Credit to @Erkan_Yilmaz who reported the issue on IRC. He also reported having an oddly corrupted XmlTypeCheck.php file, which didn't match the one in the 1.23.16 tarball which I downloaded at the time. It looks kind of like a bad conflict merge. See P5230, especially the wrong indenting and missing brace around line 357.

I wonder what needs to change to make it possible to run CI on security release tarballs. I understand this is currently not being done, contrary to the instructions at https://www.mediawiki.org/wiki/Release_checklist . The procedure suggested at T156445 has releases done before CI, and suggests only that the release engineer "Do some kind of testing???" before release.

In T162572#3167301, @tstarling wrote:

I wonder what needs to change to make it possible to run CI on security release tarballs. I understand this is currently not being done, contrary to the instructions at https://www.mediawiki.org/wiki/Release_checklist . The procedure suggested at T156445 has releases done before CI, and suggests only that the release engineer "Do some kind of testing???" before release.

There's work in this area being done in the coming quarter. It should also reduce the time it takes us to spin out security releases.

@demon, do you anticipate you'll be able to quickly push out a 1.23.17 update to address this for PHP 5.3 users?

In T162572#3170766, @TTO wrote:

@demon, do you anticipate you'll be able to quickly push out a 1.23.17 update to address this for PHP 5.3 users?

Already generated a 1.23.17 tag, creating tarball now

Files uploaded to releases.wm.o, just need to prep & send announcement and do the on-wiki updates.

I take that back, had to regenerate the tag and tarball, I hadn't bumped the version number yet.

1.23.17 released