25

06 Jul '25

Package: release.debian.org Severity: normal X-Debbugs-Cc: mediawiki(a)packages.debian.org Control: affects -1 + src:mediawiki User: release.debian.org(a)packages.debian.org Usertags: unblock Please unblock package mediawiki [ Reason ] The new release in unstable includes: * The latest upstream point release, which includes security fixes and various other bug fixes. The MediaWiki packaging will follow upstream point releases in trixie-security like we have done in previous stable releases. * A fix in the Debian-specific configuration fixing how the "Powered by Debian" icon is displayed in modern skins. * A fix for outdated information in the package description. [ Impact ] The current version in Trixie contains various security issues. In addition this release has various fixes specifically targeting MediaWiki's support for the PHP version Trixie will ship with. [ Tests ] Both the upstream test suite and our autopkgtests are passings. I have also done a small amount of manual testing and am watching the upstream bug tracker for any regressions. [ Risks ] The debdiff is relatively large, although most of it is upstream's translation updates. I've also attached a separate diff file without the i18n updates to make the changes easier to review. [ Checklist ] [x] all changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in testing [ Other info ] thanks, Taavi unblock mediawiki/1:1.43.3+dfsg-1

1 0

mediawiki_1.39.13-1~deb12u1_source.changes ACCEPTED into proposed-updates
by Debian FTP Masters 05 Jul '25

05 Jul '25

Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 01 Jul 2025 19:31:26 +0300 Source: mediawiki Architecture: source Version: 1:1.39.13-1~deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: MediaWiki packaging team <mediawiki-debian(a)lists.wikimedia.org> Changed-By: Taavi Väänänen <taavi(a)debian.org> Changes: mediawiki (1:1.39.13-1~deb12u1) bookworm-security; urgency=medium . * New upstream version 1.39.13, fixing CVE-2025-6590, CVE-2025-6591, CVE-2025-6593, CVE-2025-6594, CVE-2025-6597, CVE-2025-32072. Checksums-Sha1: b32f48b49a60c56e1427bdaecb9aab87bafba3db 2569 mediawiki_1.39.13-1~deb12u1.dsc 76121202fe77d99bfeb0d8ba1c345f71d11a76b6 59844264 mediawiki_1.39.13.orig.tar.gz 31c2f75a1e70bb9556b539df4460dc9c34b945f4 195 mediawiki_1.39.13.orig.tar.gz.asc d5dbda8a7b924c147da42f04fb6018e25341aff1 103140 mediawiki_1.39.13-1~deb12u1.debian.tar.xz 5110d35cac44cbd87fe939dd29163074a03c1fd3 7979 mediawiki_1.39.13-1~deb12u1_amd64.buildinfo Checksums-Sha256: 0075e77de1d420ff1fea03bc585123093c5e488df9cd127ec49197f9eff11d81 2569 mediawiki_1.39.13-1~deb12u1.dsc bb700c09792ece0877181a174c1687389d3dff93c8a5f39f81ba7509bdebecd6 59844264 mediawiki_1.39.13.orig.tar.gz 357415c6774615f5d8b85559598ce0c8a7d9de27253680bb6f902befafac0ec9 195 mediawiki_1.39.13.orig.tar.gz.asc 616fd9a2e94ed3fc94ebf2aba1d461dd7d3f3e3e5cc7ea01070cf8301ab8b73c 103140 mediawiki_1.39.13-1~deb12u1.debian.tar.xz a665e01a6385c934e156ddecc66aab0c9c737df82fcf6f8f2957929c9f794cca 7979 mediawiki_1.39.13-1~deb12u1_amd64.buildinfo Files: cb6679970ab6707f2438844ca259154c 2569 web optional mediawiki_1.39.13-1~deb12u1.dsc df0ea76dee3b15592bf9388db5c101fa 59844264 web optional mediawiki_1.39.13.orig.tar.gz 0f64e55c281000982e43917a2268c1bf 195 web optional mediawiki_1.39.13.orig.tar.gz.asc 3477e44bae3e2793580b1e2b7c7692be 103140 web optional mediawiki_1.39.13-1~deb12u1.debian.tar.xz dd1c43d3e3bcbeda3d0762e25b6d3fe4 7979 web optional mediawiki_1.39.13-1~deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJFBAEBCgAvFiEENGVGnLGdYeXi6or77yQvcJ+RL74FAmhkD24RHHRhYXZpQGRl Ymlhbi5vcmcACgkQ7yQvcJ+RL76paw/7BeT3ZNAZhyIxqpvkQYudkqUm3obs7XYX 3f05ZjZcZnBMKONwQPo6/d6f6JlwHaPrDK+t4+T9VAsiLDQpR2UZnfrlvjy191nE q8HaatFCSGYAMCc8okEoILUJErSegdy43oMFH8HjdBJJ5LCoUDlvGkxkYHBS3E17 rNSCtqfiymLeqdFtS+NMvi2e2BUV5BDOZHy3jj6dDDK4yv62PVA7gOIQ21en9kzz 4qZN4Jh9ghwBdR9ISdMt+4JtQYcPZrZ5ROGv+MVH0jL81B9JOwollxSpd7lfDPcK +ub6YoQnz6flzwzUUUA9HqzbsXWki49B8hyKgVXeQRJeDl70eSC+U8AlielHzxuG UQeCvZJf/o0MFUgxUaQAe1phujsXn0cU2nVfgulL2DWept9T8bSJnGpLggslgeyj WjXsLd76hafnxLlrur3+G05CFY3gJqRaEEPeWdDRiM83GZk/W7Vl5Faz2pP1Ug5t M48Z99xi2HnbYhxCXoKBk2bpNdDR+cfpvpv+KJH/wA7LLVAIvKNJDRqWNLrk+1ok +n1ISKqBMSi2NKynHSeNlTiJ2B/3AjG6MmtkgXoOaeZA44OY2MBSo8vX+NiZhjo9 Yu8YsXGiHJVZp9os96ecWPvSEr+h2V2xR1LjhQOdUaE4NfBo/yCVv1bxhTWY8nhz Bfey10ch7qk= =RXsc -----END PGP SIGNATURE-----

