[IT-SecNots] [MediaWiki-announce] Security pre-release announcement: 1.31.9 / 1.34.3 / 1.35.0

[Sam Reed <reedy AT wikimedia.org>]

Hi all,

Tomorrow we will be issuing a security and maintenance release to all
supported branches of MediaWiki.

The new releases will be:

- 1.34.3
- 1.31.9

This will resolve eight issues in MediaWiki core (two of which aren't
applicable to MediaWiki 1.31), and also includes some fixes previously
committed to git, including minor security and hardening patches along with
bug fixes included for maintenance reasons.

For those of you waiting on MediaWiki 1.35.0, this will also come either
tomorrow, or at latest Friday (depending on CI load), including the
security fixes applied to these other supported release branches. We thank
you for your patience; the current global situation means things have taken
longer than would have been expected, but it has meant more bug fixes being
incorporated from testing across the board. It also meant not having a
security 1.35.1 release followup only a couple of weeks after 1.35.0 coming
out. Which, for many people would mean extra work to upgrade again, and it
was decided to avoid this.

We will make the fixes available in these respective release branches, and
also master. Tarballs will be available for the above mentioned point
releases as well.

A summary of some of the security fixes that have gone into non-bundled
MediaWiki extensions will also follow.

As per the MediaWiki Version lifecycle [1], November 2020 is the scheduled
EOL date for the REL1_34. 1.34.3 will therefore potentially be the final
release of the MediaWiki 1.34 branch, barring any unforeseen issues. As per
above, MediaWiki 1.35.0 will be released this week, and will be supported
until at least September 2023, and would be the recommended upgrade path.

[1] https://www.mediawiki.org/wiki/Version_lifecycle
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce