1.45.0-wmf.3 deployment blockers
Closed, ResolvedPublic5 Estimated Story PointsRelease
Actions

Assigned To

Authored By

	thcipriani
	Apr 17 2025, 12:26 AM

Details

Backup Train Conductor: Aklapper
Release Version: 1.45.0-wmf.3
Release Date: May 26 2025, 12:00 AM

2025 week 22 1.45-wmf.3 Changes wmf/1.45.0-wmf.3

This MediaWiki Train Deployment is scheduled for the week of Monday, May 26th:

Monday May 26th	Tuesday, May 27th	Wednesday, May 28th	Thursday, May 29th	Friday
Backports only.	Branch `wmf.3` and deploy to Group 0 Wikis.	Deploy `wmf.3` to Group 1 Wikis.	Deploy `wmf.3` to all Wikis.	No deployments on fridays

See https://wikitech.wikimedia.org/wiki/Deployments for full schedule.

How this works

Any serious bugs affecting wmf.3 should be added as subtasks beneath this one.
- Use this form to create one.
Any open subtask(s) block the train from moving forward. This means no further deployments until the blockers are resolved.
If something is serious enough to warrant a rollback then you should bring it to the attention of deployers on the #wikimedia-operations IRC channel.
If you have a risky change in this week's train add a comment to this task using the Risky patch template
For more info about deployment blockers, see Holding the train.

Other Deployments

Previous: 1.45.0-wmf.2

Next: 1.45.0-wmf.4

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
group2 to 1.45.0-wmf.3	operations/mediawiki-config	master	+348 -348
group1 to 1.45.0-wmf.3	operations/mediawiki-config	master	+560 -560
group0 to 1.45.0-wmf.3	operations/mediawiki-config	master	+140 -140
testwikis to 1.45.0-wmf.3	operations/mediawiki-config	master	+3 -3
Branch commit for wmf/1.45.0-wmf.3	mediawiki/core	wmf/1.45.0-wmf.3	+1 K -3

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved	Release	dancy	T392173 1.45.0-wmf.3 deployment blockers
Resolved	Security	STran	T392341 CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation
Resolved		matmarex	T395214 Multiple test failures for MediaWiki\Minerva\SkinMinervaTest::testHasPageTabs

Event Timeline

thcipriani created this task.Apr 17 2025, 12:26 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 17 2025, 12:26 AM

thcipriani assigned this task to dancy.Apr 17 2025, 12:30 AM

thcipriani triaged this task as Medium priority.

thcipriani updated Other Assignee, added: Aklapper.

thcipriani set the point value for this task to 5.

thcipriani added projects: Essential-Work, Release-Engineering-Team (Priority Backlog 📥).

thcipriani renamed this task from 1.45.0-wmf.5 deployment blockers to 1.45.0-wmf.4 deployment blockers.Apr 17 2025, 6:02 PM

thcipriani changed Release Version from 1.45.0-wmf.5 to 1.45.0-wmf.4.

thcipriani renamed this task from 1.45.0-wmf.4 deployment blockers to 1.45.0-wmf.3 deployment blockers.May 5 2025, 9:50 PM

thcipriani changed Release Version from 1.45.0-wmf.4 to 1.45.0-wmf.3.

bwang mentioned this in T394329: Verify 1.45.0-wmf.3 deployment.May 14 2025, 4:17 PM

SecurityPatchBot changed the status of subtask T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation from In Progress to Open.May 23 2025, 11:52 PM

SecurityPatchBot added a subtask: T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation.

SecurityPatchBot mentioned this in T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation.

sbassett changed the status of subtask T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation from Open to In Progress.May 24 2025, 12:43 AM

Risky Patch! 🚂🔥

Change: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1146557
Summary:
- We are hard-deprecating a method, ParserOutput::getText that has been used in many places and for a long time. We have done our best to remove all the usages of the method from the whole code base, but considering the low specificity of the method name ("getText") we cannot exclude that it's still used somewhere, which would generate logspam.
Test plan:
- We have checked to the best of our ability that there's no remaining call of ParserOutput::getText in production. CI seems to agree.
- The breakage would be deprecation logspam, so that'd be the thing to check for.
Places to monitor:
- Logstash: mediawiki-errors
Revert plan: The patch is safe to revert, but its "only" negative impact would be logspam. If said logspam is sustainable for the time we'll need to fix it, we'd rather fix the stray usage of getText rather than revert.
Affected wikis: all wikis
IRC contact: ihurbain (UTC+2), cscott (timezone UTC-4); #content-transformers on Slack
UBN Task Projects/tags: Content-Transform-Team
Would you like to backport this change rather than ride the train?: No (the train grouping gives us more time to catch logspam if any)