1 0

Re: CVE-2025-32697/mediawiki is not fixed in bookworm
by Guilhem Moulin 04 Jul '25

04 Jul '25

Hi, [Resending to the team list rather to Kunal directly.] While working on Mediawiki update for Bullseye LTS I understood from d/changelog that 1:1.39.12-1~deb12u1 fixes CVE-2025-32697, however there is no custom Debian patch to that effect and AFAICT the tentative upstream patch was abandoned hence not included in 1.39.12: https://phabricator.wikimedia.org/T140010#10726169 https://phabricator.wikimedia.org/T62109#10726171 https://phabricator.wikimedia.org/T24521#10726170 Did I misunderstand or should the security tracker be updated to drop CVE-2025-32697 from DSA-5901-1? (I haven't tried to reproduce the issue on a bookworm system, but the code is not patched.) And AFAICT CVE-2025-32700 wasn't fixed in bookworm either. According to the CVE description it doesn't affect the AbuseFilter extension <1.43.0, and indeed before https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1032420 $privacyLevel was a boolean not a bitmask. AFAICT the incorrect bitwise operator was introduced in bf28dbce0e5084340cda84365e4ffe65f020124c from REL1_43. So I believe the issue should be dropped from DSA-5901-1 and marked <non-affected> instead. -- Guilhem.

3 2

mediawiki_1.39.13-1~deb12u1_source.changes ACCEPTED into proposed-updates->stable-new
by Debian FTP Masters 03 Jul '25

