MediaWiki-l April 2026

mediawiki-l@lists.wikimedia.org

5 participants
7 discussions

Problems after install of 1.45.3
by sebastian＠debianfan.de 01 May '26

01 May '26

Hi, i installed Version 1.45.3 from tar.gz-archive on debian 13, nginx, mariadb, php 8.4 and after install, there is a page: (first line) Hoppla! Die mit $wgDefaultSkin als minervaneue für dein Wiki definierte Standardbenutzeroberfläche ist nicht verfügbar. # ls -a skins/ . .. MinervaNeue MonoBook README Timeless Vector LocalSettings.php [...] $wgDefaultSkin = "minervaneue"; wfLoadSkin( 'MinervaNeue' ); [...] What is wrong? Tnx Sebastian

2 1

MediaWiki 1.46-beta has been branched
by Mateus Santos 28 Apr '26

28 Apr '26

Hey all, This is a quick note to highlight that we've created the REL1_46 branch for MediaWiki core and each of the extensions and skins in Wikimedia git [0]. This is the first step in the release process for MediaWiki 1.46.0, which should be out in June 2026, approximately six months after MediaWiki 1.45.0. The branches reflect the code as of the last 'alpha' branch for the release, 1.46.0-wmf.26, which was deployed to Wikimedia wikis on Tuesday, 28th April, for MediaWiki itself and those extensions and skins available there. From now on, patches that land in the main development branch of MediaWiki and its bundled extensions and skins will be slated for the MediaWiki 1.47 release, unless specifically backported [1]. If you are working on a critical bug fix that will affect the code in the release, once the patch has been merged into the development branch, you should propose it for backporting by cherry-picking to the REL1_46 branch. If you are working on a new feature, that should now not be backported. If you have an urgent case where the work should block release for everyone else, please file a task against the `mw 1.46-release` project on Phabricator [2]. If you have tickets that are tagged for `mw-1.46-release`, please finish them, untag them, or reach out to get them resolved in the next few days. We hope to issue the first release candidate, 1.46.0-rc.0, in roughly three weeks' time, and if all goes well, to then release MediaWiki 1.46.0 a few weeks after that. [0]: https://www.mediawiki.org/wiki/Bundled_extensions_and_skins [1]: https://www.mediawiki.org/wiki/Backporting_fixes [2]: https://phabricator.wikimedia.org/tag/mw-1.46-release/

1 0

Correction: MediaWiki 1.46-alpha will be branched as a beta on 21st April 2026
by Mateus Santos 14 Apr '26

14 Apr '26

Hey all, apologies for the previous email with incorrect dates and title. This is a quick note to highlight that in the week of 21st of April 2026, the REL1_46 branch will be created for MediaWiki core and each of the extensions and skins in Wikimedia git, with some (the 'tarball') included as sub-modules of MediaWiki itself[0]. This is the first step in the release process for MediaWiki 1.46, which should be out in June 2026, approximately six months after MediaWiki 1.45. The branches will reflect the code as of the last 'alpha' branch for the release, 1.46.0-wmf.25, which will be deployed to Wikimedia wikis in the week beginning 21 April 2026 for MediaWiki itself and those extensions and skins available there. After that point, patches that land in the main development branch of MediaWiki and its bundled extensions and skins will be instead be slated for the MediaWiki 1.47 release unless specifically backported[1]. If you are working on a new feature that you wish to land for the release, you now have a few days to finish your work and land it in the development branch; feature changes should not be backported except in an urgent case. If your work might not be complete in time, and yet should block release for everyone else, please file a task against the `mw-1.46-release` project on Phabricator.[2] If you have tickets that are already tagged for `mw-1.46-release`, please finish them, untag them, or reach out to get them resolved in the next few weeks. We hope to issue the first release candidate, 1.46.0-rc.0, two weeks after the branch point, and if all goes well, to release MediaWiki 1.46.0 a few weeks after that in the beginning of June. [0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins> [1]: <https://www.mediawiki.org/wiki/Backporting_fixes> [2]: <https://phabricator.wikimedia.org/tag/mw-1.46-release/>

