MediaWiki-l

mediawiki-l@lists.wikimedia.org

4 participants
16539 discussions

Correction: MediaWiki 1.46-alpha will be branched as a beta on 21st April 2026
by Mateus Santos 14 Apr '26

14 Apr '26

Hey all, apologies for the previous email with incorrect dates and title. This is a quick note to highlight that in the week of 21st of April 2026, the REL1_46 branch will be created for MediaWiki core and each of the extensions and skins in Wikimedia git, with some (the 'tarball') included as sub-modules of MediaWiki itself[0]. This is the first step in the release process for MediaWiki 1.46, which should be out in June 2026, approximately six months after MediaWiki 1.45. The branches will reflect the code as of the last 'alpha' branch for the release, 1.46.0-wmf.25, which will be deployed to Wikimedia wikis in the week beginning 21 April 2026 for MediaWiki itself and those extensions and skins available there. After that point, patches that land in the main development branch of MediaWiki and its bundled extensions and skins will be instead be slated for the MediaWiki 1.47 release unless specifically backported[1]. If you are working on a new feature that you wish to land for the release, you now have a few days to finish your work and land it in the development branch; feature changes should not be backported except in an urgent case. If your work might not be complete in time, and yet should block release for everyone else, please file a task against the `mw-1.46-release` project on Phabricator.[2] If you have tickets that are already tagged for `mw-1.46-release`, please finish them, untag them, or reach out to get them resolved in the next few weeks. We hope to issue the first release candidate, 1.46.0-rc.0, two weeks after the branch point, and if all goes well, to release MediaWiki 1.46.0 a few weeks after that in the beginning of June. [0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins> [1]: <https://www.mediawiki.org/wiki/Backporting_fixes> [2]: <https://phabricator.wikimedia.org/tag/mw-1.46-release/>

1 0

MediaWiki 1.45-alpha will be branched as a beta on 21st April 2026
by Mateus Santos 14 Apr '26

14 Apr '26

Hey all, This is a quick note to highlight that in the week of 21st of April 2026, the REL1_46 branch will be created for MediaWiki core and each of the extensions and skins in Wikimedia git, with some (the 'tarball') included as sub-modules of MediaWiki itself[0]. This is the first step in the release process for MediaWiki 1.46, which should be out in June 2024, approximately six months after MediaWiki 1.45. The branches will reflect the code as of the last 'alpha' branch for the release, 1.46.0-wmf.25, which will be deployed to Wikimedia wikis in the week beginning 21 April 2024 for MediaWiki itself and those extensions and skins available there. After that point, patches that land in the main development branch of MediaWiki and its bundled extensions and skins will be instead be slated for the MediaWiki 1.47 release unless specifically backported[1]. If you are working on a new feature that you wish to land for the release, you now have a few days to finish your work and land it in the development branch; feature changes should not be backported except in an urgent case. If your work might not be complete in time, and yet should block release for everyone else, please file a task against the `mw-1.46-release` project on Phabricator.[2] If you have tickets that are already tagged for `mw-1.46-release`, please finish them, untag them, or reach out to get them resolved in the next few weeks. We hope to issue the first release candidate, 1.46.0-rc.0, two weeks after the branch point, and if all goes well, to release MediaWiki 1.46.0 a few weeks after that in the beginning of June. [0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins> [1]: <https://www.mediawiki.org/wiki/Backporting_fixes> [2]: <https://phabricator.wikimedia.org/tag/mw-1.46-release/>

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.43.7/1.44.4/1.45.2)
by Maryum Styles 08 Apr '26