03 Jul '25

Thank you for your contribution to Debian. Mapping stable-security to proposed-updates. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 01 Jul 2025 19:31:26 +0300 Source: mediawiki Architecture: source Version: 1:1.39.13-1~deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: MediaWiki packaging team <mediawiki-debian(a)lists.wikimedia.org> Changed-By: Taavi Väänänen <taavi(a)debian.org> Changes: mediawiki (1:1.39.13-1~deb12u1) bookworm-security; urgency=medium . * New upstream version 1.39.13, fixing CVE-2025-6590, CVE-2025-6591, CVE-2025-6593, CVE-2025-6594, CVE-2025-6597, CVE-2025-32072. Checksums-Sha1: b32f48b49a60c56e1427bdaecb9aab87bafba3db 2569 mediawiki_1.39.13-1~deb12u1.dsc 76121202fe77d99bfeb0d8ba1c345f71d11a76b6 59844264 mediawiki_1.39.13.orig.tar.gz 31c2f75a1e70bb9556b539df4460dc9c34b945f4 195 mediawiki_1.39.13.orig.tar.gz.asc d5dbda8a7b924c147da42f04fb6018e25341aff1 103140 mediawiki_1.39.13-1~deb12u1.debian.tar.xz 5110d35cac44cbd87fe939dd29163074a03c1fd3 7979 mediawiki_1.39.13-1~deb12u1_amd64.buildinfo Checksums-Sha256: 0075e77de1d420ff1fea03bc585123093c5e488df9cd127ec49197f9eff11d81 2569 mediawiki_1.39.13-1~deb12u1.dsc bb700c09792ece0877181a174c1687389d3dff93c8a5f39f81ba7509bdebecd6 59844264 mediawiki_1.39.13.orig.tar.gz 357415c6774615f5d8b85559598ce0c8a7d9de27253680bb6f902befafac0ec9 195 mediawiki_1.39.13.orig.tar.gz.asc 616fd9a2e94ed3fc94ebf2aba1d461dd7d3f3e3e5cc7ea01070cf8301ab8b73c 103140 mediawiki_1.39.13-1~deb12u1.debian.tar.xz a665e01a6385c934e156ddecc66aab0c9c737df82fcf6f8f2957929c9f794cca 7979 mediawiki_1.39.13-1~deb12u1_amd64.buildinfo Files: cb6679970ab6707f2438844ca259154c 2569 web optional mediawiki_1.39.13-1~deb12u1.dsc df0ea76dee3b15592bf9388db5c101fa 59844264 web optional mediawiki_1.39.13.orig.tar.gz 0f64e55c281000982e43917a2268c1bf 195 web optional mediawiki_1.39.13.orig.tar.gz.asc 3477e44bae3e2793580b1e2b7c7692be 103140 web optional mediawiki_1.39.13-1~deb12u1.debian.tar.xz dd1c43d3e3bcbeda3d0762e25b6d3fe4 7979 web optional mediawiki_1.39.13-1~deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJFBAEBCgAvFiEENGVGnLGdYeXi6or77yQvcJ+RL74FAmhkD24RHHRhYXZpQGRl Ymlhbi5vcmcACgkQ7yQvcJ+RL76paw/7BeT3ZNAZhyIxqpvkQYudkqUm3obs7XYX 3f05ZjZcZnBMKONwQPo6/d6f6JlwHaPrDK+t4+T9VAsiLDQpR2UZnfrlvjy191nE q8HaatFCSGYAMCc8okEoILUJErSegdy43oMFH8HjdBJJ5LCoUDlvGkxkYHBS3E17 rNSCtqfiymLeqdFtS+NMvi2e2BUV5BDOZHy3jj6dDDK4yv62PVA7gOIQ21en9kzz 4qZN4Jh9ghwBdR9ISdMt+4JtQYcPZrZ5ROGv+MVH0jL81B9JOwollxSpd7lfDPcK +ub6YoQnz6flzwzUUUA9HqzbsXWki49B8hyKgVXeQRJeDl70eSC+U8AlielHzxuG UQeCvZJf/o0MFUgxUaQAe1phujsXn0cU2nVfgulL2DWept9T8bSJnGpLggslgeyj WjXsLd76hafnxLlrur3+G05CFY3gJqRaEEPeWdDRiM83GZk/W7Vl5Faz2pP1Ug5t M48Z99xi2HnbYhxCXoKBk2bpNdDR+cfpvpv+KJH/wA7LLVAIvKNJDRqWNLrk+1ok +n1ISKqBMSi2NKynHSeNlTiJ2B/3AjG6MmtkgXoOaeZA44OY2MBSo8vX+NiZhjo9 Yu8YsXGiHJVZp9os96ecWPvSEr+h2V2xR1LjhQOdUaE4NfBo/yCVv1bxhTWY8nhz Bfey10ch7qk= =RXsc -----END PGP SIGNATURE-----

1 0

mediawiki_1.43.3+dfsg-1_source.changes ACCEPTED into unstable
by Debian FTP Masters 01 Jul '25

