Wikitech-l May 2025

wikitech-l@lists.wikimedia.org

26 participants
29 discussions

Forthcoming maintenance to irc.wikimedia.org - Moving to ircstream
by Moritz Mühlenhoff 30 Sep '25

30 Sep '25

Hi all, we're moving irc.wikimedia.org to a new infrastructure [1]. This service is unrelated to the IRC network (Libera) we use for real time discussions. Instead irc.wikimedia.org is an IRC service for broadcasting recent changes events from public Wikimedia wikis to be used by various bots connected to per-wiki IRC channels. irc.wikimedia.org should not be used for any new bots (which should rather use Eventstreams[2]), but we still have various important bots relying on the legacy IRC-based infrastructure. The current setup is full of technical debt and ultimately based on a patched version of a very old release of ircd-ratbox with a relay service written in Python 2. We are replacing it with a modern standalone implementation in Python, which broadcasts IRC notifications in a format compatible to what is currently in use by the legacy setup: https://github.com/paravoid/ircstream Last week during the SRE Infrastructure Foundations hackathon the ircstream production setup was created. All our tests have been successful, so on Thursday October 10 at 08:00 UTC we'll switch the irc.wikimedia.org DNS name to the new setup. No changes are needed to any bots, but if you run into any issues after the switch, please notify us in the #wikimedia-sre-foundations IRC channel or leave a note at https://phabricator.wikimedia.org/T376014. Cheers, Luca, Simon and Moritz Footnotes: [1] https://wikitech.wikimedia.org/wiki/Irc.wikimedia.org [2] https://wikitech.wikimedia.org/wiki/Event_Platform/EventStreams_HTTP_Service

4 3

MediaWiki Extensions and Skins Security Release Supplement (1.39.11/1.41.5/1.42.4)
by Manfredi Martorana 21 Aug '25

21 Aug '25

Greetings- With the security/maintenance release of MediaWiki 1.39.11/1.41.5/1.42.4, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: SocialProfile + (T373265 <https://phabricator.wikimedia.org/T373265>, CVE-2025-23074) - Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed) https://gerrit.wikimedia.org/r/q/I4b77ced314bc6cea0ef3657a82e7467d3661fe2a GlobalBlocking + (T377855 <https://phabricator.wikimedia.org/T377855>, CVE-2025-23073) - API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter https://gerrit.wikimedia.org/r/q/I2a2d32aedf6328be0a9f1b4e04a6567a25f19486 RefreshSpecial + (T378885 <https://phabricator.wikimedia.org/T378885>, CVE-2025-23072) - XSS in Special:RefreshSpecial https://gerrit.wikimedia.org/r/q/Ic9547e80a8296d707ad8a157eb8ba7aa26fb08dc DataTransfer + (T379749 <https://phabricator.wikimedia.org/T379749>, CVE-2025-23081) - Various security vulnerabilities in Extension:DataTransfer https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3 https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7 https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9 https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451 OpenBadges + (T381220 <https://phabricator.wikimedia.org/T381220>, CVE-2025-23080) - XSSes in Special:BadgeView https://gerrit.wikimedia.org/r/q/Ic9448312fa7f1cbc8feac3f852bc8720568522e2 ArticleFeedbackv5 + (T381753 <https://phabricator.wikimedia.org/T381753>, CVE-2025-23079) - XSSes in Extension:ArticleFeedbackv5 https://gerrit.wikimedia.org/r/q/I6ee51c8b518bda41739fd666fa2891cc12e79ac3 BreadCrumbs2 + (T382043 <https://phabricator.wikimedia.org/T382043>, CVE-2025-23078) - XSS in BreadCrumbs2 https://gerrit.wikimedia.org/r/q/I7878f8f7bc067080f80427b90f8d85337f172711 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T375631 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

Maintenance scripts are moving to Kubernetes
by Reuven Lazarus 23 Jul '25

23 Jul '25

Hi all, With MediaWiki at the WMF moving to Kubernetes, it's now time to start running manual maintenance scripts there. Any time you would previously SSH to a mwmaint host and run mwscript, follow these steps instead. The old way will continue working for a little while, but it will be going away. What's familiar: Starting a maintenance script looks like this: rzl@deploy2002:~$ mwscript-k8s --comment="T341553" -- Version.php --wiki=enwiki Any options for the mwscript-k8s tool, as described below, go before the --. After the --, the first argument is the script name; everything else is passed to the script. This is the same as you're used to passing to mwscript. What's different: - Run mwscript-k8s on a deployment host, not the maintenance host. Either deployment host will work; your job will automatically run in whichever data center is active, so you no longer need to change hosts when there’s a switchover. - You don't need a tmux. By default the tool launches your maintenance script and exits immediately, without waiting for your job to finish. If you log out of the deployment host, your job keeps running on the Kubernetes cluster. - Kubernetes saves the maintenance script's output for seven days after completion. By default, mwscript-k8s prints a kubectl command that you (or anyone else) can paste and run to monitor the output or save it to a file. - As a convenience, you can pass -f (--follow) to mwscript-k8s to immediately begin tailing the script output. If you like, you can do this inside a tmux and keep the same workflow as before. Either way, you can safely disconnect and your script will continue running on Kubernetes. rzl@deploy2002:~$ mwscript-k8s -f -- Version.php --wiki=testwiki [...] MediaWiki version: 1.43.0-wmf.24 LTS (built: 22:35, 23 September 2024) - For scripts that take input on stdin, you can pass --attach to mwscript-k8s, either interactively or in a pipeline. rzl@deploy2002:~$ mwscript-k8s --attach -- shell.php --wiki=testwiki [...] Psy Shell v0.12.3 (PHP 7.4.33 — cli) by Justin Hileman > $wmgRealm = "production" > rzl@deploy2002:~$ cat example_url.txt | mwscript-k8s --attach -- purgeList.php [...] Purging 1 urls Done! - Your maintenance script runs in a Docker container which will not outlive it, so it can't save persistent files to disk. Ensure your script logs its important output to stdout, or persists it in a database or other remote storage. - The --comment flag sets an optional (but encouraged) descriptive label, such as a task number. - Using standard kubectl commands[1][2], you can check the status, and view the output, of your running jobs or anyone else's. (Example: `kube_env mw-script codfw; kubectl get pod -l username=rzl`) [1]: https://wikitech.wikimedia.org/wiki/Kubernetes/Kubectl [2]: https://kubernetes.io/docs/reference/kubectl/quick-reference/ What's not supported yet: - Maintenance scripts launched automatically on a timer. We're working on migrating them -- for now, this is for one-off scripts launched by hand. - If your job is interrupted (e.g. by hardware problems), Kubernetes can automatically move it to another machine and restart it, babysitting it until it completes. But we only want to do that if your job is safe to restart. So by default, if your job is interrupted, it will stay stopped until you restart it yourself. Soon, we'll add an option to declare "this is idempotent, please restart it as needed" and that design is recommended for new scripts. - No support yet for mwscriptwikiset, foreachwiki, foreachwikiindblist, etc, but we'll add similar functionality as flags to mwscript_k8s. Your feedback: Let me know by email or IRC, or on Phab (T341553 <https://phabricator.wikimedia.org/T341553>). If mwscript-k8s doesn't work for you, for now you can fall back to using the mwmaint hosts as before -- but they will be going away. Please report any problems sooner rather than later, so that we can ensure the new system meets your needs before that happens. Thanks, Reuven, for Service Ops SRE

9 23

Talk to the Search Platform / Query Service Team—June 4, 2025
by Guillaume Lederrey 04 Jun '25

04 Jun '25

Hello all! The Search Platform Team usually holds an open meeting on the first Wednesday of each month. Come talk to us about anything related to Wikimedia search, Wikidata Query Service (WDQS), Wikimedia Commons Query Service (WCQS), etc.! Feel free to add your items to the Etherpad Agenda for the next meeting. Details for our next meeting: Date: Wednesday, June 4, 2025 Time: 15:00-16:00 UTC / 08:00 PST / 11:00 EST / 17:00 CET Etherpad: https://etherpad.wikimedia.org/p/Search_Platform_Office_Hours Google Meet link: https://meet.google.com/vgj-bbeb-uyi Join by phone: https://tel.meet/vgj-bbeb-uyi?pin=8118110806927 Have fun and see you soon! Guillaume *Guillaume Lederrey* (he/him) Engineering Manager Wikimedia Foundation <https://wikimediafoundation.org/>

