Wikitech-l April 2025

wikitech-l@lists.wikimedia.org

51 participants
44 discussions

User style to reduce Gerritbot comments on Phabricator
by Bartosz Dziewoński 08 Jan '26

08 Jan '26

Do your eyes glaze over when trying to make sense of Phabricator tasks with a long and troubled history of patches? Do you struggle to find the real people in the sea of automated bot comments? I've made myself a user style to compact the Gerritbot comments on Phabricator. You might like it too: https://userstyles.world/style/13140/wikimedia-phabricator-reduce-gerritbot… (See screenshots and installation instructions there.) -- Bartosz Dziewoński

10 23

Struggling with Online Classes? Here's a Reliable Help Option!
by course fpx 19 Nov '25

19 Nov '25

Hey everyone, I’ve noticed a lot of students (including myself) struggling with the pressure of online classes, deadlines, and quizzes — especially with platforms like Capella FlexPath, WGU, and others. If you're overwhelmed, there’s a service I recently came across called Online Classes Help. They assist with everything from discussion posts and assignments to full course completion. Super helpful for those juggling jobs or other responsibilities! Whether you need one-time help or ongoing support, this could really reduce your stress and help you maintain a good GPA. Just make sure to use it ethically — as a support tool, not a shortcut! Has anyone else tried such services? Would love to hear your experiences. Cheers! fpr more info :https://coursefpx.com/online-class-help/

2 2

Forthcoming maintenance to irc.wikimedia.org - Moving to ircstream
by Moritz Mühlenhoff 30 Sep '25

30 Sep '25

Hi all, we're moving irc.wikimedia.org to a new infrastructure [1]. This service is unrelated to the IRC network (Libera) we use for real time discussions. Instead irc.wikimedia.org is an IRC service for broadcasting recent changes events from public Wikimedia wikis to be used by various bots connected to per-wiki IRC channels. irc.wikimedia.org should not be used for any new bots (which should rather use Eventstreams[2]), but we still have various important bots relying on the legacy IRC-based infrastructure. The current setup is full of technical debt and ultimately based on a patched version of a very old release of ircd-ratbox with a relay service written in Python 2. We are replacing it with a modern standalone implementation in Python, which broadcasts IRC notifications in a format compatible to what is currently in use by the legacy setup: https://github.com/paravoid/ircstream Last week during the SRE Infrastructure Foundations hackathon the ircstream production setup was created. All our tests have been successful, so on Thursday October 10 at 08:00 UTC we'll switch the irc.wikimedia.org DNS name to the new setup. No changes are needed to any bots, but if you run into any issues after the switch, please notify us in the #wikimedia-sre-foundations IRC channel or leave a note at https://phabricator.wikimedia.org/T376014. Cheers, Luca, Simon and Moritz Footnotes: [1] https://wikitech.wikimedia.org/wiki/Irc.wikimedia.org [2] https://wikitech.wikimedia.org/wiki/Event_Platform/EventStreams_HTTP_Service

4 3

MediaWiki Extensions and Skins Security Release Supplement (1.39.11/1.41.5/1.42.4)
by Manfredi Martorana 21 Aug '25

21 Aug '25

Greetings- With the security/maintenance release of MediaWiki 1.39.11/1.41.5/1.42.4, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: SocialProfile + (T373265 <https://phabricator.wikimedia.org/T373265>, CVE-2025-23074) - Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed) https://gerrit.wikimedia.org/r/q/I4b77ced314bc6cea0ef3657a82e7467d3661fe2a GlobalBlocking + (T377855 <https://phabricator.wikimedia.org/T377855>, CVE-2025-23073) - API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter https://gerrit.wikimedia.org/r/q/I2a2d32aedf6328be0a9f1b4e04a6567a25f19486 RefreshSpecial + (T378885 <https://phabricator.wikimedia.org/T378885>, CVE-2025-23072) - XSS in Special:RefreshSpecial https://gerrit.wikimedia.org/r/q/Ic9547e80a8296d707ad8a157eb8ba7aa26fb08dc DataTransfer + (T379749 <https://phabricator.wikimedia.org/T379749>, CVE-2025-23081) - Various security vulnerabilities in Extension:DataTransfer https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3 https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7 https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9 https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451 OpenBadges + (T381220 <https://phabricator.wikimedia.org/T381220>, CVE-2025-23080) - XSSes in Special:BadgeView https://gerrit.wikimedia.org/r/q/Ic9448312fa7f1cbc8feac3f852bc8720568522e2 ArticleFeedbackv5 + (T381753 <https://phabricator.wikimedia.org/T381753>, CVE-2025-23079) - XSSes in Extension:ArticleFeedbackv5 https://gerrit.wikimedia.org/r/q/I6ee51c8b518bda41739fd666fa2891cc12e79ac3 BreadCrumbs2 + (T382043 <https://phabricator.wikimedia.org/T382043>, CVE-2025-23078) - XSS in BreadCrumbs2 https://gerrit.wikimedia.org/r/q/I7878f8f7bc067080f80427b90f8d85337f172711 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T375631 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

