Page MenuHomePhabricator

Make wdio-mediawiki independent of mwbot to remove security vulnerabilities and make us move faster in the future
Closed, ResolvedPublic5 Estimated Story Points

Description

In T403748 I investigated what needed to be done to replace mwbot in core. Mwbot is an unmainteaned npm library we use to talk to the MediaWiki API. It hasn't been updated in a long while and the error handling do not log what actually goes wrong so it's been hard to understand the root cause when something goes wrong.

In core we use the mwbot functionality:

  • mwbot.read
  • mwbot.edit
  • mwbot.request
  • mwbot.delete
  • mwbot.loginGetEditToken
  • mwbot.getCreateaccountToken

The idea is to replace mwbot, make core pass and then release it. We should release it as a new major release because extension and skins need to take caution when they do the update .

AC:

  • Aim to keep the API so that extensions that updates will automatically use the new functionality
  • Make sure the current tests in core works
  • Make sure the changelog is updated to extension/skin users know how to update it. Maybe we need some extra documentation

Details

Related Changes in Gerrit:

Event Timeline

Peter triaged this task as Medium priority.
Peter changed the subtype of this task from "Spike" to "Task".Sep 12 2025, 8:03 AM
Peter renamed this task from Make wdio-mediawiki independent of mwbot to Make wdio-mediawiki independent of mwbot to remove security vulnerabilities and make us move faster in the future.Sep 12 2025, 8:07 AM
Peter updated the task description. (Show Details)
Peter renamed this task from Make wdio-mediawiki independent of mwbot to remove security vulnerabilities and make us move faster in the future to Make wdio-mediawiki independent of mwbot to remove security vulnerabilities and make us move faster in the future.Sep 12 2025, 1:05 PM
Peter updated the task description. (Show Details)

I could adapt this https://gitlab.wikimedia.org/mhurd/mediawiki-quickstart-utils pretty easily to quickly check ALL extensions/skin gerrit repos for whether they use mwbot in their package.json (checks 100+ repos in a few seconds)

Peter set the point value for this task to 5.Sep 22 2025, 4:22 PM
Peter removed Peter as the assignee of this task.Sep 25 2025, 11:10 AM

Change #1193892 had a related patch set uploaded (by Phedenskog; author: Phedenskog):

[mediawiki/core@master] wip: Replace mwbot

https://gerrit.wikimedia.org/r/1193892

Change #1193892 merged by jenkins-bot:

[mediawiki/core@master] selenium: Replace mwbot

https://gerrit.wikimedia.org/r/1193892