MediaWiki-l July 2026

mediawiki-l@lists.wikimedia.org

6 participants
6 discussions

Re: Native Markdown for MediaWiki
by 谢大大 16 Jul '26

16 Jul '26

2 1

Native Markdown for MediaWiki
by Jeroen De Dauw 13 Jul '26

13 Jul '26

Hi all, We are pleased to announce Native Markdown, a new MediaWiki extension that provides a deeply integrated Markdown content model. In contrast to some earlier Markdown extensions, the entire page is stored as Markdown rather than embedding Markdown within wikitext via a tag or similar. You get functioning links, categories, search, image embeds, table of contents, WhatLinksHere, etc. You can even embed templates and parser functions, though wiki admins can disable this for a full Markdown-only experience. The extension can be added to existing wikis with wikitext pages without breaking anything, since those pages will remain wikitext. By default, all new wiki pages will be in Markdown, with configuration options that let you control how fully you switch to Markdown (e.g., only in certain namespaces). Find the release blog with demo video at https://professional.wiki/en/news/native-markdown-released Read the docs at https://professional.wiki/en/extension/native-markdown Explore the source or file issues at https://github.com/ProfessionalWiki/NativeMarkdown Best -- Jeroen De Dauw | CEO [Professional Wiki](https://www.professional.wiki/) Sovereign knowledge infrastructure: knowledge graphs, optional AI, open source [NeoWiki](https://neowiki.ai/) | [AI Assistant](https://professional.wiki/en/mediawiki-ai-assistant) | [MediaWiki Hosting](https://professional.wiki/en/hosting) | [Wiki Services](https://professional.wiki/en/services)

1 0

MediaWiki Users and Developers Conference Fall 2026 – Call for Contributions
by [[kgh]] 06 Jul '26

06 Jul '26

Hello everyone, MUDCon Fall 2026 (https://www.semantic-mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conf…) will be held from November 11 to 13, 2026, in Ljubljana, Slovenia. You can now submit your contributions to the program. Day 1 is dedicated to GLAM topics. We welcome talks about using MediaWiki in galleries, libraries, archives, and museums. Share your collection data, data models, queries, or experiences with migration. Day 2 will cover MediaWiki in enterprise, government, and public sector contexts. This includes internal knowledge bases, structured data, registries, monument lists, archival data, and related topics. We also invite talks on knowledge management and AI, such as assistants that use wiki content, knowledge graphs, or the Model Context Protocol (MCP). Day 3 is a half-day focused on hands-on work, including 90-minute tutorials and open sessions that we will organize together at the event. We are also interested in new MediaWiki integrations and extensions, project ideas, technical experiments, and challenges related to building and running wikis. If you are unsure, please submit your idea anyway. We will try to find a suitable place for your contribution. You can choose from several formats: full talks (25 minutes), short talks (10 to 15 minutes), or lightning talks (5 minutes). Tutorials and co-creation sessions will take place on day 3. To submit, just provide a title, the format, and a short abstract. Please use the Semantic-MediaWiki website (https://www.semantic-mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conf…) to publish your proposal by September 15, 2026. We will get back to you by October 1, and the full program will be announced soon after. If you are giving your first talk, this is a great conference to start with. Sharing your own wiki experiences is just as valuable as technical presentations. Get in touch with us if you are unsure whether your topic is a good fit. We look forward to receiving your proposals. Cheers, Karsten Hoffmeyer, on behalf of the organizing committee -- Karsten / MediaWiki, Semantic MediaWiki and NeoWiki enthusiast https://professional.wiki // https://www.pro.wiki // https://neowiki.ai

1 0

MediaWiki Stakeholders welcomes Brooke Vibber as new board member
by Mark A. Hershberger 03 Jul '26

03 Jul '26

Hi all: The MediaWiki Stakeholders' Group (MWStake) is thrilled to announce that Brooke Vibber has joined our board! Brooke is one of the original authors of MediaWiki and has remained an active developer ever since. She writes; It's a tremendous honor to work with my old friends and colleagues at MWStake on something that's always been near and dear to my heart: working together to provide good documentation, coding, and feature support for MediaWiki's many third-party users. A strong Open Source ecosystem with many users and contributors enriches the commons, and that's what we're all about here! Thanks, Mark A. Hershberger President, MWStake https://mwstake.org/

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.43.9/1.44.6/1.45.4)
by Maryum Styles 02 Jul '26