01 Jul '25

Thank you for your contribution to Debian. Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 01 Jul 2025 19:08:37 +0300 Source: mediawiki Architecture: source Version: 1:1.43.3+dfsg-1 Distribution: unstable Urgency: medium Maintainer: MediaWiki packaging team <mediawiki-debian(a)lists.wikimedia.org> Changed-By: Taavi Väänänen <taavi(a)debian.org> Changes: mediawiki (1:1.43.3+dfsg-1) unstable; urgency=medium . [ Lucas Werkmeister ] * Update package description. . [ Taavi Väänänen ] * New upstream version 1.43.3, fixing CVE-2025-6926, CVE-2025-6927, CVE-2025-6589, CVE-2025-6590, CVE-2025-6591, CVE-2025-6592, CVE-2025-6593, CVE-2025-6594, CVE-2025-6595, CVE-2025-6596, CVE-2025-6597. * Drop merged patches. * Drop exclusions for files no longer included in the upstream releases. * Use different $wgFooterIcons key to fix display issues on modern skins. Checksums-Sha1: f5f53f0384aae1a8bdc994f69e97a1b2267366e5 2299 mediawiki_1.43.3+dfsg-1.dsc 260705831909d621727686cc32951790b49af675 87728534 mediawiki_1.43.3+dfsg.orig.tar.gz 7698e2d3e8d30aa699156bb5bdcd439eec1daf4d 127696 mediawiki_1.43.3+dfsg-1.debian.tar.xz 3cb9a0857b99892424f1a41d2dfe8962844c7023 6968 mediawiki_1.43.3+dfsg-1_amd64.buildinfo Checksums-Sha256: af9aae4cde32e8fab265cff13ab2ab2baaa5984471ceed14cae388ba73b7baac 2299 mediawiki_1.43.3+dfsg-1.dsc 0132909e28b4cb04a61008d9b3ee9645f43c40f54a12562131d3cef94c670cdb 87728534 mediawiki_1.43.3+dfsg.orig.tar.gz 7184b59c59c57107b227d71cc2ff2ded69d702752490913af218dbb71c6b6b49 127696 mediawiki_1.43.3+dfsg-1.debian.tar.xz e1401562d2aa228d31ed83111a48b9b27f03616d117ac0b7370fb400772d74e8 6968 mediawiki_1.43.3+dfsg-1_amd64.buildinfo Files: 747fb5ac4f267c93721bdc0549d73bab 2299 web optional mediawiki_1.43.3+dfsg-1.dsc 6cc85e868aa25df4005db5b9ebf30061 87728534 web optional mediawiki_1.43.3+dfsg.orig.tar.gz 03397a707328fba1ee7586090e6a5a04 127696 web optional mediawiki_1.43.3+dfsg-1.debian.tar.xz 07159223158033266d8b92fe5f399bc0 6968 web optional mediawiki_1.43.3+dfsg-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJFBAEBCgAvFiEENGVGnLGdYeXi6or77yQvcJ+RL74FAmhkDFwRHHRhYXZpQGRl Ymlhbi5vcmcACgkQ7yQvcJ+RL75YixAAkxFwHnUm6TQH1ftSqLp8m+pgRlQl/iKV ALv3EaP7DneVHpNBwPqcdRcAoc5PnT9FhBeFHO/ws01pUedHPc1+rbxbrEhy63vD Ehj2NPmk1/IHLGZomPzn6kbEa0w+331PeN/kyjuSYKrHXmlbo/L3SKiQlqKcCzN/ 2Eu4Ns67UuJIv6+u73muVUAuTgaw+pVKQaZCTAxuDXsSKdT1UpPpwFT3xdt64m/r Pu6kruOod+XvY1NS7uowUQbkfY+h02uGpLsClH3jNRwNEaFdvEsQAdcyOz2coPH6 8IGDoy5oHo8PfrmNxOVboeqXYfLLJ/dqakt0968/G1q5yNsV93c9IZy1zG7WSsFB 5voQxm8dITSEF5uO7UVCZI9hhpcqsWwBjON4lBu2F1wJhJBc2z+H/5KXuszBbEoZ Q08WIhOIB0PES5YXcncovMoZVeWNHoRTXokj7VnSE9ie/e7Hca/E6StMgayF0CAJ o5qhTSRLWPq6/SuITzaJA5aFD1eo1BupdwtSix5/dLgtgyKjzqW0kB/2ttcl58sj zXRrF2ohOmb9iw0tOvkw4zwkK6qmMNxy9onZERnq1pveTn5H4M1PZDZ3H4ndCBr6 QM56T/8rfNfGeaEjN+z5w7ybk0fFNV4o/M4y/92wu6fPFFpZjVGaPEeJgijRasJd xV0FsABg2t8= =/c7R -----END PGP SIGNATURE-----

1 0

Processing of mediawiki_1.43.3+dfsg-1_source.changes
by Debian FTP Masters 01 Jul '25

01 Jul '25

mediawiki_1.43.3+dfsg-1_source.changes uploaded successfully to localhost along with the files: mediawiki_1.43.3+dfsg-1.dsc mediawiki_1.43.3+dfsg.orig.tar.gz mediawiki_1.43.3+dfsg-1.debian.tar.xz mediawiki_1.43.3+dfsg-1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org)

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

MediaWiki-Debian July 2025