1 1

Watchlist
by יגאל חיטרון 31 May '25

31 May '25

Hi. Was there any change of code right now? Saturday 19:00 UTC. Because I suddenly get a huge hole in my Watchlist, because of client-js .mw-rcfilters-collapsed.mw-special-Watchlist .mw-rcfilters-head { min-height: 220px; } I can, of course, add mw.util.addCSS('.client-js .mw-rcfilters-collapsed.mw-special-Watchlist .mw-rcfilters-head {min-height:initial !important}') but I'd really be glad to know from whence it came. Thank you. Igal (User:IKhitron) <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free.www.avg.com <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

1 0

OpenSearch can now be used in Wikimedia CI
by Jakob Warkotsch 28 May '25

28 May '25

Hi everyone, The CI MediaWiki jobs can now have OpenSearch enabled. This is useful for testing anything involving advanced search functionality provided by CirrusSearch. The first CI job to make use of this feature is the Wikibase api-testing suite (by setting QUIBBLE_OPENSEARCH=true via a config patch <https://gerrit.wikimedia.org/r/c/integration/config/+/1150758>). As a result we are now able to properly end-to-end test its search endpoints. At the moment, OpenSearch is only included in Quibble images 1.14.1+ based on Debian Bullseye. The work for this was largely tracked in T386691 <https://phabricator.wikimedia.org/T386691>. Cheers, Jakob -- Jakob Warkotsch Software Developer Wikimedia Deutschland e. V. | Tempelhofer Ufer 23-24 | 10963 Berlin Phone: +49 (0)30 219 158 26-0 https://wikimedia.de Imagine a world, in which every single human being can freely share in the sum of all knowledge. That‘s our commitment. Wikimedia Deutschland - Gesellschaft zur Förderung Freien Wissens e. V. Eingetragen im Vereinsregister des Amtsgerichts Berlin-Charlottenburg unter der Nummer 23855 B. Als gemeinnützig anerkannt durch das Finanzamt für Körperschaften I Berlin, Steuernummer 27/029/42207.

2 1

Upcoming Language Community Meeting (May 30th, 15:00 UTC), Newsletter, and Namespaces
by Oscar Costero 27 May '25

27 May '25

*My apologies for writing in English. Please help translate to your language.* Hello everyone! We're excited to announce that the next *Language Community Meeting* is happening soon, *May 30th at 15:00 UTC*! If you’d like to join, simply *sign up on the wiki page* <https://www.mediawiki.org/wiki/Wikimedia_Language_and_Product_Localization/…> . This is a participant-driven meeting where we share updates on language-related projects, discuss technical challenges in language wikis, and collaborate on solutions. In our upcoming meeting, we plan to cover results from a recent language onboarding experiment and hear experiences from a Nigerian contributor who contributes to the Obolo wiki, which was part of this experiment. *Got a topic to share?* Whether it’s a technical update from your project, a challenge you need help with, or a request for interpretation support, we’d love to hear from you! Feel free to reply to this message or add agenda items to *the document here* <https://etherpad.wikimedia.org/p/language-community-meeting-may-2025>. Also, we wanted to highlight that the 7th edition of the *Language & Internationalization newsletter (April 2025)* is available here: *Wikimedia Language and Product Localization/Newsletter/2025/April* <https://www.mediawiki.org/wiki/Special:MyLanguage/Wikimedia_Language_and_Pr…>. This newsletter provides updates from the January–March 2025 quarter on new feature development, improvements in various language-related technical projects and support efforts, details about community meetings, and ideas for contributing to projects. To stay updated, you can subscribe to the newsletter on its wiki page: *Wikimedia Language and Product Localization/Newsletter* <https://www.mediawiki.org/wiki/Special:MyLanguage/Newsletter:Language_and_I…> . Would you be interested in contributing to the technical workaround language development? There is a newcomer-friendly core namespace-related task waiting for your contribution: *T391725* <https://phabricator.wikimedia.org/T391725>. We look forward to your ideas and participation at the Language Community Meeting, see you there! Oscar Language Diversity Hub