jnuche added a subtask: T395214: Multiple test failures for MediaWiki\Minerva\SkinMinervaTest::testHasPageTabs.May 26 2025, 11:09 AM

matmarex closed subtask T395214: Multiple test failures for MediaWiki\Minerva\SkinMinervaTest::testHasPageTabs as Resolved.May 26 2025, 7:23 PM

ABreault-WMF mentioned this in T395282: CTT tasks week of 2025-05-23.May 26 2025, 8:28 PM

Change #1150828 had a related patch set uploaded (by TrainBranchBot; author: trainbranchbot):

[mediawiki/core@wmf/1.45.0-wmf.3] Branch commit for wmf/1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1150828

gerritbot added a project: Patch-For-Review.May 27 2025, 1:08 AM

Change #1150828 merged by jenkins-bot:

[mediawiki/core@wmf/1.45.0-wmf.3] Branch commit for wmf/1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1150828

Maintenance_bot removed a project: Patch-For-Review.May 27 2025, 1:30 AM

Change #1150855 had a related patch set uploaded (by TrainBranchBot; author: MediaWiki PreSync):

[operations/mediawiki-config@master] testwikis to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1150855

Change #1150855 merged by jenkins-bot:

[operations/mediawiki-config@master] testwikis to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1150855

Mentioned in SAL (#wikimedia-operations) [2025-05-27T03:02:47Z] <mwpresync@deploy1003> Started scap sync-world: testwikis to 1.45.0-wmf.3 refs T392173

Maintenance_bot removed a project: Patch-For-Review.May 27 2025, 3:30 AM

Mentioned in SAL (#wikimedia-operations) [2025-05-27T03:49:36Z] <mwpresync@deploy1003> Finished scap sync-world: testwikis to 1.45.0-wmf.3 refs T392173 (duration: 46m 49s)

Change #1151286 had a related patch set uploaded (by TrainBranchBot; author: Ahmon Dancy):

[operations/mediawiki-config@master] group0 to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1151286

Change #1151286 merged by jenkins-bot:

[operations/mediawiki-config@master] group0 to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1151286

Mentioned in SAL (#wikimedia-operations) [2025-05-27T18:21:48Z] <dancy@deploy1003> rebuilt and synchronized wikiversions files: group0 to 1.45.0-wmf.3 refs T392173

Maintenance_bot removed a project: Patch-For-Review.May 27 2025, 6:31 PM

Change #1151770 had a related patch set uploaded (by TrainBranchBot; author: Ahmon Dancy):

[operations/mediawiki-config@master] group1 to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1151770

Change #1151770 merged by jenkins-bot:

[operations/mediawiki-config@master] group1 to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1151770

Mentioned in SAL (#wikimedia-operations) [2025-05-28T18:19:05Z] <dancy@deploy1003> rebuilt and synchronized wikiversions files: group1 to 1.45.0-wmf.3 refs T392173

Maintenance_bot removed a project: Patch-For-Review.May 28 2025, 6:30 PM

Change #1152119 had a related patch set uploaded (by TrainBranchBot; author: Ahmon Dancy):

[operations/mediawiki-config@master] group2 to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1152119

Change #1152119 merged by jenkins-bot:

[operations/mediawiki-config@master] group2 to 1.45.0-wmf.3

https://gerrit.wikimedia.org/r/1152119

Mentioned in SAL (#wikimedia-operations) [2025-05-29T18:27:39Z] <dancy@deploy1003> rebuilt and synchronized wikiversions files: group2 to 1.45.0-wmf.3 refs T392173

Maintenance_bot removed a project: Patch-For-Review.May 29 2025, 6:32 PM

thcipriani closed this task as Resolved.May 29 2025, 11:35 PM

mmartorana closed subtask T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation as Resolved.Jul 8 2025, 5:42 PM

Dreamy_Jazz reopened subtask T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation as Open.Jul 23 2025, 2:23 PM

STran closed subtask T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation as Resolved.Aug 19 2025, 12:00 PM