Change notes from older releases. For current info, see RELEASE-NOTES-1.41.

= MediaWiki 1.40 =

PHP 8.0 workboard: https://phabricator.wikimedia.org/tag/php_8.0_support/
PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
PHP 8.2 workboard: https://phabricator.wikimedia.org/tag/php_8.2_support/
PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/

== MediaWiki 1.40.1 ==

This is a security and maintenance release of the MediaWiki 1.40 branch.

=== Changes since MediaWiki 1.40.0 ===
* Localisation updates.
* (T333050, CVE-2023-45363) SECURITY: Fix infinite loop for self-redirects
  with variants conversion.
* docs: Fix a few typos in MainConfigSchema.
* (T290464) Add DiscussionTools bundling to release notes.
* (T309714) mime: Add support for 'font/sfnt' mime type.
* (T341434) WikiImporter: Improve error message output.
* (T341737) ApiBase: Cast $id to string in filterIDs.
* (T286291, T296188) Merge zh and zh-tw namespace translations back to zh-hans,
  zh-hant, zh-hk respectively.
* (T337875) WRStats: Round up SequenceSpec::hardExpiry to the nearest integer.
* (T237898) installer: Check MariaDB version in updater/installer.
* (T342632) ApiComparePages: Add help url.
* (T326182, T324903) EditPage: Add #[AllowDynamicProperties].
* (T342351) rdbms: Fix postgres db function call.
* (T343675) user: Use {@} to escape annotation when writting about annotation.
* (T343797) LanguageWa: Fix double timezone adjustment.
* (T343669) skins: Avoid function call on array.
* (T326454) Update pear/mail to 1.5.1.
* (T343622) docs: Set the <comment> tag back to optional.
* (T330528) Upgrade wikimedia/html-formatter from 3.0.1 to 4.0.3.
* Updated jQuery from v3.6.1 to v3.7.1.
* (T337463) wdio-mediawiki: await saveScreenshot.
* (T208477) $wgPrivilegedGroups – Users belonging in some of the listed groups
  will be audited more aggressively.
* doc: Improve description of "type" in extension.schema.v2.json.
* Added PrivilegedGroups attribute for extension.json / skin.json, which lets
  you add any new user groups you define to wgPrivilegedGroups (see above).
* (T288624) MultiHttpClient: Unset $this->cmh after closing it.
* (T345039) Do not run SkinAfterBottomScripts hook twice unconditionally.
* (T265734) API Help: Note that parameters may be inherited from other context.
* (T285545) i18n: Split apihelp for standard dir parameter.
* (T285545) i18n: Split apihelp for redirects/linkshere/transcludedin/fileusage
  show.
* (T285545) i18n: Split apihelp for parameter list=deletedrevs&drprop=.
* (T285545) i18n: Split apihelp for parameter list=allpages&apprexpiry=.
* (T285545) i18n: Split apihelp for parameter action=opensearch&redirects=.
* (T285545) i18n: Split apihelp for parameter action=managetags&operation=.
* (T285545) api: Add message for list=watchlist&wlprop=expiry.
* (T334011) ApiComparePages: expose 'difftype' param if wikidiff2 is installed.
* (T342633) api: Add message for action=compare&prop=timestamp.
* API: revids=… does not necessarily return the queried revisions.
* (T235207) Get correct main page in API call examples.
* doc: Make extension.schema.v2.json a valid JSON schema.
* (T326696) Add since tag to UserOptionsManager::MAX_BYTES_OPTION_VALUE.
* updateSpecialPages.php: Avoid implicit float conversion on modulo.
* (T347227) ImportReporter: Make callback functions public.
* (T346898) importDump: Unconditionally call $importer->setUsernamePrefix().
* doc: Improve description of type in extension.schema.v1.json.
* (T340217, CVE-2023-45359) SECURITY: Vector 2022: Numerous unescaped messages
  leading to potential XSS.
* (T340220, CVE-2023-45361) SECURITY: Vector 2022: vector-intro-page message
  is assumed to yield a valid title.
* (T340221, CVE-2023-45360) SECURITY: XSS via 'youhavenewmessagesmanyusers'
  and 'youhavenewmessages' messages.
* (T341529, CVE-2023-45362) SECURITY: diff-multi-sameuser ("X intermediate
  revisions by the same user not shown") ignores username suppression.
* (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted
  XML file to Special:Upload (non standard configuration).

== MediaWiki 1.40.0 ==

=== Changes since MediaWiki 1.40.0-rc.0 ===
* Localisation updates.
* (T330464) Work around argument corruption bug in XMLReader::open.
* build: Updating mediawiki/mediawiki-phan-config to 0.12.1.
* Fix frame and frameless rdfa depending on file existing.
* (T329214) Pass whether current rev of file exists to
  Linker::makeBrokenImageLinkObj.
* (T334659) Handle thumb errors when !$enableLegacyMediaDOM.
* A manualthumb that doesn't exist should be considered a thumb error.
* (T313157) IndexPager: Also protect against $offset being 0.
* (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

== MediaWiki 1.40.0-rc.0 ==

== Upgrading notes for 1.40 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.35.

Some specific notes for MediaWiki 1.40 upgrades are below:
* Maintenance scripts should now be executed using maintenance/run.php, e.g.
  maintenance/run.php update not maintenance/update.php as before.
* Five extensions have now been bundled with MediaWiki:
  * The DiscussionTools extension, which provides a forum-like editing
    experience for wikitext-based discussion pages.
  * The Echo extension, which provides a system of user notifications.
  * The Linter extension, which warns about use of deprecated wikitext.
  * The LoginNotify extension, which warns users about failed attempted logins.
  * The Thanks extension, which lets users thank editors for edits.
* The Renameuser extension has been moved to MediaWiki core. It is now possible
  to rename users without installing an extension. The extension had already
  been bundled with MediaWiki since 1.18.

For notes on 1.39.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.40 ===
* When computing PBKDF2 password hashes, MediaWiki now detects and uses OpenSSL
  support if available, unless $wgPasswordConfig['pbkdf2']['class'] is set in
  LocalSettings.php. OpenSSL is more efficient, so if that setting is present,
  you should remove it (or set it to 'Pbkdf2PasswordUsingOpenSSL' if possible).
  If users get an internal error when trying to log in, you can try setting it
  to 'Pbkdf2PasswordUsingHashExtension'. In particular, this would be necessary
  if existing PBKDF2 password hashes were computed using a hash algorithm other
  than "sha512" or "sha256" (the current and prior defaults).
* You should configure your webserver to return the http header
  'X-Content-Type-Options: nosniff' for the /images directory. This will
  instruct browsers to not apply content sniffing when accessing the files.
  MediaWiki before 1.40 shipped with a content sniffer which disallowed
  potentially dangerous files at upload time, but this protection has now been
  removed in favor of this 'X-Content-Type-Options: nosniff' header and the
  installer will return a warning when it is not in place.
* Support for MW_USE_LEGACY_DEFAULT_SETTINGS has been removed, setting this
  constant will not have any effect. Use of MW_USE_LEGACY_DEFAULT_SETTINGS
  had been deprecated since 1.39.

==== New configuration ====
* $wgThumbnailNamespaces - This setting lets you define the namespaces for which
  image thumbnails (or a placeholder in the absence of a thumbnail) will be
  displayed on Special:Search.
* $wgResourceLoaderClientPreferences – This experimental flag lets you enable
  client-side preferences for logged-out users.
* $wgExternalLinksSchemaMigrationStage – This temporary flag lets you control
  the migration stage for the new schema for the external links database table.
  Ignore it unless you have a large wiki farm with complex migration needs.
* $wgCommentTempTableSchemaMigrationStage – This temporary flag lets you control
  the migration stage for the temporary comment database table, from revision.
  Ignore it unless you have a large wiki farm with complex migration needs.
* $wgSpecialContributeSkinsEnabled – This setting lets you list skins on which
  Special:Contribute is available, for where others don't work for the feature.
* $wgPrivilegedGroups – Users belonging in some of the listed groups will be
  audited more aggressively.

==== Changed configuration ====
* $wgPasswordPolicies – This setting, which controls what makes for a valid
  password for wiki accounts, has been adjusted to raise the minimal password
  length from 1 to 8 characters. The initial limit of 1 has been in place since
  MediaWiki 1.26. If you wish to allow shorter passwords, you can over-ride it
  in your LocalSettings following the guidance on MediaWiki.org.
* (T254045) New accounts can no longer use an equals sign (=) in their
  usernames because of issues it causes in wikitext syntax. This can be
  adjusted by changing the value of $wgInvalidUsernameCharacters.
* (T314318) $wgParserEnableLegacyMediaDOM – This setting has been changed, so
  the alternative modern HTML structure for media is now the default. You can
  disable it for now by over-riding this back to `true` in LocalSettings, but
  this configuration will be removed in future versions of MediaWiki. For more
  details, see the documentation at:
  https://www.mediawiki.org/wiki/Parsoid/Parser_Unification/Media_structure/FAQ
* $wgWatchlistExpiryMaxDuration – This setting, which controls the maximum
  allowed duration for users to set their temporary watchlist entries for expiry
  if that feature is enabled, has been increased from 6 months to 1 year.

==== Removed configuration ====
* $wgShellboxUrl – This setting, deprecated in 1.37, has now been removed; use
  $wgShellboxUrls instead.
* $wgMainWANCache and $wgWANObjectCaches – These never-used settings have been
  removed. To inject WANObjectCache parameters, use $wgWANObjectCache instead.
  These variables were introduced for multi-DC wiki farms to add a separate
  memcached proxy for cross-DC relaying of purges but never used because
  WANObjectCache works based on route prefixes, which can be transparently
  handled by the main memcached proxy.
* $wgParserTestFiles – This setting, deprecated in 1.30, has now been removed;
  extensions can place their parser test files in `tests/parser` instead.
* (T231412) $wgAutoloadAttemptLowercase – This setting, deprecated in 1.35, no
  longer has any effect. If you run into difficulties, fix the names of miscased
  local files.
* (T309787) $wgVerifyMimeTypeIE – This setting, to provide extra security checks
  for very old versions of Internet Explorer clients, was removed. These user
  agents aren't used in practice, and haven't been served JavaScript content for
  years.

=== New user-facing features in 1.40 ===
* Special:Search can now show thumbnails for results for titles outside NS_FILE.
  This is controlled via the new onSearchResultProvideThumbnail hook.
* A new preference ('search-thumbnail-extra-namespaces') to allow users to
  control whether to show more thumbnails (per $wgThumbnailNamespaces)
* (T324910) On pages using multi-content revisions, the raw content of a
  specific slot can be retrieved using the action=raw&slot=<role-name> query
  parameters.
* (T313804) The preferences page now provides a search bar to find preferences,
  regardless of the tab on which they appear.

=== New developer features in 1.40 ===
* The MediaWiki-Docker development environment is now configured to
  run on PHP 8.1 by default, up from PHP 7.4 now that that's EOL.
* Vue development mode is enabled by default in DevelopmentSettings.php
* (T277618) The @noVarDump annotation from the DebugInfoTrait tool can now be
  added to references to stop them from being expanded when their object is
  passed to var_dump(), to make its use for debugging more feasible.
* The ApiSandbox will now by default request responses in the latest API format,
  rather than the original format. Users can set `formatversion` to a different
  value if needed.
* A new hook, GetBlockErrorMessageKeyHook, allows extensions' block error
  messages to be received and displayed by BlockErrorFormatter.
* A new hook, SpecialCreateAccountBenefits, lets extensions and local code set
  custom content on the signup page about the benefits of using an account.
* (T321412) A new 'PageUndeleteComplete' hook has been added for more thorough
  information about a page post restoration than the 'PageUndelete' hook passes.
  This provides similar functionality to the 'PageDeleteComplete' hook.
* The Linker::specialLink() method can now link to a Special page's with a sub-
  page or action parameter set, e.g. [[Special:Contributions/JohnDoe]].
* The PHPUnit entrypoints (tests/phpunit/phpunit.php and vendor/bin/phpunit)
  now check if composer dependencies are up-to-date, like update.php, using
  CheckComposerLockUpToDate. To disable this check, use
  MW_SKIP_EXTERNAL_DEPENDENCIES=1 environment flag when running PHPUnit.
* ManualLogEntry::setForceBotFlag() has been added to allow the forcing of the
  bot flag for log entries which are inserted to the recent changes.

=== External library changes in 1.40 ===

==== New external libraries ====
* Added codex-design-tokens at v0.6.2.
* Added symfony/polyfill-php81 at v1.27.0.
* Added wikimedia/bcp-47-code at v1.0.0.

===== New development-only external libraries =====
* Added wikimedia/langconv at v0.4.2.

==== Changed external libraries ====
* Updated OOUI from v0.44.3 to v0.46.3.
* Updated codex, codex-search, and codex-icons from v0.2.2 to v0.6.2.
* Updated cssjanus/cssjanus from 2.1.0 to 2.1.1.
* Updated guzzlehttp/guzzle 7.4.5 to 7.5.0.
* Updated justinrainbow/json-schema from 5.2.11 to 5.2.12.
* Updated pear/mail from 1.4.1 to 1.5.1.
* Updated pear/net_smtp from 0.10.0 to 0.10.1.
* Updated psr/container from 1.1.1 to 1.1.2.
* Updated symfony/polyfill-php80 from 1.26.0 to 1.27.0.
* Updated symfony/yaml from 5.4.10 to 5.4.17.
* Updated wikimedia/html-formatter from 3.0.1 to 4.0.3.
* Updated wikimedia/less.php from 3.1.0 to 4.0.0.
* Updated wikimedia/object-factory from 4.0.0 to 5.0.1.
* Updated wikimedia/parsoid from 0.16.0 to 0.17.0.
* Updated wikimedia/remex-html from 3.0.2 to 3.0.3.
* Updated wikimedia/shellbox from 3.0.0 to 4.0.0.
* Updated wikimedia/timestamp from 4.0.0 to 4.1.0.
* Updated wikimedia/xmp-reader from 0.8.4 to 0.9.1.

===== Changed development-only external libraries =====
* Updated QUnit from 2.18.2 to 2.19.4.
* Updated api-testing from 1.5.0 to 1.5.1.
* Updated composer/spdx-licenses from 1.5.6 to 1.5.7.
* Updated eslint-config-wikimedia from 0.22.1 to 0.24.0.
* Updated giorgiosironi/eris from ^0.10.0 to ^0.13.0.
* Updated grunt from 1.5.2 to 1.6.1.
* Updated grunt-banana-checker from 0.9.0 to 0.10.0.
* Updated grunt-eslint from 24.0.0 to 24.0.1.
* Updated karma from 6.3.15 to 6.4.1.
* Updated mediawiki/mediawiki-codesniffer from 38.0.0 to 41.0.0.
* Updated mediawiki/mediawiki-phan-config from 0.11.1 to 0.12.1.
* Updated php-parallel-lint/php-console-highlighter from 0.5 to 1.0.0.
* Updated php-parallel-lint/php-parallel-lint from 1.3.1 to 1.3.2.
* Updated phpunit/phpunit from 8.5.28 to 9.5.28.
* Updated stylelint-config-wikimedia from 0.13.0 to 0.13.1.
* Updated wikimedia/alea from 0.9.3 to 1.0.0.

