Re: Announcing MediaWiki 1.46.0

--===============6520798074741861167==
Content-Type: multipart/alternative; boundary="0000000000000aa91206558b3e60"

--0000000000000aa91206558b3e60
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Correction:

MediaWiki 1.46 is due to be supported until the end of *July 2027*.


On Tue, Jun 30, 2026 at 6:14=E2=80=AFPM Mateus Santos <[email protected]=
g> wrote:

> I am happy to announce the availability of the general release of
> MediaWiki 1.46!
>
> Tarballs have already been uploaded, and the git tag has been pushed.
>
> Thanks to everyone who helped out with this release, especially thanks to
> those who tested out the release candidate and provided feedback, as well
> as the developers who worked on fixes for the 1.46 final release. To see
> what's changed in 1.46, see the release notes file.[0] If you encounter a=
ny
> issues, please file a task.[1] You can see open tasks for the branch on
> Phabricator.[2]
>
> MediaWiki 1.46 is due to be supported until the end of July 2026.
>
> It's important to note that 1.46.0 is shipped with the changes released o=
n
> the current security and maintenance release.
>
> =3D=3D=3D Changes since MediaWiki 1.46.0-rc.0 =3D=3D=3D
> * (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry
> parameters [CVE-2026-58025]
> * (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter forma=
t
> is no longer raw HTML [CVE-2026-58037]
> * (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right i=
n
> more places [CVE-2026-58029]
> * (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in
> ApiUserrights [CVE-2026-58024]
> * (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's
> being transcluded is includable [CVE-2026-58026]
> * (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat
> formatversion=3D1 as text [CVE-2026-58032]
> * (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from
> distinct authors query [CVE-2026-58033]
> * (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print
> api.php responses [CVE-2026-58028]
> * (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of
> private user conditions for user [CVE-2026-58036]
> * (T428809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html
> instead of using v-html
> * (T423617) Check the target url for redirects are allowed
> * (T383047) Mail: Log PHP mail() send failures with recipient count
> * (T429720) FileRepo: Fix typos in schema compatibility checks
> * (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send()
> * (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3
> * (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1
> * (T428406) LocalFileMoveBatch: Also update fr_archive_name when moving
> file
> * (T424462) tests: Limit ResourcesTest::testRespond to general-purpose
> skins
> * (T424462) tests: loop modules inside ResourcesTest::testRespond
> * (T428289) Email confirmation banner: Remove Test Kitchen A/B test
> scaffolding
> * (T421366) Email confirmation banner: Remove obsolete arm_b variant
> * (T427622) Store indicators in ContentHolder: forward compatibility
> * changePassword: Add reason option for password change
> * (T425818) changePassword: Log password change to authentication log
>
> Release notes:
> [0]
> https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/head=
s/REL1_46/RELEASE-NOTES-1.46
>
> Bug report form:
> [1]
> https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=3DMW-1=
.46-Release
>
> Open Bugs:
> [2] https://phabricator.wikimedia.org/tag/mw-1.46-release/
>
> **********************************************************************
> Download:
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip
>
> Download without bundled extensions:
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.g=
z
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip
>
> Patch to previous version (1.46.0-rc.0):
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip
>
> GPG signatures for the above:
>
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.g=
z.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.s=
ig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.s=
ig
>
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip.=
sig
>
> Public keys:
> https://www.mediawiki.org/keys/keys.html
>
>
>

