Update Feed

MediaWiki 1.39.11

30 December 2024

MediaWiki version 1.39.11 is now available (security release).

Upgrading to MediaWiki 1.39.11

MediaWiki 1.39.11 can be updated to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply MediaWiki updates as new versions are released, or use Installatron's Clone feature to duplicate an existing MediaWiki install to test the 1.39.11 upgrade prior to moving it live with Installatron's Sync funtionality. Get started managing MediaWiki with Installatron

What's New in MediaWiki 1.39.11

Security

logging: Fix non-escaped messages used in rights log.
Fix infinite loop for self-redirects with variants conversion.
Article: Check permissions before showing link to view deleted revision.
Article: Check permissions before showing link to view deleted revision.
Vector 2022: Numerous unescaped messages leading to potential XSS.
Vector 2022: vector-intro-page message is assumed to yield a valid title.
XSS via 'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
diff-multi-sameuser ("X intermediate revisions by the same user not shown") ignores username suppression.
Stored XSS when uploading crafted XML file to Special:Upload (non-standard configuration).
Upgrading guzzlehttp/psr7 (2.4.0 => 2.4.5).
Fix escaping in BlockLogFormatter.
Move badFile lookup to Linker.

1.39.11

This is a maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
[DatabaseUpdater] Don't interact with updatelog on virtual domains.
specials: Avoid passing null to str_replace().
AutoLoader: Use require_once rather than require.
GlobalIdGenerator: Update str_getcsv() call for PHP 8.4.
Upgrade php-session-serializer from 2.0.1 to 3.0.0.
Upgrade xmp-reader from 0.8.6 to 0.9.2.
installer: Consistently use double quotes when outputting settings.
Correct range error in regexp of formatmetadata.
ButtonAuthenticationRequest: Add AllowDynamicProperties directive.

1.39.10

This is a maintenance release of the MediaWiki 1.39 branch.

Fix issue related to backport of AbuseFilter patch for T372998.

1.39.9

This is a security and maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
skins: Fix Skin::buildSidebar to not share cache between skins.
When using the 'runMaintenance' method in a LoadExtensionSchemaUpdates hook handler, only the script's class name is required, not its path.
Clarify that $wgAllowCrossOrigin only applies to REST.
installer: Support MW_SKIP_EXTERNAL_DEPENDENCIES in update.php.
composer.json: Add 5 more ext- to suggests.
resources: Fix 404 Not Found for foreign Financial-Times/polyfill-library.
ResourceLoader: Fix regression of color mapping in Less.php.
ResourceLoader: Upgrade wikimedia/less.php to 4.4.1.
SpecialExport: Prevent passing null to strtolower.

1.39.8

This is a maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
tests: Skip failing tests on php8.2 (and make pass).
ApiResult: Make array ordering consistent across PHP versions.
build: Raise TestingAccessWrapper from 2.0.0 to 3.0.0.
tests: Create new classes to hold dynamic properties in auth tests.
tests: Avoid dynamic properties in AuthenticationProvider Test.
Introduce and use DynamicPropertyTestHelper.
tests: Skip failing tests on php8.3 (and make pass).
tests: Use TestingAccessWrapper::newFromClass in session tests.
tests: Avoid dynamic properties in auth tests.
StatusValue: Allow passing arbitrary data to augment result.
tests: Remove dead code from WikiPageDbTest::assertPreparedEditNotEquals.
tests: Avoid dynamic properties in SessionManagerTest.
Upgrading wikimedia/parsoid (v0.16.3 => v0.16.4).
Use i18n strings for truncated subpage message in SpecialMovePage.
ArticleTest: Skip testGetOrSetOnNewProperty() if PHP >= 8.2.
Update wikimedia/less.php from 3.1.0 to 3.2.1.
debug: Update PsySH 0.11.1 -> 0.12.3.
Fix slash-delimited regex from CLI on maintenence/grep.php.
Improve RestAPIAdditionalRouteFiles path expansion.
tests: Only set $dbSetup if setupTestDB() ends without throwing.
Add title cache for Title::newMainPage().
objectcache: Fix flaky WANObjectCacheTest::testLockTSESlow case.
api: Replace null $httpCode by 0 in ApiBase::dieWithErrorOrDebug.
Make EncryptedPassword work with Argon2Password.
Special:ApiHelp: Move widths and floats in CSS to media query.
Fix long param names overlapping docs in API help pages.
MaintenanceRunner.php: Add trailing newline to error message.
wrapOldPasswords: Improve progress output and decrease batch size.
ApiFeedWatchlist: Fix handling of array parameters.
ResourceLoader: Add 1min grace via stale-while-revalidate Cache-Control.
EncryptedPassword: Store default parameters as strings.
Name the PagerTools array entries to allow hooks to unset them.

