== MediaWiki 1.39.5 ==

[0] Fix | Delete

[1] Fix | Delete

This is a security and maintenance release of the MediaWiki 1.39 branch.

[2] Fix | Delete

[3] Fix | Delete

=== Changes since MediaWiki 1.39.4 ===

[4] Fix | Delete

* Localisation updates.

[5] Fix | Delete

* (T333050, CVE-2023-PENDING) SECURITY: Fix infinite loop for self-redirects

[6] Fix | Delete

with variants conversion.

[7] Fix | Delete

* docs: Fix a few typos in MainConfigSchema.

[8] Fix | Delete

* (T309714) mime: Add support for 'font/sfnt' mime type.

[9] Fix | Delete

* (T341434) WikiImporter: Improve error message output.

[10] Fix | Delete

* (T317255) VueComponentParser: Use Zest's getElementsByTagName() rather than

[11] Fix | Delete

PHP's.

[12] Fix | Delete

* (T341737) ApiBase: Cast $id to string in filterIDs.

[13] Fix | Delete

* (T286291, T296188) Merge zh and zh-tw namespace translations back to zh-hans,

[14] Fix | Delete

zh-hant, zh-hk respectively.

[15] Fix | Delete

* (T337875) WRStats: Round up SequenceSpec::hardExpiry to the nearest integer.

[16] Fix | Delete

* (T237898) installer: Check MariaDB version in updater/installer.

[17] Fix | Delete

* (T342632) ApiComparePages: Add help url.

[18] Fix | Delete

* (T326182, T324903) EditPage: Add #[AllowDynamicProperties].

[19] Fix | Delete

* (T342351) rdbms: Fix postgres db function call.

[20] Fix | Delete

* (T343675) user: Use {@} to escape annotation when writting about annotation.

[21] Fix | Delete

* (T343797) LanguageWa: Fix double timezone adjustment.

[22] Fix | Delete

* (T326454) Update pear/mail to 1.5.1.

[23] Fix | Delete

* (T343622) docs: Set the <comment> tag back to optional.

[24] Fix | Delete

* (T330528) Upgrade wikimedia/html-formatter from 3.0.1 to 4.0.3.

[25] Fix | Delete

* (T337463) wdio-mediawiki: await saveScreenshot.

[26] Fix | Delete

* (T274041) Include core PSR-4 classes in the generated classmap.

[27] Fix | Delete

* (T208477) $wgPrivilegedGroups – Users belonging in some of the listed groups

[28] Fix | Delete

will be audited more aggressively.

[29] Fix | Delete

* doc: Improve description of "type" in extension.schema.v2.json.

[30] Fix | Delete

* Added PrivilegedGroups attribute for extension.json / skin.json, which lets

[31] Fix | Delete

you add any new user groups you define to wgPrivilegedGroups (see above).

[32] Fix | Delete

* HTMLForm: Fix E_NOTICE when hide-if is used with setFormIdentifier.

[33] Fix | Delete

* (T288624) MultiHttpClient: Unset $this->cmh after closing it.

[34] Fix | Delete

* (T345039) Do not run SkinAfterBottomScripts hook twice unconditionally.

[35] Fix | Delete

* (T265734) API Help: Note that parameters may be inherited from other context.

[36] Fix | Delete

* API: Make continue parameter help description more specific.

[37] Fix | Delete

* (T285545) i18n: Split apihelp for standard dir parameter.

[38] Fix | Delete

* (T285545) i18n: Split apihelp for redirects/linkshere/transcludedin/fileusage

[39] Fix | Delete

show.

[40] Fix | Delete

* (T285545) i18n: Split apihelp for parameter list=deletedrevs&drprop=.

[41] Fix | Delete

* (T285545) i18n: Split apihelp for parameter list=allpages&apprexpiry=.

[42] Fix | Delete

* (T285545) i18n: Split apihelp for parameter action=opensearch&redirects=.

[43] Fix | Delete

* (T285545) i18n: Split apihelp for parameter action=managetags&operation=.

[44] Fix | Delete

* (T285545) api: Add message for list=watchlist&wlprop=expiry.

[45] Fix | Delete

* (T334011) ApiComparePages: expose 'difftype' param if wikidiff2 is installed.

[46] Fix | Delete

* (T342633) api: Add message for action=compare&prop=timestamp.

[47] Fix | Delete

* API: revids=… does not necessarily return the queried revisions.

[48] Fix | Delete

* (T326696) user: Truncate option value in UserOptionsManager.

[49] Fix | Delete

* (T326696) ApiOptions: Give warning if the value is too long.

[50] Fix | Delete

* API i18n: Add {{PLURAL:}} for byte count messages.

[51] Fix | Delete

* (T235207) Get correct main page in API call examples.

[52] Fix | Delete

* doc: Make extension.schema.v2.json a valid JSON schema.

[53] Fix | Delete

* updateSpecialPages.php: Avoid implicit float conversion on modulo.

[54] Fix | Delete

* (T347227) ImportReporter: Make callback functions public.