==== Removed external libraries ====
* jquery.throttle-debounce, deprecated since MediaWiki 1.33.
* WVUI, deprecated since MediaWiki 1.39.

=== Action API changes in 1.40 ===
* New `cancreateaccount` parameter on action=query&meta=userinfo that allows
  you to check if the user can create an account. Some of the errors that have
  previously been returned by action=query&list=users&usprop=cancreate are now
  returned here.

=== Languages updated in 1.40 ===
MediaWiki supports over 400 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T300378) Added language support for Toki Pona (tok).
* (T320465) Added language support for Magahi (mag).
* (T320912) Added language support for Arakanese (rki).
* (T323971) Added language support for Khakas (kjh).
* (T326526) Added language support for Igala (igl).
* (T329476) Added language support for Kusaal (kus).
* (T330266) Added language support for Southern Dagaare (dga).
* (T331596) Added language support for Obolo (ann).
* (T331597) Added language support for Nogai (nog).
* (T331599) Added language support for Wolaytta (wal).
* (T295637) Add no to fallback chain of nb and nn.

=== Breaking changes in 1.40 ===
* OutputPage::enableClientCache no longer accepts a parameter, nor does it
  return the current value. It simply sets the OutputPage::mEnableClientCache
  to true. Use OutputPage::disableClientCache to disable client side caching
  instead.
* ResourceLoader::makeMessageSetScript, unused since 1.26, has been removed
  without deprecation.
* Changes to skins:
  - The internal protected method Skin::getFooterLinks() was removed.
    It had no known usages. Different from SkinTemplate::getFooterLinks.
  - The internal public method Skin::getSiteFooterLinks() was removed.
    It had no known usages.
* The 'oojs-router' module has been removed without deprecation in favour
  of the 'mediawiki.router' wrapper module.
* BagOStuff::makeKeyInternal(), deprecated for public use in 1.36, is now a
  protected method of MediumSpecificBagOStuff.
* WANObjectCache::reap() and WANObjectCache::reapCheckKey(), deprecated since
  1.39, have been removed.
* The EnqueueJob class, unused since 1.31, has been removed without
  deprecation.
* JobQueueGroup::singleton() and ::destroySingletons(), deprecated since 1.37,
  have been removed.
* JobRunner no longer supports manually calling the constructor,
  use MediaWikiServices::getInstance()->getJobRunner() instead.
* JobRunner::setLogger, deprecated since 1.35, has been removed.
* ContextSource::getStats, deprecated since 1.27, has been removed.
* The following public properties of Parser, deprecated in 1.35,
  have been made private: Parser::$mLinkId, Parser::$mIncludeSizes,
  Parser::$mDoubleUnderscore, Parser::$mShowToc, Parser::$mRevisionId,
  Parser::$mRevisionTimestamp, Parser::$mRevisionUser, Parser::$mRevisionSize,
  Parser::$mInputSize, Parser::$mInParse, Parser::$mFirstCall,
  Parser::$mGeneratedPPNodeCount
* The MWGrants class, deprecated since 1.38, has been removed.
* PageProps::getInstance(), deprecated since 1.38, has been removed.
* Global functions wfReadOnly and wfReadOnlyReason, deprecated since 1.38, have
  been removed.
* Global function wfQueriesMustScale, deprecated since 1.39, has been removed.
* Global function wfLogProfilingData, deprecated since 1.38, has been removed.
* The HTMLCacheUpdate class, deprecated since 1.34, has been removed.
* Linker::normaliseSpecialPage(), deprecated since 1.35, has been removed.
* MWTimestamp::getHumanTimestamp(), deprecated since 1.26, has been removed.
* Collation::singleton() and ::factory(), deprecated since 1.37, have been
  removed.
* SpecialVersion::listToText() and SpecialVersion::arrayToString()
  have become private or internal without deprecation.
* The 'ParserTestFiles' key in the schema for extension.json has been removed.
  This was deprecated in 1.30 and the corresponding $wgParserTestFiles
  configuration variable has also been removed in this release.  Extensions
  can put parser test files in their `tests/parser` directory to have them
  automatically run.
* DBLockManager, MySqlLockManager, and PostgreSqlLockManager have been
  removed without deprecation.
* MediaWikiTestCaseTrait::checkPHPExtension() has been removed without
  deprecation. Use PHPUnit @requires annotations instead.
* EditPage::getCopywarn(), deprecated since 1.38, has been removed.
* EditPage::getCopyrightWarning() now requires a MessageLocalizer parameter.
  Use of other parameter types or omitting it was deprecated since 1.38.
* Action constructor now requires Article and IContextSource parameters.
  Use of other parameter types or omitting them was deprecated since 1.35.
* Article::viewRedirect(), deprecated since 1.30, has been removed.
* Title::getNotificationTimestamp(), deprecated since 1.35, has been removed.
* WikiRevision::$fileIsTemp property, deprecated since 1.29, has been removed.
* Use of CommentStore::insertWithTempTable() with 'img_description' is no
  longer supported, it was deprecated since 1.32. Use CommentStore::insert()
  instead.
* Return values in the parameter $pageLang of the PageContentLanguage hook with
  other types than a Language object, deprecated since 1.33 & emitting warnings
  since 1.38, now throws an exception.
* FormatMetadata::flattenArrayContentLang(), deprecated since 1.36, has been
  removed.
* WikiRevision::downloadSource() and ::importUpload(), deprecated since 1.31,
  have been removed.
* DataUpdate::runUpdates(), deprecated since 1.28, has been removed.
* CdnCacheUpdate::newFromTitles(), deprecated since 1.35, has been removed.
* HtmlFileCacheUpdate::newFromTitles(), deprecated since 1.37, has been
  removed.
* BaseTemplate::renderAfterPortlet() and ::getAfterPortlet(), has been removed.
  Use the corresponding methods in Skin class.
* DifferenceEngine::textDiff(), deprecated since 1.32, has been removed.
* Skin::getSearchPageTitle() and Skin::setSearchPageTitle(), deprecated since
  1.38, have been removed.
* DifferenceEngine::getDiffBodyCacheKey(), deprecated since 1.31, has been
  removed.
* ForeignDBViaLBRepo::getMasterDB(), LocalRepo::getMasterDB(), and
  JobQueueDB::getMasterDB(), deprecated since 1.37, have been removed.
* Clarified that the InitializeArticleMaybeRedirect hook should not change
  its $article parameter; the behavior when doing so was previously
  undocumented.
* IDatabase::ping()'s $rtt parameter was removed without deprecation.
* IDatabase::setBigSelects(), unused, was removed without deprecation.
* IDatabase::attributesFromType(), unused, was removed without deprecation.
* IMaintainableDatabase::deadlockLoop() was removed without deprecation.
* DatabasePostgres::remappedTableName(), deprecated since 1.37, has been
  removed.
* ILBFactory::getChronologyProtectorClientId and ::commitAll, unused, were
   removed without deprecation.
* LoadBalancer::haveIndex() and ::isNonZeroLoad(), deprecated in 1.34,
  have been removed.
* LoadBalancer::getLazyConnectionRef(), deprecated in 1.38, has been removed.
* ILBFactory::forEachLB(), deprecated in 1.39, has been removed.
* LoadBalancer::getTransactionRoundStage and ::commitAll, unused, were
  removed without deprecation.
* ILoadBalancer::getLaggedReplicaMode, unused, was removed  without
  deprecation. Use ILBFactory::laggedReplicaUsed() instead.
* Optional parameters of ILoadBalancer::waitForPrimaryPos(), $pos and $timeout
  have been removed without deprecation as they are unused.
* LoadMonitorMysql was removed without deprecation. Use LoadMonitor instead.
* IDatabase::selectDB(), deprecated since 1.32, has been removed.
  Use IDatabase::selectDomain() instead.
* The following deprecated hooks have been removed:
  - BaseTemplateAfterPortlet, deprecated in 1.35
  - BeforeParserFetchTemplateAndtitle, deprecated in 1.36
  - BeforeParserrenderImageGallery, deprecated in 1.35
  - InternalParseBeforeSanitize, deprecated in 1.35
  - LinksUpdateConstructed, deprecated in 1.38
  - LinksUpdateAfterInsert, deprecated in 1.38
  - ParserSectionCreate, deprecated in 1.35
  - ResourceLoaderTestModules, deprecated in 1.33
  - SpecialMuteSubmit, deprecated in 1.35
  - UserLoadFromDatabase, deprecated in 1.37
  - UserSetCookies, deprecated in 1.27
* RemexDriver::__construct() now only accepts a ServiceOptions instance as
  the only argument. Passing an array was deprecated since 1.36.
* TidyDriverBase::supportsValidate(), deprecated since 1.36, has been removed.
* RevDelList::reloadFromMaster(), deprecated since 1.37, has been removed.
* ExternalStoreDB::getMaster(), deprecated since 1.37, has been removed.
* DeletePage::deletionWasScheduled(), deprecated since 1.38, has been removed.
* The SearchResultProvideThumbnailHook (which was unstable) and now no longer
  used, has been removed. Use SearchResultProvideThumbnailHook in the search
  namespace: MediaWiki\Search\Hook\SearchResultProvideThumbnailHook.
* Command::cgroup(), deprecated since 1.36, has been removed.
* When running tests, the serialize_precision INI setting is now set to -1
  (current PHP default) instead of 17. Extension tests may need to be adjusted
  accordingly; string representations of floating-point numbers in serialized
  or JSON-encoded data may change.
* WikiRevision::$sha1base36 is now private.
* IcuCollation::getUnicodeVersionForICU() was removed without deprecation.
* LinkFilter::supportsIDN() was removed without deprecation.
* The ability to pass null for the errorData parameter of HttpException and
  LocalizedHttpException was removed without deprecation.
* ApiQueryExtLinksUsage::getProtocolPrefix() and ::prepareProtocols() have
  been moved to LinkFilter with the same name.
* .box-sizing() Less mixin, deprecated since 1.37, has been removed.
  Use CSS box-sizing now.
* MimeAnalyzer::getIEMimeTypes() and IEContentAnalyzer were removed.
* Language::commafy and mw.language.commafy, deprecated since 1.36, has been
  removed.
* BagOStuff::decr(), deprecated since 1.28, has been removed.
* BagOStuff::incr(), deprecated since 1.28, has been removed.

