The bug description is about a specific bug which was accidental introduced by change rECTRaec8d75570fd: Replace WebRequest::getVal by ::getRawVal or ::getText. This bug gets fixed by https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CategoryTree/+/991038 PS1. But you blocked this change.

@Jdlrobson: Is this still a regression?

This bug was introduced by the change rECTRaec8d75570fd: Replace WebRequest::getVal by ::getRawVal or ::getText.

I tested with a iPhone SE3 with iOS 16.7.2, 30 MBit/s downstream and with mobile version and desktop version of the page. I can see the starting and stopping of loading animation, which takes a few 100 ms I guess.

The behavior on https://patchdemo.wmflabs.org/wikis/274381f11d/wiki/Hymne_der_Sowjetunion with a iPhone Safari is now slightly different:

This issue is independent to T350369, because rEPHN365e80b9f580: Use static integers instead of OO.ui.Keys (https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Phonos/+/973387/) is now deployed, but issue still exist.

modules/ext.phonos.init.js uses OO.ui.Keys. OO.ui.Keys is defined in module oojs-ui-core. In extension.json there is no dependency on this module. Therefor error can happen if the module in not loaded yet.

Issue is solved. Verified on Wikipedia.

The URL parameters maxage and smaxage of api.php ignore now negative integers.

No more hits: https://codesearch.wmcloud.org/search/?q=AjaxUploadDestCheck

rMW95a4189814e2: Prepare for deprecation of Skin::bottomScripts is already included in MediaWiki 1.39.

rMW11e0fba3b0cd: Deprecate global function wfReportTime() didn't introduce a duplicate call of SkinAfterBottomScripts. The call was just moved to the beginning of getBottomScripts to include the execution time of this call in the elapsed time calculation.

The issues on skins Timeless and Splash are solved. The issue with the green markers is tracked in T342445.

The green markers are generated by the gadget https://en.wikipedia.org/wiki/MediaWiki:Gadget-WatchlistGreenIndicators.css and not by the skin Timeless. Therefor the change described in T342445#9037143 should adapt the gadget to the new HTML code.

@Trappist_the_monk Is this the problem described in T342445: Watchlist isn't showing unread triangle (multiple change) markers in green?

As someone who uses Timeless on small screens, this is a pretty significant negative change to watchlist behavior. Did you test small resolutions here?

1.41.0-wmf.19 is now deployed on https://en.wiktionary.org/wiki/hasOwnProperty and there are no JavaScript errors anymore.

A change from

Background is the change https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/912356

I don't see a security problem here. https://www.mediawiki.org/wiki/Security_for_developers#Cross-site_scripting_(XSS) recommends:

Escape as close to the output as possible, so that the reviewer can easily verify that it was done.

Therefor the developer should use

$element.text( mw.message( key ).text() )

or

$element.text( message )

instead of

$element.html( mw.message( key ).escaped() )

or

$element.html( message )

The most common use case is the unescaped mw.message( key ).text() because escaping should be done as close to the output as possible. And mw.msg( key ) is a useful shortcut for the most common use case.

Before rMW103eb48ac20e: ResourceLoader: Set module state "error" if request fails on network the screen gets black.
After rMW103eb48ac20e: ResourceLoader: Set module state "error" if request fails on network there is a flash of a black screen.

The problematic line-height: 0 was introduced in rMWaf2aed8ea9a9: Suppress line-height inside thumbs by @Arlolra.