02 Jul '26

Greetings- With the security/maintenance release of MediaWiki 1.43.9/1.44.6/1.45.4, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: UrlShortener + (T418533, CVE-2026-13706) - UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG https://gerrit.wikimedia.org/r/q/I64268dda19ea9dfa048b3e2212a682d53c2a59d6 RedirectManager + (T423826, CVE-2026-58518) - RedirectManager's API does not require a CSRF token https://gerrit.wikimedia.org/r/1275494 Cargo + (T424140, CVE-2026-58519) - Stored XSS through Cargo's map format https://gerrit.wikimedia.org/r/c/1277612 UrlShortener + (T418431, CVE-2026-58520) - UrlShortener defaults to ineffective validation open to third-party redirects https://gerrit.wikimedia.org/r/1306769 CentralAuth + (T422306, CVE-2026-58028) - Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets https://gerrit.wikimedia.org/r/q/Idb42ab1cf685ef145b78701784909c590d758917 StructuredDiscussions + (T424285) - Flow ships Handlebars 3.0.0 with known security vulnerabilities. See https://security.snyk.io/package/npm/handlebars/3.0.0 for more details https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Flow/+/1277782 Timeline + (T426631, CVE-2026-8857) - Full RCE using EasyTimeline Extension https://gerrit.wikimedia.org/r/q/Ic2f3aa24922e6d44d063b76630cc888016ba4c74 https://gerrit.wikimedia.org/r/q/Ia19cbe8c80fa5a765abca68305254c15e817bfac Timeline + (T427611, CVE-2026-58038) - Stored XSS through javascript URLs in SVGs generated by EasyTimeline https://gerrit.wikimedia.org/r/q/Ia61203fcd4913ce97fd6c05ea908d3910c213ff6 Maps + (GHSA-4h7g-5542-v3fc, CVE-2026-52854) - Stored XSS through the overlays parameter in the display_map parser function https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542… https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd… Cargo + (T428274, CVE-2026-58521) - SQLi in Cargo extension via year range filter https://gerrit.wikimedia.org/r/1298854 OAuth +(T428324, CVE-2026-13707) - Session fixation attacks on improperly configured OAuth 1.0a tools https://gerrit.wikimedia.org/r/q/Ife0b4bf16761c01bdb0e91a29f1fb94de380c73e EmbedVideo (fork) +(GHSA-c29q-5xm7-5p62, CVE-2026-55690) - Stored XSS via unsanitized service name in exception text https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/9… EmbedVideo (fork) +(GHSA-v65j-hff3-753c, CVE-2026-57440) - Stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/3… EmbedVideo (fork) +(GHSA-5c7p-g73q-rpg5, CVE-2026-55692) - Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/3… EmbedVideo (fork) +(GHSA-7h5p-637f-jfr7, CVE-2026-55691) - Stored XSS via unsanitized class passed to template https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/3… WikiLambda +(T428833, CVE-2026-58517) - Blocked users can create and edit WikiLambda objects https://gerrit.wikimedia.org/r/1305376 Charts +(T430548, CVE-2026-14358) - Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title https://gerrit.wikimedia.org/r/q/Ibdaa7c852ae83f562e84dddc9c96ad64e2152210 Cargo +(T422774, CVE-2026-14363) - Cargo Extension: SQLi in Special:Drilldown https://gerrit.wikimedia.org/r/c/1269701 https://gerrit.wikimedia.org/r/c/1279498 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. CVE JSON references can be found on Gitlab [4]. [1] https://phabricator.wikimedia.org/T421273 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs [4] https://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments

1 0

Announcing MediaWiki 1.46.0
by Mateus Santos 01 Jul '26

01 Jul '26

I am happy to announce the availability of the general release of MediaWiki 1.46! Tarballs have already been uploaded, and the git tag has been pushed. Thanks to everyone who helped out with this release, especially thanks to those who tested out the release candidate and provided feedback, as well as the developers who worked on fixes for the 1.46 final release. To see what's changed in 1.46, see the release notes file.[0] If you encounter any issues, please file a task.[1] You can see open tasks for the branch on Phabricator.[2] MediaWiki 1.46 is due to be supported until the end of July 2026. It's important to note that 1.46.0 is shipped with the changes released on the current security and maintenance release. === Changes since MediaWiki 1.46.0-rc.0 === * (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry parameters [CVE-2026-58025] * (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML [CVE-2026-58037] * (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in more places [CVE-2026-58029] * (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in ApiUserrights [CVE-2026-58024] * (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's being transcluded is includable [CVE-2026-58026] * (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat formatversion=1 as text [CVE-2026-58032] * (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from distinct authors query [CVE-2026-58033] * (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print api.php responses [CVE-2026-58028] * (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of private user conditions for user [CVE-2026-58036] * (T428809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html instead of using v-html * (T423617) Check the target url for redirects are allowed * (T383047) Mail: Log PHP mail() send failures with recipient count * (T429720) FileRepo: Fix typos in schema compatibility checks * (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send() * (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3 * (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1 * (T428406) LocalFileMoveBatch: Also update fr_archive_name when moving file * (T424462) tests: Limit ResourcesTest::testRespond to general-purpose skins * (T424462) tests: loop modules inside ResourcesTest::testRespond * (T428289) Email confirmation banner: Remove Test Kitchen A/B test scaffolding * (T421366) Email confirmation banner: Remove obsolete arm_b variant * (T427622) Store indicators in ContentHolder: forward compatibility * changePassword: Add reason option for password change * (T425818) changePassword: Log password change to authentication log Release notes: [0] https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/… Bug report form: [1] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.46-… Open Bugs: [2] https://phabricator.wikimedia.org/tag/mw-1.46-release/ ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip Patch to previous version (1.46.0-rc.0): https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip GPG signatures for the above: https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l July 2026