1.39.7

This is a security and maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
Headings in the license pickers should not be selected.
ActiveUsersPager: Count actions only once.
composer: Use @php instead of php.
Indent JsonContent using tabs.
authmanager: Improve AuthenticationRequest docs.
Add missing space in Special:RecentChangesLinked.
composer.json Add ext-bcmath and ext-gmp to suggests.
PHPVersionCheck: Update text to match currently supported upstream PHP versions (8.1+).
API: mark HTML output as non-cacheable.
filerepo: Fix img_major_mime for files with a non-standard extensions.
MimeAnalyzer: Add @since to isValidMajorMimeType.
Mark some parserTests on talk pages Parsoid only on REL1_39.
Update wikimedia/parsoid to 0.16.3.
ZhConverter: Fix language variant fallback chain.
Parser::getExternalLinkAttribs: Don't set rel attribute to null.
LockManagerGroupIntegrationTest: Remove test depending on DBLockManager.
LinkRendererTest: Add missing import for LinkTarget.
ApiResetPassword: Allow both user and email parameters to be passed for reset.
updateCollation: Explicitly cast $scale to int.
api: Improve linking of language codes lists in top level i18n messages.
Make sure MovePage::isValidFileMove matches UploadBase::getTitle.
Respect $maxConcurrency when queuing async FileOps.
Follow-up "ZhConverter: Fix language variant fallback chain".
build: Restore Doxygen output for MediaWiki release tags.
HistoryPager: Add #[AllowDynamicProperties].
Update Apache config syntax in .htaccess files.
mime: Add support for 'font/woff' and 'font/woff2' mime type.
mime: Make test cases use data provider.
installer: Bear with schema drift caused by running old updater.
docs: Remove use of $IP from mwdocgen.php.
build: Restore Doxygen output for MediaWiki release tags (take 3).
docs: Set stable permalink on markdown files.
allow maintenance/deleteBatch.php to accept page ID.
XSS in edit summary parser.
Denial of service vector via GET request to Special:MovePage on pages with thousands of subpages.

1.39.6

This is a security and maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
Updated symfony/polyfill-php80 from 1.26.0 to 1.28.0.
Updated symfony/polyfill-php81 from 1.26.0 to 1.28.0.
mail: Encode period (ascii 46) if it appears in encoded email header.
Added symfony/polyfill-php82.
Added symfony/polyfill-php83.
Updated symfony/yaml from 5.4.10 to 5.4.23.
ApiQueryLanguageinfoTest: Do not pass a float to setFakeTime.
Updated wikimedia/timestamp from 4.0.0 to 4.1.1.
tests: Provide coverage for StatusValue::__toString.
StatusValue: Improve logging/debug output with multibyte characters.
Updated wikimedia/parsoid from 0.16.1 to 0.16.2.
LocalisationCache: Preserve fallback source language info.
Fix logging Status objects to 'authevents' channel.
DEVELOPERS.md: mention git clone and WSL.
DEVELOPERS.md: reword WSL instructions to include best practices.
LocalisationCache: Fix a rare case in fallback source language.
SwiftFileBackend: Fix "PHP Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated".
maintenance: Add missing parenthesis to SQL in attachLatest.php.
maintenance: Fix join condition in DeduplicateArchiveRevId.