Maintenance scripts are moving to Kubernetes
by Reuven Lazarus 23 Jul '25

23 Jul '25

Hi all, With MediaWiki at the WMF moving to Kubernetes, it's now time to start running manual maintenance scripts there. Any time you would previously SSH to a mwmaint host and run mwscript, follow these steps instead. The old way will continue working for a little while, but it will be going away. What's familiar: Starting a maintenance script looks like this: rzl@deploy2002:~$ mwscript-k8s --comment="T341553" -- Version.php --wiki=enwiki Any options for the mwscript-k8s tool, as described below, go before the --. After the --, the first argument is the script name; everything else is passed to the script. This is the same as you're used to passing to mwscript. What's different: - Run mwscript-k8s on a deployment host, not the maintenance host. Either deployment host will work; your job will automatically run in whichever data center is active, so you no longer need to change hosts when there’s a switchover. - You don't need a tmux. By default the tool launches your maintenance script and exits immediately, without waiting for your job to finish. If you log out of the deployment host, your job keeps running on the Kubernetes cluster. - Kubernetes saves the maintenance script's output for seven days after completion. By default, mwscript-k8s prints a kubectl command that you (or anyone else) can paste and run to monitor the output or save it to a file. - As a convenience, you can pass -f (--follow) to mwscript-k8s to immediately begin tailing the script output. If you like, you can do this inside a tmux and keep the same workflow as before. Either way, you can safely disconnect and your script will continue running on Kubernetes. rzl@deploy2002:~$ mwscript-k8s -f -- Version.php --wiki=testwiki [...] MediaWiki version: 1.43.0-wmf.24 LTS (built: 22:35, 23 September 2024) - For scripts that take input on stdin, you can pass --attach to mwscript-k8s, either interactively or in a pipeline. rzl@deploy2002:~$ mwscript-k8s --attach -- shell.php --wiki=testwiki [...] Psy Shell v0.12.3 (PHP 7.4.33 — cli) by Justin Hileman > $wmgRealm = "production" > rzl@deploy2002:~$ cat example_url.txt | mwscript-k8s --attach -- purgeList.php [...] Purging 1 urls Done! - Your maintenance script runs in a Docker container which will not outlive it, so it can't save persistent files to disk. Ensure your script logs its important output to stdout, or persists it in a database or other remote storage. - The --comment flag sets an optional (but encouraged) descriptive label, such as a task number. - Using standard kubectl commands[1][2], you can check the status, and view the output, of your running jobs or anyone else's. (Example: `kube_env mw-script codfw; kubectl get pod -l username=rzl`) [1]: https://wikitech.wikimedia.org/wiki/Kubernetes/Kubectl [2]: https://kubernetes.io/docs/reference/kubectl/quick-reference/ What's not supported yet: - Maintenance scripts launched automatically on a timer. We're working on migrating them -- for now, this is for one-off scripts launched by hand. - If your job is interrupted (e.g. by hardware problems), Kubernetes can automatically move it to another machine and restart it, babysitting it until it completes. But we only want to do that if your job is safe to restart. So by default, if your job is interrupted, it will stay stopped until you restart it yourself. Soon, we'll add an option to declare "this is idempotent, please restart it as needed" and that design is recommended for new scripts. - No support yet for mwscriptwikiset, foreachwiki, foreachwikiindblist, etc, but we'll add similar functionality as flags to mwscript_k8s. Your feedback: Let me know by email or IRC, or on Phab (T341553 <https://phabricator.wikimedia.org/T341553>). If mwscript-k8s doesn't work for you, for now you can fall back to using the mwmaint hosts as before -- but they will be going away. Please report any problems sooner rather than later, so that we can ensure the new system meets your needs before that happens. Thanks, Reuven, for Service Ops SRE