--0000000000000aa91206558b3e60
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Correction:=C2=A0</div><div><br></div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">MediaWiki 1.46 is due to be supported un=
til the end of <b>July 2027</b>.=C2=A0</blockquote></div><br><div class=3D"=
gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On=
 Tue, Jun 30, 2026 at 6:14=E2=80=AFPM Mateus Santos &lt;<a href=3D"mailto:m=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockq=
uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p=
x solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">I am happy to a=
nnounce the availability of the general release of MediaWiki 1.46!<br><br>T=
arballs have already been uploaded, and the git tag has been pushed.<br><br=
>Thanks to everyone who helped out with this release, especially thanks to =
those who tested out the release candidate and provided feedback, as well a=
s the developers who worked on fixes for the 1.46 final release. To see wha=
t&#39;s changed in 1.46, see the release notes file.[0] If you encounter an=
y issues, please file a task.[1] You can see open tasks for the branch on P=
habricator.[2]<br><br><div>MediaWiki 1.46 is due to be supported until the =
end of July 2026.</div><div><br></div><div>It&#39;s important to note that =
1.46.0 is shipped with the changes released on the current security and mai=
ntenance release.</div><br>=3D=3D=3D Changes since MediaWiki 1.46.0-rc.0 =
=3D=3D=3D<br>* (T422244, CVE-2026-58025) SECURITY: Safely unserialize log e=
ntry parameters [CVE-2026-58025]<br>* (T422995, CVE-2026-58037) SECURITY: L=
ogFormatter: &#39;raw&#39; parameter format is no longer raw HTML [CVE-2026=
-58037]<br>* (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinf=
o right in more places [CVE-2026-58029]<br>* (T422085, CVE-2026-58024) SECU=
RITY: Restrict interwiki user lookup in ApiUserrights [CVE-2026-58024]<br>*=
 (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that&#39;s =
being transcluded is includable [CVE-2026-58026]<br>* (T426867, CVE-2026-58=
032) SECURITY: mw.Api.getErrorMessage: Treat formatversion=3D1 as text [CVE=
-2026-58032]<br>* (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted u=
sernames from distinct authors query [CVE-2026-58033]<br>* (T422306, CVE-20=
26-58028) SECURITY: Disallow user JS in pretty-print api.php responses [CVE=
-2026-58028]<br>* (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers lea=
king status of private user conditions for user [CVE-2026-58036]<br>* (T428=
809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html instead of u=
sing v-html<br>* (T423617) Check the target url for redirects are allowed<b=
r>* (T383047) Mail: Log PHP mail() send failures with recipient count<br>* =
(T429720) FileRepo: Fix typos in schema compatibility checks<br>* (T383047)=
 Mail: Extract sendWithMailFunction() from UserMailer::send()<br>* (T429965=
) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3<br>* (T429826) Updated gu=
zzlehttp/guzzle from 7.10.0 to 7.12.1<br>* (T428406) LocalFileMoveBatch: Al=
so update fr_archive_name when moving file<br>* (T424462) tests: Limit Reso=
urcesTest::testRespond to general-purpose skins<br>* (T424462) tests: loop =
modules inside ResourcesTest::testRespond<br>* (T428289) Email confirmation=
 banner: Remove Test Kitchen A/B test scaffolding<br>* (T421366) Email conf=
irmation banner: Remove obsolete arm_b variant<br>* (T427622) Store indicat=
ors in ContentHolder: forward compatibility<br>* changePassword: Add reason=
 option for password change<br>* (T425818) changePassword: Log password cha=
nge to authentication log<br><br>Release notes:<br>[0] <a href=3D"https://g=
errit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/REL1_46/R=
ELEASE-NOTES-1.46" target=3D"_blank">https://gerrit.wikimedia.org/r/plugins=
/gitiles/mediawiki/core/+/refs/heads/REL1_46/RELEASE-NOTES-1.46</a><br><br>=
Bug report form:<br>[1] <a href=3D"https://phabricator.wikimedia.org/maniph=
est/task/edit/form/1/?tags=3DMW-1.46-Release" target=3D"_blank">https://pha=
bricator.wikimedia.org/maniphest/task/edit/form/1/?tags=3DMW-1.46-Release</=
a><br><br>Open Bugs:<br>[2] <a href=3D"https://phabricator.wikimedia.org/ta=
g/mw-1.46-release/" target=3D"_blank">https://phabricator.wikimedia.org/tag=
/mw-1.46-release/</a><br><br>**********************************************=
************************<br>Download:<br><a href=3D"https://releases.wikime=
dia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz" target=3D"_blank">https://r=
eleases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz</a><br><a href=
=3D"https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip" tar=
get=3D"_blank">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46=
.0.zip</a><br><br>Download without bundled extensions:<br><a href=3D"https:=
//releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz" targe=
t=3D"_blank">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1=
.46.0.tar.gz</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.4=
6/mediawiki-core-1.46.0.zip" target=3D"_blank">https://releases.wikimedia.o=
rg/mediawiki/1.46/mediawiki-core-1.46.0.zip</a><br><br>Patch to previous ve=
rsion (1.46.0-rc.0):<br><a href=3D"https://releases.wikimedia.org/mediawiki=
/1.46/mediawiki-1.46.0.patch.gz" target=3D"_blank">https://releases.wikimed=
ia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz</a><br><a href=3D"https://r=
eleases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip" target=3D"=
_blank">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patc=
h.zip</a><br><br>GPG signatures for the above:<br><a href=3D"https://releas=
es.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz.sig" target=3D=
"_blank">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.=
0.tar.gz.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.4=
6/mediawiki-core-1.46.0.zip.sig" target=3D"_blank">https://releases.wikimed=
ia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.sig</a><br><a href=3D"https=
://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig" targe=
t=3D"_blank">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0=
.tar.gz.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46=
/mediawiki-1.46.0.zip.sig" target=3D"_blank">https://releases.wikimedia.org=
/mediawiki/1.46/mediawiki-1.46.0.zip.sig</a><br><a href=3D"https://releases=
.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.sig" target=3D"_bla=
nk">https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz=
.sig</a><br><a href=3D"https://releases.wikimedia.org/mediawiki/1.46/mediaw=
iki-1.46.0.patch.zip.sig" target=3D"_blank">https://releases.wikimedia.org/=
mediawiki/1.46/mediawiki-1.46.0.patch.zip.sig</a><br><br>Public keys:<br><a=
 href=3D"https://www.mediawiki.org/keys/keys.html" target=3D"_blank">https:=
//www.mediawiki.org/keys/keys.html</a><br><br><br></div>
</blockquote></div>

--0000000000000aa91206558b3e60--

--===============6520798074741861167==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
MediaWiki-l mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/
--===============6520798074741861167==--