08 Apr '26

Greetings- With the security/maintenance release of MediaWiki 1.43.7/1.44.4/1.45.2, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: ReportIncident + (T414582, CVE-2026-5762) - ReportIncident DiscussionTools integration causes slow requests with occasional timeouts on large talk pages https://gerrit.wikimedia.org/r/q/I05d7f65c57d9aa1b70cdb159c4291ac28c60b4dd ProofreadPage + (T406088, CVE-2026-39838) - ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6bdd0628 Cargo + (T416271, CVE-2026-39839) - Stored XSS through URLs in Cargo's map format https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237957 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237977 Cargo + (T416368, CVE-2026-39840) - CSS injection in multiple Cargo display formats https://gerrit.wikimedia.org/r/c/1237966 Cargo + (T416389, CVE-2026-39841) - Stored XSS through list fields on Cargo's page values and Special:CargoTables https://gerrit.wikimedia.org/r/c/1237973 Cargo + (T416402, CVE-2026-39837) - Stored XSS through the dynamic table format in Cargo https://gerrit.wikimedia.org/r/c/1237979 WikiLove +(T416502, CVE-2026-22711) - Stored XSS through system messages in WikiLove https://gerrit.wikimedia.org/r/q/Iab86209478a044504f5a6aea0d8c3d14f21c48b3 CentralAuth +(T418122, CVE-2026-39937) - Global vanishing does not completely remove user email https://gerrit.wikimedia.org/r/q/I0b72427fa329aee85841a2cb23dec3058edce85e GlobalWatchlist +(T418179, CVE-2026-39933) - Multiple XSS vulnerabilities in GlobalWatchlist https://gerrit.wikimedia.org/r/q/I1fc7b7e1d234b0aaf9f7d782a65da1451577587e GrowthExperiments +(T418222, CVE-2026-39934) - ReassignMenteesJob runs as an infinite loop https://gerrit.wikimedia.org/r/c/1243874 CampaignEvents +(T418254, CVE-2026-39935) - Stored XSS through system messages https://gerrit.wikimedia.org/r/c/1249320 Score +(T419186, CVE-2026-39936) - Stored XSS due to usage of non-reserved data attributes https://gerrit.wikimedia.org/r/q/I1fb2913bc32328cbc4ecd4b4ad4a4788fb98c56c RenderBlocking +(GHSA-4h5r-8rjm-496r, CVE-2026-30977) - Stored XSS in renderblocking-css with Inline Assets mode https://github.com/lihaohong6/RenderBlocking/commit/096fc47dad9dca153b02cba… The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. CVE JSON references can be found on Gitlab [4]. [1] https://phabricator.wikimedia.org/T411394 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs [4] https://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments

1 0

MediaWiki Language Extension Bundle 2026.02
by Kartik Mistry 02 Apr '26

02 Apr '26

We would like to announce the release of MediaWiki Language Extension Bundle 2026.02. This bundle is compatible with *MediaWiki 1.45.0*. It requires *PHP >= 8.1.0*. The next MLEB is expected to be released in 6 months after *MediaWiki 1.46 release*. If there are important bug fixes, we will do an intermediate release. Please give us your feedback at https://www.mediawiki.org/wiki/Talk:MLEB. - Download: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2026.02.tar… - sha256sum: 297e6ca2b62615db17b614021cf805e875dd10d2f03e81c222431fd2edb6ebf4 - Signature: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2026.02.tar… *Quick links* - Installation instructions are at: https://www.mediawiki.org/wiki/MLEB - Announcements of new releases will be posted to a mailing list: https://lists.wikimedia.org/postorius/lists/mediawiki-i18n.lists.wikimedia.… - Report bugs to: https://phabricator.wikimedia.org/project/view/1464 Highlights Babel - Localisation and maintenance updates only. cldr - Update to cldr 48. - Localisation and maintenance updates. Translate - Removed support for Yandex machine translation service. - Mark Echo extension dependency as optional. This is only required if Message group subscription feature is enabled. (T389998 <https://phabricator.wikimedia.org/T389998>) - Require permission to create translations of empty categories. (T390348 <https://phabricator.wikimedia.org/T390348>) - Enable subpage syntax based search in Special:SearchTranslations. ( T405607 <https://phabricator.wikimedia.org/T405607>) - Security fix: Ensure session information is set in jobs. (T399627 <https://phabricator.wikimedia.org/T399627>) - Check DisabledTargetLanguages and group configuration for disabled languages to check for reason. (T402132 <https://phabricator.wikimedia.org/T402132>) - Add hook to control the state of title translation on Special:PageTranslation (T401874 <https://phabricator.wikimedia.org/T401874>) - Fix empty proofread section on Special:Translate when moving from untranslated tab. (T253017 <https://phabricator.wikimedia.org/T253017>) - Don't display unusable shortcuts on Special:Translate (T406826 <https://phabricator.wikimedia.org/T406826>) - Fix fatal error when a message bundle page is empty (T401348 <https://phabricator.wikimedia.org/T401348>) - Force-load the translation unit editor if saving fails (T345987 <https://phabricator.wikimedia.org/T345987>) - Make it clearer how to edit "translations" into the source language ( T393515 <https://phabricator.wikimedia.org/T393515>) - Block external attempts to move translatable pages and message bundles (T370714 <https://phabricator.wikimedia.org/T370714>) - Display all validation errors when using the legacy editor (T409665 <https://phabricator.wikimedia.org/T409665>) UniversalLanguageSelector - The languagesearch API has moved to MediaWiki core with no changes to its signature. The Universal Language Selector will maintain the code for legacy compatibility until the next MLEB release, at which point it will be removed. - Localisation and maintenance updates. Full release notes are available at: https://www.mediawiki.org/wiki/MediaWiki_Language_Extension_Bundle/2026.02 -- Kartik Mistry

1 1

Maintenance release: MediaWiki 1.43.8 / 1.44.5 / 1.45.3
by Sam Reed 01 Apr '26

01 Apr '26

1 0

Security and maintenance release: 1.43.7 / 1.44.4 / 1.45.2
by Sam Reed 31 Mar '26

