Hi Sam,
It looks like Git tags have not yet been created for these new releases - are they coming?
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+refs
On Wed, Dec 10, 2025 at 2:23 PM Sam Reed reedy@wikimedia.org wrote:
I would like to announce the release of MediaWiki 1.39.16, 1.43.6, 1.44.3 and 1.45.1!
These releases serve as security and maintenance releases for these branches.
The tarballs have already been uploaded as of this email, and the git tags will be pushed shortly.
A "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions.
Reports of bugs with PHP 8.0 to 8.5 support are particularly welcome, and fixes will be back-ported when possible. If you find issues that haven't been backported, please report these too, referring to the relevant supported release.
PHP 8.x workboards:
- https://phabricator.wikimedia.org/tag/php_8.0_support/
- https://phabricator.wikimedia.org/tag/php_8.1_support/
- https://phabricator.wikimedia.org/tag/php_8.2_support/
- https://phabricator.wikimedia.org/tag/php_8.3_support/
- https://phabricator.wikimedia.org/tag/php_8.4_support/
- https://phabricator.wikimedia.org/tag/php_8.5_support/
As a reminder, MediaWiki 1.35 became end of life (EOL) in December 2023, MediaWiki 1.40 became EOL in June 2024, MediaWiki 1.41 became EOL in December 2024 and MediaWiki 1.42 became EOL at the end of June 2025.
MediaWiki 1.39 (the old LTS before 1.43) becomes EOL in December 2025, later this month. It is strongly recommended to upgrade to 1.43 (the next LTS after 1.39), which will be supported until December 2027.
A formal EOL email for MediaWiki 1.39 will come later this month. This is because as per our support policy, it is to be supported until the end of the month, but we are not expecting any further changes to be made to the branch.
For T401987/T401995, when using format=xml with the api, the xslt feature has been disabled by default for all installations. If for some reason you need it (modern browsers won't likely load the stylesheets anyway), you can turn it back on again by setting `$wgEnableUnsafeXsltOption = true;` in LocalSettings.php, but this functionality will be removed in 1.46, so you should migrate any usages ahead of this removal occuring.
== Security fixes ==
- (T401987, T401995, CVE-2025-67484) SECURITY: Disable xslt option by
default.
- (T406639, CVE-2025-67477) SECURITY: Escape word-separator message in
Special:ApiSandbox.
- (T406664, CVE-2025-67475) SECURITY: Escape square brackets in
autocomment links.
- (T405859, CVE-2025-67476) SECURITY: Do not use importers IP in case of
external rev author.
- (T385403, CVE-2025-67478) SECURITY: Always escape commas in mail
encoded-words.
- (T407131, CVE-2025-67479) SECURITY: Sanitizer: disallow underscore and
wide underscore in data-* attribute names.
- (T401053, CVE-2025-67480) SECURITY: Check read permissions in
ApiQueryRevisionsBase.
- (T409226, CVE-2025-67483) SECURITY: mediawiki.page.preview: Escape
'comma-separator' between multiple protection levels.
- (T251032, CVE-2025-67481) SECURITY: Disallow 'style' attribute in
client-side messages (jqueryMsg).
- (T408135, CVE-2025-67482) SECURITY: Lua segfault in unpack().
== Links to all mentioned tasks ==
- https://phabricator.wikimedia.org/T251032
- https://phabricator.wikimedia.org/T385403
- https://phabricator.wikimedia.org/T401053
- https://phabricator.wikimedia.org/T401987
- https://phabricator.wikimedia.org/T401995
- https://phabricator.wikimedia.org/T405859
- https://phabricator.wikimedia.org/T406639
- https://phabricator.wikimedia.org/T406664
- https://phabricator.wikimedia.org/T407131
- https://phabricator.wikimedia.org/T408135
- https://phabricator.wikimedia.org/T409226
== Release notes ==
Full release notes for 1.39.16:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_39/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.39
Full release notes for 1.43.6:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_43/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.43
Full release notes for 1.44.3:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_44/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.44
Full release notes for 1.45.1:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_45/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.45
For information about how to upgrade, see https://www.mediawiki.org/wiki/Manual:Upgrading
Download: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.tar.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.16.tar.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.16.zip
Patch to previous version (1.39.15): https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.patch.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.patch.zip
GPG signatures:
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.16.tar.gz....
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.16.zip.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.zip.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.16.patch.zip.si...
Public keys: https://www.mediawiki.org/keys/keys.html
Download: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.tar.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.6.tar.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.6.zip
Patch to previous version (1.43.5): https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.patch.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.patch.zip
GPG signatures:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.6.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.6.zip.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.zip.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.6.patch.zip.sig
Public keys: https://www.mediawiki.org/keys/keys.html
Download: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.tar.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.3.tar.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.3.zip
Patch to previous version (1.44.2): https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.patch.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.patch.zip
GPG signatures:
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.3.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.3.zip.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.zip.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.3.patch.zip.sig
Public keys: https://www.mediawiki.org/keys/keys.html
Download: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.tar.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.1.tar.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.1.zip
Patch to previous version (1.45.0): https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.patch.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.patch.zip
GPG signatures:
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.1.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.1.zip.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.zip.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.1.patch.zip.sig
Public keys: https://www.mediawiki.org/keys/keys.html _______________________________________________ MediaWiki-l mailing list -- mediawiki-l@lists.wikimedia.org To unsubscribe send an email to mediawiki-l-leave@lists.wikimedia.org
https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/