=== Deprecations in 1.40 ===
* Changes to skins:
  - The public Skin::footerLink is deprecated.
    Use SkinComponentMenuLink::getTemplateData instead.
    It now emits deprecation warnings.
  - The protected Skin::lastModified is deprecated, and marked for @internal use
    and now emits deprecation warnings.
* Manipulating $wgHooks after initialization is deprecated.
  HookContainer::register() or HookContainer::scopedRegister() should be
  used instead. During initialization, SettingsBuilder::registerHookHandlers
  can be used. For backwards compatibility, $wgHooks is replaced by a fake
  array that calls methods on HookContainer. $wgHooks can still be used as a
  configuration variable, only dynamic manipulation is deprecated.
* ParserOptions::{get,set}ExternalLinkTarget() and
  ParserOptions::{get,set}MaxTemplateDepth() have been deprecated and marked
  for @internal use only.
* ParserOutput::getCategories() has been deprecated; use ::getCategoryNames()
  and ::getCategorySortKey() instead.
* ParserOutput::{get,set}TOCHTML() has been deprecated; use
  ::{get,set}TOCData() instead.
* TransactionProfiler::setSilenced() is deprecated.
  Use TransactionProfiler::silenceForScope() instead.
* The following methods in the Title class, deprecated since 1.37, emits
  deprecations warnings:
  - ::areCascadeProtectionSourcesLoaded()
  - ::areRestrictionsCascading()
  - ::areRestrictionsLoaded()
  - ::getAllRestrictions()
  - ::getCascadeProtectionSources()
  - ::getFilteredRestrictionTypes()
  - ::getRestrictionExpiry()
  - ::getRestrictionTypes()
  - ::getRestrictions()
  - ::isCascadeProtected()
  - ::isProtected()
  - ::isSemiProtected()
  - ::loadRestrictionsFromRows()
* The class Pbkdf2Password was renamed to Pbkdf2PasswordUsingHashExtension,
  and the old name is now deprecated.
* WikiPage::factory(), ::newFromID() and ::newFromRow, deprecated in 1.36, now
  emit deprecation warnings.
* Manually constructing a LinkBatch object, deprecated in 1.35, now emits
  deprecation warnings. Use LinkBatchFactory instead.
* Calling MediaWikiSite::getFileUrl() without a $path argument is deprecated.
  If you need the "generic" full file path, with $1 not replaced by anything,
  call $site->getPath( MediaWikiSite::PATH_FILE ) directly.
* In SessionConsistentConnectionManager, the methods
  getReadConnectionRef() and getWriteConnectionRef() are deprecated;
  the ConnectionManager methods they override had been deprecated already.
* Database::wasErrorReissuable() is deprecated.
* MimeAnalyzer::isPHPImageType was not used and will now emit deprecation
  warnings.
* GenericArrayObject, originally developed for Wikibase and SiteList, has been
  deprecated. Use built-in ArrayObject directly instead.
* Parser::getFunctionLang() has been deprecated; use
  Parser::getTargetLanguage() instead.
* MagicWordArray::getVariableRegex(), deprecated in 1.36, now emits deprecation
  warnings.
* AbstractBlock::getId() now emits deprecation warnings in case of cross-wiki
  access. This use was deprecated in 1.38.
* CommentStore::getStore, deprecated in 1.31, now emits deprecation warnings.
* BacklinkCache::get(), ::getLinks() and ::getCascadeProtectedLinks(),
  deprecated in 1.37, now emit deprecation warnings.
* LanguageConverterFactory::isTitleConversionDisabled(), deprecated in 1.36,
  now emits deprecation warnings.
* Language::getFileName(), ::getMessagesFileName() and
  ::getJsonMessagesFileName(), deprecated in 1.34,
  now emit deprecation warnings.
* Language::getLocalisationCache(), deprecated in 1.34, also
  Language::getMessagesFor(), ::getMessageFor() and ::getMessageKeysFor(),
  deprecated in 1.35, now emit deprecation warnings.
* User::incEditCount(), deprecated in 1.37, now emits deprecation warnings.
* User::idFromName(), deprecated in 1.37, now emits deprecation warnings.
* The ability to override and use User::$mRights, deprecated in 1.34, now emits
  deprecation warnings.
* IndexPager::getHookContainer is deprecated and emits deprecation warnings.
  Inject a HookContainer instead.
* User::getGroupPermissions(), ::getGroupsWithPermission() and
  ::groupHasPermission(), deprecated in 1.34, now emit deprecation warnings.
* PermissionManager::getGroupPermissions(), ::getGroupsWithPermission() and
  ::groupHasPermission(), deprecated in 1.36, now emit deprecation warnings.
* Global function wfShowingResults is deprecated and emits deprecation warnings.
* UserGroupMembership::getGroupMemberName is deprecated, the deprecation of
  UserGroupMembership::getGroupName in 1.38 missed a release note.
  Use Language::getGroupMemberName or ::getGroupName instead.
* AbstractBlock::getPermissionsError(), deprecated in 1.35, now emits
  deprecation warnings.
* SearchEngine::getNearMatcher() and ::getDefaultMatcher() have been deprecated
  in favor of MediaWikiServices::getInstance()->getTitleMatcher().
* SearchNearMatcher class has been deprecated in 1.40 in favor of TitleMatcher.
* The following functions are deprecated: User::isBlockedGlobally and
  User::getGlobalBlock. Use User::getBlock instead.
* The UserIsBlockedGlobally hook is deprecated.
  Use GetUserBlock hook instead.
* The SystemBlock type global-block is deprecated.
  GlobalBlocks are now added into CompositeBlocks via the GetUserBlock hook.
* Language::isWellFormedLanguageTag(), deprecated in 1.39, now emits deprecation
  notices. Please use LanguageCode::isWellFormedLanguageTag() instead.
* Language::fetchLanguageNames() and ::fetchLanguageName(), deprecated in 1.34,
  now emit deprecation warnings.
* Language::getFallbackFor(), ::getFallbacksIncludingSiteLanguage() and
  ::getFallbacksFor(), deprecated in 1.35, now emit deprecation warnings.
* Language::isSupportedLanguage(), ::isValidCode(), ::isValidBuiltInCode() and
  ::isKnownLanguageTag(), deprecated in 1.34, now emit deprecation warnings.
* Language::getConverter(), ::autoConvert(), ::autoConvertToAllVariants(),
  ::convert(), ::convertNamespace(), ::convertHtml(), ::convertCategoryKey(),
  ::getVariants(), ::hasVariants(), ::hasVariant(), ::getDefaultVariant(),
  ::getURLVariant(), ::getExtraHashOptions(), ::getConvRuleTitle(),
  deprecated in 1.35, now emit deprecation warnings.
* Language::factory() and ::getParentLanguage(), deprecated in 1.35, now emit
  deprecation warnings.
* Executing maintenance scripts directly is deprecated. The maintenance/run.php
  entry point should be used instead.
* MWHttpRequest::factory, deprecated in 1.34, now emits deprecation warnings.
* Job::factory is deprecated, use JobFactory::newJob instead.
* Http::request(), ::get(), ::post(), ::userAgent() and ::isValidURI(),
  deprecated in 1.34, now emit deprecation warnings.
* Title.js's confusingly-named getName() and getNameText() methods, for using
  media files' pages, have been renamed to getFileNameWithoutExtension() and
  getFileNameTextWithoutExtension() respectively. The old names are deprecated.
* Command::whitelistPaths() should now emit deprecation warnings. Make use of
  Command::allowPaths/disallowPaths() instead.
* When manually creating an HTMLFormField (i.e. not via HTMLForm::factory),
  it is deprecated to not include the "parent" field as one of the parameters.
* The MWException class is deprecated. Use native exceptions, either directly
  or as base classes.
* SelectQueryBuilder::lockForUpdate() is deprecated. Use ::forUpdate() with
  ::fetchRowCount() or ::acquireRowLocks() instead.
* ArticleUndelete hook is deprecated. Use PageUndeleteComplete hook instead.
* The global function wfReportTime() is now deprecated.
* PrevNextNavigationRenderer, deprecated in 1.39, now emits deprecation
  warnings.
* PagerNavigationBuilder::setMakeLinkCallback(), deprecated in 1.39, now emits
  deprecation warnings.
* IndexPager::getPagingLinks(), IndexPager::getLimitLinks() and
  IndexPager::buildPrevNextNavigation(), deprecated in 1.39, now emit
  deprecation warnings.
* Overriding the method IndexPager::makeLink(), deprecated in 1.39, now emits
  deprecation warnings.
* The following class names were namespaced (and, for the special pages,
  also renamed), and the old class names are now deprecated:
  - MostimagesPage -> MediaWiki\Specials\SpecialMostImages
  - MovePageForm -> MediaWiki\Specials\SpecialMovePage
  - UserrightsPage -> MediaWiki\Specials\SpecialUserRights
  - WantedFilesPage -> MediaWiki\Specials\SpecialWantedFiles
  - WantedPagesPage -> MediaWiki\Specials\SpecialWantedPages
  - DerivativeRequest -> MediaWiki\Request\DerivativeRequest
  - FauxRequest -> MediaWiki\Request\FauxRequest
  - FauxRequestUpload -> MediaWiki\Request\FauxRequestUpload
  - PathRouter -> MediaWiki\Request\PathRouter
  - WebRequestUpload -> MediaWiki\Request\WebRequestUpload
  - HeaderCallback -> MediaWiki\Request\HeaderCallback
  - FauxResponse -> MediaWiki\Request\FauxResponse
  - WebResponse -> MediaWiki\Request\WebResponse
  - ForeignResourceManager ->
    MediaWiki\ResourceLoader\ForeignResourceManager
  - DummyLinker -> MediaWiki\Linker\DummyLinker
  - Linker -> MediaWiki\Linker\Linker
  - PageProps -> MediaWiki\Page\PageProps
  - MagicWord -> MediaWiki\Parser\MagicWord
  - MagicWordArray -> MediaWiki\Parser\MagicWordArray
  - MagicWordFactory -> MediaWiki\Parser\MagicWordFactory
  - RawMessage -> MediaWiki\Language\RawMessage
  - ActorMigration -> MediaWiki\User\ActorMigration
  - ActorMigrationBase -> MediaWiki\User\ActorMigrationBase
  - CategoriesRdf -> MediaWiki\Category\CategoriesRdf
  - Category -> MediaWiki\Category\Category
  - CategoryViewer -> MediaWiki\Category\CategoryViewer
  - TrackingCategories -> MediaWiki\Category\TrackingCategories
  - EditPage -> MediaWiki\EditPage\EditPage
  - TemplatesOnThisPageFormatter ->
    MediaWiki\EditPage\TemplatesOnThisPageFormatter
  - ContentSecurityPolicy -> MediaWiki\Request\ContentSecurityPolicy
  - FormOptions -> MediaWiki\Html\FormOptions
  - Html -> MediaWiki\Html\Html
  - HtmlHelper -> MediaWiki\Html\HtmlHelper
  - TemplateParser -> MediaWiki\Html\TemplateParser
  - FormOptions -> MediaWiki\Html\FormOptions
  - WikiMap -> MediaWiki\WikiMap\WikiMap
  - WikiReference -> MediaWiki\WikiMap\WikiReference
  - MediaWiki\BadFileLookup -> MediaWiki\Page\File\BadFileLookup
  - FileDeleteForm -> MediaWiki\Page\File\FileDeleteForm
  - MergeHistory -> MediaWiki\Page\MergeHistory
  - MovePage -> MediaWiki\Page\MovePage
  - ProtectionForm -> MediaWiki\Page\ProtectionForm
  - LinkFilter -> MediaWiki\ExternalLinks\LinkFilter
  - TitleArray -> MediaWiki\Title\TitleArray
  - TitleArrayFromResult -> MediaWiki\Title\TitleArrayFromResult
  - TitleFactory -> MediaWiki\Title\TitleFactory
  - Title -> MediaWiki\Title\Title
  - ForkController -> MediaWiki\Maintenance\ForkController
  - OrderedStreamingForkController ->
    MediaWiki\Maintenance\OrderedStreamingForkController
  - AtomFeed -> MediaWiki\Feed\AtomFeed
  - ChannelFeed -> MediaWiki\Feed\ChannelFeed
  - FeedItem -> MediaWiki\Feed\FeedItem
  - FeedUtils -> MediaWiki\Feed\FeedUtils
  - RSSFeed -> MediaWiki\Feed\RSSFeed
  - DeprecatedGlobal -> MediaWiki\StubObject\DeprecatedGlobal
  - StubGlobalUser -> MediaWiki\StubObject\StubGlobalUser
  - StubObject -> MediaWiki\StubObject\StubObject
  - StubUserLang -> MediaWiki\StubObject\StubUserLang
* ContentHandler::getParserOutputForIndexing() and ::getDataForSearchIndex()
  now take an optional RevisionRecord parameter.
* The SearchDataForIndex hook is deprecated in favor of SearchDataForIndex2
* IDatabase::lastQuery and IReadableDatabase::lastQuery are deprecated without
  without replacement.

=== Other changes in 1.40 ===
* Calling RecentChange::doMarkPatrolled() with $auto = true has no effect and
  logs a warning. Since 1.31, it would mark the change as manually patrolled,
  but would not log it as such in patrol log and would still require
  'autopatrol' right (not 'patrol'). Generally, whether a change should become
  autopatrolled, is usually determined before it's inserted in the database.
* In versions of MediaWiki before 1.39, the table of contents location
  was marked internally with <mw:toc>...</mw:toc>; in version 1.39
  this was changed to an empty tag <mw:tocplace />.  In 1.40 this has
  been changed a final time to use an empty <meta> tag for future
  Parsoid compatibility (see Parser::TOC_PLACEHOLDER).  This may
  affect you if stale content is left in the ParserCache or if your
  skin did manual ToC replacement without using the recommended
  Parser::replaceTableOfContentsMarker() function.
* Skins can now choose which Codex theme should be loaded by setting the
  SkinCodexThemes attribute in their skin.json file.
* The parser test framework has been updated, and the 'pst', 'ill', 'cat'
  and 'showflags' options have slight differences in their output.  These
  options are not much used outside core, but third parties may need to
  update parser tests.
* (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.

== Compatibility ==

MediaWiki 1.40 requires PHP 7.4.3 or later and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

MariaDB is the recommended database software. MySQL, PostgreSQL, or SQLite can
be used instead, but support for them is somewhat less mature.

The supported versions are:

* MariaDB 10.3 or higher
* MySQL 5.7.0 or higher
* PostgreSQL 10 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.

= MediaWiki 1.39 =

PHP 8.0 workboard: https://phabricator.wikimedia.org/tag/php_8.0_support/
PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
PHP 8.2 workboard: https://phabricator.wikimedia.org/tag/php_8.2_support/
PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/

== MediaWiki 1.39.5 ==

This is a security and maintenance release of the MediaWiki 1.39 branch.

=== Changes since MediaWiki 1.39.4 ===
* Localisation updates.
* (T333050, CVE-2023-45363) SECURITY: Fix infinite loop for self-redirects
  with variants conversion.
* docs: Fix a few typos in MainConfigSchema.
* (T309714) mime: Add support for 'font/sfnt' mime type.
* (T341434) WikiImporter: Improve error message output.
* (T317255) VueComponentParser: Use Zest's getElementsByTagName() rather than
  PHP's.
* (T341737) ApiBase: Cast $id to string in filterIDs.
* (T286291, T296188) Merge zh and zh-tw namespace translations back to zh-hans,
  zh-hant, zh-hk respectively.
* (T337875) WRStats: Round up SequenceSpec::hardExpiry to the nearest integer.
* (T237898) installer: Check MariaDB version in updater/installer.
* (T342632) ApiComparePages: Add help url.
* (T326182, T324903) EditPage: Add #[AllowDynamicProperties].
* (T342351) rdbms: Fix postgres db function call.
* (T343675) user: Use {@} to escape annotation when writting about annotation.
* (T343797) LanguageWa: Fix double timezone adjustment.
* (T326454) Update pear/mail to 1.5.1.
* (T343622) docs: Set the <comment> tag back to optional.
* (T330528) Upgrade wikimedia/html-formatter from 3.0.1 to 4.0.3.
* (T337463) wdio-mediawiki: await saveScreenshot.
* (T274041) Include core PSR-4 classes in the generated classmap.
* (T208477) $wgPrivilegedGroups – Users belonging in some of the listed groups
  will be audited more aggressively.
* doc: Improve description of "type" in extension.schema.v2.json.
* Added PrivilegedGroups attribute for extension.json / skin.json, which lets
  you add any new user groups you define to wgPrivilegedGroups (see above).
* HTMLForm: Fix E_NOTICE when hide-if is used with setFormIdentifier.
* (T288624) MultiHttpClient: Unset $this->cmh after closing it.
* (T345039) Do not run SkinAfterBottomScripts hook twice unconditionally.
* (T265734) API Help: Note that parameters may be inherited from other context.
* API: Make continue parameter help description more specific.
* (T285545) i18n: Split apihelp for standard dir parameter.
* (T285545) i18n: Split apihelp for redirects/linkshere/transcludedin/fileusage
  show.
* (T285545) i18n: Split apihelp for parameter list=deletedrevs&drprop=.
* (T285545) i18n: Split apihelp for parameter list=allpages&apprexpiry=.
* (T285545) i18n: Split apihelp for parameter action=opensearch&redirects=.
* (T285545) i18n: Split apihelp for parameter action=managetags&operation=.
* (T285545) api: Add message for list=watchlist&wlprop=expiry.
* (T334011) ApiComparePages: expose 'difftype' param if wikidiff2 is installed.
* (T342633) api: Add message for action=compare&prop=timestamp.
* API: revids=… does not necessarily return the queried revisions.
* (T326696) user: Truncate option value in UserOptionsManager.
* (T326696) ApiOptions: Give warning if the value is too long.
* API i18n: Add {{PLURAL:}} for byte count messages.
* (T235207) Get correct main page in API call examples.
* doc: Make extension.schema.v2.json a valid JSON schema.
* updateSpecialPages.php: Avoid implicit float conversion on modulo.
* (T347227) ImportReporter: Make callback functions public.
* (T346898) importDump: Unconditionally call $importer->setUsernamePrefix().
* doc: Improve description of type in extension.schema.v1.json.
* (T340217, CVE-2023-45359) SECURITY: Vector 2022: Numerous unescaped
  messages leading to potential XSS.
* (T340220, CVE-2023-45361) SECURITY: Vector 2022: vector-intro-page
  message is assumed to yield a valid title.
* (T340221, CVE-2023-45360) SECURITY: XSS via
  'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
* (T341529, CVE-2023-45362) SECURITY: diff-multi-sameuser
  ("X intermediate revisions by the same user not shown") ignores
  username suppression.
* (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted
  XML file to Special:Upload (non-standard configuration).

== MediaWiki 1.39.4 ==

This is a security and maintenance release of the MediaWiki 1.39 branch.

=== Changes since MediaWiki 1.39.3 ===
* Localisation updates.
* (T333990) composer.json: Explicitly pin psr/http-message to 1.0.1.
* (T335203, CVE-2023-29197) SECURITY: Upgrading guzzlehttp/psr7
  (2.4.0 => 2.4.5).
* (T333776) {{ACTIVEUSERS}} wasn't being updated without updateSpecialPages.php.
* (T258860) Prevent LogicCache exception from message cache during IO errors
  from memcache.
* (T336868) Improve idempotency of postgres index upgrades.
* (T322944) Add Authorization to default $wgAllowedCorsHeaders.
* (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.
* A fake MessageLocalizer for use in unit tests.
* (T338114) Title: Add forward alias.
* composer: Add symfony/polyfill-php81 like symfony/polyfill-php80.
* (T330464) Work around argument corruption bug in XMLReader::open.
* Fix frame and frameless rdfa depending on file existing.
* Fixes for the phan upgrade, part 1.
* Fixes for the phan upgrade, part 2.
* (T298571) build: Update mediawiki/mediawiki-phan-config to 0.12.0.
* build: Updating mediawiki/mediawiki-phan-config to 0.12.1.
* (T329214) Pass whether current rev of file exists to
  Linker::makeBrokenImageLinkObj.
* (T334659) Handle thumb errors when !$enableLegacyMediaDOM.
* A manualthumb that doesn't exist should be considered a thumb error.
* (T313157) IndexPager: Also protect against $offset being 0.
* (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

== MediaWiki 1.39.3 ==

This is a security and maintenance release of the MediaWiki 1.39 branch.