2 2

Upcoming Codex 2.0 release
by Anne Tomasevich 27 May '25

27 May '25

The Design System Team (DST)[0] is preparing to release the next major version of Codex, the design system for Wikimedia. Codex has evolved significantly since the first major version release in late 2023: expanding the toolkit with a number of new components[1], tokens[2] and icons[3], introducing alternative color modes[4], adding a proper i18n system[5], refactoring components to be compatible with native browser validation[6], supporting the creation of a PHP implementation of the component library[7], refreshing the documentation, and (finally) getting a unique logo. With the upcoming introduction of a revised typography scale and customizable font modes[8] along with a handful of other breaking changes, DST has determined this to be an appropriate time for another major version release. ==== Timeline ==== DST plans to first release a release candidate (rc) of version 2.0.0 that will include all known breaking changes. It is anticipated that only one rc version will be released, but if major issues are discovered, there will be additional rcs until the build is considered stable enough to be the official major version. - v2.0.0-rc.1 will be released on 29 April 2025 and ride the deployment train the week of 5 May 2025 - v2.0.0 will be released on 13 May 2025 and ride the train the week of 19 May 2025 ==== Breaking Changes ==== Codex 2.0 will include a number of breaking changes that need to be addressed in downstream code to avoid compatibility issues. These are detailed in full along with guidance on how to prepare for the release at https://www.mediawiki.org/wiki/Codex/Release_Timeline/2.0#Breaking_changes. If you are using Codex for a feature actively deployed in Wikimedia production, please check to see if the breaking changes apply to your code. DST has already opened Phabricator tasks for known areas that need to be updated based on codesearch but this is likely not comprehensive. Thank you to everyone who has contributed to the development of Codex throughout its 1.0 lifespan! We look forward to seeing its use in Wikimedia projects continue to grow as it further evolves through this next major iteration. Anne Tomasevich, on behalf of the Design System Team [0] https://www.mediawiki.org/wiki/Design_System_Team [1] https://doc.wikimedia.org/codex/latest/components/overview.html [2] https://doc.wikimedia.org/codex/latest/design-tokens/overview.html [3] https://doc.wikimedia.org/codex/latest/icons/overview.html [4] https://doc.wikimedia.org/codex/latest/using-codex/adrs/08-adr-color-modes.… [5] https://doc.wikimedia.org/codex/latest/using-codex/adrs/10-adr-i18n-for-com… [6] https://doc.wikimedia.org/codex/latest/using-codex/adrs/12-adr-native-const… [7] https://doc.wikimedia.org/codex/latest/using-codex/adrs/11-adr-codex-php.ht… [8] https://doc.wikimedia.org/codex/latest/using-codex/adrs/13-adr-font-modes.h… [9] https://codesearch-beta.wmcloud.org/search -- Anne Tomasevich (she/her) Staff Software Engineer, Design System Wikimedia Foundation

4 3

RESTBase Sunset: Deprecation of emitted events to resource_change topic for URL /page/html
by Mateus Santos 27 May '25

27 May '25

Hello everyone, As part of the RESTBase Sunset, we will deprecate emitting events from RESTBase/Parsoid to the resource_change events topic for *URLs: /page/html/<title>*. We have done a preliminary investigation and we don’t foresee any disruptions since we haven’t found obvious consumers. However, we would appreciate any questions or concerns you might have. The deprecation will happen in 2 weeks, on *June 9th 2025*. Best, -- Mateus Santos Product Manager MediaWiki Engineering Group

