Page MenuHomePhabricator
Create Task
Maniphest T297829

Release MediaWiki 1.35.6/1.36.4/1.37.2
Closed, ResolvedPublic
Actions

Description

Previous release work: T292226: Release MediaWiki 1.35.5/1.36.3/1.37.1

Tracking for activities actually pertaining to making the release of MediaWiki 1.35.6/1.36.4/1.37.2

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedReedyT297829 Release MediaWiki 1.35.6/1.36.4/1.37.2
 ResolvedReedyT297830 Tracking bug for MediaWiki 1.35.6/1.36.4/1.37.2
 ResolvedSecurityLadsgroupT297731 CVE-2022-28203: Requesting Special:NewFiles in commons with actor as a condition can bring the whole database down
ResolvedSecurityLegoktmT297571 CVE-2022-28201: Title::newMainPage() goes into an infinite recursion loop if it points to a local interwiki
 ResolvedSecurityLucas_Werkmeister_WMDET297754 CVE-2022-28204: Whatlinkshere of heavily used properties in wikidata can be easily utilized as a DDoS vector
 ResolvedSecuritysbassettT297543 CVE-2022-28202: Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete
 ResolvedReedyT297831 Obtain CVEs for 1.35.6/1.36.4/1.37.2 security releases
 ResolvedReedyT297832 Write and send pre-release announcements for MediaWiki 1.35.6/1.36.4/1.37.2
 ResolvedReedyT297833 Write and send release announcements for MediaWiki 1.35.6/1.36.4/1.37.2
 ResolvedReedyT297834 Tag 1.35.6/1.36.4/1.37.2
 ResolvedReedyT297835 Update onwiki news and Module:Version
 ResolvedReedyT297836 Update onwiki release notes for 1.35.6/1.36.4/1.37.2
 ResolvedReedyT297837 Update Wikidata Q83
 ResolvedReedyT297838 Update HISTORY in master after 1.35.6/1.36.4/1.37.2
 ResolvedMstylesT297839 Write and send supplementary release announcement for extensions and skins with security patches (1.35.6/1.36.4/1.37.2)
 ResolvedSecuritytaaviT285116 Echo does not set X-Forwarded-For for internal API requests, some of which get logged to CU (CVE-2022-28324)
 ResolvedSecurityMstylesT304126 One of the checks for 'override-antispoof' permission is inverted (CVE-2022-28209)

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Dec 15 2021, 8:53 PM
Reedy added a subscriber: Reedy.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 15 2021, 8:53 PM
Reedy added subtasks: T297830: Tracking bug for MediaWiki 1.35.6/1.36.4/1.37.2, T297831: Obtain CVEs for 1.35.6/1.36.4/1.37.2 security releases, T297832: Write and send pre-release announcements for MediaWiki 1.35.6/1.36.4/1.37.2, T297833: Write and send release announcements for MediaWiki 1.35.6/1.36.4/1.37.2, T297834: Tag 1.35.6/1.36.4/1.37.2, T297835: Update onwiki news and Module:Version, T297836: Update onwiki release notes for 1.35.6/1.36.4/1.37.2, T297837: Update Wikidata Q83, T297838: Update HISTORY in master after 1.35.6/1.36.4/1.37.2, T297839: Write and send supplementary release announcement for extensions and skins with security patches (1.35.6/1.36.4/1.37.2).Dec 15 2021, 8:53 PM
Reedy renamed this task from Release MediaWiki 1.35.5/1.36.3/1.37.1 to Release MediaWiki 1.35.6/1.36.4/1.37.2.Dec 15 2021, 9:11 PM
Reedy updated the task description. (Show Details)
sbassett mentioned this in T297754: CVE-2022-28204: Whatlinkshere of heavily used properties in wikidata can be easily utilized as a DDoS vector.Feb 1 2022, 4:03 PM
Reedy updated the task description. (Show Details)Mar 20 2022, 12:44 PM
Reedy added a comment.EditedMar 20 2022, 12:50 PM

For clarity, patches to be backported to MW-1.38-release, but no release made due to T302893: Release MW 1.38.0 still being in progress.

I believe this should all land before T302913: Write release announcement for 1.38.0-rc.0/T302912: Release 1.38.0-rc.0 happens too, so works nicely.

Reedy changed the status of subtask T297831: Obtain CVEs for 1.35.6/1.36.4/1.37.2 security releases from Open to In Progress.Mar 28 2022, 1:52 PM
Reedy changed the status of subtask T297832: Write and send pre-release announcements for MediaWiki 1.35.6/1.36.4/1.37.2 from Open to In Progress.Mar 28 2022, 1:55 PM
Reedy changed the status of subtask T297833: Write and send release announcements for MediaWiki 1.35.6/1.36.4/1.37.2 from Open to In Progress.
Reedy closed subtask T297832: Write and send pre-release announcements for MediaWiki 1.35.6/1.36.4/1.37.2 as Resolved.Mar 30 2022, 6:17 PM
Reedy closed subtask T297833: Write and send release announcements for MediaWiki 1.35.6/1.36.4/1.37.2 as Resolved.Mar 31 2022, 9:46 PM
DannyS712 mentioned this in T305199: Release MediaWiki 1.35.7/1.37.3/1.38.2.Mar 31 2022, 10:13 PM
Reedy closed subtask T297831: Obtain CVEs for 1.35.6/1.36.4/1.37.2 security releases as Resolved.Mar 31 2022, 10:27 PM
Reedy closed subtask T297835: Update onwiki news and Module:Version as Resolved.
Reedy closed subtask T297837: Update Wikidata Q83 as Resolved.
Reedy triaged this task as Medium priority.Mar 31 2022, 11:03 PM
Reedy closed subtask T297834: Tag 1.35.6/1.36.4/1.37.2 as Resolved.
Reedy closed subtask T297830: Tracking bug for MediaWiki 1.35.6/1.36.4/1.37.2 as Resolved.
Reedy changed the visibility from "acl*security (Project)" to "Public (No Login Required)".
Reedy changed the edit policy from "acl*security (Project)" to "All Users".
Reedy closed subtask T297836: Update onwiki release notes for 1.35.6/1.36.4/1.37.2 as Resolved.Mar 31 2022, 11:13 PM
Reedy closed subtask T297838: Update HISTORY in master after 1.35.6/1.36.4/1.37.2 as Resolved.Mar 31 2022, 11:19 PM
• toan added a subscriber: • toan.Apr 1 2022, 5:23 PM
WMDE-leszek added a subscriber: WMDE-leszek.Apr 2 2022, 6:51 PM
Zabe added a subscriber: Zabe.Apr 3 2022, 5:13 PM
sbassett closed subtask T297839: Write and send supplementary release announcement for extensions and skins with security patches (1.35.6/1.36.4/1.37.2) as Resolved.Apr 7 2022, 9:24 PM
MacFan4000 added a subscriber: MacFan4000.Apr 18 2022, 5:12 PM

I think this can be closed? The mentioned versions have been released at this point.

Aklapper closed this task as Resolved.May 18 2022, 8:55 AM
Aklapper assigned this task to Reedy.

Indeed.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL