Security and maintenance release: 1.39.15 / 1.43.5 / 1.44.2

--===============7173410559988255512==
Content-Type: multipart/alternative; boundary="0000000000009c6fd0064045809b"

--0000000000009c6fd0064045809b
Content-Type: text/plain; charset="UTF-8"

I would like to announce the release of MediaWiki 1.39.15, 1.43.5 and 1.44.2

This release primarily serves as a security and maintenance release for
these branches.

REL1_39 had an issue with the VisualEditor extension backports.

REL1_43 had missing backports for the DiscussionTools and Thanks extensions
from.

REL1_44 also had an issue with a backport for a CheckUser extension patch.
This has been corrected in 1.44.2, but this unfortunately made another low
severity XSS apparent in MediaWiki core which affects all release branches.
This is tracked at T406322 under CVE-2025-11261.

Some other changes may be included in these patches based on what has been
merged to those branches in the meantime.

The tarballs have already been uploaded as of this email, and the git tags
have been pushed.

Reports of bugs with PHP 8.0, 8.1, 8.2, 8.3 and 8.4 support are
particularly welcome, and fixes will be back-ported when possible. Please
see https://phabricator.wikimedia.org/tag/php_8.0_support/,
https://phabricator.wikimedia.org/tag/php_8.1_support/,
https://phabricator.wikimedia.org/tag/php_8.2_support/,
https://phabricator.wikimedia.org/tag/php_8.3_support/ and
https://phabricator.wikimedia.org/tag/php_8.4_support/ for the relevant
work boards.

As a reminder, MediaWiki 1.35 became end of life (EOL) in December 2023,
MediaWiki 1.40 became EOL in June 2024, MediaWiki 1.41 became EOL in
December 2024 and MediaWiki 1.42 became EOL at the end of June 2025.

MediaWiki 1.39 (the old LTS before 1.43) becomes EOL in December 2025. It
is strongly recommended to upgrade to 1.43 (the next LTS after 1.39), which
will be supported until December 2027.

== Links to all mentioned tasks ==

* https://phabricator.wikimedia.org/T406322

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.tar.gz
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.15.tar.gz
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.15.zip

Patch to previous version (1.39.14):
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.patch.gz
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.15.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.15.zip.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.zip.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.tar.gz
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.5.tar.gz
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.5.zip

Patch to previous version (1.43.4):
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.patch.gz
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.5.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.5.zip.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.zip.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.tar.gz
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.2.tar.gz
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.2.zip

Patch to previous version (1.44.1):
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch.gz
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.2.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.2.zip.sig
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.zip.sig
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

