[IT-SecNots] [MediaWiki-announce] Security pre-release announcement: 1.39.7 / 1.40.3 / 1.41.1

[Sam Reed <reedy AT wikimedia.org>]

Hi all,

On Thursday we will be issuing a security and maintenance release to all
supported branches of MediaWiki.

The new releases will be:

- 1.39.7
- 1.40.3
- 1.41.1

This will resolve two security issues in MediaWiki core, along with bug
fixes included for maintenance reasons. This includes various patches for
PHP 8.0, 8.1, 8.2 and 8.3 support.

This release may or may not be made with a CVE number formally attached,
due to the recent delays in receiving them from MITRE.

We will make the fixes available in the respective release branches and
master in git. Tarballs will be available for the above mentioned point
releases as well.

A summary of some of the security fixes that have gone into non-bundled
MediaWiki extensions will also follow later.

As a reminder, MediaWiki 1.35 became end of life (EOL) in December 2023.

It is strongly recommended to upgrade to either 1.39 (the next LTS after
1.35), which will be supported until November 2025, 1.40, which will be
supported until June 2024, or 1.41, which will be supported until December
2024.

[1] https://www.mediawiki.org/wiki/Version_lifecycle
_______________________________________________
MediaWiki-announce mailing list -- mediawiki-announce AT lists.wikimedia.org
To unsubscribe send an email to mediawiki-announce-leave AT lists.wikimedia.org