[IT-SecNots] [MediaWiki-announce] Security pre-release announcement: 1.30.6 / 1.32.6 / 1.33.2 / 1.34.0

[Sam Reed <reedy AT wikimedia.org>]

Hi all,

Tomorrow we will be issuing a security and maintenance release to all
supported branches of MediaWiki.

It will also coincide with the with formal release of 1.34.0, which has
been a little bit delayed due to the US holidays and the Wikimedia
Technical Conference whilst the last few couple of outstanding issues could
be fixed. It also meant that a followup release to the REL1_34 branch
wouldn't be needed only a couple of weeks after the 1.34.0 release was cut.

The new releases will be:
1.34.0
1.33.2
1.32.6
1.31.6

This will resolve 1 issue in MediaWiki core (when running on older PHP
versions), and also includes some fixes previously committed to git, such
as minor security and hardening patches.

Fixes will be available in these respective release branches, and also
master. Tarballs will be available for the above mentioned point releases
as well.

1.32.6 will also be the final release for 1.32 (barring any unforeseen
issues), which is scheduled to become end of life in January 2020 [1]. If
you're using 1.32, it is recommended that you upgrade to the latest point
release of the 1.33 branch (1.33.2, to be released tomorrow) or 1.34.0 to
carry on using a maintained and supported release.

This security release includes fixes for MediaWiki core.

A summary of some of the security fixes that have gone into non bundled
MediaWiki extensions will also follow.

[1] https://www.mediawiki.org/wiki/Version_lifecycle

Thanks!


Sam
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce