Maniphest T389302

Release MediaWiki 1.39.13/1.42.7/1.43.2
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Mar 19 2025, 12:48 AM

Tags

Referenced Files

None

Subscribers

Description

Previous release work: T382316: Release MediaWiki 1.39.12/1.42.6/1.43.1

Tracking for activities actually pertaining to making the release of MediaWiki 1.39.13/1.42.7/1.43.2

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Reedy	T389313 Formally EOL MW 1.42
		Resolved		Reedy	T389302 Release MediaWiki 1.39.13/1.42.7/1.43.2
					Restricted Task
		Resolved	Security	tstarling	T391343 CVE-2025-6589: With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList
		Resolved	Security	Dylsss	T392746 CVE-2025-6590: Complete content leak of private wikis due to PasswordReset Wikitext injection in error message
		Resolved	Security	Legoktm	T392276 CVE-2025-6591: HTML injection in API action=feedcontributions output from i18n message
					Restricted Task
		Resolved	Security	Michael	T396230 CVE-2025-6593: "{{SITENAME}} registered email address has been changed" email sent to unverified email addresses
		Resolved	Security	• matmarex	T395063 CVE-2025-6594: XSS in Special:ApiSandbox (User interaction required)
		Resolved	Security	Jdrewniak	T394863 CVE-2025-6595: Stored XSS through system messages in MultimediaViewer
		Resolved	Security	SomeRandomDeveloper	T396685 CVE-2025-6596: Vector inserts portlet labels as HTML, allowing for stored XSS through system messages
		Resolved	Security	Tgr	T389009 CVE-2025-6597: MediaWiki should not consider autocreation as login for the purposes of security reauthentication
		Resolved	Security	Lucas_Werkmeister_WMDE	T386175 CVE-2025-32072: HTML injection in feed output from i18n message
		Resolved	Security	Tgr	T389010 CVE-2025-6926: SUL3 local login should not count for security reauthentication
		Resolved	Security	tstarling	T397595 CVE-2025-6927: Autoblocks from global account suppressions are publicly visible
					Restricted Task
					Restricted Task
					Restricted Task
					Restricted Task
					Restricted Task
					Restricted Task
					Restricted Task
		Resolved		Zabe	T389311 Update HISTORY in master after 1.39.13/1.42.7/1.43.2
		Resolved		mmartorana	T389312 Write and send supplementary release announcement for extensions and skins with security patches (1.39.13/1.42.7/1.43.2)

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Mar 19 2025, 12:48 AM

Reedy subscribed.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 19 2025, 12:48 AM

Reedy added subtasks: Restricted Task, Restricted Task, Restricted Task, Restricted Task, Restricted Task, Restricted Task, Restricted Task, Restricted Task, T389311: Update HISTORY in master after 1.39.13/1.42.7/1.43.2, T389312: Write and send supplementary release announcement for extensions and skins with security patches (1.39.13/1.42.7/1.43.2).Mar 19 2025, 12:48 AM

Reedy updated the task description. (Show Details)Mar 19 2025, 12:49 AM

Reedy added a parent task: T389313: Formally EOL MW 1.42.Mar 19 2025, 12:53 AM

sbassett changed the status of subtask T389312: Write and send supplementary release announcement for extensions and skins with security patches (1.39.13/1.42.7/1.43.2) from Open to In Progress.Apr 21 2025, 2:53 PM

sbassett mentioned this in T392309: Costly IP block queries triggered by long x-forwarded-for.Apr 25 2025, 3:21 PM

sbassett mentioned this in T391343: CVE-2025-6589: With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList.May 5 2025, 2:39 PM

Reedy changed the status of subtask Restricted Task from Open to In Progress.Jun 24 2025, 11:29 PM

Reedy changed the status of subtask Restricted Task from Open to In Progress.Jun 25 2025, 12:30 AM

Reedy changed the status of subtask Restricted Task from Open to In Progress.

Reedy closed subtask Restricted Task as Resolved.Jun 27 2025, 10:28 PM

tstarling mentioned this in T397595: CVE-2025-6927: Autoblocks from global account suppressions are publicly visible.Jun 30 2025, 9:39 AM

Reedy closed subtask Restricted Task as Resolved.Jun 30 2025, 6:06 PM

Reedy closed subtask Restricted Task as Resolved.Jun 30 2025, 7:37 PM

Reedy closed subtask Restricted Task as Resolved.

Reedy closed subtask Restricted Task as Resolved.Jun 30 2025, 10:07 PM

Reedy closed subtask Restricted Task as Resolved.

sbassett closed subtask T389312: Write and send supplementary release announcement for extensions and skins with security patches (1.39.13/1.42.7/1.43.2) as Resolved.Jul 9 2025, 5:53 PM

Reedy closed this task as Resolved.Aug 28 2025, 5:04 PM

Reedy claimed this task.

sbassett mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Oct 22 2025, 3:35 PM

Zabe closed subtask T389311: Update HISTORY in master after 1.39.13/1.42.7/1.43.2 as Resolved.Jan 1 2026, 12:17 PM

Zabe changed the visibility from "acl*security (Project)" to "Public (No Login Required)".Jan 1 2026, 12:29 PM

Zabe changed the edit policy from "acl*security (Project)" to "All Users".