1 0

Tech News 2025, week 22
by Uzoma Ozurumba 26 May '25

26 May '25

Latest *tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News>* from the Wikimedia technical community. Please tell other users about these changes. Not all changes will affect you. Translations <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2025/22> are available. *Weekly highlight* - A community-wide discussion about a very delicate issue for the development of Abstract Wikipedia <https://meta.wikimedia.org/wiki/Special:MyLanguage/Abstract_Wikipedia> is now open on Meta: where to store the abstract content that will be developed through functions from Wikifunctions and data from Wikidata. The discussion is open until June 12 at Abstract Wikipedia/Location of Abstract Content <https://meta.wikimedia.org/wiki/Special:MyLanguage/Abstract_Wikipedia/Locat…>, and every opinion is welcomed. The decision will be made and communicated after the consultation period by the Foundation. *Updates for editors* - Since last week, on all wikis except the largest 20 <https://phabricator.wikimedia.org/T388604>, people using the mobile visual editor will have additional tools in the menu bar <https://phabricator.wikimedia.org/T385851>, accessed using the new + toolbar button. To start, the new menu will include options to add: citations, hieroglyphs, and code blocks. Deployment to the remaining wikis is scheduled <https://phabricator.wikimedia.org/T388605> to happen in June. - [image: Advanced item] The #ifexist <https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Extension:ParserFunc…> parser function will no longer register a link to its target page. This will improve the usefulness of Special:WantedPages <https://meta.wikimedia.org/wiki/Special:WantedPages>, which will eventually only list pages that are the target of an actual red link. This change will happen gradually as the source pages are updated. [1] <https://phabricator.wikimedia.org/T14019> - This week, the Moderator Tools team will launch a new filter to Recent Changes <https://www.mediawiki.org/wiki/Special:MyLanguage/2025_RecentChanges_Langua…>, starting at Indonesian Wikipedia. This new filter highlights edits that are likely to be reverted. The goal is to help Recent Changes patrollers identify potentially problematic edits. Other wikis will benefit from this filter in the future. - Upon clicking an empty search bar, logged-out users will see suggestions of articles for further reading. The feature will be available on both desktop and mobile. Readers of Catalan, Hebrew, and Italian Wikipedias and some sister projects will receive the change between May 21 and mid-June. Readers of other wikis will receive the change later. The goal is to encourage users to read the wikis more. Learn more <https://www.mediawiki.org/wiki/Special:MyLanguage/Reading/Web/Content_Disco…> . - Some users of the Wikipedia Android app can use a new feature for readers, WikiGames <https://www.mediawiki.org/wiki/Special:MyLanguage/Wikimedia_Apps/Team/Andro…>, a daily trivia game based on real historical events. The release has started as an A/B test, available to 50% of users in the following languages: English, French, Portuguese, Russian, Spanish, Arabic, Chinese, and Turkish. - The Newsletter extension <https://www.mediawiki.org/wiki/Special:MyLanguage/Extension:Newsletter> that is available on MediaWiki.org allows the creation of various newsletters <https://www.mediawiki.org/wiki/Special:Newsletters> for global users. The extension can now publish new issues as section links on an existing page, instead of requiring a new page for each issue. [2] <https://phabricator.wikimedia.org/T393844> - [image: Recurrent item] View all 32 community-submitted tasks that were resolved last week <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Recently_resol…> . *Updates for technical contributors* - The previously deprecated ipblocks <https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Ipblocks_table> views in Wiki Replicas <https://wikitech.wikimedia.org/wiki/Help:Wiki_Replicas> will be removed in the beginning of June. Users are encouraged to query the new block <https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Block_table> and block_target <https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Block_target_table> views instead. - [image: Recurrent item] Detailed code updates later this week: MediaWiki <https://www.mediawiki.org/wiki/MediaWiki_1.45/wmf.3> *Meetings and events* - Wikidata and Sister Projects <https://www.wikidata.org/wiki/Special:MyLanguage/Event:Wikidata_and_Sister_…> is a multi-day online event that will focus on how Wikidata is integrated to Wikipedia and the other Wikimedia projects. The event runs from May 29 – June 1. You can read the Program schedule <https://www.wikidata.org/wiki/Special:MyLanguage/Event:Wikidata_and_Sister_…> and register <https://www.wikidata.org/wiki/Special:RegisterForEvent/1291>. *Tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News> prepared by Tech News writers <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Writers> and posted by bot <https://meta.wikimedia.org/wiki/Special:MyLanguage/User:MediaWiki_message_d…> • Contribute <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News#contribute> • Translate <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2025/22> • Get help <https://meta.wikimedia.org/wiki/Tech> • Give feedback <https://meta.wikimedia.org/wiki/Talk:Tech/News> • Subscribe or unsubscribe <https://meta.wikimedia.org/wiki/Global_message_delivery/Targets/Tech_ambass…>.* -- Uzoma Ozurumba (She/her) Movement Communications Specialist (Product and Tech) meta.wikimedia.org/wiki/User:UOzurumba_(WMF)

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l May 2025