[IT-SecNots] [MediaWiki-announce] Security pre-release announcement: 1.31.15 / 1.35.3 / 1.36.1

[Sam Reed <reedy AT wikimedia.org>]

Hi all,

Tomorrow we will be issuing a security and maintenance release to all
supported branches of MediaWiki.

The new releases will be:

- 1.31.15
- 1.35.3
- 1.36.1

This will resolve 1 minor issue in MediaWiki core and also includes some
fixes previously committed to git, including minor security and hardening
patches along with bug fixes included for maintenance reasons.

We will make the fixes available in these respective release branches, and
also master. Tarballs will be available for the above mentioned point
releases as well.

A summary of some of the security fixes that have gone into non-bundled
MediaWiki extensions will also follow.

As a reminder, 1.31 (the old LTS) was due to become end of life (EOL) in
June 2021. 1.35 (the new LTS) is supported until September 2023. However,
to try and meet our LTS-LTS overlap commitments (1.35 was late due to
COVID), 1.31 will get best-efforts extra support until the end of September
2021. Practically, this will mean 1.31 is only tested on PHP 7.2, removing
the burden of testing on PHP 7.0 and 7.1 which both became EOL in 2019.
This will also mean 1.31 is eligible for one final security release in late
September 2021 before formally becoming EOL.

[1] https://www.mediawiki.org/wiki/Version_lifecycle
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to: