Wikitech-l July 2025

wikitech-l@lists.wikimedia.org

19 participants
12 discussions

New Built-in Notifications system in MediaWiki 1.44
by Jonathan Tweed 12 Jul '25

12 Jul '25

Hi all, We’re excited to share that the MediaWiki Platform team has released a major improvement to how notifications are handled across MediaWiki and Echo. As part of MediaWiki 1.44 <https://www.mediawiki.org/wiki/MediaWiki_1.44> we’ve introduced a unified Built-in Notifications <https://www.mediawiki.org/wiki/Manual:Notifications> system that replaces the current complex mix of hooks and other patterns with a more consistent interface. This makes it easier to send, manage, and customize notifications across the platform. What’s changing There is a new way to trigger notifications through the new system and an easier way to manage notification overrides through the new NotificationsMiddleware. We are also deprecating several hooks as part of this work. The new framework doesn’t deliver or display notifications directly, instead relying on pluggable handlers defined by extensions. Echo has been updated to become a handler and Enotif has been reimplemented on top of the new built-in notifications. Migrating notifications Check out the updated documentation at Manual:Notifications <https://www.mediawiki.org/wiki/Manual:Notifications> to: - Start using NotificationService::notify() instead of Event::create() - Switch from notification-related hooks to the new NotificationMiddleware system You can also find further information on Phabriactor: T388663 <https://phabricator.wikimedia.org/T388663> Deprecated hooks If your extension uses any of the following hooks please check the relevant Phabricator tasks and migration examples: - AbortEmailNotification (https://phabricator.wikimedia.org/T389618) - SendWatchlistEmailNotification (https://phabricator.wikimedia.org/T388003 ) - AbortTalkPageEmailNotification (https://phabricator.wikimedia.org/T388004 ) - Echo\EventInsertComplete (https://phabricator.wikimedia.org/T395913) - UpdateUserMailerFormattedPageStatus ( https://phabricator.wikimedia.org/T395050) There is a parent task for all deprecation activities: T389624 <https://phabricator.wikimedia.org/T389624> This work is part of our broader effort to simplify feature development through iterative improvements to platform architecture <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Artifacts/Simplif…>. We really appreciate all your help and feedback as we continue to improve MediaWiki. Thanks! MediaWiki Platform -- *Jonathan Tweed* (he/him) Senior Product Manager, Core Platform Wikimedia Foundation <https://wikimediafoundation.org/>

