Page MenuHomePhabricator

Improve LTS support of extensions
Closed, DuplicatePublic

Description

Problem

MediaWiki has a LTS release, which receives security updates. Unfortunately most extensions are being developed in current master or maybe latest wmf* branch. That means that downloading an extension from REL1_27 branch (e.g. by using Special:ExtensionDistributor) leaves the user with an outdated and potentially insecure codebase.

Who would benefit

Everyone who wants to use LTS version of MediaWiki and also be sure extensions that work with this version don't have security issues or severe bugs

Proposed solution

At least the greater WMF extensions like "WikiEditor", "VisualEditor/Parsoid", "FlaggedRevs", "CategoryTree", ... should get bugfix and security cherry-picks/backports from the current development into REL1_27.

Of course most voluntary, WMF-independent extension developers won't have time/will to do something like this, but maybe we can find a way to help them or at least make them more aware of the LTS release.

Event Timeline

At least the greater WMF extensions like "WikiEditor", "VisualEditor/Parsoid", "FlaggedRevs", "CategoryTree", ... should get bugfix and security cherry-picks/backports from the current development into REL1_27.

As far as I know that should have been already the case for a while regarding security fixes and other really important bugfixes.
Do you have any recent specific examples when this was not the case, or what is your statement based on? :)

Of course most voluntary, WMF-independent extension developers won't have time/will to do something like this, but maybe we can find a way to help them or at least make them more aware of the LTS release.

Maintainers are free to start that they don't support certain older MW versions, and anyone is free to contact maintainers to ask for supporting older MW versions. So it's a bit unclear to me how you expect to "improve LTS support of extensions" exactly...

Well, maybe it is just a wrong impression that I have. I've had another look at the change history of a few WMF extensions and there actually seem to be bugfix changes on the LTS branches [1][2][3]. They are only a few but that may also be a sign for the very high code quality of those extensions.

I still believe that the LTS versions should be more visible within the MediaWiki world. E. g. in the info boxes on extension pages there could be three separate buttons for download : "Latest", "LTS 1.27", "LTS 1.23". With a recommendation to use a LTS version. This could encurage developers to focus on those branches. Also Special:ExtensionDistributor could feature such buttons/recommendations. Last but not least this could be part of the tutorials/howto section on mediawiki.org: "How to maintain LTS branches".

[1] https://gerrit.wikimedia.org/r/#/q/status:merged+project:mediawiki/extensions/WikiEditor+branch:REL1_23
[2] https://gerrit.wikimedia.org/r/#/q/status:merged+project:mediawiki/extensions/FlaggedRevs+branch:REL1_27
[3] https://gerrit.wikimedia.org/r/#/q/status:merged+project:mediawiki/extensions/CategoryTree+branch:REL1_23

This proposal is selected for the Developer-Wishlist voting round and will be added to a MediaWiki page very soon. To the subscribers, or proposer of this task: please help modify the task description: add a brief summary (10-12 lines) of the problem that this proposal raises, topics discussed in the comments, and a proposed solution (if there is any yet). Remember to add a header with a title "Description," to your content. Please do so before February 5th, 12:00 pm UTC.