[55] Fix | Delete

* (T346898) importDump: Unconditionally call $importer->setUsernamePrefix().

[56] Fix | Delete

* doc: Improve description of type in extension.schema.v1.json.

[57] Fix | Delete

* (T340217, CVE-2023-PENDING) SECURITY: Vector 2022: Numerous unescaped

[58] Fix | Delete

messages leading to potential XSS.

[59] Fix | Delete

* (T340220, CVE-2023-PENDING) SECURITY: Vector 2022: vector-intro-page

[60] Fix | Delete

message is assumed to yield a valid title.

[61] Fix | Delete

* (T340221, CVE-2023-PENDING) SECURITY: XSS via

[62] Fix | Delete

'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.

[63] Fix | Delete

* (T341529, CVE-2023-PENDING) SECURITY: diff-multi-sameuser

[64] Fix | Delete

("X intermediate revisions by the same user not shown") ignores

[65] Fix | Delete

username suppression.

[66] Fix | Delete

* (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted

[67] Fix | Delete

XML file to Special:Upload (non-standard configuration).

[68] Fix | Delete

[69] Fix | Delete

== MediaWiki 1.39.4 ==

[70] Fix | Delete

[71] Fix | Delete

This is a security and maintenance release of the MediaWiki 1.39 branch.

[72] Fix | Delete

[73] Fix | Delete

=== Changes since MediaWiki 1.39.3 ===

[74] Fix | Delete

* Localisation updates.

[75] Fix | Delete

* (T333990) composer.json: Explicitly pin psr/http-message to 1.0.1.

[76] Fix | Delete

* (T335203, CVE-2023-29197) SECURITY: Upgrading guzzlehttp/psr7

[77] Fix | Delete

(2.4.0 => 2.4.5).

[78] Fix | Delete

* (T333776) {{ACTIVEUSERS}} wasn't being updated without updateSpecialPages.php.

[79] Fix | Delete

* (T258860) Prevent LogicCache exception from message cache during IO errors

[80] Fix | Delete

from memcache.

[81] Fix | Delete

* (T336868) Improve idempotency of postgres index upgrades.

[82] Fix | Delete

* (T322944) Add Authorization to default $wgAllowedCorsHeaders.

[83] Fix | Delete

* (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.

[84] Fix | Delete

* A fake MessageLocalizer for use in unit tests.

[85] Fix | Delete

* (T338114) Title: Add forward alias.

[86] Fix | Delete

* composer: Add symfony/polyfill-php81 like symfony/polyfill-php80.

[87] Fix | Delete

* (T330464) Work around argument corruption bug in XMLReader::open.

[88] Fix | Delete

* Fix frame and frameless rdfa depending on file existing.

[89] Fix | Delete

* Fixes for the phan upgrade, part 1.

[90] Fix | Delete

* Fixes for the phan upgrade, part 2.

[91] Fix | Delete

* (T298571) build: Update mediawiki/mediawiki-phan-config to 0.12.0.

[92] Fix | Delete

* build: Updating mediawiki/mediawiki-phan-config to 0.12.1.

[93] Fix | Delete

* (T329214) Pass whether current rev of file exists to

[94] Fix | Delete

Linker::makeBrokenImageLinkObj.

[95] Fix | Delete

* (T334659) Handle thumb errors when !$enableLegacyMediaDOM.

[96] Fix | Delete

* A manualthumb that doesn't exist should be considered a thumb error.

[97] Fix | Delete

* (T313157) IndexPager: Also protect against $offset being 0.

[98] Fix | Delete

* (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

[99] Fix | Delete

[100] Fix | Delete

== MediaWiki 1.39.3 ==

[101] Fix | Delete

[102] Fix | Delete

This is a security and maintenance release of the MediaWiki 1.39 branch.

[103] Fix | Delete

[104] Fix | Delete

=== Changes since MediaWiki 1.39.2 ===

[105] Fix | Delete

* Localisation updates.

[106] Fix | Delete

* (T225218) LinksUpdate: Use DB key for category links table.

[107] Fix | Delete

* GlobalFunctions: Remove check for MEDIAWIKI constant.

[108] Fix | Delete

* (T329484) API: Fix query+allimages user parameter description.

[109] Fix | Delete

* (T330529) SpecialEditTags: Set default of '' for wpReason.

[110] Fix | Delete

* (T330382) postgres: Make the upgrade ignore dropping indexes that

[111] Fix | Delete

might not exist.

[112] Fix | Delete

* (T330526) htmlform: Handle null from HTMLFormField::getDefault in

[113] Fix | Delete

multiselects.

[114] Fix | Delete

* (T291753) rdbms: escape backslashes in makeConnectionString for PostgreSQL.

[115] Fix | Delete

* (T325529) Fix total breakage of wgCanonicalServer fallback.

[116] Fix | Delete

* (T318103) mediawiki.storage: Disable async GC during integration test.

[117] Fix | Delete

* (T332461, T332397) TempFSFile: Keep the WeakMap alive.