--0000000000009c6fd0064045809b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I would like to announce the release of MediaWiki 1.39.15,=
 1.43.5 and 1.44.2<br><br>This release primarily serves as a security and m=
aintenance release for these branches.<br><br>REL1_39 had an issue with the=
 VisualEditor extension backports.<br><br>REL1_43 had missing backports for=
 the DiscussionTools and Thanks extensions from.<br><br>REL1_44 also had an=
 issue with a backport for a CheckUser extension patch. This has been corre=
cted in 1.44.2, but this unfortunately made another low severity XSS appare=
nt in MediaWiki core which affects all release branches. This is tracked at=
 T406322 under CVE-2025-11261.<br><br>Some other changes may be included in=
 these patches based on what has been merged to those branches in the meant=
ime.<br><br>The tarballs have already been uploaded as of this email, and t=
he git tags have been pushed.<br><br>Reports of bugs with PHP 8.0, 8.1, 8.2=
, 8.3 and 8.4 support are particularly welcome, and fixes will be back-port=
ed when possible. Please see <a href=3D"https://phabricator.wikimedia.org/t=
ag/php_8.0_support/">https://phabricator.wikimedia.org/tag/php_8.0_support/=
</a>, <a href=3D"https://phabricator.wikimedia.org/tag/php_8.1_support/">ht=
tps://phabricator.wikimedia.org/tag/php_8.1_support/</a>, <a href=3D"https:=
//phabricator.wikimedia.org/tag/php_8.2_support/">https://phabricator.wikim=
edia.org/tag/php_8.2_support/</a>, <a href=3D"https://phabricator.wikimedia=
.org/tag/php_8.3_support/">https://phabricator.wikimedia.org/tag/php_8.3_su=
pport/</a> and <a href=3D"https://phabricator.wikimedia.org/tag/php_8.4_sup=
port/">https://phabricator.wikimedia.org/tag/php_8.4_support/</a> for the r=
elevant work boards.<br><br>As a reminder, MediaWiki 1.35 became end of lif=
e (EOL) in December 2023, MediaWiki 1.40 became EOL in June 2024, MediaWiki=
 1.41 became EOL in December 2024 and MediaWiki 1.42 became EOL at the end =
of June 2025.<br><br>MediaWiki 1.39 (the old LTS before 1.43) becomes EOL i=
n December 2025. It is strongly recommended to upgrade to 1.43 (the next LT=
S after 1.39), which will be supported until December 2027.<br><br>=3D=3D L=
inks to all mentioned tasks =3D=3D<br><br>* <a href=3D"https://phabricator.=
wikimedia.org/T406322">https://phabricator.wikimedia.org/T406322</a><br><br=
>**********************************************************************<br>=
Download:<br><a href=3D"https://releases.wikimedia.org/mediawiki/1.39/media=
wiki-1.39.15.tar.gz">https://releases.wikimedia.org/mediawiki/1.39/mediawik=
i-1.39.15.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki=
/1.39/mediawiki-1.39.15.zip">https://releases.wikimedia.org/mediawiki/1.39/=
mediawiki-1.39.15.zip</a><br><br>Download without bundled extensions:<br><a=
 href=3D"https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.=
15.tar.gz">https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.3=
9.15.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.39=
/mediawiki-core-1.39.15.zip">https://releases.wikimedia.org/mediawiki/1.39/=
mediawiki-core-1.39.15.zip</a><br><br>Patch to previous version (1.39.14):<=
br><a href=3D"https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.=
15.patch.gz">https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.1=
5.patch.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.39/=
mediawiki-1.39.15.patch.zip">https://releases.wikimedia.org/mediawiki/1.39/=
mediawiki-1.39.15.patch.zip</a><br><br>GPG signatures:<br><a href=3D"https:=
//releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.15.tar.gz.sig">=
https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.15.tar.gz=
.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.39/mediaw=
iki-core-1.39.15.zip.sig">https://releases.wikimedia.org/mediawiki/1.39/med=
iawiki-core-1.39.15.zip.sig</a><br><a href=3D"https://releases.wikimedia.or=
g/mediawiki/1.39/mediawiki-1.39.15.tar.gz.sig">https://releases.wikimedia.o=
rg/mediawiki/1.39/mediawiki-1.39.15.tar.gz.sig</a><br><a href=3D"https://re=
leases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.zip.sig">https://rele=
ases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.zip.sig</a><br><a href=
=3D"https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.patch.g=
z.sig">https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.15.patc=
h.gz.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.39/me=
diawiki-1.39.15.patch.zip.sig">https://releases.wikimedia.org/mediawiki/1.3=
9/mediawiki-1.39.15.patch.zip.sig</a><br><br>Public keys:<br><a href=3D"htt=
ps://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.=
html</a><br><br>***********************************************************=