=== Changes since MediaWiki 1.39.2 ===
* Localisation updates.
* (T328477) LinksUpdate: Use DB key for category links table.
* GlobalFunctions: Remove check for MEDIAWIKI constant.
* (T329484) API: Fix query+allimages user parameter description.
* (T330529) SpecialEditTags: Set default of '' for wpReason.
* (T330382) postgres: Make the upgrade ignore dropping indexes that
  might not exist.
* (T330526) htmlform: Handle null from HTMLFormField::getDefault in
  multiselects.
* (T291753) rdbms: escape backslashes in makeConnectionString for PostgreSQL.
* (T325529) Fix total breakage of wgCanonicalServer fallback.
* (T318103) mediawiki.storage: Disable async GC during integration test.
* (T332461, T332397) TempFSFile: Keep the WeakMap alive.
* (T332902) page: fix InvalidArgumentException in SQLPlatform::makeList.
* (T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted
  XFF headers.

== MediaWiki 1.39.2 ==

This is a maintenance release of the MediaWiki 1.39 branch.

=== Changes since MediaWiki 1.39.1 ===
* Localisation updates.
* (T325872) ChangeTags: Remove table name from condition.
* (T324895) MWCallbackStream: Add explicit $stream property.
* (T297031, T326039) PostgresUpdater: Move setDefault ahead of
  changeNullableField.
* (T321319) Produce HTML for invalid JSON.
* (T215466, T326071) MigrateActors: Write to revision table (Follow-up 24115a8).
* (T223027) ReservedUsernames config: Add reserved names from maintenance
  scripts.
* (T325000, T324896, T307631) Updated OOUI from v0.44.3 to v0.44.5.
* Remove /images .htaccess rules that are no longer relevant.
* Disable php in .htaccess of images directory as a hardening measure.
* (T322583) Include missing message parameter in message.
* LocalFileTest: use encodeBlob/decodeBlob for img_metadata.
* DatabaseSqlite: fix null blobs.
* rdbms: avoid pg_escape_bytea() call-style deprecation notices.
* (T322278) Improve LocalisationCache post-merge validation check.
* (T324408, T326367) Updated wikimedia/remex-html from 3.0.2 to 3.0.3.
* (T322278) Fix the remaining Phan failures on PHP 8.1.
* (T322278, T326367) Respond to some messages from Phan on PHP 8.1.
* Fix phan error when Excimer is enabled.
* (T326021) Add matrix: to $wgUrlProtocols.
* (T314099) stream wrapper: Declare $context class property.
* (T314099) libs\jsminplus: Declare JSNode::$expression.
* (T314096) composer.json: Updated composer/spdx-licenses from 1.5.6 to 1.5.7.
* (T326472) Upgrading cssjanus/cssjanus (v2.1.0 => v2.1.1).
* (T308536) rdbms: Remove deprecation mark for $wgSharedDB.
* (T215466, T326071) installer: Split drop action out of the SQL patch for actor
  migration.
* (T322603) SqliteMaintenance.php: Fix fatally broken instanceof check.
* (T326377) rdbms: Use DBConnRef in SelectQueryBuilder.
* api/en.json: api-help-datatype-expiry add missing 'may'.
* (T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
* (T328222) Pass empty string to strlen() if schema is null for
  PostgresDatabase.
* (T289926) SpecialRevisionDelete: Set default of '' for wpReason.
* (T155582, T328503) Fix XML dumps for content types with non-string
  getNativeData().
* (T326886) PoolCounterRedis: Fix wrong cast, locks weren't being released.
* (T314099) revisiondelete: Replace dynamic property Status::$itemStatuses
* (T327821) skin: Restore default 'value' attribute in makeSearchButton().
* (T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
* (T329415) Clear the statsd data buffer regardless of StatsdServer config.
* (T292348) WikiImporter: do not fail if upload entry in dump lacks 'text' tag.
* (T330049) UnregisteredLocalFile: Don't call MimeAnalyzer if no path.
* (T324894 TempFSFile: Use a WeakMap for reference tracking if available.
* (T295637) Add no to fallback chain of nb and nn.

== MediaWiki 1.39.1 ==

This is a security and maintenance release of the MediaWiki 1.39 branch.

=== Changes since MediaWiki 1.39.0 ===
* Localisation updates.
* PostgresUpdater: Remove trailing space from 'user_id ' column.
* (T304515) LCStoreStaticArray: atomically replace the cache file.
* (T324516) postgres: Fix upgrade for templatelinks primary key.
* (T324890, T324891, T324901) Parser: Allow dynamic properties on PHP 8.2.
* (T324513) uuid\GlobalIdGenerator: Check if getmyuid() exists.
* (T314099) OutputPage: Remove unused dynamic property ParserOptions->isBogus.
* (T314099) api: Remove use of undeclared property in action=comparepages.
* Upgrading wikimedia/xmp-reader (0.8.5 => 0.8.6).
* (T324489) Upgrading wikimedia/parsoid (v0.16.0 => v0.16.1).
* Updated pear/mail (v1.4.1 => v1.5.0).
* Removed wikimedia/dodo (v0.4.0).
* (T324910) On pages using multi-content revisions, the raw content of a
  specific slot can be retrieved using the action=raw&slot=<role-name> query
  parameters.
* (T322637) SECURITY: sqlite should not create DB file world-readable.

== MediaWiki 1.39.0 ==

=== Changes since MediaWiki 1.39.0-rc.1 ===
* Localisation updates.
* exception: Tolerate no service container when trying DB rollback.
* (T320282) Upgrading wikimedia/xmp-reader (0.8.3 => 0.8.4).
* objectcache: Deprecate WANObjectCache::reap() and ::reapCheckKey().
* (T320864) When calling mail(), use an array for headers.
* Upgrading wikimedia/xmp-reader (0.8.4 => 0.8.5).
* (T321154) Call setFormIdentifier() on LogEventsList form.
* When importing revision with same timestamp as latest revision, treat
  it as the new latest.
* (T320726) RandomImageGenerator::getImageSpec: Don't pass a float to mt_rand(),
  for PHP 8.1.
* (T298485, T322360) WikiExporter: Avoid calling reload in processing every row.
* (T321551) pager: Fix null used for foreach in Pager::getNavigationBar.
* (T321551) pager: Remove unused AlphabeticPager::getOrderTypeMessages()
  support.
* pager: Remove unused PagerNavigationBuilder::setExtra().
* PagerNavigationBuilder: Document that nulls in setLinkQuery() etc. are
  allowed.
* (T322335) ApiQueryRevisionsBase: Fix 'rvdiffto' parameter handling on PHP 8.0.
* (T314096) TestFileEditor: Fix string interpolation.
* (T289926) api: Fix minor PHP 8.1 incompatibility in ApiOptions.
* (T322803) SpecialBotPasswords: Don't pass null to trim().
* (T289926) Fix incomplete ITextFormatter mocks.
* Language: Handle ronna and quetta.
* (T72510) rdbms: make SqlitePlatform::tableName() apply double quotes.
* (T323373) Parser: Fix extractSections() behavior for PHP >= 8.0.
* .gitattributes: Ship docker-compose.yml to the tarball.

== MediaWiki 1.39.0-rc.1 ==

=== Changes since MediaWiki 1.39.0-rc.0 ===
* Localisation updates.
* (T318481) composer: Drop symfony/php73-polyfill.
* (T318460) SpecialChangeEmail: Set default for returntoquery.
* (T318307) HTMLFormField::validate(): Update docs to permit all data types
* (T306802) docker: update to latest published images.
* (T318754) WebInstallerOptions::addPersonalizationOptions(): Close fieldset.
* (T227047) Soft-deprecate the remainder of ActorMigration.
* (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
  in an IP range check on Special:Contributions.
* (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
  of hidden users.
* (T307278, CVE-2022-41766) SECURITY: On action=rollback the message
  "alreadyrolled" can leak revision deleted user name.
* (T319186) .phan/config.php: Update minimum_target_php_version.
* Tests: Explicit cast to int in RandomImageGenerator test (php8 warnings).
* (T319186) .phan/config.php: Update minimum_target_php_version.
* (T310243) Deprecate use of 'wvui-search' package.
* utils: Fix return doc about false/null for UrlUtils::expand.
* (T319000) WebInstaller: Don't try and run trim() on null.
* In the event of preg failure in MagicWordArray throw exception.
* (T318753) Installer: Disable logo dropper for now.

== MediaWiki 1.39.0-rc.0 ==

== Upgrading notes for 1.39 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.31.

Some specific notes for MediaWiki 1.39 upgrades are below:
* (T278139) Drop PHP 7.3 support in MediaWiki 1.39; require 7.4.3 or higher.

For notes on 1.38.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.39 ===

==== New configuration ====
* $wgAutoCreateTempUser – This configures automatic user creation on page save.
* $wgCopyUploadAllowOnWikiDomainConfig – This configures if administrators can
  use the MediaWiki:Copyupload-allowed-domains system message to define which
  domains can be used with the upload-by-url tool.
* $wgCdnMatchParameterOrder – This can be set to false if MediaWiki is behind a
  CDN that re-orders query parameters. This will make the code that matches
  request URLs to canonical CDN URLs insensitive to parameter order.
* $wgMultiShardSiteStats – This allows you to split site_stats across multiple
  rows. Only useful for very large, heavily edited wikis. (T306589)
* $wgPrivilegedGroups – Users belonging in some of the listed groups will be
  audited more aggressively.

==== Changed configuration ====
* $wgInvalidUsernameCharacters – This setting now contains the char '>', which
  is now the reserved delimiter for external user names.
* $wgLocalFileRepo – The default serialization method for file meta-data has
  been changed to JSON. You can revert it to PHP by setting the property
  'useJsonMetadata' to false.
* $wgLBFactoryConf – The 'configCallback' flag can now be set to a callback
  function that returns an array with keys to update in $wgLBFactoryConf. This
  can be used to update the database configuration on the fly, e.g. to take
  replica hosts out of rotation.
* $wgDBservers and $wgLBFactoryConf – The DBO_SSL flag in has been deprecated in
  favour of a boolean "ssl" parameter.
* $wgObjectCaches – The 'globalKeyLB' and 'localKeyLB' flags are no longer
  supported.

==== Removed configuration ====
* $wgMultiContentRevisionSchemaMigrationStage - This transition flag, deprecated
  since MediaWiki 1.35, has been removed; the data migration is over.
* $wgActorTableSchemaMigrationStage - This transition flag has been removed; the
  data migration is over.
* $wgWikiFarmSiteDetector – This experimental setting has been removed without
  replacement. Use the MW_WIKI_NAME environment variable to specifiy the name of
  the site for which to load configuration. Using the WIKI_NAME environment
  variable for this purpose is deprecated.
* $wgParserCacheUseJson - The ParserCache now always uses JSON serialization.
  Reading old non-JSON cache entries is still supported. The setting had been
  deprecated since 1.36.
* $wgAllowJavaUploads - To allow uploads of JAR files, remove application/java
  from $wgMimeTypeExclusions.
* $wgMaxRedirects – This broken feature was removed, as it never worked as
  intended (T296430).
* $wgElementTiming – This experimental, default-disabled feature has been
  removed without replacement.
* $wgPriorityHints and $wgPriorityHintsRatio – The related experimental feature
  has been removed without replacement.
* $wgIncludeLegacyJavaScript – This flag has been removed, without loss of any
  functionality in this release. Most former "wikibits" functions were removed
  after deprecation in previous releases. The remaining functions, such as
  importScript, are now available unconditionally.
* $wgLegacySchemaConversion - This unused setting has been removed.
* $wgInterwikiPrefixDisplayTypes - This unused setting has been removed.
* $wgMangleFlashPolicy – This is no longer functional, and is now deprecated.
  Users who are somehow still using Flash as a browser extension will be exposed
  to CSRF vulnerabilities.

=== New user-facing features in 1.39 ===
* Optional automatic user creation on page save ($wgAutoCreateTempUser)
* Administrators now have the option to delete/undelete the associated "Talk"
  page when they are (un)deleting a given page. `deletetalk` and `undeletetalk`
  options were added to the 'delete' and 'undelete' action APIs in MW 1.38.
* `{{=}}` is now a wikitext built-in magic word, expanding to `=`.  This is
  conventionally used as an escape mechanism to allow the use of `=` in
  unnamed template arguments.  Defining [[Template:=]] to expand to something
  other than `=` has been deprecated since 1.36, with affected pages put into
  a special tracking category for migration.
* (T284020) Bot passwords are now supported when using the REST API.

=== New developer features in 1.39 ===
* Added optional $size param to SearchResultProvideThumbnail hook.
* SearchResultProvideThumbnail hook interface moved from MediaWiki\Rest\Hook
  namespace to MediaWiki\Search\Hook.
* JsonValidateSaveHook has been added to allow extensions to set additional
  pre-save validations for specific JSON pages (T313254)
* Added 'PermissionErrorAudit' hook, enabling extensions to audit permission
  errors on specfic actions. For instance account registration failed attempts
  due to a block (T306018).

=== External library changes in 1.39 ===

==== New external libraries ====
* Added Codex v0.1.1. This replaces the now deprecated wvui library.
* Added symfony/polyfill-php81.

===== New development-only external libraries =====
* Updated QUnit from 2.18.0 to 2.18.2.

==== Changed external libraries ====
* Updated jQuery from v3.6.0 to v3.6.1.
* Updated OOUI from v0.43.2 to v0.44.5.
* Updated composer/semver from 3.2.6 to 3.3.2.
* Updated cssjanus/cssjanus fromv2.1.0 to v2.1.1.
* Updated pear/mail from v1.4.1 to v1.5.1.
* Updated symfony/polyfill-php73 from 1.25.0 to 1.26.0.
* Updated symfony/polyfill-php80 from 1.25.0 to 1.26.0.
* Updated symfony/yaml from 5.4.3 to 5.4.10.
* Updated vue/compat from 3.2.23 to 3.2.37.
* Updated wikimedia/base-convert from 2.0.1 to 2.0.2.
* Updated wikimedia/html-formatter from 3.0.1 to 4.0.3.
* Updated wikimedia/ip-set from 3.0.0 to 3.1.0.
* Updated wikimedia/minify from 2.2.6 to 2.3.0.
* Updated wikimedia/php-session-serializer from 2.0.0 to 2.0.1.
* Updated wikimedia/remex-html from 3.0.2 to 3.0.3.
* Updated wikimedia/running-stat from 1.2.1 to 2.1.0.
* Updated wikimedia/scoped-callback from 3.0.0 to 4.0.0.
* Updated wikimedia/services from 2.0.1 to 3.0.0.
* Updated wikimedia/timestamp from 3.0.0 to 4.0.0.
* Updated wikimedia/xmp-reader from 0.8.1 to 0.8.6.

