Wikitech-l July 2026

wikitech-l@lists.wikimedia.org

23 participants
24 discussions

WMF Product + Tech @ Wikimania
by Bee Piovesan 14 Jul '26

14 Jul '26

Hello everyone, As we get closer to Wikimania, we wanted to share some details about how to connect with the Wikimedia Foundation's *Product + Technology <https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Product_and_Technology>* staff who will be in attendance. On Thursday, July 23rd representatives from Product + Tech will have two tables in Foyer S2. At those tables will be representatives of the following teams: - Product Design <https://www.mediawiki.org/wiki/Design> - Tech News <https://meta.wikimedia.org/wiki/Tech/News> - Language/Product localization <https://www.mediawiki.org/wiki/Wikimedia_Language_and_Product_Localization> - Data Engineering <https://www.mediawiki.org/wiki/Data_Platform_Engineering/Data_Engineering> Please stop by if you have any questions, suggestions or just want to chat with any of these teams! And if there’s a team you’ve been wanting to talk to that isn’t represented above, just let one of us know and we’ll connect you to the right person. See you at Wikimania! *Bee (on behalf of P+T colleagues)* -- *Bee Piovesan *(she/her) Lead Program Manager, Developer Outreach Wikimedia Foundation <https://wikimediafoundation.org/>

1 0

Survey - Understanding technical contributions by women on Wikimedia
by Giovanna Fontenelle 13 Jul '26

13 Jul '26

Hello! As part of the Celebrate Women <http://meta.wikimedia.org/wiki/Event:Celebrate_Women> campaign in March 2027, the Wikimedia Foundation's Content Enablement team <https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Advancement/Community_…> wants to support women+ (anyone who identifies as a woman in some way) to advance as technical contributors on Wikimedia. To achieve that, we are launching a survey to help us understand technical contributions by women+ on the Wikimedia projects. *Start the survey here*: https://wikimediafoundation.limesurvey.net/779358 This survey has 22 questions, and it should take between 15 and 20 minutes to complete. It will remain open until *20 July 2026*. The questions are also available here <https://meta.wikimedia.org/wiki/Celebrate_Women/Technical_contributions_sur…> if you would like to read them in advance. Please consider that the target audience for this survey is Wikimedia contributors who identify in any way as women. For questions, contact me or leave a message on the talk page here <https://meta.wikimedia.org/wiki/Talk:Celebrate_Women/Technical_contribution…> . Privacy notice: the data from this survey is maintained solely to create activities related to the Celebrate Women campaign. Please access the privacy statement for this survey here <https://foundation.wikimedia.org/wiki/Legal:Understanding_technical_contrib…> . Thank you! Giovanna Fontenelle (she/her) Program Officer, Content Enablement <https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Advancement/Community_…> Wikimedia Foundation <https://wikimediafoundation.org/>