***********<br>Download:<br><a href=3D"https://releases.wikimedia.org/media=
wiki/1.43/mediawiki-1.43.5.tar.gz">https://releases.wikimedia.org/mediawiki=
/1.43/mediawiki-1.43.5.tar.gz</a><br><a href=3D"https://releases.wikimedia.=
org/mediawiki/1.43/mediawiki-1.43.5.zip">https://releases.wikimedia.org/med=
iawiki/1.43/mediawiki-1.43.5.zip</a><br><br>Download without bundled extens=
ions:<br><a href=3D"https://releases.wikimedia.org/mediawiki/1.43/mediawiki=
-core-1.43.5.tar.gz">https://releases.wikimedia.org/mediawiki/1.43/mediawik=
i-core-1.43.5.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/media=
wiki/1.43/mediawiki-core-1.43.5.zip">https://releases.wikimedia.org/mediawi=
ki/1.43/mediawiki-core-1.43.5.zip</a><br><br>Patch to previous version (1.4=
3.4):<br><a href=3D"https://releases.wikimedia.org/mediawiki/1.43/mediawiki=
-1.43.5.patch.gz">https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1=
.43.5.patch.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1=
.43/mediawiki-1.43.5.patch.zip">https://releases.wikimedia.org/mediawiki/1.=
43/mediawiki-1.43.5.patch.zip</a><br><br>GPG signatures:<br><a href=3D"http=
s://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.5.tar.gz.sig"=
>https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.5.tar.gz=
.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.43/mediaw=
iki-core-1.43.5.zip.sig">https://releases.wikimedia.org/mediawiki/1.43/medi=
awiki-core-1.43.5.zip.sig</a><br><a href=3D"https://releases.wikimedia.org/=
mediawiki/1.43/mediawiki-1.43.5.tar.gz.sig">https://releases.wikimedia.org/=
mediawiki/1.43/mediawiki-1.43.5.tar.gz.sig</a><br><a href=3D"https://releas=
es.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.zip.sig">https://releases.=
wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.zip.sig</a><br><a href=3D"htt=
ps://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.patch.gz.sig">h=
ttps://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.5.patch.gz.sig<=
/a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1=
.43.5.patch.zip.sig">https://releases.wikimedia.org/mediawiki/1.43/mediawik=
i-1.43.5.patch.zip.sig</a><br><br>Public keys:<br><a href=3D"https://www.me=
diawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a><br=
><br>**********************************************************************=
<br>Download:<br><a href=3D"https://releases.wikimedia.org/mediawiki/1.44/m=
ediawiki-1.44.2.tar.gz">https://releases.wikimedia.org/mediawiki/1.44/media=
wiki-1.44.2.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawi=
ki/1.44/mediawiki-1.44.2.zip">https://releases.wikimedia.org/mediawiki/1.44=
/mediawiki-1.44.2.zip</a><br><br>Download without bundled extensions:<br><a=
 href=3D"https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.=
2.tar.gz">https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44=
.2.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.44/m=
ediawiki-core-1.44.2.zip">https://releases.wikimedia.org/mediawiki/1.44/med=
iawiki-core-1.44.2.zip</a><br><br>Patch to previous version (1.44.1):<br><a=
 href=3D"https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.pat=
ch.gz">https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch=
.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.44/mediawi=
ki-1.44.2.patch.zip">https://releases.wikimedia.org/mediawiki/1.44/mediawik=
i-1.44.2.patch.zip</a><br><br>GPG signatures:<br><a href=3D"https://release=
s.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.2.tar.gz.sig">https://re=
leases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.2.tar.gz.sig</a><br=
><a href=3D"https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.=
44.2.zip.sig">https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-=
1.44.2.zip.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1=
.44/mediawiki-1.44.2.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1=
.44/mediawiki-1.44.2.tar.gz.sig</a><br><a href=3D"https://releases.wikimedi=
a.org/mediawiki/1.44/mediawiki-1.44.2.zip.sig">https://releases.wikimedia.o=
rg/mediawiki/1.44/mediawiki-1.44.2.zip.sig</a><br><a href=3D"https://releas=
es.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch.gz.sig">https://rele=
ases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch.gz.sig</a><br><a h=
ref=3D"https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.patch=
.zip.sig">https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.2.pa=
tch.zip.sig</a><br><br>Public keys:<br><a href=3D"https://www.mediawiki.org=
/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a></div>

--0000000000009c6fd0064045809b--

--===============7173410559988255512==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
MediaWiki-l mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/
--===============7173410559988255512==--