3 2

Beta Cluster now lives on beta.wmcloud.org
by Timo Tijhof 11 Jul '25

11 Jul '25

TLDR: - Report issues to https://phabricator.wikimedia.org/T289318 - If you use an autofill password manager, change the beta.*wmflabs*.org URL to beta.*wmcloud*.org. - If you maintain any automated requests to Beta Cluster, update your URLs. - In the future, browsers will enforce cookie restrictions for *.beta.wmcloud.org the same way as *.org. Hi all, Back in 2020, the wmcloud.org domain became the default for projects hosted in Cloud VPS <https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS>, the cloud computing infrastructure provided by Wikimedia Cloud Services. [1][2] This follows the rebranding of Wikimedia Labs in 2017. [3][4] While most of the 200+ Cloud VPS projects can (or have) migrated their subdomains relatively easily, the Beta Cluster project is a bit more complicated. There are assumptions at every level that the Beta equivalent of a production site like en.wikipedia.org lives at en.wikipedia.beta.*wmflabs*.org (including Varnish, TLS cert, Apache, Puppet, MediaWiki multiversion routing, MediaWiki wmf-config, Swift, Puppet, and WikimediaDebug). Last month, I audited the services at each of these levels (their Hiera data, Puppet manifests, and Apache config) and any relevant MediaWiki configuration (e.g. Interwiki maps, LocalVHost proxy, CORS grants, Content-Security-Policy grants, UrlShortener, GlobalUserPage, and FileImporter) and identified what needs to change, whether it can support both, and what other thing it requires to add/change first to come up with an order of execution, to ensure a smooth transition. As of last month, Wednesday June 4th, all wikis in the Beta Cluster support a beta.wmcloud.org hostname as alias, in addition to the canonical beta.wmflabs.org subdomain. Over the past week, I've switched the canonical hostname for Beta Wikidata, Beta Commons, Beta Wikipedia, and other Beta Cluster wikis and services from beta.wmflabs.org to beta.wmcloud.org. This means pageview URLs such as https://en.wikipedia.beta.wmflabs.org/wiki/Special:Blankpage now redirect to https://en.wikipedia.beta.wmcloud.org/wiki/Special:Blankpage. Requests to /w/api.php, /w/rest.php, and most other services work both ways and don't (yet) redirect. As part of this transition, I eliminated a few Beta-specific inconsistencies. Read the task for details, but the more notable ones include: * Wikidata hostname: wikidata.beta -> www.wikidata.beta. This now includes "www." to match prod. This makes beta/prod config syncing less error prone in the future, and fixes the last exemption to the expectation that all wikis have a two-segment domain name. It also simplifies TLS certs routing. * Multiversion routing, now translates automatically and re-uses production logic instead of needing its own. * Cookie and CORS restrictions. https://github.com/publicsuffix/list/pull/2527 [5] ipedia.org and zh.wikipedia.org are : I've requested that PSL include beta.wmcloud.org so that the different domains are treated as their own origins in the browser. This will make testing of CentralAuth CORS If you have an autofill in your password manager associated with a domain like beta.wmflabs.org or auth.wikimedia.beta.wmflabs.org, change this to beta.wmcloud.org accordingly. Also, if you still have entries based on pre-SUL3 logins for en.wikipedia.beta.wmflabs.org or login.wikimedia.beta.wmflabs.org, you may want to remove or update those as well while at it. If you maintain any automated requests to Beta Cluster (such as demos, test fixtures, etc), please update your URLs accordingly. In a couple of weeks, I'll change make these domains redirect which may break or change behaviour of scripts that don't expect HTTP redirects. See also: Codesearch <https://codesearch.wmcloud.org/search/?q=%5C.beta.wmflabs.org>. While at it, if the code in question should not actually make a request to the Beta Cluster, consider using a TLD such as "foobar.example" instead. If you encounter any issues, please report them to https://phabricator.wikimedia.org/T289318. -- Timo Tijhof, MediaWiki Engineering, Wikimedia Foundation. [1]: https://wikitech.wikimedia.org/wiki/News/Wmcloud.org [2]: https://wikitech.wikimedia.org/wiki/News/2020_Phasing_out_the_.wmflabs_doma… [3]: https://phabricator.wikimedia.org/T166404 (FY17-18 P10.2: Rebranding Labs) [4]: https://wikitech.wikimedia.org/wiki/Help:Labs_labs_labs [5] Addendum: Browsers allow cookies to be shared by subdomains of the same parent, unless that parent is an eTLD <https://en.wikipedia.org/wiki/Public_Suffix_List> like ".org" or ".co.uk" because two domains may have a different owner. The list of eTLDs is known as the "public suffix list", and mostly contains what you'd expect: suffixes that you can buy a domain name under from a domain registrar. However, there is no technical reason why money needs to be involved. For example, github.io and our own toolforge.org are also considered public suffixes. While you can't manage domain names under these in the traditional way, they nonetheless allow different people to independently host web pages under their own domain, which would otherwise be at risk of tracking cookies and cross-site scripting. Beta Cluster wikis were essentially all equal subdomains under the same domain name (beta.wmflabs.org). This meant that, unlike in production, a domain like en.wikipedia.beta.wmflabs.org could read cookies from auth.wikimedia.beta.wmflabs.org. Last year, in order to realistically test authentication in the Beta Cluster for the MediaWiki SUL3 project <https://www.mediawiki.org/wiki/MediaWiki_Platform_Team/SUL3>, we moved one wiki (test2.wikipedia.beta) from beta.wmflabs.org to beta.wmcloud.org, so that it would not be a sibling (T355281 <https://phabricator.wikimedia.org/T355281>). Todays migration essentially reverses this, because all wikis are now under the same umbrella again. This doesn't break anything, because this actually grants the sites more power, not less; and given that production uses separate domains, we don't have code relying on this anyway. But, it was of course valuable to be able to validate this with strict enforcement by the browser. To solve this going forward, I asked Mozilla to include "beta.wmcloud.org" in the Public Suffix List. This is routinely pulled into downstream repos by other browser vendors, and tools like Curl. This means wikipedia.beta and wiktionary.beta will be considered separate domains, just like they are in production. If you're curious how this works, check https://github.com/publicsuffix/list/pull/2527.

1 0

Probable phabricator.wikimedia.org downtime 2025-07-15 @ 15:00 UTC
by Brennen Bearnes 10 Jul '25

10 Jul '25

Hey all, We're tentatively planning an upgrade to Phabricator (Phorge) for this coming Tuesday, July 15th, at 15:00 UTC (08:00 PDT), which will require some downtime for database operations. Based on testing, I expect this to take an hour or so. I say tentatively because I'm still figuring out some logistics and may need to push this back, but it is _reasonably likely_ to happen. Updates as events warrant. -- Brennen Bearnes Release Engineering Wikimedia Foundation

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.39.13/1.42.7/1.43.2)
by Manfredi Martorana 09 Jul '25

09 Jul '25

1 0

Linear git history in Gerrit via automatic Rebase
by Antoine Musso 09 Jul '25

09 Jul '25

Hello, I have changed how Gerrit integrates changes which will eliminate the extra merge commits created by CI and ensure linear git history. By default, when Gerrit submits a change it first attempt to fast forward the target branch. If it is not possible, it creates a merge commit and fast-forwards the branch to it. I have changed our configuration so that Gerrit will now rebase changes instead of generating those merge commits. Thus when previously you would have an history with a merge commit: * (master) Merge "Some nice feature" <jenkins-bot> |\ | * Some nice feature <Jane Doe> |/ * The base branch <Ann Onymous> With this change Gerrit I have made, Gerrit would now rebase the change. The history would now looks like: * (master) Some nice feature <Jane Doe> * The base branch <Ann Onymous> This ensures our branches have a linear history, that would make it easier to follow. Please let me know if you have any questions or encounter issues. References: * Gerrit submit strategy: https://gerrit.wikimedia.org/r/Documentation/config-project-config.html#sub… * Change default strategy to Rebase if Necessary: https://phabricator.wikimedia.org/T390719 Antoine "hashar" Musso Wikimedia Release Engineering team

4 4

seeking an AI/ML + Wiki* speaker for an October conference in Kosovo
by Arianit Dobroshi 09 Jul '25

09 Jul '25

Hello, I’m reaching out on behalf of Wikimedians of Albanian Language User Group (WoALUG) seeking a speaker on AI/ML + Wiki* for Software Freedom Kosova Conference (SFK) held in Prishtina, Kosovo. Over the years, SFK has brought together FLOSS contributors, technologists, educators, and digital rights advocates from across the Balkans and beyond. SFK is organized by FLOSSK (https://flossk.org). WoALUG has in its annual plan support for a Wikimedia tech speaker. The conference is planned for October 24 (evening), 25 (main event) 26 (mid-day), 2025 in Prishtina. WoALUG will cover travel from Europe and hotel. Interested persons please email me at arianit(a)gmail.com with a short pitch. Thank you, Arianit