1 1

Tech News 2026 - Issue 29
by Sandister Tei 13 Jul '26

13 Jul '26

Latest *tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News>* from the Wikimedia technical community. Please tell other users about these changes. Not all changes will affect you. Translations <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2026/29> are available. *Updates for editors* - Revise Tone <https://www.mediawiki.org/wiki/Special:MyLanguage/Growth/Revise_Tone> helps newcomers identify passages in Wikipedia articles that may contain non-encyclopedic language and encourages them to consider revising the tone. The feature was A/B tested <https://en.wikipedia.org/wiki/en:A/B_testing> on the Arabic, English, French, and Portuguese Wikipedias, where newcomer task completion rates increased by 38.7% <https://www.mediawiki.org/wiki/Special:MyLanguage/Growth/Revise_Tone#Experi…> compared to the default Copyedit task, with no decrease in edit quality. The test ended on July 9, and the feature is now available for everyone on these wikis, configurable via Community Configuration. The plan <https://phabricator.wikimedia.org/T426364> is to release Revise Tone to more wikis. - The community configuration that allows automatic removal of inactive mentors <https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Growth/Mentorship#Au…> based on configurable criteria will be enabled on Thursday 16, on some wikis <https://www.mediawiki.org/wiki/Special:MyLanguage/Growth/Deployment> to keep mentor lists up to date. Mentors are experienced contributors who opt in to help new users on-wiki through the Growth Features <https://www.mediawiki.org/wiki/Special:MyLanguage/Growth/Feature_summary>. Administrators can now prepare the settings via Special:CommunityConfiguration/Mentorship <https://en.wikipedia.org/wiki/Special:CommunityConfiguration/Mentorship>; they will take effect starting Thursday. - View all 38 community-submitted tasks that were resolved last week <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Recently_resol…>. For example, an issue where some users of the Wikipedia Android app were logged out immediately after signing in, preventing them from staying logged in and editing pages, has now been fixed. [1] <https://phabricator.wikimedia.org/T316916> *Updates for technical contributors* - Editing a page via user scripts or gadgets was causing watchlist labels that the user had assigned to that page to reset. This has now been fixed. [2] <https://phabricator.wikimedia.org/T423778> - To work around a Safari bug (see phab:T425211 <https://phabricator.wikimedia.org/T425211>), on Parsoid-enabled wikis, wikilink hrefs now use absolute urls instead of protocol-relative urls. REST API output remains unchanged and continues to use protocol-relative urls. Gadgets, user scripts, bots, and CSS might need to be adapted if they relied on the presence of protocol-relative urls in wikilink hrefs. [3] <https://phabricator.wikimedia.org/T431358> - Detailed code updates later this week: MediaWiki <https://www.mediawiki.org/wiki/MediaWiki_1.47/wmf.11> *In depth* - The Wikimedia Foundation’s Experiment Platform Team has published a blog post reflecting on its first year of structured experimentation. It highlights successful experiments such as Paste Check, Reference Check, and Tone Check, which improved editing outcomes and have been rolled out to more users, as well as experiments that did not lead to product changes. Read more <https://diff.wikimedia.org/2026/07/07/moving-the-needle-how-we-test-new-ide…> . *Tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News> prepared by Tech News writers <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Writers> and posted by bot <https://meta.wikimedia.org/wiki/Special:MyLanguage/User:MediaWiki_message_d…> • Contribute <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News#contribute> • Translate <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2026/29> • Get help <https://meta.wikimedia.org/wiki/Tech> • Give feedback <https://meta.wikimedia.org/wiki/Talk:Tech/News> • Subscribe or unsubscribe <https://meta.wikimedia.org/wiki/Global_message_delivery/Targets/Tech_ambass…>.*

1 0

Some GLAM Updates in July
by Connor Benedict 10 Jul '26

10 Jul '26

Hi everyone, July is shaping up to be a very exciting month for the GLAM, culture and heritage community and the Wikimedia movement at large! Wikimania is taking place in Paris from 21-26 July, with numerous GLAM related activities taking place throughout the days, including a culture + heritage focused meetup taking place on 23 July. https://meta.wikimedia.org/wiki/Event:M%C3%A9lange_%E2%80%94_A_Content_Part… The following week is the monthly global GLAM Call, on Tuesday 28 July at 13:30 UTC. Be sure to register in advance via the meta-wiki page. This month there will be discussions and presentations about GLAM + gender, a UN Resolution on Reparative Justice, the GLAM User Group, and the GLAM Tool Hospital. https://meta.wikimedia.org/wiki/Event:Global_GLAM_call_2026-07-28#Agenda As a reminder you can always submit proposals and request topics via the forms on Meta-wiki as well, and watch the recordings from previous calls at anytime. Best, Connor Community Coordinator, Wikimedia Content Partnerships Hub https://meta.wikimedia.org/wiki/Content_Partnerships_Hub

1 0

Announcing the Media Platform team [MediaWiki Engineering]
by Birgit Müller 10 Jul '26

10 Jul '26

Hi All, Some of you might have seen this <https://phabricator.wikimedia.org/project/profile/8845/> already on Phabricator :-) - I'm happy to share that we’ve created a Media Platform team under the umbrella of the MediaWiki Engineering group <https://www.mediawiki.org/wiki/MediaWiki_Engineering_Group>. This enhances the MediaWiki Engineering group from formerly 3 to now 4 teams – Core Platform, API Platform (also known as: MW Interfaces), Content Platform (also known as: the content transformers :), and Media Platform. [1] With this change, we’re addressing the need to invest in the sustainability of our media platform, with an initial focus on de-risking key parts of the media infrastructure, ensuring the platform remains resilient when scaled scraping occurs and can scale for continued growth. The Media Platform team will work on how we store, manipulate, stream, and display media and is responsible for the media related work under the Responsible Reuse objective <https://meta.wikimedia.org/wiki/Wikimedia_Foundation_Annual_Plan/2026-2027/…> in the Foundation’s annual plan (July 2026 - June 2027). The first major project is to come up with a new architecture for the thumbnail infrastructure (see ticket <https://phabricator.wikimedia.org/T431141>). We’ve created a Phabricator project for the team <https://phabricator.wikimedia.org/project/profile/8845/> and updated the developers and maintainers list <https://www.mediawiki.org/wiki/Developers/Maintainers> to reflect the changes. Feel free to come say Hi <https://www.mediawiki.org/wiki/Media_Platform_Team> when you get the chance :-) Birgit [1] - We're adjusting the names of the other MediaWiki Engineering teams to maintain consistency across platform teams & are working on updating the corresponding tags and team pages. -- Birgit Müller (she/her) Director of Product, MediaWiki and Developer Experiences Wikimedia Foundation <https://wikimediafoundation.org/>

