Hello @ATitkov and @Jdrewniak -

We're going to expedite this review for the first week or so of January 2026, but we will need some key items and responses from your team before we can start the review:

1. What front-end JavaScript will be used for the microsite? We will definitely want to review that prior to any deployment.
2. Will any other code be used for the microsite? Right now, we're assuming that everything else will be static content (html, css, images, video, etc.)
3. What will the hosting architecture look like? What hardware will wikipedia25.org specifically point to? Wikimedia production? Something else? Is there a plan to host any resources on the toolforge.org test site for the production site? That likely isn't advisable given various security and performance issues around toolforge.org.
4. What privacy policy and ToU will this site use? Has WMF Legal reviewed these?

Thanks.

I can answer 3. - Wikimedia production - Kubernetes cluster "wikikube" in the existing "miscweb" service. Where other micro sites live nowadays like https://15.wikipedia.org/ or https://research.wikimedia.org/ among others.

The expectation from SRE side is that all resources are copied over there so nothing cross-loads from toolforge.org - We also expect the deployment repository to stay in GitLab but move out of the repos/toolforge structure.

Hi @ATitkov and @Jdrewniak ,

The privacy team also has a few additional questions.

1. Are you collecting and/or sharing personal data (with volunteers, grantees, or other external third party or the general public)? Please specify what personal data is being collected and/or shared.
2. Who has access to this data? (Example: WMF employees - event organizers, tool admins)

Thank you!

Please note, the code repository has moved to https://gitlab.wikimedia.org/repos/sre/miscweb/wikipedia25-years-of-wikipedia (out of toolforge)

Sorry for the delayed rely...

@sbassett

What front-end JavaScript will be used for the microsite? We will definitely want to review that prior to any deployment.

The front-end is utilizing vite, vue, typescript, accompanied by vue-i18n and vue-router.

For design purposes it is utilizing tailwind, @wikimedia/codex, a lot of fonts from @fontsource, and motion-v for animations.

For sharing functionality html-to-image is used in order to "take a screenshot" of the part of the page that the user is viewing at the point of triggering the share functionality.

It has multiple utilities created to control the animations in regards to the scrolling.

It also contains a couple of media files - ogg for audio interviews and webm for video backgrounds.

Will any other code be used for the microsite? Right now, we're assuming that everything else will be static content (html, css, images, video, etc.)

No other code will be used. It's only static frontend, without any backend or external services.

What privacy policy and ToU will this site use? Has WMF Legal reviewed these?

@Jdrewniak @cmadeo Can you answer this question?

@aranyap

Are you collecting and/or sharing personal data (with volunteers, grantees, or other external third party or the general public)? Please specify what personal data is being collected and/or shared.

We are not sharing any data IIUC. @cmadeo please correct me here if I am wrong.

But we will collect analytics in the regards to the usage of the page. The collected data will be about how many times, which buttons were clicked, etc. And IIUC this should not include personal data of the visitors.

If needed I can provide detailed info about how the analytics events will look.

Who has access to this data? (Example: WMF employees - event organizers, tool admins)

@Jdrewniak @cmadeo Can you answer this question?

Thanks for the follow-up @ATitkov. @Catrope has been assigned this review and plans to complete it by this week or very early next week. From a quick application security review perspective, it sounds like we'd mainly want to be concerned with:

1. The various production dependencies within package.json. I ran snyk and osv-scanner against these dependecies - they found a medium severity issue for the dev dependency esbuild@<=0.24.2. This is a low-risk issue in this particular scenario since we shouldn't be running the vite dev server in any external capacity. And it's probably not easily addressed unless those get version-bumped (vitest 0.0.1 - 0.0.12 || 0.0.29 - 0.0.122 || 0.3.3 - 2.2.0-beta.2 => vite-node <=2.2.0-beta.2 => vite 0.11.0 - 6.1.6) by getting to vitest@4.0.16 which introduces breaking changes, apparently.
2. Various Vue components and TypeScript files under src (e.g. components, composables, i18n, navigation, sections and views)
3. Ensuring that we're using the correct privacy policy (per Legal) if we're importing a bunch of external resource files (fonts, media, etc.)

@Catrope just to to let you know the planned official rollout of this website is Jan 15.

The privacy team has reviewed this request and is concluding this to be a low risk as long as analytics collection is limited to aggregated metrics (e.g., page views and interaction events) and does not include personal identifiers.