1 0

MediaWiki 1.45-alpha will be branched as a beta on 21st April 2026
by Mateus Santos 14 Apr '26

14 Apr '26

Hey all, This is a quick note to highlight that in the week of 21st of April 2026, the REL1_46 branch will be created for MediaWiki core and each of the extensions and skins in Wikimedia git, with some (the 'tarball') included as sub-modules of MediaWiki itself[0]. This is the first step in the release process for MediaWiki 1.46, which should be out in June 2024, approximately six months after MediaWiki 1.45. The branches will reflect the code as of the last 'alpha' branch for the release, 1.46.0-wmf.25, which will be deployed to Wikimedia wikis in the week beginning 21 April 2024 for MediaWiki itself and those extensions and skins available there. After that point, patches that land in the main development branch of MediaWiki and its bundled extensions and skins will be instead be slated for the MediaWiki 1.47 release unless specifically backported[1]. If you are working on a new feature that you wish to land for the release, you now have a few days to finish your work and land it in the development branch; feature changes should not be backported except in an urgent case. If your work might not be complete in time, and yet should block release for everyone else, please file a task against the `mw-1.46-release` project on Phabricator.[2] If you have tickets that are already tagged for `mw-1.46-release`, please finish them, untag them, or reach out to get them resolved in the next few weeks. We hope to issue the first release candidate, 1.46.0-rc.0, two weeks after the branch point, and if all goes well, to release MediaWiki 1.46.0 a few weeks after that in the beginning of June. [0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins> [1]: <https://www.mediawiki.org/wiki/Backporting_fixes> [2]: <https://phabricator.wikimedia.org/tag/mw-1.46-release/>

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.43.7/1.44.4/1.45.2)
by Maryum Styles 09 Apr '26

09 Apr '26

Greetings- With the security/maintenance release of MediaWiki 1.43.7/1.44.4/1.45.2, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: ReportIncident + (T414582, CVE-2026-5762) - ReportIncident DiscussionTools integration causes slow requests with occasional timeouts on large talk pages https://gerrit.wikimedia.org/r/q/I05d7f65c57d9aa1b70cdb159c4291ac28c60b4dd ProofreadPage + (T406088, CVE-2026-39838) - ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6bdd0628 Cargo + (T416271, CVE-2026-39839) - Stored XSS through URLs in Cargo's map format https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237957 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237977 Cargo + (T416368, CVE-2026-39840) - CSS injection in multiple Cargo display formats https://gerrit.wikimedia.org/r/c/1237966 Cargo + (T416389, CVE-2026-39841) - Stored XSS through list fields on Cargo's page values and Special:CargoTables https://gerrit.wikimedia.org/r/c/1237973 Cargo + (T416402, CVE-2026-39837) - Stored XSS through the dynamic table format in Cargo https://gerrit.wikimedia.org/r/c/1237979 WikiLove +(T416502, CVE-2026-22711) - Stored XSS through system messages in WikiLove https://gerrit.wikimedia.org/r/q/Iab86209478a044504f5a6aea0d8c3d14f21c48b3 CentralAuth +(T418122, CVE-2026-39937) - Global vanishing does not completely remove user email https://gerrit.wikimedia.org/r/q/I0b72427fa329aee85841a2cb23dec3058edce85e GlobalWatchlist +(T418179, CVE-2026-39933) - Multiple XSS vulnerabilities in GlobalWatchlist https://gerrit.wikimedia.org/r/q/I1fc7b7e1d234b0aaf9f7d782a65da1451577587e GrowthExperiments +(T418222, CVE-2026-39934) - ReassignMenteesJob runs as an infinite loop https://gerrit.wikimedia.org/r/c/1243874 CampaignEvents +(T418254, CVE-2026-39935) - Stored XSS through system messages https://gerrit.wikimedia.org/r/c/1249320 Score +(T419186, CVE-2026-39936) - Stored XSS due to usage of non-reserved data attributes https://gerrit.wikimedia.org/r/q/I1fb2913bc32328cbc4ecd4b4ad4a4788fb98c56c RenderBlocking +(GHSA-4h5r-8rjm-496r, CVE-2026-30977) - Stored XSS in renderblocking-css with Inline Assets mode https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba… The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. CVE JSON references can be found on Gitlab [4]. [1] https://phabricator.wikimedia.org/T411394 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs [4] https://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments

1 0

MediaWiki Language Extension Bundle 2026.02
by Kartik Mistry 02 Apr '26

02 Apr '26

We would like to announce the release of MediaWiki Language Extension Bundle 2026.02. This bundle is compatible with *MediaWiki 1.45.0*. It requires *PHP >= 8.1.0*. The next MLEB is expected to be released in 6 months after *MediaWiki 1.46 release*. If there are important bug fixes, we will do an intermediate release. Please give us your feedback at https://www.mediawiki.org/wiki/Talk:MLEB. - Download: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2026.02.tar… - sha256sum: 297e6ca2b62615db17b614021cf805e875dd10d2f03e81c222431fd2edb6ebf4 - Signature: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2026.02.tar… *Quick links* - Installation instructions are at: https://www.mediawiki.org/wiki/MLEB - Announcements of new releases will be posted to a mailing list: https://lists.wikimedia.org/postorius/lists/mediawiki-i18n.lists.wikimedia.… - Report bugs to: https://phabricator.wikimedia.org/project/view/1464 Highlights Babel - Localisation and maintenance updates only. cldr - Update to cldr 48. - Localisation and maintenance updates. Translate - Removed support for Yandex machine translation service. - Mark Echo extension dependency as optional. This is only required if Message group subscription feature is enabled. (T389998 <https://phabricator.wikimedia.org/T389998>) - Require permission to create translations of empty categories. (T390348 <https://phabricator.wikimedia.org/T390348>) - Enable subpage syntax based search in Special:SearchTranslations. ( T405607 <https://phabricator.wikimedia.org/T405607>) - Security fix: Ensure session information is set in jobs. (T399627 <https://phabricator.wikimedia.org/T399627>) - Check DisabledTargetLanguages and group configuration for disabled languages to check for reason. (T402132 <https://phabricator.wikimedia.org/T402132>) - Add hook to control the state of title translation on Special:PageTranslation (T401874 <https://phabricator.wikimedia.org/T401874>) - Fix empty proofread section on Special:Translate when moving from untranslated tab. (T253017 <https://phabricator.wikimedia.org/T253017>) - Don't display unusable shortcuts on Special:Translate (T406826 <https://phabricator.wikimedia.org/T406826>) - Fix fatal error when a message bundle page is empty (T401348 <https://phabricator.wikimedia.org/T401348>) - Force-load the translation unit editor if saving fails (T345987 <https://phabricator.wikimedia.org/T345987>) - Make it clearer how to edit "translations" into the source language ( T393515 <https://phabricator.wikimedia.org/T393515>) - Block external attempts to move translatable pages and message bundles (T370714 <https://phabricator.wikimedia.org/T370714>) - Display all validation errors when using the legacy editor (T409665 <https://phabricator.wikimedia.org/T409665>) UniversalLanguageSelector - The languagesearch API has moved to MediaWiki core with no changes to its signature. The Universal Language Selector will maintain the code for legacy compatibility until the next MLEB release, at which point it will be removed. - Localisation and maintenance updates. Full release notes are available at: https://www.mediawiki.org/wiki/MediaWiki_Language_Extension_Bundle/2026.02 -- Kartik Mistry

1 1

Maintenance release: MediaWiki 1.43.8 / 1.44.5 / 1.45.3
by Sam Reed 01 Apr '26

01 Apr '26

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l April 2026