9 23

Upcoming Language Community Meeting (May 30th, 15:00 UTC), Newsletter, and Namespaces
by Oscar Costero 28 May '25

28 May '25

*My apologies for writing in English. Please help translate to your language.* Hello everyone! We're excited to announce that the next *Language Community Meeting* is happening soon, *May 30th at 15:00 UTC*! If you’d like to join, simply *sign up on the wiki page* <https://www.mediawiki.org/wiki/Wikimedia_Language_and_Product_Localization/…> . This is a participant-driven meeting where we share updates on language-related projects, discuss technical challenges in language wikis, and collaborate on solutions. In our upcoming meeting, we plan to cover results from a recent language onboarding experiment and hear experiences from a Nigerian contributor who contributes to the Obolo wiki, which was part of this experiment. *Got a topic to share?* Whether it’s a technical update from your project, a challenge you need help with, or a request for interpretation support, we’d love to hear from you! Feel free to reply to this message or add agenda items to *the document here* <https://etherpad.wikimedia.org/p/language-community-meeting-may-2025>. Also, we wanted to highlight that the 7th edition of the *Language & Internationalization newsletter (April 2025)* is available here: *Wikimedia Language and Product Localization/Newsletter/2025/April* <https://www.mediawiki.org/wiki/Special:MyLanguage/Wikimedia_Language_and_Pr…>. This newsletter provides updates from the January–March 2025 quarter on new feature development, improvements in various language-related technical projects and support efforts, details about community meetings, and ideas for contributing to projects. To stay updated, you can subscribe to the newsletter on its wiki page: *Wikimedia Language and Product Localization/Newsletter* <https://www.mediawiki.org/wiki/Special:MyLanguage/Newsletter:Language_and_I…> . Would you be interested in contributing to the technical workaround language development? There is a newcomer-friendly core namespace-related task waiting for your contribution: *T391725* <https://phabricator.wikimedia.org/T391725>. We look forward to your ideas and participation at the Language Community Meeting, see you there! Oscar Language Diversity Hub

2 2

Upcoming Codex 2.0 release
by Anne Tomasevich 27 May '25

27 May '25

The Design System Team (DST)[0] is preparing to release the next major version of Codex, the design system for Wikimedia. Codex has evolved significantly since the first major version release in late 2023: expanding the toolkit with a number of new components[1], tokens[2] and icons[3], introducing alternative color modes[4], adding a proper i18n system[5], refactoring components to be compatible with native browser validation[6], supporting the creation of a PHP implementation of the component library[7], refreshing the documentation, and (finally) getting a unique logo. With the upcoming introduction of a revised typography scale and customizable font modes[8] along with a handful of other breaking changes, DST has determined this to be an appropriate time for another major version release. ==== Timeline ==== DST plans to first release a release candidate (rc) of version 2.0.0 that will include all known breaking changes. It is anticipated that only one rc version will be released, but if major issues are discovered, there will be additional rcs until the build is considered stable enough to be the official major version. - v2.0.0-rc.1 will be released on 29 April 2025 and ride the deployment train the week of 5 May 2025 - v2.0.0 will be released on 13 May 2025 and ride the train the week of 19 May 2025 ==== Breaking Changes ==== Codex 2.0 will include a number of breaking changes that need to be addressed in downstream code to avoid compatibility issues. These are detailed in full along with guidance on how to prepare for the release at https://www.mediawiki.org/wiki/Codex/Release_Timeline/2.0#Breaking_changes. If you are using Codex for a feature actively deployed in Wikimedia production, please check to see if the breaking changes apply to your code. DST has already opened Phabricator tasks for known areas that need to be updated based on codesearch but this is likely not comprehensive. Thank you to everyone who has contributed to the development of Codex throughout its 1.0 lifespan! We look forward to seeing its use in Wikimedia projects continue to grow as it further evolves through this next major iteration. Anne Tomasevich, on behalf of the Design System Team [0] https://www.mediawiki.org/wiki/Design_System_Team [1] https://doc.wikimedia.org/codex/latest/components/overview.html [2] https://doc.wikimedia.org/codex/latest/design-tokens/overview.html [3] https://doc.wikimedia.org/codex/latest/icons/overview.html [4] https://doc.wikimedia.org/codex/latest/using-codex/adrs/08-adr-color-modes.… [5] https://doc.wikimedia.org/codex/latest/using-codex/adrs/10-adr-i18n-for-com… [6] https://doc.wikimedia.org/codex/latest/using-codex/adrs/12-adr-native-const… [7] https://doc.wikimedia.org/codex/latest/using-codex/adrs/11-adr-codex-php.ht… [8] https://doc.wikimedia.org/codex/latest/using-codex/adrs/13-adr-font-modes.h… [9] https://codesearch-beta.wmcloud.org/search -- Anne Tomasevich (she/her) Staff Software Engineer, Design System Wikimedia Foundation