31 Mar '26

1 0

Removing the PHP response format of Action APIs
by Amir Sarabadani 31 Mar '26

31 Mar '26

Hello, The PHP response format [1] has been deprecated in favor of json format for more than ten years <https://www.mediawiki.org/w/index.php?title=API:Data_formats&diff=prev&oldi…>now. The usage of it is extremely low (0.17% which mostly are scrapers loading links or examples). In comparison, The xml format that was also deprecated for more than ten years now still gets 18 times more requests than the PHP format. It is now time to pull the plug. We will drop the format in a month (around May 1, 2026). You can follow the work or comment (for example if you need more time) in T118538 <https://phabricator.wikimedia.org/T118538>. [1] for example: https://meta.wikimedia.org/w/api.php?action=query&meta=siteinfo&siprop=gene… Best -- Amir (he/him)

1 0

SVWP title DOM differ from displaytitle
by Viktoria Hillerud 30 Mar '26

30 Mar '26

Hi! We are working on the Wikispeech extension and have run into an issue on Swedish Wikipedia (svwp) where the page title DOM seems different both from the *displayTitle* returned by the API and from what we see on other wikis. For example, if we query: *https://sv.wikipedia.org/w/api.php?action=parse&format=json&page=Apa&prop=displaytitle&formatversion=2 <https://sv.wikipedia.org/w/api.php?action=parse&format=json&page=Apa&prop=d…>* we get: *{"title":"Apa","pageid":3877894,"displaytitle":"Apa"}}* However, in the actual DOM on svwp, the title appears wrapped differently, for example: *Apa + editsection span* So it adds an extra **.. What confuses us is that this seems to behave differently from other wikis we have tested, such as enwp, where the title DOM appears as the *displayTitle* structure. Is there something specific about svwp that causes the page title DOM to be wrapped differently from other wikis, or has there been any updates regarding the structure? Kind regards, *Viktoria Hillerud Ahlbäck* *Developer* Wikimedia Sverige (WMSE)

3 2

Security pre-release announcement: 1.43.7 / 1.44.4 / 1.45.2
by Sam Reed 30 Mar '26

30 Mar '26

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.43.7 - 1.44.4 - 1.45.2 This will also resolve security issues in bundled extensions, along with bug fixes included for maintenance reasons. These security issues also affect many unsupported versions of MediaWiki. We will make the fixes available in the respective release branches and master in git. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow later. As a reminder, MediaWiki 1.39 became EOL in December 2025 and MediaWiki 1.42 became EOL in June 2025. More information on these timelines can be viewed on the version lifecycle page at [1]. [1] https://www.mediawiki.org/wiki/Version_lifecycle

1 0

problem upgrade mediawiki from 1.42.1 to other
by hdyugoplastika＠gmail.com 03 Mar '26

03 Mar '26

Hello I have a problem to upgrade from ver 1.42.1 to other: I have tried to 1.42.7, to 1.42.2 but nothing. The upgrade seems to work but: 1) when i try to add new image or file the file are saved in old version images dir 2) from special pages the version is old one the update command execution don't show error This is the installation dir situation: /var/www/html/wiki -rw-r--r--. 1 apache apache 9662 Jun 7 2017 favicon.ico -rw-r--r--. 1 apache apache 6065 Oct 8 2024 PLUTO_logo_135.png -rwxr-xr-x. 1 apache apache 2001 Sep 19 2024 pluto_logo.png -rw-r--r--. 1 root root 144 Sep 27 2024 .htaccess -rw-r--r--. 1 apache apache 1056 Feb 25 10:59 index.html drwxr-xr-x. 15 apache apache 4096 Sep 25 2024 mediawiki-1.26.4 drwxr-xr-x. 14 apache apache 4096 Dec 12 2024 mediawiki-1.35.14 drwxr-xr-x. 14 apache apache 4096 Feb 25 17:13 mediawiki-1.42.1 drwxr-xr-x. 14 apache apache 4096 Feb 25 16:22 mediawiki-1.42.2 drwxr-xr-x. 14 apache apache 4096 Feb 25 12:16 mediawiki-1.42.7 drwxr-xr-x. 14 apache apache 4096 Feb 25 14:32 mediawiki-1.43.6-notwork -rw-r--r--. 1 apache apache 2823 Jun 7 2017 style.css lrwxrwxrwx. 1 root root 16 Feb 25 16:34 wiki -> mediawiki-1.42.1 I have tried to update to 1.43.6 but from "Special Pages" I many error about pat h: the path is old one ( /var/www/html/wikinet/mediawiki-1.42.1/* ) Please, could You help me? Cheers, yugo

1 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l