Hi @CCicalese_WMF - can you please let us know if this is the only patch set you'd like us to look at? https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/OAuth/+/550847/

Hi @SBisson - can you please let us know what your target deployment date is?

We are waiting decisions from the Frontend working group and declining until the direction being taken is more clear.

Happy @sbassett could help, and as he mentioned we'll be adding more and refining in the near future. Cheers :)

Excellent news @JTannerWMF - James is on it and we should have an update for you soon.

Hi @JTannerWMF - we've taken a look at this and once WMF-Legal has wrapped up their review we should only need a few days at most.

Hi @JTannerWMF, @sbassett beat me to the punch! We'll make a point of reviewing on Monday at our triage meeting and I'll be sure to touch base with you when we know what our timeline will look like.

As an initial approach to get better visibility around security issues for bundled and deployed extensions, we plan to send this supplementary announcement: https://phabricator.wikimedia.org/T232113

There is nothing in the repo and we do not know what plans Chase had / has for this. We will move to our "watching" column for the time being.

Upon review, Security Team is untagging as we will not be working on this ticket.

Upon review, Security Team is untagging as we will not be working on this ticket.

Security Team has reviewed and is untagging to remove from team backlog as we will not be actively working on the ticket. This was reviewed in a Concept Review: https://phabricator.wikimedia.org/T227820

Due to the explanation in T150605#4580720, the Security Team is resolving this task.

@Aklapper - as I said in my comment above, we were clearly mistaken. We are happy to perform any work that is needed.

Hi everyone,

Hi @Aklapper - apologies for any confusion. In a team meeting where we were working on cleaning up our workboard, we made the (apparently erroneous) assumption that this ticket had already been addressed and was no longer being worked on. If you could please let me know what additional actions are needed on this ticket I would be happy to keep things moving forward.

Resolving for the time being. Will revisit should the desire to pursue arise.

As nothing additional is required on this task, the Security Team is resolving. Please feel free to submit a new ticket should additional / further action be required.

The Security Team agrees and resolving this task for the time being.

The team has taken a look at this feels we can provide a basic review by your target deployment date, but that a more in-depth look may need to happen post-launch. We hope that this will work for you and your team - please let us know if you have any questions or concerns and we'll be in touch as we move forward.

Thank you for the quick reply @Mholloway - please just let us know when we can be of further assistance. Cheers!

Thank you for the quick reply @Yurik ! Please let us know when we are needed for additional review. Cheers.

Hi @Yurik - will we be providing additional review for you or may I close this ticket? Please let us know, and thank you!

@Reedy - could use your eyes on this. Thank you!