In LocalFile: purgeCache(), purgeThumbnails() and recordUpload2() all call SquidUpdate::purge(), and apparently the URLs in all three cases are potentially protocol-relative. SquidUpdate has always had support for purging relative URLs, it calls SquidUpdate::expand(), but this function has not been updated to support protocol-relative URLs, so the result is invalid. HTCP packets with URLs like the following have been logged:
commons.wikimedia.orgupload.wikimedia.org/wikipedia/commons/thumb/0/03/Laurel_Caverns_cave.jpg/1024px-Laurel_Caverns_cave.jpg
Users are complaining. I'm going to look at doing a quick live patch.
Version: 1.17.x
Severity: blocker