Announcing MediaWiki 1.46.0

--===============6139347229681027185==
Content-Type: multipart/alternative; boundary="00000000000089f7ba06557adf21"

--00000000000089f7ba06557adf21
Content-Type: text/plain; charset="UTF-8"

I am happy to announce the availability of the general release of MediaWiki
1.46!

Tarballs have already been uploaded, and the git tag has been pushed.

Thanks to everyone who helped out with this release, especially thanks to
those who tested out the release candidate and provided feedback, as well
as the developers who worked on fixes for the 1.46 final release. To see
what's changed in 1.46, see the release notes file.[0] If you encounter any
issues, please file a task.[1] You can see open tasks for the branch on
Phabricator.[2]

MediaWiki 1.46 is due to be supported until the end of July 2026.

It's important to note that 1.46.0 is shipped with the changes released on
the current security and maintenance release.

=== Changes since MediaWiki 1.46.0-rc.0 ===
* (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry
parameters [CVE-2026-58025]
* (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format
is no longer raw HTML [CVE-2026-58037]
* (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in
more places [CVE-2026-58029]
* (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in
ApiUserrights [CVE-2026-58024]
* (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's
being transcluded is includable [CVE-2026-58026]
* (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat
formatversion=1 as text [CVE-2026-58032]
* (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from
distinct authors query [CVE-2026-58033]
* (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print
api.php responses [CVE-2026-58028]
* (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of
private user conditions for user [CVE-2026-58036]
* (T428809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html
instead of using v-html
* (T423617) Check the target url for redirects are allowed
* (T383047) Mail: Log PHP mail() send failures with recipient count
* (T429720) FileRepo: Fix typos in schema compatibility checks
* (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send()
* (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3
* (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1
* (T428406) LocalFileMoveBatch: Also update fr_archive_name when moving file
* (T424462) tests: Limit ResourcesTest::testRespond to general-purpose skins
* (T424462) tests: loop modules inside ResourcesTest::testRespond
* (T428289) Email confirmation banner: Remove Test Kitchen A/B test
scaffolding
* (T421366) Email confirmation banner: Remove obsolete arm_b variant
* (T427622) Store indicators in ContentHolder: forward compatibility
* changePassword: Add reason option for password change
* (T425818) changePassword: Log password change to authentication log

Release notes:
[0]
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/REL1_46/RELEASE-NOTES-1.46

Bug report form:
[1]
https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.46-Release

Open Bugs:
[2] https://phabricator.wikimedia.org/tag/mw-1.46-release/

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip

Patch to previous version (1.46.0-rc.0):
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip

GPG signatures for the above:
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