1 0

Maintenance scripts are moving to Kubernetes
by Reuven Lazarus 09 Jul '25

09 Jul '25

Hi all, With MediaWiki at the WMF moving to Kubernetes, it's now time to start running manual maintenance scripts there. Any time you would previously SSH to a mwmaint host and run mwscript, follow these steps instead. The old way will continue working for a little while, but it will be going away. What's familiar: Starting a maintenance script looks like this: rzl@deploy2002:~$ mwscript-k8s --comment="T341553" -- Version.php --wiki=enwiki Any options for the mwscript-k8s tool, as described below, go before the --. After the --, the first argument is the script name; everything else is passed to the script. This is the same as you're used to passing to mwscript. What's different: - Run mwscript-k8s on a deployment host, not the maintenance host. Either deployment host will work; your job will automatically run in whichever data center is active, so you no longer need to change hosts when there’s a switchover. - You don't need a tmux. By default the tool launches your maintenance script and exits immediately, without waiting for your job to finish. If you log out of the deployment host, your job keeps running on the Kubernetes cluster. - Kubernetes saves the maintenance script's output for seven days after completion. By default, mwscript-k8s prints a kubectl command that you (or anyone else) can paste and run to monitor the output or save it to a file. - As a convenience, you can pass -f (--follow) to mwscript-k8s to immediately begin tailing the script output. If you like, you can do this inside a tmux and keep the same workflow as before. Either way, you can safely disconnect and your script will continue running on Kubernetes. rzl@deploy2002:~$ mwscript-k8s -f -- Version.php --wiki=testwiki [...] MediaWiki version: 1.43.0-wmf.24 LTS (built: 22:35, 23 September 2024) - For scripts that take input on stdin, you can pass --attach to mwscript-k8s, either interactively or in a pipeline. rzl@deploy2002:~$ mwscript-k8s --attach -- shell.php --wiki=testwiki [...] Psy Shell v0.12.3 (PHP 7.4.33 — cli) by Justin Hileman > $wmgRealm = "production" > rzl@deploy2002:~$ cat example_url.txt | mwscript-k8s --attach -- purgeList.php [...] Purging 1 urls Done! - Your maintenance script runs in a Docker container which will not outlive it, so it can't save persistent files to disk. Ensure your script logs its important output to stdout, or persists it in a database or other remote storage. - The --comment flag sets an optional (but encouraged) descriptive label, such as a task number. - Using standard kubectl commands[1][2], you can check the status, and view the output, of your running jobs or anyone else's. (Example: `kube_env mw-script codfw; kubectl get pod -l username=rzl`) [1]: https://wikitech.wikimedia.org/wiki/Kubernetes/Kubectl [2]: https://kubernetes.io/docs/reference/kubectl/quick-reference/ What's not supported yet: - Maintenance scripts launched automatically on a timer. We're working on migrating them -- for now, this is for one-off scripts launched by hand. - If your job is interrupted (e.g. by hardware problems), Kubernetes can automatically move it to another machine and restart it, babysitting it until it completes. But we only want to do that if your job is safe to restart. So by default, if your job is interrupted, it will stay stopped until you restart it yourself. Soon, we'll add an option to declare "this is idempotent, please restart it as needed" and that design is recommended for new scripts. - No support yet for mwscriptwikiset, foreachwiki, foreachwikiindblist, etc, but we'll add similar functionality as flags to mwscript_k8s. Your feedback: Let me know by email or IRC, or on Phab (T341553 <https://phabricator.wikimedia.org/T341553>). If mwscript-k8s doesn't work for you, for now you can fall back to using the mwmaint hosts as before -- but they will be going away. Please report any problems sooner rather than later, so that we can ensure the new system meets your needs before that happens. Thanks, Reuven, for Service Ops SRE

9 22

Technical issue
by Leonid G 09 Jul '25

09 Jul '25

Dear Wikitechs, my username is Martinitolove, since 12 years Im contributing in several languages and am very glad to feel myself a part of a greater team to provide knowledge to the world! All these years Im using a Windows XP laptop with Firefox 52.9.0 (32-bit) on it, and am quite happy with it (wont change the system). But since two weeks most pictures and map links are not showing up properly. Here are the screenshots as an example of one page in three languages and an example of a picture file: https://drive.google.com/file/d/1fYqWSfaJ18Zperk4-9XtwWqPBPZWv4ZL/view?usp=s haring https://drive.google.com/file/d/1fcd9RMvy0dAP8fQT8wQbowOKBJ1XQcUk/view?usp=s haring https://drive.google.com/file/d/1OLszK9GZRb0U_DGI0NFhCqg3H9YmjUrD/view?usp=s haring https://drive.google.com/file/d/1Co47IT2LbCFiX0K84wns7WlrsCGucEvQ/view?usp=s haring Was a coding algorithm at Wikipedia changed or support for older browsers disabled? According to this (https://www.mediawiki.org/wiki/Template:Compatibility_browser) my browser is still supported. If it has been caused by mistake, then could you please turn it back on? Thanks and kind regards! Martini