3 4

Content Partnerships Hub @ Wikimania 2026
by Connor Benedict 08 Jul '26

08 Jul '26

Dear all, Hope this email finds you well! The Content Partnerships Hub is bringing an in-person Helpdesk to Wikimania this year and we’d love for you to stop by. https://meta.wikimedia.org/wiki/Content_Partnerships_Hub The Helpdesk is designed to support any member of the Wikimedia community to make a content partnership successful. This could be uploading content, creating meta data structures, drafting a project plan together, or supporting a new partner with their uncertainties with Wiki-tools and platforms or even copyright clearance. This is your opportunity to talk to an expert directly and get your questions answered. Book an appointment now, or stop by the Helpdesk in Foyer S2 during Thursday, 23 July. https://calendar.app.google/jfuYvU3LTMikZcBr5 Looking forward to seeing you there! Best, Connor

1 0

June 3rd maintenance of CI servers
by Daniel Zahn 07 Jul '26

07 Jul '26

Hello developers, in a week, on June 3rd 2026, between 15:00 and 16:00 UTC (8am - 9am PST) we are going to perform maintenance on our Continuous Integration servers. We are switching Jenkins CI to a new host and will upgrade Java on integration nodes. While we are trying to keep the period as short as possible please expect some downtime to CI and getting patches verified. The maintenance has been added to the deployment calendar. Best, SRE collaboration services & Release Engineering teams -- Daniel Zahn <dzahn(a)wikimedia.org> Site Reliability Engineer

1 2

Tech News 2026 - Issue 28
by Sandister Tei 06 Jul '26

06 Jul '26

Latest *tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News>* from the Wikimedia technical community. Please tell other users about these changes. Not all changes will affect you. Translations <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2026/28> are available. *Updates for editors* - View all 34 community-submitted tasks that were resolved last week <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Recently_resol…>. For example, an issue where the search bar results on Wikidata, showed English results instead of using the correct language fallback for users of language variants, has now been fixed. Search suggestions will now follow the expected language fallback chain. [1] <https://phabricator.wikimedia.org/T429769> *Updates for technical contributors* - In preparation for Celebrate Women campaign <https://meta.wikimedia.org/wiki/Special:MyLanguage/Event:Celebrate_Women> planned for March 2027, the Wikimedia Foundation’s Content Enablement team <https://meta.wikimedia.org/wiki/Special:MyLanguage/Wikimedia_Foundation/Adv…> has launched a 22-question survey to better understand technical contributions by women+ (anyone who identifies as a woman) across Wikimedia projects. The survey takes approximately 15–20 minutes to complete and will remain open until 20 July 2026. The questions <https://meta.wikimedia.org/wiki/Special:MyLanguage/Celebrate_Women/Technica…> are also available on-wiki for review in advance. - The Score extension <https://www.mediawiki.org/wiki/Special:MyLanguage/Extension:Score> now supports rendering music scores as SVG images in addition to PNG, addressing a long-standing feature request <https://phabricator.wikimedia.org/T49578> and resolving historical image quality issues. Both formats are now provided to clients, with PNG in the src attribute and SVG in the srcset attribute. - The new Parsoid <https://wikitech.wikimedia.org/wiki/Parsoid> parser continues to be deployed to additional wikis <https://www.mediawiki.org/wiki/Special:MyLanguage/Parsoid/Parser_Unificatio…>, making it easier to introduce new reading and editing features. It was enabled on French Wikipedia, bringing total progress to covering 78.9% of Wikipedia page views. Rollout to English Wikipedia desktop will progress through this week. - Detailed code updates later this week: MediaWiki <https://www.mediawiki.org/wiki/MediaWiki_1.47/wmf.10> *In depth* - The Wikimedia Hackathon 2026 recap blog post <https://diff.wikimedia.org/2026/06/29/wikimedia-hackathon-2026-building-col…> is now live. It highlights the projects, sessions, and social activities from this year’s event, and shares initial plans for the 2027 Wikimedia Hackathon. *Tech news <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News> prepared by Tech News writers <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/Writers> and posted by bot <https://meta.wikimedia.org/wiki/Special:MyLanguage/User:MediaWiki_message_d…> • Contribute <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News#contribute> • Translate <https://meta.wikimedia.org/wiki/Special:MyLanguage/Tech/News/2026/28> • Get help <https://meta.wikimedia.org/wiki/Tech> • Give feedback <https://meta.wikimedia.org/wiki/Talk:Tech/News> • Subscribe or unsubscribe <https://meta.wikimedia.org/wiki/Global_message_delivery/Targets/Tech_ambass…>.*

