[IT-SecNots] [MediaWiki-announce] Security and maintenance release: 1.43.10 / 1.45.5 / 1.46.1

[Sam Reed via MediaWiki-announce <mediawiki-announce AT lists.wikimedia.org>]

I would like to announce the release of MediaWiki 1.43.10, 1.45.5 and
1.46.1!

These releases serve as security and maintenance releases for these
branches.

The tarballs have already been uploaded as of this email, and the git tags
will be pushed shortly.

A "MediaWiki Extensions Security Release Supplement" e-mail will follow
this one, covering security updates for non-bundled extensions.

Reports of bugs with PHP 8.1 to 8.6 support are particularly welcome, and
fixes will be back-ported when possible. If you find issues that haven't
been backported, please report these too, referring to the relevant
supported release.

PHP 8.x workboards:
* https://phabricator.wikimedia.org/tag/php_8.1_support/
* https://phabricator.wikimedia.org/tag/php_8.2_support/
* https://phabricator.wikimedia.org/tag/php_8.3_support/
* https://phabricator.wikimedia.org/tag/php_8.4_support/
* https://phabricator.wikimedia.org/tag/php_8.5_support/
* https://phabricator.wikimedia.org/tag/php_8.6_support/

As a reminder, MediaWiki 1.39 became EOL in December 2025, MediaWiki 1.42
became EOL in June 2025 and MediaWiki 1.44 became EOL at the end of July
2026.

== Security fixes ==

* (T432551, CVE-2026-102966) SECURITY: Fix deleted edit summary leak in
page history feeds.
* (T431819, CVE-2026-102967) SECURITY: SpecialUpload: Prevent Open Redirect
using wpDestUrl.
* (T431819, CVE-2026-102968) SECURITY: NoLocalSettings: Fixes a potential
path traversal.
* (T434189, CVE-2026-102969) SECURITY: Check the authority of selser data
when html is supplied.
* (T434278, CVE-2026-102970) SECURITY: APIComparePages should preserve
revision visibility.
* (T434521, CVE-2026-102971) SECURITY: PageContentHelper: Respect
visibility of user_id in output.
* (T120386, CVE-2026-102972) SECURITY: Disallow raw action for
Special:MyPage.
* (T435022, CVE-2026-102973) SECURITY: ApiEmailUser: Check authorizeSend()
instead of canSend() before sending an email.
* (T435026, CVE-2026-102975) SECURITY: ApiRevisionDelete: Check permissions
when unsuppressing.
* (T435457, CVE-2026-102974) SECURITY: Run ImageRedirectConstraint with
post-PST content.
* (T434372, CVE-2026-102977) SECURITY: Conceal inaccessible hit counts when
sorting filters on Special:AbuseFilter.

== Links to all mentioned tasks ==

* https://phabricator.wikimedia.org/T120386
* https://phabricator.wikimedia.org/T431819
* https://phabricator.wikimedia.org/T431819
* https://phabricator.wikimedia.org/T432551
* https://phabricator.wikimedia.org/T434189
* https://phabricator.wikimedia.org/T434278
* https://phabricator.wikimedia.org/T434372
* https://phabricator.wikimedia.org/T434521
* https://phabricator.wikimedia.org/T435022
* https://phabricator.wikimedia.org/T435026
* https://phabricator.wikimedia.org/T435457

== Release notes ==

Full release notes for 1.43.10:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_43/RELEASE-NOTES-1.43
https://www.mediawiki.org/wiki/Release_notes/1.43

Full release notes for 1.45.5:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_45/RELEASE-NOTES-1.45
https://www.mediawiki.org/wiki/Release_notes/1.45

Full release notes for 1.46.1:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_46/RELEASE-NOTES-1.46
https://www.mediawiki.org/wiki/Release_notes/1.46

For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.tar.gz
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.tar.gz
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.zip

Patch to previous version (1.43.9):
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.gz
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.10.zip.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.zip.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.10.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html


**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.tar.gz
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.tar.gz
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.zip

Patch to previous version (1.45.4):
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.gz
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.5.zip.sig
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.zip.sig
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.5.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.tar.gz
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.tar.gz
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.zip

Patch to previous version (1.46.0):
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.gz
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-core-1.46.1.zip.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.zip.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.46/mediawiki-1.46.1.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html
_______________________________________________
MediaWiki-announce mailing list -- mediawiki-announce AT lists.wikimedia.org
To unsubscribe send an email to mediawiki-announce-leave AT lists.wikimedia.org