[118] Fix | Delete

* (T332902) page: fix InvalidArgumentException in SQLPlatform::makeList.

[119] Fix | Delete

* (T285159, CVE-2023-PENDING) SECURITY: Do not apply autoblocks to untrusted

[120] Fix | Delete

XFF headers.

[121] Fix | Delete

[122] Fix | Delete

== MediaWiki 1.39.2 ==

[123] Fix | Delete

[124] Fix | Delete

This is a maintenance release of the MediaWiki 1.39 branch.

[125] Fix | Delete

[126] Fix | Delete

=== Changes since MediaWiki 1.39.1 ===

[127] Fix | Delete

* Localisation updates.

[128] Fix | Delete

* (T325872) ChangeTags: Remove table name from condition.

[129] Fix | Delete

* (T324895) MWCallbackStream: Add explicit $stream property.

[130] Fix | Delete

* (T297031, T326039) PostgresUpdater: Move setDefault ahead of

[131] Fix | Delete

changeNullableField.

[132] Fix | Delete

* (T321319) Produce HTML for invalid JSON.

[133] Fix | Delete

* (T215466, T326071) MigrateActors: Write to revision table (Follow-up 24115a8).

[134] Fix | Delete

* (T223027) ReservedUsernames config: Add reserved names from maintenance

[135] Fix | Delete

scripts.

[136] Fix | Delete

* (T325000, T324896, T307631) Updated OOUI from v0.44.3 to v0.44.5.

[137] Fix | Delete

* Remove /images .htaccess rules that are no longer relevant.

[138] Fix | Delete

* Disable php in .htaccess of images directory as a hardening measure.

[139] Fix | Delete

* (T322583) Include missing message parameter in message.

[140] Fix | Delete

* LocalFileTest: use encodeBlob/decodeBlob for img_metadata.

[141] Fix | Delete

* DatabaseSqlite: fix null blobs.

[142] Fix | Delete

* rdbms: avoid pg_escape_bytea() call-style deprecation notices.

[143] Fix | Delete

* (T322278) Improve LocalisationCache post-merge validation check.

[144] Fix | Delete

* (T324408, T326367) Updated wikimedia/remex-html from 3.0.2 to 3.0.3.

[145] Fix | Delete

* (T322278) Fix the remaining Phan failures on PHP 8.1.

[146] Fix | Delete

* (T322278, T326367) Respond to some messages from Phan on PHP 8.1.

[147] Fix | Delete

* Fix phan error when Excimer is enabled.

[148] Fix | Delete

* (T326021) Add matrix: to $wgUrlProtocols.

[149] Fix | Delete

* (T314099) stream wrapper: Declare $context class property.

[150] Fix | Delete

* (T314099) libs\jsminplus: Declare JSNode::$expression.

[151] Fix | Delete

* (T314096) composer.json: Updated composer/spdx-licenses from 1.5.6 to 1.5.7.

[152] Fix | Delete

* (T326472) Upgrading cssjanus/cssjanus (v2.1.0 => v2.1.1).

[153] Fix | Delete

* (T308536) rdbms: Remove deprecation mark for $wgSharedDB.

[154] Fix | Delete

* (T215466, T326071) installer: Split drop action out of the SQL patch for actor

[155] Fix | Delete

migration.

[156] Fix | Delete

* (T322603) SqliteMaintenance.php: Fix fatally broken instanceof check.

[157] Fix | Delete

* (T326377) rdbms: Use DBConnRef in SelectQueryBuilder.

[158] Fix | Delete

* api/en.json: api-help-datatype-expiry add missing 'may'.

[159] Fix | Delete

* (T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.

[160] Fix | Delete

* (T328222) Pass empty string to strlen() if schema is null for

[161] Fix | Delete

PostgresDatabase.

[162] Fix | Delete

* (T289926) SpecialRevisionDelete: Set default of '' for wpReason.

[163] Fix | Delete

* (T155582, T328503) Fix XML dumps for content types with non-string

[164] Fix | Delete

getNativeData().

[165] Fix | Delete

* (T326886) PoolCounterRedis: Fix wrong cast, locks weren't being released.

[166] Fix | Delete

* (T314099) revisiondelete: Replace dynamic property Status::$itemStatuses

[167] Fix | Delete

* (T327821) skin: Restore default 'value' attribute in makeSearchButton().

[168] Fix | Delete

* (T329198) ParamValidator: Improve paramvalidator-help-multi-max message.

[169] Fix | Delete

* (T329415) Clear the statsd data buffer regardless of StatsdServer config.

[170] Fix | Delete

* (T292348) WikiImporter: do not fail if upload entry in dump lacks 'text' tag.

[171] Fix | Delete

* (T330049) UnregisteredLocalFile: Don't call MimeAnalyzer if no path.

[172] Fix | Delete

* (T324894 TempFSFile: Use a WeakMap for reference tracking if available.

[173] Fix | Delete

* (T295637) Add no to fallback chain of nb and nn.

[174] Fix | Delete