Adding some more details:

I’m not 100% sure it’s a bug, but it sure was confusing because it gave me the feeling there was a security risk (someone else logging in with my account). So I would suggest at least rewording the message.

I was also curious to hear the opinion of someone who knows the codebase, and might have a better idea if this was intended behaviour, or an edge case that wasn’t considered.

The “weird” behaviour is that the login cookie was still valid, so I could use wikitech just fine with my account, but when I went to change my password, I received that email, and I thought: I’ve been using this device all day, so what “new device” is it talking about? :)

This should only happen if your IP address is in a /24 subnet (or /64 for IPv6) that hasn't been used for login in the past 80 days. Can you comment on whether that is likely to be the case?

If the subnet is unknown and there is no cookie, then yes, we send a notification.

The cookie expiration should be 6 months everywhere.

Arguably you are on a known device if you are already logged in and clicking the "change password" button. You could call that a bug. You could say we're not saving the subnet or refreshing the cookie often enough.

Regarding the wording of the email, that could be discussed on T194385.

This should only happen if your IP address is in a /24 subnet (or /64 for IPv6) that hasn't been used for login in the past 80 days. Can you comment on whether that is likely to be the case?

Yes, before changing the password and receiving the email I don't recall logging in for quite a long time. So it's very likely my last login prior to receiving the message was more than 80 days before. Maybe from the same IP, or maybe from a completely different one.

Arguably you are on a known device if you are already logged in and clicking the "change password" button. You could call that a bug. You could say we're not saving the subnet or refreshing the cookie often enough.

That's exactly my point, not a serious bug, but probably still a bug?

The cookie expiration should be 6 months everywhere.

Yes, sorry, I just re-tested this by logging in again to enwiki:

Last Accessed:"Thu, 04 Apr 2024 09:22:58 GMT"
Expires / Max-Age:"Tue, 01 Oct 2024 09:22:58 GMT"
Created:"Mon, 29 Aug 2022 09:26:56 GMT"

The last time I checked, I was confused by the "Created" timestamp in 2022 and assumed the cookie had a longer expiration time, I've edited the task description.