From Tims post mortem of the outage overnight:
"WikibaseDataModel returns null from the file level of its extension setup file, causing mergeMessageFileList.php to abort even when the file was present."
Not sure if any other of your extensions are potentially vulnerable due to similar loader code setups
See also 50347
Version: master
Severity: critical
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=50347
attempt to make localisation update happier:
https://gerrit.wikimedia.org/r/#/c/71004/
although think there are underlying issues with the way WikibaseDataModel is loaded and also issues with the mergeMessageFileList.php script.
probably related to this code in WikibaseDataModel and bad interaction with the version of Wikibase in wmf8.
if ( defined( 'WIKIBASE_DATAMODEL_VERSION' ) ) {
// Do not initialize more then once. return;
}
having WikibaseDataModel and Wikibase/DataModel (in the wmf8 version of Wikibase) means that the constant WIKIBASE_DATA_MODEL gets set already before WikibaseDataModel is loaded.
not having WikibaseDataModel there means mergeMessageFileList chokes
can't mergeMessageFileList check if the file exists and if not, skip it?
https://gerrit.wikimedia.org/r/#/c/71056/ to provide a --force option in the mergeMessageFileList script to be able to ignore any missing extensions.
By default, it will still abort and then require the script operator to look at the situation. If something like WikibaseDataModel, then --force can be used, since that component was already present in Wikibase in the wmf8 version.
In the future, we could have a different version constant name when we move a component out of an existing deployed extension. That way, localisation update could load it.
Closing. There is nothing we can do right now, except to be aware of the issue next time.