4 3

FYI: Edge Uniques
by Brandon Black 12 May '25

12 May '25

Hi everyone, If you follow any technical Wikimedia news, you might have read about this in Tech News or on Diff already, but in case you missed it: The Wikimedia Foundation is working on a system called Edge Uniques which will enable A/B testing, help mitigate DDoS attacks, and eventually give better visitor metrics. We’re doing this by adding a first-party cookie named "WMF-Uniq" which is handled *only* on our CDN edge servers directly. This cookie contains a randomly-generated unique identifier and a few bits of minimal metadata about site visit history. We've explicitly designed this system such that we do *not* need to or intend to store these cookies or their identifiers in any databases or logs anywhere on our servers, or forward them to any other complex parts of our internal server-side infrastructure where the risks of accidental leakage or storage might be higher. It's a fairly unique system, and one that we've tried to design for maximal privacy preservation and data minimization for Wikimedians while also meeting our needs around both A/B testing of reader-oriented features and helping to control the server load from botnets of various kinds with resource-abusive patterns. The A/B testing portion of this design can record relevant, specific, pre-defined metrics into our analytics databases for those agents selected for testing (e.g. "an agent in Test123/GroupA clicked the new blue button"), but these metrics records use a temporary, per-experiment derivative identifier created by a one-way hash, making them non-reversible back to the original cookie identifiers. You can read more details on Meta: https://meta.wikimedia.org/wiki/Edge_Uniques If you want to talk to us about this, we’re happy to discuss it on the project talk page: https://meta.wikimedia.org/wiki/Talk:Edge_Uniques We’re also hosting an office hours/community call to answer questions or discuss the topic further on April 29, 14:00 UTC. See more info here: https://meta.wikimedia.org/wiki/Edge_Uniques#Next_steps -- Brandon Black Principal Site Reliability Engineer, SRE Traffic Team Wikimedia Foundation

3 3

Talk to the Search Platform / Query Service Team—May 7, 2025
by Guillaume Lederrey 07 May '25

07 May '25

Hello all! The Search Platform Team usually holds an open meeting on the first Wednesday of each month. Come talk to us about anything related to Wikimedia search, Wikidata Query Service (WDQS), Wikimedia Commons Query Service (WCQS), etc.! Feel free to add your items to the Etherpad Agenda for the next meeting. Details for our next meeting: Date: Wednesday, May 7, 2025 Time: 15:00-16:00 UTC / 08:00 PST / 11:00 EST / 17:00 CET Etherpad: https://etherpad.wikimedia.org/p/Search_Platform_Office_Hours Google Meet link: https://meet.google.com/vgj-bbeb-uyi Join by phone: https://tel.meet/vgj-bbeb-uyi?pin=8118110806927 Have fun and see you soon! Guillaume -- *Guillaume Lederrey* (he/him) Engineering Manager Wikimedia Foundation <https://wikimediafoundation.org/>

1 1

Gerrit is down for troubleshooting
by Lukasz Sobanski 30 Apr '25

30 Apr '25

Hi, Following the Gerrit switchover from gerrit2002 to gerrit1003 earlier today we noticed missing changes in the Gerrit interface. We shut down Gerrit to prevent further complications and are troubleshooting in T393034 <https://phabricator.wikimedia.org/T393034>. -- Lukasz Sobanski SRE

1 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l April 2025