@Reedy I don't think there are any relevant dependencies.

css-sanitizer

The item in the check list is vague. Yes it’s already in master, but it’s not currently included in release branches

css-sanititer is a Composer dependency. I thought those get packaged automatically in the bundle?

In T327006#8526678, @Tgr wrote:

css-sanititer is a Composer dependency. I thought those get packaged automatically in the bundle?

Automatically, as far as what is in the vendor branch (submoduled into the REL1_XX branch) is included. And the REL1_XX branch of vendor is made by (manually, because the tracking of dependancies is hard) trimming the master branch.

Like I say, "Any relevant dependencies also bundled" is vague... It could cover dependant skins/extensions, composer libraries etc.

Bundled would suggest currently included etc. Whereas it's not currently, so it is not currently bundled. It can be (trivially) bundled in future.

I know, it's semantics.

Why aren't we just using composer install? There's a security disadvantage in theory, but the moment you install any other extension you'll get vendor code generated by Composer anyway...

In any case, what's the actionable part? The trimming will only happen when REL1_40 is cut, right? Should a notice be added somewhere about css-sanitizer now being a bundle dependency?

(manually, because the tracking of dependancies is hard)

I tried to add more formal tracking at one point but it didn't garner much interest.

In T327006#8526704, @Tgr wrote:

Why aren't we just using composer install? There's a security disadvantage in theory, but the moment you install any other extension you'll get vendor code generated by Composer anyway...

We'd have to setup/use composer merge plugin for that to work. As it'd need to know about the core + any skin/extension dependancies...

But then we also lose the pinning of individual packages like we do. As in the composer.json in MW Core, we don't pin every individual and dependant package like we (or at least try to) do in Vendor

In T327006#8526704, @Tgr wrote:

In any case, what's the actionable part? The trimming will only happen when REL1_40 is cut, right? Should a notice be added somewhere about css-sanitizer now being a bundle dependency?

It's part of the bigger issue (as below). It's not uncommon we miss (or leave something extra) in vendor when we do the manual trimming.

In T327006#8526704, @Tgr wrote:

(manually, because the tracking of dependancies is hard)

I tried to add more formal tracking at one point but it didn't garner much interest.

I know :). But just pointing out (for others watching too) how awkward this kinda gets.

Yes, this is all very rough around the edges.

And like I say, what "Any relevant dependencies also bundled" actually means is vague at best.

Why is the checklist vague? Why not make it less vague? Then you can't hide behind it as an excuse to avoid doing something - or have I discovered the reason why it's vague?

reedy updated https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/160

settings.yaml: Promote TemplateStyles to being bundled

I think new additions / removals in the bundle should get sign-off from the MW releasing process from a Product/etc. POV – that'd be @MSantos. Is this OK?

In T327006#10731862, @Jdforrester-WMF wrote:

I think new additions / removals in the bundle should get sign-off from the MW releasing process from a Product/etc. POV – that'd be @MSantos. Is this OK?

LGTM.

jforrester merged https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/160

settings.yaml: Promote TemplateStyles to being bundled

OK, this will Just Work™ when the bundle is made using the script.

Remaining work:

• Add an entry about this to the release notes for MW itself, and
• Double-check when pruning vendor that new things are included (looking at the composer.json we'll need to add wikimedia/css-sanitizer, but in extension.json there's nothing new).

The periodic (twice a day) "MediaWiki branch and publish WMF single-version image" job on https://releases-jenkins.wikimedia.org/ is currently failing with:

00:36:51 MediaWiki wmf/next successfully checked out.
00:36:51 Finished scap prep next (duration: 04m 33s)
00:36:52 Started scap build-images: publishing wmf/next image
00:36:52 Started cache_git_info
00:36:54 Finished cache_git_info (duration: 00m 01s)
00:36:54 Started update_localization_cache
00:36:54 Creating empty /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/wmf-config/ExtensionMessages-next.php
00:36:54 Bootstrapping l10n cache for next
00:36:54 Running rebuildLocalisationCache.php
00:36:57 Error: The TemplateStyles extension cannot be loaded. Check that all of its files are installed properly.
00:36:57 
00:36:57 #0 /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/includes/GlobalFunctions.php(59): MediaWiki\Registration\ExtensionRegistry->queue('/srv/jenkins-ag...')
00:36:57 #1 /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/wmf-config/CommonSettings.php(2630): wfLoadExtension('TemplateStyles')
00:36:57 #2 /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/LocalSettings.php(4): require('/srv/jenkins-ag...')
00:36:57 #3 /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/includes/Setup.php(230): require_once('/srv/jenkins-ag...')
00:36:57 #4 /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/maintenance/run.php(49): require_once('/srv/jenkins-ag...')
00:36:57 #5 /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/multiversion/MWScript.php(221): require_once('/srv/jenkins-ag...')
00:36:57 #6 {main}
00:36:57 Fatal error: Error Loading extension. Unable to open file /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/extensions/TemplateStyles/extension.json: filemtime(): stat failed for /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/extensions/TemplateStyles/extension.json in /srv/jenkins-agent/workspace/MediaWiki publish WMF single-version image/mediawiki/php-next/includes/registration/MissingExtensionException.php on line 102

That's most odd. TemplateStyles was already in the pull-list and so this shouldn't have had any effect. Looking at https://gitlab.wikimedia.org/repos/releng/jenkins-deploy it's not obvious to me but I don't think there's a secondary list of extensions to pull?

Also we added CheckUser at the same time, and presumably if it was going alphabetically it'd be loaded first. Both appear in wmf-config/extension-list in the same fashion.

(Fixed via https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/166.)

Why isn't this mentioned in the 1.44 release notes?

https://github.com/wikimedia/mediawiki/blob/master/RELEASE-NOTES-1.44

It should be mentioned under "Upgrading Notes" similar to https://www.mediawiki.org/wiki/Release_notes/1.40

There's still no mention in the release notes!