9 23

Tech News 2025, week 28
by Nick Wilson (Quiddity) 08 Jul '25

08 Jul '25

Latest *tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News>* from the Wikimedia technical community. Please tell other users about these changes. Not all changes will affect you. Translations <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2025/28> are available. *Weekly highlight* - Temporary accounts <https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Temporary_accounts> have been rolled out on 18 large and medium-sized Wikipedias, including German, Japanese, French, and Chinese. Now, about 1/3 of all logged-out activity across wikis is coming from temporary accounts. Users involved in patrolling may be interested in two new documentation pages: Access to IP <https://www.mediawiki.org/wiki/Special:MyLanguage/Trust_and_Safety_Product/…>, explaining everything related to access to temporary account IP addresses, and Repository <https://www.mediawiki.org/wiki/Special:MyLanguage/Trust_and_Safety_Product/…> with a list of new gadgets and user scripts. *Updates for editors* - Anyone can play an experimental new game, WikiRun <https://www.mediawiki.org/wiki/Special:MyLanguage/New_Engagement_Experiment…>, that lets you race through Wikipedia by clicking from one article to another, aiming to reach a target page in as few steps and in as little time as possible. The project's goal is to explore new ways of engaging readers. Try playing the game <https://wikirun-game.toolforge.org/> and let the team know what you think on the talk page <https://www.mediawiki.org/wiki/Talk:New_Engagement_Experiments/WikiRun>. - Users of the Wikipedia Android app in some languages can now play the new trivia game <https://www.mediawiki.org/wiki/Special:MyLanguage/Wikimedia_Apps/Team/Andro…>. *Which came first?* is a simple history game where you guess which of two events happened earlier on today's date. It was previously available as an A/B test. It is now available to all users in English, German, French, Spanish, Portuguese, Russian, Arabic, Turkish, and Chinese. The goal of the feature is to help engage with new generations of readers. [1] <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2025/22> - Users of the iOS Wikipedia App in some languages may see a new tabbed browsing feature that enables you to open multiple tabs while reading. This feature makes it easier to explore related topics and switch between articles. The A/B test is currently running in Arabic, English, and Japanese in selected regions. More details are available on the Tabbed Browsing project page <https://www.mediawiki.org/wiki/Special:MyLanguage/Wikimedia_Apps/Team/iOS/T…> . - Bureaucrats on Wikimedia wikis can now use Special:VerifyOATHForUser <https://meta.wikimedia.org/wiki/Special:VerifyOATHForUser> to check if users have enabled two-factor authentication <https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Two-factor_authentic…>. [2] <https://phabricator.wikimedia.org/T265726> - A new feature related to Template Recall and Discovery <https://meta.wikimedia.org/wiki/Special:MyLanguage/Community_Wishlist/Focus…> will be deployed later this week to all Wikimedia projects: a template category browser <https://www.mediawiki.org/wiki/Special:MyLanguage/Help:TemplateData/Templat…> will be introduced to assist users in finding templates to put in their “favourite” list. The browser will allow users to browse a list of templates which have been organised into a given category tree. The feature has been requested by the community through the Community Wishlist <https://meta.wikimedia.org/wiki/Special:MyLanguage/Community_Wishlist/Wishe…> . - It is now possible to access watchlist preferences from the watchlist page. Also the redundant button to edit the watchlist has been removed. [3] <https://www.mediawiki.org/wiki/Moderator_Tools/Watchlist> - View all 27 community-submitted tasks that were resolved last week <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Recently_resol…> . *Updates for technical contributors* - As part of MediaWiki 1.44 <https://www.mediawiki.org/wiki/MediaWiki_1.44> there is now a unified built-in Notifications system that makes it easier for developers to send, manage, and customize notifications. Check out the updated documentation at Manual:Notifications <https://www.mediawiki.org/wiki/Manual:Notifications>, information about migration in T388663 <https://phabricator.wikimedia.org/T388663> and details on deprecated hooks in T389624 <https://phabricator.wikimedia.org/T389624>. - Detailed code updates later this week: MediaWiki <https://www.mediawiki.org/wiki/MediaWiki_1.45/wmf.9> *Meetings and events* - WikidataCon 2025 <https://www.wikidata.org/wiki/Special:MyLanguage/Event:WikidataCon_2025>, the conference dedicated to Wikidata is now open for session proposals <https://pretalx.com/wikidatacon-2025/cfp> and for registration <https://www.wikidata.org/wiki/Special:RegisterForEvent/1340>. This year's event will be held online from October 31 – November 02 and will explore on the theme of "Connecting People through Linked Open Data". *Tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News> prepared by Tech News writers <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Writers> and posted by bot <https://meta.wikimedia.org/wiki/Special:MyLanguage/User:MediaWiki_message_d…> • Contribute <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News#contribute> • Translate <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2025/28> • Get help <https://meta.wikimedia.org/wiki/Tech> • Give feedback <https://meta.wikimedia.org/wiki/Talk:Tech/News> • Subscribe or unsubscribe <https://meta.wikimedia.org/wiki/Global_message_delivery/Targets/Tech_ambass…>.*