--00000000000089f7ba06557adf21
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I am happy to announce the availability of the general rel=
ease of MediaWiki 1.46!<br><br>Tarballs have already been uploaded, and the=
 git tag has been pushed.<br><br>Thanks to everyone who helped out with thi=
s release, especially thanks to those who tested out the release candidate =
and provided feedback, as well as the developers who worked on fixes for th=
e 1.46 final release. To see what&#39;s changed in 1.46, see the release no=
tes file.[0] If you encounter any issues, please file a task.[1] You can se=
e open tasks for the branch on Phabricator.[2]<br><br><div>MediaWiki 1.46 i=
s due to be supported until the end of July 2026.</div><div><br></div><div>=
It&#39;s important to note that 1.46.0 is shipped with the changes released=
 on the current security and maintenance release.</div><br>=3D=3D=3D Change=
s since MediaWiki 1.46.0-rc.0 =3D=3D=3D<br>* (T422244, CVE-2026-58025) SECU=
RITY: Safely unserialize log entry parameters [CVE-2026-58025]<br>* (T42299=
5, CVE-2026-58037) SECURITY: LogFormatter: &#39;raw&#39; parameter format i=
s no longer raw HTML [CVE-2026-58037]<br>* (T422676, CVE-2026-58029) SECURI=
TY: Check for editmyprivateinfo right in more places [CVE-2026-58029]<br>* =
(T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in ApiUs=
errights [CVE-2026-58024]<br>* (T299359, CVE-2026-58026) SECURITY: Make sur=
e the actual title that&#39;s being transcluded is includable [CVE-2026-580=
26]<br>* (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat =
formatversion=3D1 as text [CVE-2026-58032]<br>* (T427235, CVE-2026-58033) S=
ECURITY: Exclude rev-deleted usernames from distinct authors query [CVE-202=
6-58033]<br>* (T422306, CVE-2026-58028) SECURITY: Disallow user JS in prett=
y-print api.php responses [CVE-2026-58028]<br>* (T425406, CVE-2026-58036) S=
ECURITY: Fix ApiQueryUsers leaking status of private user conditions for us=
er [CVE-2026-58036]<br>* (T428809, CVE-2026-58035) SECURITY: Parse message =
using v-i18n-html instead of using v-html<br>* (T423617) Check the target u=
rl for redirects are allowed<br>* (T383047) Mail: Log PHP mail() send failu=
res with recipient count<br>* (T429720) FileRepo: Fix typos in schema compa=
tibility checks<br>* (T383047) Mail: Extract sendWithMailFunction() from Us=
erMailer::send()<br>* (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.=
12.3<br>* (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1<br>* (T=
428406) LocalFileMoveBatch: Also update fr_archive_name when moving file<br=
>* (T424462) tests: Limit ResourcesTest::testRespond to general-purpose ski=
ns<br>* (T424462) tests: loop modules inside ResourcesTest::testRespond<br>=
* (T428289) Email confirmation banner: Remove Test Kitchen A/B test scaffol=
ding<br>* (T421366) Email confirmation banner: Remove obsolete arm_b varian=
t<br>* (T427622) Store indicators in ContentHolder: forward compatibility<b=
r>* changePassword: Add reason option for password change<br>* (T425818) ch=
angePassword: Log password change to authentication log<br><br>Release note=
s:<br>[0] <a href=3D"https://gerrit.wikimedia.org/r/plugins/gitiles/mediawi=
ki/core/+/refs/heads/REL1_46/RELEASE-NOTES-1.46">https://gerrit.wikimedia.o=
rg/r/plugins/gitiles/mediawiki/core/+/refs/heads/REL1_46/RELEASE-NOTES-1.46=
</a><br><br>Bug report form:<br>[1] <a href=3D"https://phabricator.wikimedi=
a.org/maniphest/task/edit/form/1/?tags=3DMW-1.46-Release">https://phabricat=
or.wikimedia.org/maniphest/task/edit/form/1/?tags=3DMW-1.46-Release</a><br>=
<br>Open Bugs:<br>[2] <a href=3D"https://phabricator.wikimedia.org/tag/mw-1=
.46-release/">https://phabricator.wikimedia.org/tag/mw-1.46-release/</a><br=
><br>**********************************************************************=
<br>Download:<br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46/m=
ediawiki-1.46.0.tar.gz">https://releases.wikimedia.org/mediawiki/1.46/media=
wiki-1.46.0.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawi=
ki/1.46/mediawiki-1.46.0.zip">https://releases.wikimedia.org/mediawiki/1.46=
/mediawiki-1.46.0.zip</a><br><br>Download without bundled extensions:<br><a=
 href=3D"https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.=
0.tar.gz">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46=
.0.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46/m=
ediawiki-core-1.46.0.zip">https://releases.wikimedia.org/mediawiki/1.46/med=
iawiki-core-1.46.0.zip</a><br><br>Patch to previous version (1.46.0-rc.0):<=
br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.=
0.patch.gz">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.=
patch.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46/me=
diawiki-1.46.0.patch.zip">https://releases.wikimedia.org/mediawiki/1.46/med=
iawiki-1.46.0.patch.zip</a><br><br>GPG signatures for the above:<br><a href=
=3D"https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar=
.gz.sig">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.=
0.tar.gz.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.4=
6/mediawiki-core-1.46.0.zip.sig">https://releases.wikimedia.org/mediawiki/1=
.46/mediawiki-core-1.46.0.zip.sig</a><br><a href=3D"https://releases.wikime=
dia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig">https://releases.wikime=
dia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig</a><br><a href=3D"https:=
//releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig">https://r=
eleases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig</a><br><a hre=
f=3D"https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.g=
z.sig">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch=
.gz.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46/med=
iawiki-1.46.0.patch.zip.sig">https://releases.wikimedia.org/mediawiki/1.46/=
mediawiki-1.46.0.patch.zip.sig</a><br><br>Public keys:<br><a href=3D"https:=
//www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.htm=
l</a><br><br><br></div>

--00000000000089f7ba06557adf21--

--===============6139347229681027185==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
MediaWiki-l mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/
--===============6139347229681027185==--