1 0

MediaWiki Stakeholders welcomes Brooke Vibber as new board member
by Mark A. Hershberger 03 Jul '26

03 Jul '26

Hi all: The MediaWiki Stakeholders' Group (MWStake) is thrilled to announce that Brooke Vibber has joined our board! Brooke is one of the original authors of MediaWiki and has remained an active developer ever since. She writes; It's a tremendous honor to work with my old friends and colleagues at MWStake on something that's always been near and dear to my heart: working together to provide good documentation, coding, and feature support for MediaWiki's many third-party users. A strong Open Source ecosystem with many users and contributors enriches the commons, and that's what we're all about here! Thanks, Mark A. Hershberger President, MWStake https://mwstake.org/

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.43.9/1.44.6/1.45.4)
by Maryum Styles 02 Jul '26

02 Jul '26

Greetings- With the security/maintenance release of MediaWiki 1.43.9/1.44.6/1.45.4, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: UrlShortener + (T418533, CVE-2026-13706) - UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG https://gerrit.wikimedia.org/r/q/I64268dda19ea9dfa048b3e2212a682d53c2a59d6 RedirectManager + (T423826, CVE-2026-58518) - RedirectManager's API does not require a CSRF token https://gerrit.wikimedia.org/r/1275494 Cargo + (T424140, CVE-2026-58519) - Stored XSS through Cargo's map format https://gerrit.wikimedia.org/r/c/1277612 UrlShortener + (T418431, CVE-2026-58520) - UrlShortener defaults to ineffective validation open to third-party redirects https://gerrit.wikimedia.org/r/1306769 CentralAuth + (T422306, CVE-2026-58028) - Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets https://gerrit.wikimedia.org/r/q/Idb42ab1cf685ef145b78701784909c590d758917 StructuredDiscussions + (T424285) - Flow ships Handlebars 3.0.0 with known security vulnerabilities. See https://security.snyk.io/package/npm/handlebars/3.0.0 for more details https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Flow/+/1277782 Timeline + (T426631, CVE-2026-8857) - Full RCE using EasyTimeline Extension https://gerrit.wikimedia.org/r/q/Ic2f3aa24922e6d44d063b76630cc888016ba4c74 https://gerrit.wikimedia.org/r/q/Ia19cbe8c80fa5a765abca68305254c15e817bfac Timeline + (T427611, CVE-2026-58038) - Stored XSS through javascript URLs in SVGs generated by EasyTimeline https://gerrit.wikimedia.org/r/q/Ia61203fcd4913ce97fd6c05ea908d3910c213ff6 Maps + (GHSA-4h7g-5542-v3fc, CVE-2026-52854) - Stored XSS through the overlays parameter in the display_map parser function https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542… https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd… Cargo + (T428274, CVE-2026-58521) - SQLi in Cargo extension via year range filter https://gerrit.wikimedia.org/r/1298854 OAuth +(T428324, CVE-2026-13707) - Session fixation attacks on improperly configured OAuth 1.0a tools https://gerrit.wikimedia.org/r/q/Ife0b4bf16761c01bdb0e91a29f1fb94de380c73e EmbedVideo (fork) +(GHSA-c29q-5xm7-5p62, CVE-2026-55690) - Stored XSS via unsanitized service name in exception text https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/9… EmbedVideo (fork) +(GHSA-v65j-hff3-753c, CVE-2026-57440) - Stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/3… EmbedVideo (fork) +(GHSA-5c7p-g73q-rpg5, CVE-2026-55692) - Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/3… EmbedVideo (fork) +(GHSA-7h5p-637f-jfr7, CVE-2026-55691) - Stored XSS via unsanitized class passed to template https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security… https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/3… WikiLambda +(T428833, CVE-2026-58517) - Blocked users can create and edit WikiLambda objects https://gerrit.wikimedia.org/r/1305376 Charts +(T430548, CVE-2026-14358) - Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title https://gerrit.wikimedia.org/r/q/Ibdaa7c852ae83f562e84dddc9c96ad64e2152210 Cargo +(T422774, CVE-2026-14363) - Cargo Extension: SQLi in Special:Drilldown https://gerrit.wikimedia.org/r/c/1269701 https://gerrit.wikimedia.org/r/c/1279498 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. CVE JSON references can be found on Gitlab [4]. [1] https://phabricator.wikimedia.org/T421273 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs [4] https://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l July 2026