Per conversations with @Reedy and @CCicalese_WMF, I'm adding this subtask (and plan to have one for future mw security releases as well) to send a supplemental email to wikimedia-announce-l regarding any security-patched deployed or bundled extensions since the last mw security release. This is to promote some extra visibility for these critical extensions aside from folks paying careful attention to certain security bugs becoming public and/or routinely checking for relevant CVEs.
| Maniphest ID | Extension | CVE ID | REL1_31 | REL1_32 | REL1_33 | master
| ---- | ---- | ---- | ---- | ---- | ---- | --- | ---
| T229541 | MobileFrontend | CVE-2019-14807 | Yes | Yes | Yes | Yes
| T230576 | MobileFrontend | CVE-2019-15124 | Yes | Yes | Yes | Yes
| T207094 | CheckUser | TBD | No | No | No | No
| T224203 | AbuseFilter | TBD | No | Yes | Yes | Yes