1 0

Announcing MediaWiki 1.44.0
by Mateus Santos 02 Jul '25

02 Jul '25

I am happy to announce the availability of the general release of MediaWiki 1.44! Tarballs have already been uploaded, and the git tag has been pushed. Thanks to everyone who helped out with this release, especially thanks to those who tested out the release candidate and provided feedback, as well as the developers who worked on fixes for the 1.44 final release. To see what's changed in 1.44, see the release notes file.[0] If you encounter any issues, please file a task.[1] You can see open tasks for the branch on Phabricator.[2] MediaWiki 1.44 is the first release of MediaWiki to formally drop PHP 7.4 and PHP 8.0 support; you should use PHP 8.1, 8.2, or 8.3. We also now have dropped support for Composer 1.x, and require Composer 2.x for those systems using it. MediaWiki 1.44 is due to be supported until the end of June 2026. It is noted that MediaWiki 1.42 is end-of-life as of June 30th 2025. A formal announcement was made this week, and will co-incide with the next security and maintenance release which was also scheduled for June 2025. === Changes since MediaWiki 1.44.0-rc.0 === * Localisation updates. * (T379445) debug: Migrate E_USER_ERROR to throw Error in DeprecationHelper. * (T379445) Setup: Switch vendor error from echo+E_USER_ERROR to echo+exit. * Setup: Update error message for composer dependencies check. * (T381341, T379445) widget: Remove outdated try/catch wrapper from SpinnerWidget. * (T379445) phpunit: Remove unused trigger_error from TestLogger. * (T396766) ApiQueryRevisionsBase: Cast ctype_digit() param to string. * (T356451) logger: Add void as return type on setLogger. * (T328921, T359868) Drop PHP 7.4/8.0 support from master (forward-port from MW 1.42). * Drop a few phan PhanImpossibleTypeComparison suppressions now we've dropped PHP 7.4. * Clean up resource type and phan suppression in postgres code. * structure tests: allow PHP 8.1 syntax and autoload enums. * (T379508, T381291) composer.json: Updated nikic/php-parser from ^5.3.1 to ^5.5.0. * (T351055) SpecialBrokenRedirects: Batch and preload destination title info. * Pass fname to LinkBatch->setCaller in more places. * SpecialBrokenRedirects: Dedupe logic via private getRedirectTarget helper. * (T351055) SpecialBrokenRedirects: Load redirect data in batch from database * (T388406) RefreshLinksJob: Check hasText before comparing HTML. * (T397521) Api: Fix permission checks in action=compare. * (T397472) [REST Sandbox] Remove SwaggerUI from MediaWiki Releases. * (T397883, T397643) htmlform: fix min/max validations on empty input in int/float fields * specials: SpecialTalkPage: Use config from request context. * (T387408) exception: Skip use of HookRunner when not autoloaded. * (T391343, CVE-2025-6589) SECURITY: BlockList: Hide rows containing suppressed users. * (T392746, CVE-2025-6590) SECURITY: Escape usernames in HTMLUserTextField validation errors. * (T392276, CVE-2025-6591) SECURITY: API: Escape i18n messages in action=feedcontributions. * (T396230, CVE-2025-6593) SECURITY: fix IP leak to unverified email. * (T389009, CVE-2025-6597) SECURITY: Do not treat autocreation as login for reauthentication. * (T389010, CVE-2025-6926) SECURITY: Allow extensions to supress the reauth flag on login. * (T397595, CVE-2025-6927) SECURITY: Fix autoblocks visibility when bl_deleted=1. * (T397595, CVE-2025-6927) SECURITY: Fix leak of hidden usernames via autoblocks of those users. * (T395063, CVE-2025-6594) SECURITY: apisandbox: Fix reflected XSS when invalid 'format' is provided. * (T398269) Replace away symfony php polyfills for PHP8/8.1. * Rest: Move ModuleConfigurationException into correct folder. * Cache: Move MessageCache hook interfaces into correct folder. * (T394556) uppercaseTitlesForUnicodeTransition: Add missing return. * installer: Always check return of IDatabase::fieldInfo in postgres. * autoload: Expand Autoloader::CORE_NAMESPACES. Release notes: [0] https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/… Bug report form: [1] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.44-… Open Bugs: [2] https://phabricator.wikimedia.org/tag/mw-1.44-release/ ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.tar.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.0.tar.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.0.zip Patch to previous version (1.44.0-rc.0): https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.patch.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.patch.zip GPG signatures for the above: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.0.zip.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.zip.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.0.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l July 2025