1.39.5

This is a security and maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
docs: Fix a few typos in MainConfigSchema.
mime: Add support for 'font/sfnt' MIME type.
WikiImporter: Improve error message output.
VueComponentParser: Use Zest's getElementsByTagName() rather than PHP's.
ApiBase: Cast $id to string in filterIDs.
Merge zh and zh-tw namespace translations back to zh-hans, zh-hant, zh-hk respectively.
WRStats: Round up SequenceSpec::hardExpiry to the nearest integer.
installer: Check MariaDB version in updater/installer.
ApiComparePages: Add help url.
EditPage: Add #[AllowDynamicProperties].
rdbms: Fix postgres db function call.
user: Use {@} to escape annotation when writting about annotation.
LanguageWa: Fix double timezone adjustment.
Update pear/mail to 1.5.1.
Remove feedback messages from RawHtmlMessages.
Ensure that installer i18n is loaded by update.php.
docs: Set the <comment> tag back to optional.
Upgrade wikimedia/html-formatter from 3.0.1 to 4.0.3.
wdio-mediawiki: await saveScreenshot.
Include core PSR-4 classes in the generated classmap.
$wgPrivilegedGroups – Users belonging in some of the listed groups will be audited more aggressively.
doc: Improve description of "type" in extension.schema.v2.json.
Added PrivilegedGroups attribute for extension.json / skin.json, which lets you add any new user groups you define to wgPrivilegedGroups (see above).
HTMLForm: Fix E_NOTICE when hide-if is used with setFormIdentifier.
MultiHttpClient: Unset $this->cmh after closing it.
Do not run SkinAfterBottomScripts hook twice unconditionally.
API Help: Note that parameters may be inherited from other context.
API: Make continue parameter help description more specific.
i18n: Split apihelp for standard dir parameter.
i18n: Split apihelp for redirects/linkshere/transcludedin/fileusage show.
i18n: Split apihelp for parameter list=deletedrevs&drprop=.
i18n: Split apihelp for parameter list=allpages&apprexpiry=.
i18n: Split apihelp for parameter action=opensearch&redirects=.
i18n: Split apihelp for parameter action=managetags&operation=.
api: Add message for list=watchlist&wlprop=expiry.
ApiComparePages: expose 'difftype' param if wikidiff2 is installed.
api: Add message for action=compare&prop=timestamp.
API: revids=… does not necessarily return the queried revisions.
user: Truncate option value in UserOptionsManager.
ApiOptions: Give warning if the value is too long.
API i18n: Add for byte count messages.
Get correct main page in API call examples.
doc: Make extension.schema.v2.json a valid JSON schema.
updateSpecialPages.php: Avoid implicit float conversion on modulo.
ImportReporter: Make callback functions public.
importDump: Unconditionally call $importer->setUsernamePrefix().
Remove feedback messages from RawHtmlMessages.
Ensure that installer i18n is loaded by update.php.
doc: Improve description of type in extension.schema.v1.json.

1.39.4

This is a security and maintenance release of the MediaWiki 1.39 branch.

Localisation updates.
composer.json: Explicitly pin psr/http-message to 1.0.1.
Template:ACTIVEUSERS wasn't being updated without updateSpecialPages.php.
Prevent LogicCache exception from message cache during IO errors from memcache.
Improve idempotency of postgres index upgrades.
Add Authorization to default $wgAllowedCorsHeaders.
A fake MessageLocalizer for use in unit tests.
Title: Add forward alias.
composer: Add symfony/polyfill-php81 like symfony/polyfill-php80.
Work around argument corruption bug in XMLReader::open.
Fix frame and frameless rdfa depending on file existing.
Fixes for the phan upgrade, part 1.
Fixes for the phan upgrade, part 2.
build: Update mediawiki/mediawiki-phan-config to 0.12.0.
build: Updating mediawiki/mediawiki-phan-config to 0.12.1.
Pass whether current rev of file exists to Linker::makeBrokenImageLinkObj.
Handle thumb errors when !$enableLegacyMediaDOM.
A manualthumb that doesn't exist should be considered a thumb error.
IndexPager: Also protect against $offset being 0.