[IT-SecNots] [MediaWiki-announce] Security and maintenance release: 1.31.15 / 1.35.3 / 1.36.1

[Sam Reed <reedy AT wikimedia.org>]

I would like to announce the release of MediaWiki 1.31.15, 1.35.3 and
1.36.1!

These releases also serve as a maintenance release for these branches.

While tarballs have already been uploaded, git tags will follow later on
today.

An "MediaWiki Extensions Security Release Supplement" email will follow
this one.

It is also noted that the patch from MediaWiki 1.35.2 to MediaWiki 1.35.3
(mediawiki-1.35.3.patch.gz/mediawiki-1.35.3.patch.zip) is larger than
expected due to an issue with the initial importing of skins and extensions
as submodules into the REL1_35 branch; similar to what happened for 1.36.0.
A bug has been filed for this issue, but doesn't cause any practical issues
otherwise.

== Security fixes ==
* (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging
pages.

== Links to all mentioned tasks ==
* https://phabricator.wikimedia.org/T280226

== Release notes ==

Full release notes for 1.31.15:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES-1.31
https://www.mediawiki.org/wiki/Release_notes/1.31

Full release notes for 1.35.3:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES-1.35
https://www.mediawiki.org/wiki/Release_notes/1.35

Full release notes for 1.36.1:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_36/RELEASE-NOTES-1.36
https://www.mediawiki.org/wiki/Release_notes/1.36

For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.tar.gz
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.tar.gz
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.zip

Patch to previous version (1.31.14):
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.gz
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.zip.sig
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.zip.sig
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.tar.gz
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.tar.gz
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.zip

Patch to previous version (1.35.2):
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.gz
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.zip.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.zip.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.tar.gz
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.tar.gz
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.zip

Patch to previous version (1.36.0):
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.gz
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.zip.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.zip.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to: