The Cite codebase contains a query API module for the MediaWiki action API. Example API call: https://en.wikipedia.org/wiki/Special:ApiSandbox#action=query&prop=references.
It appears like we (currently) don't need to do anything about this, because this API appears to be disabled on all Wikimedia wikis. The flag $wgCiteStoreReferencesData is false by default and never enabled, as far as I can tell.
To do:
- Check if the API is enabled anywhere, and where.
- Even we can't find any usage, we still might break usages we are not aware of. Check how the API behaves when confronted with extended references, and decide on action items.