Correction: MediaWiki 1.46 is due to be supported until the end of *July 2027*.
On Tue, Jun 30, 2026 at 6:14 PM Mateus Santos <[email protected]> wrote: > I am happy to announce the availability of the general release of > MediaWiki 1.46! > > Tarballs have already been uploaded, and the git tag has been pushed. > > Thanks to everyone who helped out with this release, especially thanks to > those who tested out the release candidate and provided feedback, as well > as the developers who worked on fixes for the 1.46 final release. To see > what's changed in 1.46, see the release notes file.[0] If you encounter any > issues, please file a task.[1] You can see open tasks for the branch on > Phabricator.[2] > > MediaWiki 1.46 is due to be supported until the end of July 2026. > > It's important to note that 1.46.0 is shipped with the changes released on > the current security and maintenance release. > > === Changes since MediaWiki 1.46.0-rc.0 === > * (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry > parameters [CVE-2026-58025] > * (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format > is no longer raw HTML [CVE-2026-58037] > * (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in > more places [CVE-2026-58029] > * (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in > ApiUserrights [CVE-2026-58024] > * (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's > being transcluded is includable [CVE-2026-58026] > * (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat > formatversion=1 as text [CVE-2026-58032] > * (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from > distinct authors query [CVE-2026-58033] > * (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print > api.php responses [CVE-2026-58028] > * (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of > private user conditions for user [CVE-2026-58036] > * (T428809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html > instead of using v-html > * (T423617) Check the target url for redirects are allowed > * (T383047) Mail: Log PHP mail() send failures with recipient count > * (T429720) FileRepo: Fix typos in schema compatibility checks > * (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send() > * (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3 > * (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1 > * (T428406) LocalFileMoveBatch: Also update fr_archive_name when moving > file > * (T424462) tests: Limit ResourcesTest::testRespond to general-purpose > skins > * (T424462) tests: loop modules inside ResourcesTest::testRespond > * (T428289) Email confirmation banner: Remove Test Kitchen A/B test > scaffolding > * (T421366) Email confirmation banner: Remove obsolete arm_b variant > * (T427622) Store indicators in ContentHolder: forward compatibility > * changePassword: Add reason option for password change > * (T425818) changePassword: Log password change to authentication log > > Release notes: > [0] > https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/REL1_46/RELEASE-NOTES-1.46 > > Bug report form: > [1] > https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.46-Release > > Open Bugs: > [2] https://phabricator.wikimedia.org/tag/mw-1.46-release/ > > ********************************************************************** > Download: > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip > > Download without bundled extensions: > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip > > Patch to previous version (1.46.0-rc.0): > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip > > GPG signatures for the above: > > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz.sig > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.sig > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.sig > > https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip.sig > > Public keys: > https://www.mediawiki.org/keys/keys.html > > >
_______________________________________________ Wikitech-l mailing list -- [email protected] To unsubscribe send an email to [email protected] https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
