1.31.1
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Jul 7 2018, 4:49 PM

Description

Previous release work: T180272

Tracking for activities actually pertaining to making the release of MediaWiki 1.27.5/1.29.3/1.30.1/1.31.1

Status	Assigned	Task
Resolved	Reedy	T199021 Release MediaWiki 1.27.5/1.29.3/1.30.1/1.31.1
Resolved	Reedy	T181665 Tracking bug for 1.27.5/1.29.3/1.30.1/1.31.1 security release
Resolved	matmarex	T169545 $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie' (CVE-2018-0503)
Resolved	Samwilson	T187638 When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information (CVE-2018-0504)
Resolved	Bawolff	T194605 BotPassword can bypass CentralAuth's account lock (CVE-2018-0505)
Resolved	Anomie	T194237 bot passwords should call checkLoginSecurityLevel
Resolved	Legoktm	T199029 1.31.0 tarball is missing .htaccess files (CVE-2018-13258)
Resolved	Reedy	T199022 Write release announcements for 1.27.5/1.29.3/1.30.1/1.31.1 security releases
Resolved	Reedy	T199023 Write and send pre-release Announcements for MediaWiki 1.27.5/1.29.3/1.30.1/1.31.1
Resolved	Reedy	T199024 Update onwiki release notes for 1.27.5/1.29.3/1.30.1/1.31.1
Resolved	Reedy	T199025 Update HISTORY in master after 1.27.5/1.29.3/1.30.1/1.31.1
Resolved	Reedy	T199026 Tag MW 1.27.5/1.29.3/1.30.1/1.31.1
Resolved	MoritzMuehlenhoff	T199027 Obtain CVEs for 1.27.5/1.29.3/1.30.1/1.31.1 security releases

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 7 2018, 4:49 PM

Should probably decide if we're going to try and use the ideas in T196602: Streamline MW security release process

Status update:

T169545 - deployed, backports in phab by Reedy
T167937 - CR -1, needs a new patch.
T187638 - patches merged to all branches in Gerrit
T194605 - deployed, needs backports
T194237 - patches merged to all branches in Gerrit
T196386 - patch deployed/merged in Gerrit only for CentralAuth, still needs a patch for AntiSpoof itself. (extension isn't bundled though)