[IT-SecNots] [MediaWiki-announce] Re: Announcing MediaWiki 1.46.0

[Mateus Santos via MediaWiki-announce <mediawiki-announce AT lists.wikimedia.org>]

Correction:

MediaWiki 1.46 is due to be supported until the end of *July 2027*.


On Tue, Jun 30, 2026 at 6:14 PM Mateus Santos <msantos AT wikimedia.org> wrote:

> I am happy to announce the availability of the general release of
> MediaWiki 1.46!
>
> Tarballs have already been uploaded, and the git tag has been pushed.
>
> Thanks to everyone who helped out with this release, especially thanks to
> those who tested out the release candidate and provided feedback, as well
> as the developers who worked on fixes for the 1.46 final release. To see
> what's changed in 1.46, see the release notes file.[0] If you encounter any
> issues, please file a task.[1] You can see open tasks for the branch on
> Phabricator.[2]
>
> MediaWiki 1.46 is due to be supported until the end of July 2026.
>
> It's important to note that 1.46.0 is shipped with the changes released on
> the current security and maintenance release.
>
> === Changes since MediaWiki 1.46.0-rc.0 ===
> * (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry
> parameters [CVE-2026-58025]
> * (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format
> is no longer raw HTML [CVE-2026-58037]
> * (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in
> more places [CVE-2026-58029]
> * (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in
> ApiUserrights [CVE-2026-58024]
> * (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's
> being transcluded is includable [CVE-2026-58026]
> * (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat
> formatversion=1 as text [CVE-2026-58032]
> * (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from
> distinct authors query [CVE-2026-58033]
> * (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print
> api.php responses [CVE-2026-58028]
> * (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of
> private user conditions for user [CVE-2026-58036]
> * (T428809, CVE-2026-58035) SECURITY: Parse message using v-i18n-html
> instead of using v-html
> * (T423617) Check the target url for redirects are allowed
> * (T383047) Mail: Log PHP mail() send failures with recipient count
> * (T429720) FileRepo: Fix typos in schema compatibility checks
> * (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send()
> * (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3
> * (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1
> * (T428406) LocalFileMoveBatch: Also update fr_archive_name when moving
> file
> * (T424462) tests: Limit ResourcesTest::testRespond to general-purpose
> skins
> * (T424462) tests: loop modules inside ResourcesTest::testRespond
> * (T428289) Email confirmation banner: Remove Test Kitchen A/B test
> scaffolding
> * (T421366) Email confirmation banner: Remove obsolete arm_b variant
> * (T427622) Store indicators in ContentHolder: forward compatibility
> * changePassword: Add reason option for password change
> * (T425818) changePassword: Log password change to authentication log
>
> Release notes:
> [0]
> https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/REL1_46/RELEASE-NOTES-1.46
>
> Bug report form:
> [1]
> https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.46-Release
>
> Open Bugs:
> [2] https://phabricator.wikimedia.org/tag/mw-1.46-release/
>
> **********************************************************************
> Download:
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip
>
> Download without bundled extensions:
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip
>
> Patch to previous version (1.46.0-rc.0):
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip
>
> GPG signatures for the above:
>
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.tar.gz.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.0.zip.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.tar.gz.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.zip.sig
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.gz.sig
>
> https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.0.patch.zip.sig
>
> Public keys:
> https://www.mediawiki.org/keys/keys.html
>
>
>
_______________________________________________
MediaWiki-announce mailing list -- mediawiki-announce AT lists.wikimedia.org
To unsubscribe send an email to mediawiki-announce-leave AT lists.wikimedia.org