[IT-SecNots] [MediaWiki-announce] Security pre-release announcement: 1.39.12 / 1.42.6 / 1.43.1

[Sam Reed <reedy AT wikimedia.org>]

Hi all,

Apologies for this release being late, as it was due in the last week of
March. Unfortunately, due to the events of [2], that took priority in terms
of resources.

On Thursday we will be issuing a security and maintenance release to all
supported branches of MediaWiki.

The new releases will be:

- 1.39.12
- 1.42.6
- 1.43.1

This will also resolve a security issue in a bundled extension, along with
bug fixes included for maintenance reasons.

These security issues also affect many unsupported versions of MediaWiki.

We will make the fixes available in the respective release branches and
master in git. Tarballs will be available for the above mentioned point
releases as well.

A summary of some of the security fixes that have gone into non-bundled
MediaWiki extensions will also follow later.

As a reminder, MediaWiki 1.35 became end of life (EOL) in December 2023,
MediaWiki 1.40 became EOL in June 2024 and MediaWiki 1.41 became EOL in
December 2024.

MediaWiki 1.39 (the old LTS before 1.43) becomes EOL in November 2025.

It is strongly recommended to upgrade to either 1.42, which will be
supported until June 2025, or ideally to 1.43 (the next LTS after 1.39),
which will be supported until December 2027.

[1] https://www.mediawiki.org/wiki/Version_lifecycle
[2]
https://meta.wikimedia.org/wiki/Wikimedia_Foundation/March_2025_discovery_of_account_compromises
_______________________________________________
MediaWiki-announce mailing list -- mediawiki-announce AT lists.wikimedia.org
To unsubscribe send an email to mediawiki-announce-leave AT lists.wikimedia.org