===== Changed development-only external libraries =====
* Updated composer/spdx-licenses from 1.5.5 to 1.5.7.
* Updated doctrine/dbal for PHP < 7.3 from 2.13.6 to 2.13.9.
* Updated doctrine/dbal for PHP >= 7.3 from 3.1.5 to 3.4.2.
* Updated mediawiki/mediawiki-phan-config from 0.11.1 to 0.12.1.

==== Removed external libraries ====
* Removed wikimedia/dodo (v0.4.0).

=== Bug fixes in 1.39 ===
* (T314013) $wgExtraNamespaces no longer overrides canonical namespace names
  specified in extension.json files. While this setting can still be used to
  rename extension-defined namespaces, system administrators may need to run
  namespaceDupes.php after upgrading.

=== Action API changes in 1.39 ===
* New `undeletetalk` parameter on action=undelete that allows you to restore
  all revisions of the associated talk page.

=== Languages updated in 1.39 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* Actual localization was added for several languages, which were already
  in Names.php and even used for a Wikipedia:
** (T313200) Added language support for Rundi (Kirundi, rn).
** (T310976) Added language support for Tumbuka (ChiTumbuka, tum).
** (T314270) Added language support for Kanuri (kr).
* (T313199) Added language support for Sylheti (syl).
* (T311975) Added language support for Ghanaian Pidgin (gpe).
* (T307080) Added language support for Okinawan (ryu).
* (T307887) Added language support for Mooré (mos).
* (T308813) Added language support for Nigerian Pidgin (pcm).
* (T309763) Added language support for Tai Nüa (tdd).
* (T310040) Added language support for Fante (fat).
* (T311034) Added language support for Campidanese Sardinian (sro).
* (T315406) Fix the autonym of the Iñupiaq language to "Iñupiatun".
* (T315677) Removed French fallback from the Fula language (ff).
* (T304920) In Swahili, The "Media" namespace is now "Media", as in English,
  and the "File" namespace is now "Faili". The old name of the "File" namespace
  was "Picha", and it's kept for backwards compatibility. If you manage a wiki
  in Swahili, and you use "Faili:" as a namespace anywhere in wikitext, and
  you mean to use it as "Media:", these need to be replaced to "Media:".
* (T309866) Some namespace translations were updated for Kyrgyz (ky). The old
  ones are retained as aliases for backwards compatibility.
* (T117845) Started the renaming of the language codes for Serbian from sr-ec
  and sr-el to sr-cyrl and sr-latn.
* (T295637) Add no to fallback chain of nb and nn.

=== Breaking changes in 1.39 ===
* Basic non-JavaScript (Grade C) support has been dropped for Internet Explorer
  9-10, Firefox 27-38, and Android 4.3-4.4.
* The following methods, deprecated since 1.37, have been removed from IDatabase
  - ::fetchObject()
  - ::fetchRow()
  - ::numRows()
  - ::freeResult()
* Title::getDefaultNamespace(), deprecated since 1.37, has been removed.
* The DBPrimaryPos class alias 'DBMasterPos' has been removed.
* The global function wfGetLB(), deprecated since 1.27, has been removed.
* Passing a db to BlockRestrictionStore::loadByBlockId() is no longer supported.
  BlockRestrictionStoreFactory should be used to fetch a correct
  BlockRestrictionStore instead. This was deprecated since 1.38.
* The global function wfGetCache(), deprecated since 1.32, has been removed. You
  can use ObjectCache::getInstance() instead.
* The global function wfGetMainCache(), deprecated since 1.32, has been removed.
  You can use ObjectCache::getLocalClusterInstance() instead.
* MovePage::__construct() now requires that all parameters be passed. The
  fallback to MediaWikiServices emitted deprecation notices since 1.37.
* WikiPage::doEditContent(), deprecated since 1.32, was removed.
* WikiPage::prepareContentForEdit() now requires a UserIdentity parameter to be
  provided. Not providing one has been deprecated since 1.37.
* EventRelayerKafka, deprecated in 1.38, was removed.
* MediaWiki\Logger\Monolog\KafkaHandler, deprecated in 1.38, was removed.
* The "trace" option of SectionProfiler, deprecated in 1.38, was removed.
* The global function wfWikiID(), deprecated since 1.35, has been removed.
* Database::wasKnownStatementRollbackError() was removed. Subclasses should
  override isKnownStatementRollbackError() instead.
* Database::wasQueryTimeoutError() was removed. Subclasses should
  override isQueryTimeoutError() instead.
* Database::buildSuperlative() has been removed without deprecation.
* The following methods, deprecated in 1.37, have been removed:
  - Linker::setStubThreshold(), ::getStubThreshold().
  - LinkRendererFactory::createForUser().
  - ParserOptions::getStubThreshold(), ::setStubThreshold().
* Changes to ResourceLoader modules:
  - The mediawiki.viewport module, deprecated in 1.37 has been
     removed. Use IntersectionObserver instead.
* If you manage a wiki in Swahili, and you use "Faili:" as a namespace anywhere,
  and you mean to use it as "Media:", replace it with "Media:". See T304920.
* Changes to skins:
  - Skin::getCopyrightIcon(), ::getPoweredBy(), deprecated in 1.37 have been
    removed.
  - Skin::bottomScripts, deprecated in 1.37, now emits deprecation notices.
    Skins using SkinTemplate must set bodyOnly as a skin option and
    remove lines of code generating html, body and head elements.
  - Skin::makeSearchButton and Skin::makeSearchInput were deprecated in 1.38.
    Use SkinTemplate methods with the same name or Skin::getTemplateData
    instead.
  - Styles for the HTML classes `warningbox`, `errorbox` and `successbox` have
    been removed in favor of Html class methods.
  - The feature `legacy` used inside ResourceLoaderSkinModule,
    deprecated in 1.37, will no longer ship any styles.
  - Skin::getSkinStylePath, deprecated since 1.36, has been removed.
  - Skin::getPortletData has been made private.
  - SkinTemplate::getPersonalToolsList(), deprecated in 1.35 has been
    removed.
  - The following SkinTemplate template data, deprecated in 1.37,
    have been removed:
     - poweredbyico
     - copyrightico
  - The following hooks, deprecated in 1.37, have been removed:
     - SkinGetPoweredBy: SkinGetPoweredByHook
  - The following hooks are deprecated and replaced with
    SkinTemplateNavigation::Universal:
     - SkinTemplateNavigation::SpecialPage
     - SkinTemplateNavigation
     - PersonalUrls
  - The mediawiki.skinning.content.externallinks module, which was
    deprecated in 1.36 has been removed. Skins that still rely on it
    will lose the icon styling of external links by type.
* Experimental wiki farm support: Automatic detection of the requested site
  within a wiki farm based on the requested domain has been removed.
  Use the MW_WIKI_NAME environment variable to specify the name of the site
  to load configuration for. Using the WIKI_NAME environment variable for this
  purpose is deprecated. This is only relevant if you have been using
  $wgWikiFarmSettingsDirectory to load wiki farm config.
* MWExceptionHandler::installHandler was marked @internal and had required
  arguments added. This method is intended for use in bootstrap code and is
  unused in known extensions.
* MWException::useOutputPage was made private without deprecation.
  This method was apparently only public for testing and is unused in known
  extensions.
* Calling getId() on a User or UserIdentityValue from the wrong wiki, deprecated
  since 1.36, now throws an exception.
* The following methods have been removed from ExtensionRegistry without
  deprecation and without replacement. They had been introduced in 1.35 for use
  in the testing framework, and were not in use by any known extension:
  - exportAutoloadClassesAndNamespaces
  - exportTestAutoloadClassesAndNamespaces
* The MWNamespace class, deprecated since 1.34, has been removed. Use the
  NamespaceInfo service instead.
* The UnknownContent and UnknownContentHandler class aliases have been removed,
  use FallbackContent and FallbackContentHandler instead.
* IResultWrapper::next() now returns void, to match the Iterator interface that
  it implements. fetchObject() has the same behavior as next() used to.
* In HTMLForm HTMLAutoCompleteSelectFields, the parameters 'autocomplete' and
  'autocomplete-messages', which were deprecated in MediaWiki 1.29, were
  removed. Instead, use 'autocomplete-data' and 'autocomplete-data-messages'.
* The global $wgParser, deprecated in 1.32, was removed. Use
  MediaWikiServices::getInstance()->getParser() instead.
* ParserOutput::setText will now set the ParserOutput's text to null if
  given null. Previously it did nothing if given null.
* The default value for the first argument to the ParserOutput constructor
  is now null instead of ''.
* IDatabase::lockTables() and IDatabase::unlockTables(), deprecated since 1.38,
  have been removed.
* The $context parameter to `new HTMLForm( … )` and `HTMLForm::factory( … )`
  is now required.
* The class alias for revision related classes in namespace MediaWiki\Storage
  has been removed. Classes are IncompleteRevisionException,
  MutableRevisionRecord, MutableRevisionSlots, RevisionAccessException,
  RevisionArchiveRecord, RevisionFactory, RevisionLookup, RevisionRecord,
  RevisionSlots, RevisionStore, RevisionStoreRecord, SlotRecord, and
  SuppressedDataException.
* Calling getBy() on an AbstractBlock from the wrong wiki, deprecated since
  1.38, now throws an exception.
* Passing a MediaWiki\Linker\LinkTarget to EditPage::makeTemplatesOnThisPageList
  or TemplatesOnThisPageFormatter::format is no longer supported,
  a MediaWiki\Page\PageIdentity is required.
* The deprecated class alias FakeConverter has been removed, use
  TrivialLanguageConverter instead.
* The deprecated ApiQueryContributions class alias has been removed, use
  ApiQueryUserContribs instead.
* The deprecated MediaWiki\Special\SpecialPageFactory class alias has been
  removed, use MediaWiki\SpecialPage\SpecialPageFactory instead.
* The following skin modules, deprecated in 1.37, have been removed:
	- mediawiki.skinning.elements
	- mediawiki.skinning.content
	- mediawiki.toc.styles
	- mediawiki.legacy.config
	- mediawiki.legacy.shared
	- mediawiki.legacy.commonPrint
* FileModule::compileLessFile(), deprecated since 1.35, has been removed. Use
  ::compileLessString() instead.
* LogFormatter::styleRestricedElement(), deprecated since 1.37, has been
  removed. Use ::styleRestrictedElement() instead.
* Title::isNamespaceProtected(), deprecated in 1.34, has been removed.
* ApiStashEdit::parseAndStash(), deprecated in 1.34, has been removed.
* LinkCache::forUpdate(), deprecated in 1.34, has been removed.
* Passing null instead of a NamespaceInfo instance to LinkCache::__construct()
  is not supported anymore. It is recommended to request an instance from the
  service container.
* ApiQueryBase::showHiddenUsersAddBlockInfo(), deprecated in 1.34, has been
  removed. Use ApiQueryBlockInfoTrait instead.
* ApiQueryBase::prefixedTitlePartToKey(), deprecated in 1.35, has been removed.
  Use ::parsePrefixedTitlePart() instead.
* ExternalStoreDB::getSlave(), deprecated in 1.34, has been removed. Use
  ExternalStoreDB::getReplica() instead.
* ChangesListSpecialPage::checkStructuredFilterUiEnabled() and
  SpecialWatchlist::checkStructuredFilterUiEnabled() now support UserIdentity
  as the only argument. Passing Config argument was deprecated in 1.34.
* DatabaseUpdater::ifNoActorTable(), deprecated in 1.35, has been removed. Use
  ::ifTableNotExists() instead.
* MediaWiki\Revision\RevisionStoreFactory::getRevisionStore was documented
  to allow passing bool true as a dbDomain, this is no longer possible,
  because that is an invalid value for a dbDomain.
* LinkHolderArray::__construct() had its signature changed. The class was marked
  internal in 1.35.
* SpecialMute::isTargetBlacklisted(), deprecated in 1.35, has been removed. Use
  ::isTargetMuted() instead.
* WebRequest::checkUrlExtension(), deprecated in 1.35, has been removed.
* ContentHandler::cleanupHandlersCache(), deprecated in 1.35, has been removed.
* SpecialVersion::getExtAuthorsFileName, deprecated in 1.35, has been removed.
  Use MediaWiki\ExtensionInfo::getAuthorsFileName.
* SpecialVersion::getExtLicenseFileName, deprecated in 1.35, has been removed.
  Use MediaWiki\ExtensionInfo::getLicenseFileNames.
* CategoryPage::getCategoryViewerClass and ::setCategoryViewerClass, deprecated
  in 1.35, have been removed.
* SqlBlobStore::getLegacyEncodingConversionLang(), deprecated in 1.34, has been
  removed.
* wfCanIPUseHTTPS(), deprecated in 1.37, has been removed.
* wfGetScriptUrl(), deprecated in 1.35, has been removed.
* The following methods of Database class, are no longer stable to override:
  - ::implicitOrderby()
  - ::selectSQLText()
  - ::bitNot()
  - ::bitAnd()
  - ::bitOr()
  - ::buildConcat()
  - ::buildGreatest()
  - ::buildLeast()
  - ::buildSubstring()
  - ::buildStringCast()
  - ::buildIntegerCast()
  - ::tableName()
  - ::addIdentifierQuotes()
  - ::buildLike()
  - ::limitResult()
  - ::unionSupportsOrderAndLimit()
  - ::unionQueries()
  - ::conditional()
  - ::strreplace()
  - ::timestamp()
  - ::getInfinity()
  - ::setTableAliases()
  - ::setIndexAliases()
  - ::buildGroupConcatField()
* SpecialUnblock::processUnblock(), deprecated in 1.36, has been removed. Use
  UnblockUser instead.
* wfLocalFile() and wfFindFile(), deprecated in 1.34, have been removed.
* Maintenance script resetUserTokens.php, deprecated in 1.27, has been removed.
* These methods in Database have been removed without deprecation as they are
  not used outside core. Users should override corresponding methods in
  SQLPlatform instead:
  - Database::doInsert -> SQLPlatform::insertSqlText
  - Database::doDropTable -> SQLPlatform::dropTableSqlText
  - Database::doRollback -> SQLPlatform::rollbackSqlText
  - Database::doSavepoint -> SQLPlatform::savepointSqlText
  - Database::doReleaseSavepoint -> SQLPlatform::releaseSavepointSqlText
  - Database::doRollbackToSavepoint -> SQLPlatform::rollbackToSavepointSqlText
* The following protected methods of Database class have been removed without
  deprecation as they are not used outside core. Users should call
  corresponding methods in SQLPlatform:
  - Database::makeInsertLists -> SQLPlatform::makeInsertLists
  - Database::isFlagInOptions -> SQLPlatform::isFlagInOptions
  - Database::normalizeOptions -> SQLPlatform::normalizeOptions
  - Database::fieldNameWithAlias -> SQLPlatform::fieldNameWithAlias
  - Database::isTransactableQuery -> SQLPlatform::isTransactableQuery
* $wgCanonicalNamespaceNames no longer includes custom namespaces defined using
  $wgExtraNamespaces. Extensions should use the NamespaceInfo service instead
  of accessing this configuration setting directly.
* The following hook, deprecated in 1.35, has been removed:
     - ParserGetVariableValueVarCache: ParserGetVariableValueVarCacheHook
* The $variableCache parameter to the ParserGetVariableValueSwitch hook is
  no longer used; non-standard use of this parameter has been deprecated since
  1.35.
* These methods have been moved from IDatabase to IMaintainableDatabase:
  - IDatabase::fieldExists -> IMaintainableDatabase::fieldExists
  - IDatabase::indexExists -> IMaintainableDatabase::indexExists
  - IDatabase::tableExists -> IMaintainableDatabase::tableExists
* DBConnRef doesn't accept live connection in constructor anymore.
  Only parameters for getting connection should be provided.
* IDatabase::getTopologyRootPrimary() was removed.
* User::blockedBy(), deprecated since 1.38, has been removed.
* User::getBlockId(), deprecated since 1.38, has been removed.
* AlphabeticPager::getOrderTypeMessages(), unused since 1.13, has been removed
  without deprecation.

=== Deprecations in 1.39 ===
* PageProps::getInstance(), deprecated since 1.38, emits deprecations warnings.
* The global function wfGetDB() has been deprecated. Use
  LoadBalancer::getConnection() instead.
* SpecialRedirectWithAction::__construct without SearchEngineFactory argument
  will now emit a deprecation notice.
* Use of the SiteStatsUpdate constructor has been deprecated in favor of
  the ::factory() method.
* AuthManager::checkAccountCreatePermissions has been deprecated. Use
  AuthManager::authorizeCreateAccount or AuthManager::probablyCanCreateAccount
  instead.
* Title::getSelectFields() has been deprecated in favor of
  PageStore::newSelectQueryBuilder()
* Title::newFromTitleValue(), deprecated since in 1.34, now emits deprecation
  warnings. Use ::newFromLinkTarget() instead.
* ExtensionRegistry::readFromQueue() has been marked @internal. Extensions
  should use ExtensionProcessor instead.
* Processor::getExtraAutoloaderPaths() and
  ExtensionProcessor::getExtraAutoloaderPaths() have been deprecated, use get
  getExtractedAutoloadInfo() instead.
* The following global functions are deprecated in favor of the listed UrlUtils
  methods.
  - wfExpandUrl -> UrlUtils::expand
  - wfGetServerUrl -> UrlUtils::getServer
  - wfAssembleUrl -> UrlUtils::assemble
  - wfRemoveDotSegments -> UrlUtils::removeDotSegments
  - wfUrlProtocols -> UrlUtils::validProtocols
  - wfUrlProtocolsWithoutProtRel -> UrlUtils::validAbsoluteProtocols
  - wfParseUrl -> UrlUtils::parse
  - wfExpandIRI -> UrlUtils::expandIRI
  - wfMatchesDomainList -> UrlUtils::matchesDomainList
  These methods are exact replacements except that
  1) they return null instead of false or empty string on error (where
     applicable);
  2) UrlUtils::validProtocols does not take a parameter (documentation said not
     to pass one to wfUrlProtocols anyway);
  3) they use type hints (don't try passing null instead of string, etc.).
* MaintainableDBConnRef is deprecated, use DBConnRef instead.
* Loading DefaultSettings.php is deprecated. To get default values of main
  config settings, use MainConfigSchema::listDefaultValues() or
  MainConfigSchema::getDefaultValue().
* AbstractContent::getRedirectChain() and
  AbstractContent::getUltimateRedirectTarget() are now emitting deprecation
  warnings (T296430).
* (T244138) QueryPage::getSQL() is deprecated. Instead QueryPage::getQueryInfo()
  should be overridden.
* Calling new JobRunner() directly without $serviceOptions now emits
  deprecation warnings. Use MediaWikiServices::getInstance()->getJobRunner()
  instead.
* Passing an array of targets to Article::getRedirectHeaderHtml() is
  deprecated. Supply a single redirect target instead (T296430).
* The following Less mediawiki.mixins have been deprecated:
  - .animation()
  - .animation-delay()
  - .transform-rotate()
* Skin::getAction is deprecated. Use IContextSource::getActionName instead.
* User::getOption, deprecated since 1.35, now emits deprecation warnings.
  Use UserOptionsLookup::getOption instead.
* ILBFactory::forEachLB() is deprecated. Use ::getAllLBs().
* LoadBalancer::forEachOpenConnection() and ::forEachOpenPrimaryConnection()
  are deprecated without replacement.
* The following classes were moved from the root namespace to the
  MediaWiki\ResourceLoader namespace, the old names becoming deprecated aliases:
  ResourceLoader, MessageBlobStore, VueComponentParser.
* The following classes had the "ResourceLoader" prefix stripped while being
  moved to the MediaWiki\ResourceLoader namespace, the old names becoming
  deprecated aliases: DerivativeResourceLoaderContext,
  ResourceLoaderCircularDependencyError, ResourceLoaderClientHtml,
  ResourceLoaderCodexModule, ResourceLoaderContext, ResourceLoaderFileModule,
  ResourceLoaderFilePath, ResourceLoaderForeignApiModule, ResourceLoaderImage,
  ResourceLoaderImageModule, ResourceLoaderLanguageDataModule,
  ResourceLoaderLessVarFileModule, ResourceLoaderModule,
  ResourceLoaderMwUrlModule, ResourceLoaderOOUIFileModule,
  ResourceLoaderOOUIIconPackModule, ResourceLoaderOOUIImageModule,
  ResourceLoaderOOUIModule, ResourceLoaderSiteModule,
  ResourceLoaderSiteStylesModule, ResourceLoaderSkinModule,
  ResourceLoaderStartUpModule, ResourceLoaderUserModule,
  ResourceLoaderUserOptionsModule, ResourceLoaderUserStylesModule,
  ResourceLoaderWikiModule.
* WANObjectCache::reap() and WANObjectCache::reapCheckKey() have been
  deprecated without replacement.
* The following methods in WikiRevision and their interfaces
  ImportableUploadRevision and ImportableOldRevision are deprecated:
  - ::getUserObj() → ::getUser()
  - ::setUserObj() → ::setUsername()
  - ::setUserIP() → ::setUsername()
* ObjectCache::addBusyCallback() is deprecated and non-functional.
* MWTimestamp::getHumanTimestamp(), deprecated in 1.26, now emits deprecation
  warnings.
* Article::viewRedirect(), deprecated in 1.30, now emits deprecation warnings.
* Parser::getFreshParser() is deprecated, use ParserFactory::getInstance().
* CoreParserFunctions::mwnamespace() is deprecated and emits deprecation
  warnings, use CoreParserFunctions::namespace() instead.
* Registering magic variables whose names include a colon is deprecated.
* User::blockedFor(), deprecated in 1.35, now emits deprecation warnings.
* Access to previously public properties AbstractBlock::$mExpiry,
  AbstractBlock::$mHideName, AbstractBlock::$mTimestamp, DatabaseBlock::$mAuto,
  and DatabaseBlock::$mParentBlockId, deprecated in 1.34, now emits deprecation
  warnings.
* Access to previously public properties User::$mBlock, User::$mBlockedby, and
  User::$mHideName, deprecated in 1.35, now emits deprecation warnings.
* JobQueueGroup::singleton() and ::destroySingletons(), deprecated in 1.37, now
  emit deprecation warnings.
* Title::getNotificationTimestamp(), deprecated in 1.35, now emits deprecation
  warnings.
* Global functions wfReadOnly and wfReadOnlyReason, deprecated in 1.38, now
  emit deprecation warnings.
* Overriding or calling DifferenceEngine::getDiffBodyCacheKey(), deprecated in
  1.31, now emits deprecation warnings.
* Access to previously public property WikiRevision::$fileIsTemp, deprecated in
  1.29, now emits deprecation warnings.
* wfQueriesMustScale() has been deprecated and emits deprecation warnings.
* ContextSource::getStats(), RequestContext::getStats(), and
  DerivativeContext::getStats(), deprecated in 1.27, now emit deprecation
  warnings.
* ManualLogEntry::setTags(), deprecated in 1.33, now emits deprecation warnings.
* WikiRevision::downloadSource(), deprecated in 1.31, now emits deprecation
  warnings.
* DifferenceEngine::textDiff(), deprecated in 1.32, now emits deprecation
  warnings.
* FormatMetadata::flattenArrayContentLang(), deprecated in 1.36, now emits
  deprecation warnings.
* SkinTemplate::getNameSpaceKey(), deprecated in 1.35, now emits deprecation
  warnings.
* EnqueueJob::newFromJobsByWiki(), deprecated in 1.33, now emits deprecation
  warnings.
* The following methods of the MWGrants class, all deprecated since 1.38,
  are now emitting deprecation warnings:
  - getValidGrants
  - getRightsByGrant
  - grantName
  - grantNames
  - getGrantRights
  - grantsAreValid
  - getGrantGroups
  - getHiddenGrants
  - getGrantsLink
  - getGrantsWikiText
* DataUpdate::runUpdates(), deprecated in 1.28, now emits deprecation warnings.
* CdnCacheUpdate::newFromTitles(), deprecated in 1.35, now emits deprecation
  warnings.
* Instantiating HTMLCacheUpdate class, deprecated in 1.34, now emits deprecation
  warnings.
* ISQLPlatform::tableNames() (implemented by IDatabase) is now deprecated.
  None of the tableName*() functions should be used by most users;
  if you absolutely must use raw SQL, write several tableName() calls instead.
* Language::isWellFormedLanguageTag() has been deprecated in favor of
  LanguageCode::isWellFormedLanguageTag().
* The PrevNextNavigationRenderer helper class has been deprecated in favor of
  the new PagerNavigationBuilder one.
* The methods IndexPager::getPagingLinks(), IndexPager::getLimitLinks() and
  IndexPager::buildPrevNextNavigation() have been deprecated in favor of
  IndexPager::getNavigationBuilder().
* Overriding the method IndexPager::makeLink() has been deprecated.
* ActorMigration is deprecated. The temporary table is no longer needed, the
  actor table can be directly joined to the revision table, which is simple
  enough to not need a helper class. See the methods of ActorMigration for more
  specific information on replacements. ActorMigrationBase remains usable for
  migrations in extension tables.

=== Other changes in 1.39 ===
* Dynamic default values are now applied before extension registration callbacks
  are run. This way, extensions have a complete view of config variables, with
  all defaults applied. For example, when the default value of X used to be
  static but becomes dynamic, and an extension reads the value of X in the
  registration callback, it will now continue to function as expected. In some
  cases however, this may cause an undesired change in behavior: if the dynamic
  default of setting X depends on the value of setting Y, and an extension
  changes Y, the changed value of Y will no longer affect the value of X.

== Compatibility ==

MediaWiki 1.39 requires PHP 7.4.3 or later and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

MariaDB is the recommended database software. MySQL, PostgreSQL, or SQLite can
be used instead, but support for them is somewhat less mature.

The supported versions are:

* MariaDB 10.3 or higher
* MySQL 5.7.0 or higher
* PostgreSQL 10 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.

= MediaWiki 1.38 =

== MediaWiki 1.38.7 ==

This is a security and maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.6 ===
* Localisation updates.
* (T333990) composer.json: Explicitly pin psr/http-message to 1.0.1.
* (T335203, CVE-2023-29197) SECURITY: Upgrading guzzlehttp/psr7
  (2.4.0 => 2.4.5).
* (T322944) Add Authorization to default $wgAllowedCorsHeaders.
* (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.
* (T330464) Work around argument corruption bug in XMLReader::open.
* (T313157) IndexPager: Also protect against $offset being 0.
* (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

== MediaWiki 1.38.6 ==

This is a security and maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.5 ===
* Localisation updates.
* (T325872) ChangeTags: Remove table name from condition.
* (T324895) MWCallbackStream: Add explicit $stream property.
* (T297031, T326039) PostgresUpdater: Move setDefault ahead of
  changeNullableField.
* Remove /images .htaccess rules that are no longer relevent.
* Disable php in .htaccess of images directory as a hardening measure.
* (T322583) Include missing message parameter in message.
* Fix phan error when Excimer is enabled.
* (T323373) Parser: Fix extractSections() behavior for PHP >= 8.0
* (T326021) Add matrix: to $wgUrlProtocols.
* (T326377) rdbms: Use DBConnRef in SelectQueryBuilder.
* api/en.json: api-help-datatype-expiry add missing 'may'.
* (T328222) Pass empty string to strlen() if schema is null for
  PostgresDatabase.
* (T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
* (T289926) SpecialRevisionDelete: Set default of '' for wpReason.
* (T155582, T328503) Fix XML dumps for content types with non-string
  getNativeData().
* (T314099) revisiondelete: Replace dynamic property Status::$itemStatuses.
* (T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
* (T292348) WikiImporter: do not fail if upload entry in dump lacks 'text'
  tag.
* (T295637) Add no to fallback chain of nb and nn.
* (T329484) API: Fix query+allimages user parameter description.
* (T330529) SpecialEditTags: Set default of '' for wpReason.
* (T330526) htmlform: Handle null from HTMLFormField::getDefault in
  multiselects.
* (T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted
  XFF headers.

== MediaWiki 1.38.5 ==

This is a security and maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.4 ===
* Localisation updates.
* Tests: Explicit cast to int in RandomImageGenerator test (php8 warnings).
* (T319000) WebInstaller: Don't try and run trim() on null.
* (T318753) Installer: Disable logo dropper for now.
* (T320864) When calling mail(), use an array for headers.
* (T311567) In ManualLogEntry, cast the comment to string.
* (T289926) api: Fix minor PHP 8.1 incompatibility in ApiOptions.
* (T322803) SpecialBotPasswords: Don't pass null to trim().
* (T323082) Upgrading wikimedia/xmp-reader (0.8.1 => 0.8.5).
* Language: Handle ronna and quetta.
* PostgresUpdater: Remove trailing space from 'user_id ' column.
* (T304515) LCStoreStaticArray: atomically replace the cache file.
* (T324890, T324891, T324901) Parser: Allow dynamic properties on PHP 8.2.
* (T324910) On pages using multi-content revisions, the raw content of a
  specific slot can be retrieved using the action=raw&slot=<role-name> query
  parameters.
* (T322637) SECURITY: sqlite should not create DB file world-readable.

== MediaWiki 1.38.4 ==

This is a maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.3 ===
* Fix missing use statement from backport of fix for T307278.

== MediaWiki 1.38.3 ==

This is a security and maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.2 ===
* Localisation updates.
* (T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
* (T311559) SpecialListFiles: user parameter isn't always present.
* (T311561) ImageListPager: Don't call htmlspecialchars() on null.
* (T311920) SpecialBlockList: Prevent passing null to trim().
* (T311921) SpecialUserrights: Don't pass null to str_replace.
* (T311570) SpecialWithoutInterwiki: Don't pass null through to
  Title::capitalize().
* (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser.
* (T311360) RecentChange: Straight join to actor table when needed.
* (T311360) RecentChange: Make join to comment table also straight.
* Remove messages in en-gb.json.
* (T312519, T312520) Parser::extensionSubstitution() Don't run substr() on null.
* (T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
* (T312302) SpecialRedirect: Don't pass null to explode.
* RemoveInvalidEmails: Fix quoting for postgres.
* (T312678) import: UploadSourceAdapter::stream_read() don't pass null to
  strlen().
* (T312300) SpecialDiff: Don't pass null to explode().
* (T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
* (T289926) Handle null passed to wfShorthandToInteger() and Html::element().
* (T289926) Ensure that strlen() does not get passed a (valid) null.
* (T312301) SpecialDiff: Don't pass null to trim().
* Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
* (T289926) Ensure we don't pass null to mb_strlen.
* (T312305, T311572, T311571, T311578) HTMLForm: Null coalescence in trim()
  calls.
* (T289926) site: Consistently return null from Site::getDomain().
* (T307304, T289879) filebackend,jobqueue: Add signature for
  FilterIterator::accept().
* (T304559) Use page ID from parent revision, improve logging.
* (T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
* Add application/vnd.ms-opentype to MIME list.
* Allow composer/installers plugin in composer.json.
* (T313663) Make ReadOnlyModeTest work in php8.
* (T313663) Make HandlerTestTrait compatible with php8.1.
* (T313663) [php8] Make DeletePageTest stop giving warnings on php8.1.
* Change type hints for BatchRowIterator and NotRecursiveIterator for
  compatibility with PHP 8.1.
* (T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
* (T313663) parser: Mock WikiPage::getContentModel in ParserCacheTest to fix
  php8.1.
* (T313663) [php8.1] Make WikiImporterFactoryTest use better mock for
  ImportSource.
* Fix tests so getName() doesn't return null.
* (T313663) [php8] Don't use strlen on potentially null string.
* (T313663) [php8.1] Suppress test warning about providing null.
* (T313663) [php8.1] mock User::getTitleKey() in DeaultPreferencesFactoryTest.
* (T313663) Parser will use current timestamp instead of null if passed a
  RevisionRecord that does not have a timestamp.
* (T313663) Add explicit null check for $sha in FileBackend [php8.1].
* (T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
* (T313663) Mock UserOptionsManager::getOption for php8.1.
* (T289879, T289926) Get rid of warnings on PHP 8.1.
* (T313663) Check for null return of preg_replace in MediaWikiTitleCodec.
* (T313663) cast db name to string when checking if it is read only [php8.1].
* (T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
* (T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
* (T313663) Mock User::getTitleKey in SpecialPreferencesTest [php 8.1].
* (T314096) Migrate use of ${var}-style string interpolation.
* (T314099) preprocessor: Add missing field declarations.
* (T313663, T313662) Make default value for optional args {{PAGESINCAT:..}} be
  '' not null.
* (T313663) [php8.1] Mock out getLocalDomainID for WatchedItemStore tests.
* (T313663) Suppress warnings for the null test of addIdentifierQuotes.
* (T314225) SpecialCategories: Null coalescene $par.
* (T314099) User: Allow dynamic properties on PHP 8.2.
* (T314404) SpecialGoToInterwiki: Null coalescene $par.
* (T314397) SpecialBlock: Better handle null in getTargetUserTitle.
* (T314099) phpunit: Fix trivial dynamic property usages in tests.
* (T314405) UploadStash: Check if us_prop is set in the fileMetadata.
* (T313663) Make ChangesListSpecialPageTest cast to string for php 8.1.
* (T313663) Do not test giving a null fragment to Title::makeTitle.
* (T314550) SpecialMergeHistory: Set timestamp to '' if no mergepoint.
* (T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
* (T313663) Cast results of Sqlite test to string [php 8.1].
* (T314208) Set $wgServer for HttpRequestFactoryTest to prevent warnings on
  php8.1.
* (T314208, T297082) phpunit: Fallback to global default user options.
* (T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
* Fix a couple deprecation warnings in the installer under PHP 8.1.
* api: Add rel=nofollow to help examples.
* (T307613) Validate length of user email on Special:ChangeEmail/
  Special:CreateAccount.
* (T314226) LoginSignupSpecialPage: Check if $value is a string before length.
* (T314824) tests: Update parser test after i18n change.
* (T313663, T296083) context: Replace deprecated User::getOption.
* (T295958, T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
* (T314906, T314907) SpecialBlock: Set defaults for wpPageRestrictions and
  wpNamespaceRestrictions.
* (T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
* (T315892) composer.json: Pin phpunit to 8.5.28.
* (T313663) Do not compare byte-for-byte of serialized items in tests [php8.1].
* objectcache: avoid php 8.1 argument type warnings in
  genericKeyFromComponents().
* (T317750) session: Fix broken SessionTest case due to PHPUnit dependency
  change.
* ManualLogEntry: Don't pass null to trim() as PHP 8.1 whines.
* (T313663) Add a null check VueComponentParser to prevent php8.1 issues.
* (T313049) Bump wikimedia/parsoid to v0.15.1.
* (T318754) WebInstallerOptions::addPersonalizationOptions(): Close fieldset.
* (T318460) SpecialChangeEmail: Set default for returntoquery.
* (T318307) Update docs for HTMLFormField::validate() to permit all data types.
* (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
  in an IP range check on Special:Contributions.
* (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
  of hidden users.
* (T307278, CVE-2022-41766) SECURITY: On action=rollback the message
  "alreadyrolled" can leak revision deleted user name.

== MediaWiki 1.38.2 ==

This is a security and maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.1 ===
* Localisation updates.
* (T309426) Repair language selector for SVGs.
* (T310013) Fix default value for $wgShowEXIF and $wgUsePathInfo.
* (T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
* (T308473) SECURITY: Escape contributions-title msg for use within page title.
* (T311272) Call parent constructor of AddSite maintenance script first.
* MediaWiki: Don't eagerly initialize action name.
* (T311384, CVE-2022-27776) Updated guzzlehttp/guzzle from 7.4.1 to 7.4.5.
* (T289926) Avoid passing null to trim() in SkinTemplate.
* (T289879) Address deprecations for PHP 8.1.
* (T311473) rollbackEdits: Pass user identity to RollbackPage.
* Upgrade wikimedia/remex-html from 3.0.1 to 3.0.2.
* (T311551) ShellboxClientFactory::getUrl(): Check if $this->key is null.
* (T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
* (T311569) FileBackend::isStoragePath() Handle being passed null.
* (T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
* (T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
* (T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
* Upgrade wikimedia/common-passwords from 0.3.0 to 0.4.0.

== MediaWiki 1.38.1 ==

This is a maintenance release of the MediaWiki 1.38 branch.

=== Changes since MediaWiki 1.38.0 ===
* (T309860) Add justinrainbow/json-schema to vendor.
* (T309933) Drop PHP 7.2 support in MediaWiki 1.38; require 7.3.19.

== MediaWiki 1.38.0 ==

=== Changes since MediaWiki 1.38.0-rc.1 ===
* Localisation updates.
* (T309114) LocalFile::prerenderThumbnails: Limit the number of thumbnail
  jobs triggered.
* (T305779) phpunit: Support setting skin context in BundleSizeTest subclasses.
* (T309028) SECURITY: ApiEditPage: update title after redirects.
* (T308967) notifications: prevent log spam when invalid user object listed.
* composer: Lock Parsoid version to specific 0.15.0 release.
* (T306362, T308680) change-your-logo.svg: Resize to 135px square, re-crush,
  and manually minify.

== MediaWiki 1.38.0-rc.1 ==

=== Changes since MediaWiki 1.38.0-rc.0 ===
* Localisation updates.
* (T305028) Undeprecate EditPage::$textbox2.
* (T305635) LogActions is a map, not a list.
* (T306721) Add wikimedia/equivset to vendor; needed by bundled AbuseFilter.
* (T307284) Simplify TransactionManager::pendingWriteQueryDuration.
* (T307307) Add symfony/yaml to vendor.
* Fix old_name in UserLogoutComplete hook.
* REST: don't send stack trace in error responses.
* (T307998) SessionManager: stop storing an ObjectFactory instance.
* (T193565) UserGroupManager: Fix dbDomain in addUserToGroup() deferred update.

== Upgrading notes for 1.38 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.29.

Some specific notes for MediaWiki 1.38 upgrades are below:
* (T191740) The AbuseFilter extension is now bundled with MediaWiki. This is an
  anti-abuse feature that lets privileged users to set specific actions to be
  taken when actions by users, such as edits or file uploads, match certain
  criteria.
* (T232948) The Math extension is now bundled with MediaWiki. This is a content
  feature that lets users create mathematical formulæ, written in a sub-set of
  LaTeX and rendered in MathML with a fallback SVG image. By default, it will
  use Wikimedia's mathoid service to render each formula, but local rendering
  can be set up for network isolation or performance.
* (T191743) The Minerva skin is now bundled with MediaWiki. This is a simple,
  light-weight, and scalable skin that is particularly optimised for mobile use,
  and integrates well with the MobileFrontend extension (available separately),
  but can also be used as a regular desktop skin.

For notes on 1.37.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.38 ===

==== New configuration ====
* (T297708) $wgMaxExecutionTimeForExpensiveQueries - This setting can be used to
  control the maximum execution time for several expensive query pages (e.g.
  RecentChanges and UserContribs).
* $wgBrowserFormatDetection – This setting allows overriding browsers' automatic
  detection and handling of formats. It's initially used to prevent auto-linking
  of possible telephone numbers in wiki pages' output in Safari on iOS; this can
  be re-enabled if you wish, or locally extended for other browsers' quirks.
* (T240685) $wgMetricsTarget, $wgMetricsFormat, $wgMetricsPrefix - These provide
  configuration for a new MetricsFactory service with support for the dogstatsd
  format, intended for integration with Prometheus integration.
* $wgGroupInheritsPermissions – This setting allows inheriting permissions, both
  granted and revoked, from another group.
* $wgForeignApiRepos – ForeignAPIRepo now has a apiMetadataExpiry option to
  control for how long file metadata is cached. Additionally the default changed
  from 1 hour to 4 hours.
* $wgSkinsPreferred – This lets you set a list of preferred skins to be listed
  higher in Special:Preferences.
* $wgWikiFarmSettingsDirectory – A directory that contains site-specific
  configuration files. Setting this will enable multi-tenant ("wiki farm")
  mode, causing site-specific settings to be loaded based on information from
  the web request. EXPERIMENTAL.
* $wgWikiFarmSettingsExtension – The file extension to be used when looking up
  site-specific settings files in $wgWikiFarmSettingsDirectory, such as 'json'
  or 'yaml'. EXPERIMENTAL.
* $wgWikiFarmSiteDetector – A callback function that returns the name of the
  wiki for the current request. This is used in multi-tenant ("wiki farm")
  mode to determine which settings file to load from
  $wgWikiFarmSettingsDirectory. EXPERIMENTAL.
* $wgEnableRemoteBagOStuffTests – This replaces the environment variable
  PHPUNIT_USE_BAGOSTUFF.
* (T230211) $wgForceDeferredUpdatesPreSend – Force deferred updates to be run
  before sending a response to the client, instead of attempting to run them
  after sending the response. Setting this to true is useful for end-to-end
  testing, to ensure that the effects of a request are visible to any subsequent
  requests, even if they are made immediately after the first one. Note however
  that this does not ensure that database replication is complete, nor does it
  execute any jobs enqueued for later.
* $wgTemplateLinksSchemaMigrationStage – Templatelinks table schema migration
  stage, for normalizing tl_namespace and tl_title fields.

==== Changed configuration ====
* $wgStyleDirectory and $wgExtensionDirectory – These are now set later, so can
  no longer be used within LocalSettings.php unless explicitly set in that file.
* $wgFileBackends – This setting no longer takes 'fileJournal' as an option.
* $wgMaxImageArea - This setting may now be set to false to disable size.
  checking before scaling. Extensions can still override its value by using the
  BitmapHandlerCheckImageArea hook.
* $wgAjaxUploadDestCheck – This is now deprecated, and act as always-true.
* $wgInterwikiCache – This no longer supports the string value for CDB files.
* $wgParserOutputHooks – This is now deprecated; adjustments using this should
  be done with OutputPageParserOutputHook instead. (T292321)
* $wgExternalStores – This is newly documentated in
  includes/externalstore/README.md.

==== Removed configuration ====
* $wgShellLocale - This setting has been removed as it was a flawed solution to
  the problem of locale dependence, MediaWiki will now always set a locale of
  C.UTF-8 or C and works around the remaining problems of the C locale by not
  using escapeshellarg. This follows the direction of PHP 8.0, which sets a
  locale of C by default instead of respecting LC_CTYPE.
* $wgLoggedOutMaxAge - Experiment removed, originally added in 1.35. (T293848)
* $wgIncludejQueryMigrate - Deprecated in 1.36. We only support jQuery v3.
* $wgUseCategoryBrowser - This experimental feature has been removed. If you
  still need to use this feature, please see [[mw:Extension:CategoryExplorer]].
* $wgStyleSheetPath - alias for $wgStylePath, deprecated since 1.3 (2004).

=== User-facing changes in 1.38 ===
* (T284921) The "auto-number headings" feature was removed following a
  consultation, due to performance reasons.

=== New operator/developer features in 1.38 ===
* EXPERIMENTAL: The environment variable MW_CONFIG_FILE can be used to specify
  the location of the settings file. This allows alternative settings files to
  be loaded depending on the environment. Settings files may be given as PHP
  files like the traditional LocalSettings.php file, or they may use JSON or
  YAML format.
  See https://www.mediawiki.org/wiki/Manual:YAML_settings_file_format
* Added a deleteUserEmail maintenance script - This file enables the deletion of
  a given user's associated email address. It can be helpful for
  privacy-preserving operations.
* The description array for constructing an HTMLForm now can use 'disable-if' to
  disable fields on condition easily, supported expressions are the same as
  'hide-if'.
* There is a new interface, IForeignRepoWithMWApi, to allows you to mark file
  repos provided by an extension as supporting making API queries against the
  foreign file repo so that extensions like TimedMediaHandler that depend on
  this can stop hard-coding looking for specific class names.
* Added EXPERIMENTAL support for an easy to configure multi-tenant ("wiki
  farm") mode:
  Settings for each site can be placed in a directory specified by
  $wgWikiFarmSettingsDirectory. Site detection is controlled by
  $wgWikiFarmSiteDetector and defaults to the requested host name.
  For example, setting $wgWikiFarmSettingsDirectory = "sites" would cause
  the settings for wiki.example.com to be loaded from
  "sites/wiki_example_com.yaml".
  WARNING: YAML files under the web root may be accessible to browsers, please
  take appropriate measures to protect them from access via HTTP.
* Running QUnit tests for an individual test suite module is possible with
  `grunt qunit --qunit-component={componentName}`, where {componentName} is
  "MediaWiki" to run core's QUnit tests or the skin or extension name.
* The 'mediawiki.mixins' module now has a `.user-select()` Less mixin.

=== External library changes in 1.38 ===

==== New external libraries ====
* symfony/yaml was promoted from development-only.
* justinrainbow/json-schema was promoted from development-only.

==== Changed external libraries ====
* Updated OOUI from v0.42.0 to v0.43.2.
* Updated Vue from 2.6.11 to 3.2.23.
* Updated WVUI from v0.3.0 to v0.4.0.
* Updated composer/semver from 3.2.5 to 3.2.6.
* Updated guzzlehttp/guzzle from 7.2.0 to 7.4.5.
* Updated pear/mail_mime from 1.10.9 to 1.10.11.
* Updated pear/net_smtp from 1.9.2 to 1.10.0.
* Updated psr/log from 1.1.3 to 1.1.4.
* Updated psy/psysh from 0.10.5 to 0.11.1.
* Updated symfony/polyfill-php80 from 1.23.1 to 1.25.0.
* Updated wikimedia/assert from 0.5.0 to 0.5.1.
* Updated wikimedia/cdb from 1.4.1 to 2.0.0.
* Updated wikimedia/ip-utils from 3.0.2 to 4.0.0.
* Updated wikimedia/minify from 2.2.4 to 2.2.6.
* Updated wikimedia/object-factory from 3.0.2 to 4.0.0.
* Updated wikimedia/parsoid from v0.14.0-a14 to v0.15.0.
* Updated wikimedia/purtle from 1.0.7 to 1.0.8.
* Updated wikimedia/request-timeout from 1.1.0 to 1.2.0.
* Updated wikimedia/shellbox from 2.0.0 to 3.0.0.
* Updated wikimedia/wrappedstring from 3.2.0 to 4.0.1.
* Updated wikimedia/remex-html from 3.0.1 to 3.0.2.
* Updated wikimedia/common-passwords from 0.3.0 to 0.4.0.

===== Changed development-only external libraries =====
* Updated QUnit from 2.16.0 to 2.18.0.
* Updated composer/semver from 3.5.4 to 3.5.5.
* Updated composer/spdx-licenses from 1.5.4 to 1.5.5.
* Updated doctrine/dbal for PHP < 7.3 from 2.10.4 to 2.13.6.
* Updated doctrine/dbal for PHP >= 7.3 from 3.0.0 to 3.1.5.

==== Removed external libraries ====
* jquery.jStorage, deprecated since MW 1.28; use "mediawiki.storage" instead.

=== Action API changes in 1.38 ===
* New `deletetalk` parameter on action=delete that allows you to delete the
  associated talk page of a subject page.
* New `variant` parameter for all API actions, for specifying language variant
  (akin to the existing `variant` parameter for index.php). Task T117549.

=== Languages updated in 1.38 ===
MediaWiki supports over 400 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T292166) Updated namespace names for the Lombard language.
* (T299201) Changed the autonym of the Angika language to अंगिका
* (T298309) Changed the autonym of the Abkhaz language to аԥсшәа
* (T302972) Changed the autonym of the Kirundi language to ikirundi
* (T220303) Show numbered lists with Burmese numerals in relevant languages
* (T291899) Added language support for Xiang Chinese (hsn).
* (T292612) Added language support for S'gaw Karen (ksw).
* (T293656) Added language support for Farefare (gur).
* (T294729) Added language support for Pa'O (blk).
* (T296286) Added language support for Skolt Sámi (sms).
* (T296612) Added language support for Makhuwa (vmw).
* (T296707) Added language support for Ga (gaa).
* (T297073) Added language support for Nanai (gld).
* (T297074) Added language support for Nawdm (nmz).
* (T298075) Added language support for Northern Thai (nod).
* (T298182) Added language support for Cape Verdean Creole (kea).
* (T298385) Added language support for Nheengatu (yrl).
* (T299329) Added language support for Fon (fon).
* (T300474) Added language support for Nkore (nyn).
* (T302556) Added language support for Pannonian Rusyn (rsk).

=== Breaking changes in 1.38 ===
* (T291008) The IP class, deprecated since 1.35 in favor of the IPUtils library,
  has been removed. The IP related regexes which were also deprecated in favor
  of the IPUtils library were also removed, IPUtils::RE_* should be used
  instead.
* (T293043) The MediaWikiIntegrationTestCase class alias 'MediaWikiTestCase' has
  been removed.
* LinkCache::singleton(), deprecated since 1.28, has been removed.
* RepoGroup::singleton(), ::destroySingletons() and setSingleton(), all
  deprecated since 1.34, have been removed.
* The following methods from FileDeleteForm were removed:
  - ::__construct (the class is no longer newable)
  - ::execute()
  - ::haveDeletableFile()
  Use FileDeleteAction instead.
* MessageCache::singleton(), deprecated since 1.34, has been removed.
* LockManagerGroup::singleton() and ::destroySingletons(), both deprecated since
  1.34, have been removed.
* FileBackendGroup::singleton() and ::destroySingletons(), both deprecated since
  1.35, have been removed.
* TemplateParser used to support disabling the cache with a boolean parameter in
  its constructor. This was deprecated in 1.35 and has now been removed.
* The ArticleUndeleteLogEntry hook, deprecated in 1.37, was removed.
* The BeforeResetNotificationTimestamp hook, deprecated in 1.37, was removed.
* The global function mimeTypeMatch() has been removed without a deprecation
  process.
* The following JavaScript mw.config keys have been removed:
  - $wgCookiePrefix
  - $wgCookieDomain
  - $wgCookiePath
  - $wgCookieExpiration
  Use mw.cookie from the mediawiki.cookie module instead.
* The signature of PageUpdater::markAsRevert method was changed. It has never
  been used outside of MediaWiki core.
* If you want to use interwiki titles with HTMLTitleTextField, you now need to
  pass 'interwiki' => true. In 1.37, the default behavior was to let interwiki
  title through by default, logging a deprecation warning.
* The `UndeleteForm::undelete` hook, deprecated in 1.37, was removed.
* BagOStuff::setDebug(), deprecated since 1.36, has been removed.
* The `jquery.mw-jump` ResourceLoader module was removed.
* The `wgForeignUploadTargets` and `wgEnableUploads` configuration values were
  removed from mw.config. They had previously been documented as being included
  for internal use by the mediawiki.ForeignUpload module.
*The `&$hasHistory` parameter to WikiPage::getAutoDeleteReason() and
  ContentHandler::getAutoDeleteReason() was hard-deprecated with no replacement.
* Several Skin methods, which have emitted deprecation warnings since 1.36, have
  been removed. These include:
  - Skin::privacyLink()
  - Skin::aboutLink()
  - Skin::disclaimerLink()
    For these, instead use Skin::footerLink() to alter footer links.
  - Skin::getLogo()
    For this, use ResourceLoaderSkinModule::getAvailableLogos() instead.
  - Skin::getIndicatorsHTML()
    For this, use Skin::getIndicatorsData() instead.
  - Skin::subPageSubtitle()
    For this, use Skin::prepareSubtitle() instead.
  - Skin::makeVariablesScript()
    For this, use ResourceLoader::makeInlineScript() instead.
  - Skin::getAllowedSkins()
  - Skin::getSkinNames()
    For these, use SkinFactory::getAllowedSkins() or ::getInstalledSkins().
  - Skin::makeUrl()
  - Skin::getSearchLink()
  - Skin::mainPageLink()
* Parser::getUser and ::mUser, as well as ParserOptions::getUser, deprecated
  since 1.37, has been removed.
* Parser::$mStripState, deprecated in 1.35, has been made private. Use
  Parser::getStripState() instead.
* The following deprecated features in blocks were removed:
  - DatabaseBlock constructor 'byText' property with blocker's name, use 'by'
    property with UserIdentity value instead.
  - DatabaseBlock constructor 'by' property with blocker's ID, use 'by' property
    with UserIdentity value instead.
  - DatabaseBlock::isWhitelistedFromAutoblocks, use ::isExemptedFromAutoblocks.
  - DatabaseBlock::setBlocker now only accepts UserIdentity.
  - AbstractBlock::getTargetAndType and ::getTarget, use ::getTargetName,
    ::getTargetUserIdentity and ::getType instead
* The following functions, emitting deprecations since 1.37, have been removed:
  - Title::isWatchable()
  - WatchAction::doWatchOrUnwatch(), WatchAction::doWatch(),
    WatchAction::doUnwatch(), WatchAction::getWatchToken()
  - User::isWatched(), User::isTempWatched(), User::addWatch(),
    User::removeWatch()
* ParserOptions::setTidy() that had no effect and was deprecated since 1.35 has
  been removed.
* The "YAML" encoding option of EtcdConfig, has been removed without
  deprecation.
* The constant ApiBase::PARAM_VALUE_LINKS, deprecated since 1.35 has been
  removed.
* UserLoadOptions, UserSaveOptions and UserResetAllOptions hooks, deprecated
  since 1.37, were removed.
* The experimental FileJournal system has been removed without deprecation. This
  includes the FileJournal abstract class, its implementation classes
  DBFileJournal and NullFileJournal, various minor getters and setters, and the
  option for the wiki configuration $wgFileBackends.
* The return values for each `bind` function in checkboxHack.js has been changed
  from an object to a function. In addition, the `unbind` function has been
  removed. A deprecation process was assumed unnecessary as there were no known
  usages.
* File::getUser, ::getImageSize, ArchivedFile::getRawDescription, ::getUser,
  ::getRawUser and ::getRawDescription, deprecated since 1.37, has been removed.
* ShellboxHttpClient class has been removed without deprecation. It was an
  internal class used by ShellboxClientFactory.
* The following hard deprecated User methods have been removed:
  - ::resetIdByNameCache,
  - ::getStubThreshold,
  - ::matchEditTokenNoSuffix,
  - ::changeableByGroup,
  - ::changeableGroups,
  - ::isAllowUsertalk,
  - ::getRights
  - ::isAllowUsertalk
  - ::isIP,
  - ::isIPRange,
  - ::isValidUserName,
  - ::isUsableName,
  - ::isCreatableName,
  - ::getCanonicalName,
  - ::addAutopromoteOnceGroups,
  - ::getDefaultOptions,
  - ::getDefaultOption,
  - ::getOptions,
  - ::getBoolOption,
  - ::getIntOption,
  - ::setOption
  - ::listOptionKinds
  - ::getOptionKinds,
  - ::resetOptions,
  - ::getEffectiveGroups,
  - ::getAutomaticGroups,
  - ::getFormerGroups
  - ::isLoggedIn
  - ::getFirstEditTimestamp
  - ::getLatestEditTimestamp
* Http::$httpEngine, deprecated since 1.34, has been removed. The only available
  HTTP engine is now Guzzle. CurlHttpRequest and PhpHttpRequest classes were
  removed.
* The UserRightsProxy class was deprecated. Pass the correct domain to
  UserGroupManagerFactory instead.
* Parser option enableLimitReport was deprecated. The report is now generated
  post-parse and can be included by providing 'includeDebugInfo' option to
  ParserOutput::getText. Thus, ParserOptions::enableLimitReport and
  ::getEnableLimitReport methods were deprecated.
* Ajax action that was deprecated in 1.27 now has been removed.
* The following methods have been removed from IDatabase without deprecation as
  they were completely unused:
  - ::preCommitCallbacksPending()
  - ::pendingWriteRowsAffected()
  - ::getServerUptime()
  - ::maxListLen()
* The following deprecated methods have been removed from IDatabase:
  - ::aggregateValue() soft-deprecated since 1.33
  - ::getTopologyRootMaster() since 1.37
  - ::masterPosWait() since 1.37
  - ::dataSeek() soft-deprecated since 1.37
  - ::numFields() soft-deprecated since 1.37
  - ::fieldName() soft-deprecated since 1.37
  - ::onTransactionIdle() soft-deprecated since 1.32
  - ::getMasterPos() since 1.37
* DatabaseMysqlBase::fieldType() and DatabasePostgres::fieldType(), deprecated
  since 1.37, have been removed.
* Database::assertIsWritableMaster(), deprecated since 1.37, has been removed.
* ResultWrapper::getInternalResult(), soft-deprecated since 1.37 and
  ResultWrapper::unwrap(), deprecated since 1.37, have been removed.
* Language::AS_AUTONYMS, deprecated since 1.34, has been removed. You can use
  the LanguageNameUtils::AUTONYMS constant instead.
* Several Language class variables deprecated in 1.35 have been removed; they
  are each replaced by a constant, as listed after the arrow:
  - ::$mWeekdayMsgs → WEEKDAY_MESSAGES
  - ::$mWeekdayAbbrevMsg → WEEKDAY_ABBREVIATED_MESSAGES
  - ::$mMonthGenMsgs → MONTH_GENITIVE_MESSAGES
  - ::$mIranianCalendarMonthMsgs → IRANIAN_CALENDAR_MONTHS_MESSAGES
  - ::$mHebrewCalendarMonthMsgs → HEBREW_CALENDAR_MONTHS_MESSAGES
  - ::$mHebrewCalendarMonthGenMsgs → HEBREW_CALENDAR_MONTH_GENITIVE_MESSAGES
  - ::$mHijriCalendarMonthMsgs → HIJRI_CALENDAR_MONTH_MESSAGES
* wfIncrStats, deprecated since 1.36, has been removed.
* Profiler::profileIn and ::profileOut, deprecated in 1.33, has been removed.
* IEditObject::AS_CANNOT_USE_CUSTOM_MODEL, deprecated in 1.35, was removed.
* Several protected methods in EditPage were made private. None of these was
  used outside of EditPage itself. Since the class is not stable to extend,
  this change happened without a deprecation phase.
* The following public methods in EditPage, unused externally, were
  made private:
   - ::getCancelLink()
   - ::isSupportedContentModel()
   - ::getParentRevId()
* EditPage::setApiEditOverride() was marked as @internal for use by
  ApiEditPage only.
* SelectQueryBuilder::straightJoin() was renamed to straightJoinOption().
* The following deprecated methods have been removed from ILBFactory:
  - ::beginMasterChanges() since 1.37
  - ::commitMasterChanges() since 1.37
  - ::rollbackMasterChanges() since 1.37
  - ::hasMasterChanges() since 1.37
  - ::hasOrMadeRecentMasterChanges() since 1.37
* The "groupLoadsByDB" option to LBFactoryMulti has been removed. Consider using
  "groupLoadsBySection" instead.
* The following methods have been removed from ILoadBalancer without deprecation
  as they were completely unused:
  - ::waitForOne()
  - ::allowLagged()
  - ::forEachOpenReplicaConnection()
* The following deprecated methods have been removed from ILoadBalancer:
  - ::getMasterPos() since 1.37
  - ::finalizeMasterChanges() since 1.37
  - ::approveMasterChanges() since 1.37
  - ::beginMasterChanges() since 1.37
  - ::commitMasterChanges() since 1.37
  - ::runMasterTransactionIdleCallbacks() since 1.37
  - ::runMasterTransactionListenerCallbacks() since 1.37
  - ::rollbackMasterChanges() since 1.37
  - ::flushMasterSnapshots() since 1.37
  - ::hasMasterConnection() since 1.37
  - ::hasMasterChanges() since 1.37
  - ::lastMasterChangeTimestamp() since 1.37
  - ::hasOrMadeRecentMasterChanges() since 1.37
  - ::pendingMasterChangeCallers() since 1.37
  - ::forEachOpenMasterConnection() since 1.37
  - ::waitForMasterPos() since 1.37
* LoadBalancer::safeGetLag() which has been soft-deprecated since 1.34 has been
  removed.
* The following properties of the EditPage class, deprecated since 1.35, were
  made private:
  - ::$deletedSinceEdit
  - ::$lastDelete
  - ::$mTokenOk
  - ::$mTriedSave
  - ::$incompleteForm
  - ::$tooBig
  - ::$missingComment
  - ::$missingSummary
  - ::$allowBlankSummary
  - ::$autoSumm
  - ::$mParserOutput
  - ::$hasPresetSummary
  - ::$minoredit
  - ::$watchthis
  - ::$recreate
  - ::$nosummaryparentRevId
  - ::$editintro
  - ::$scrolltop
  - ::$markAsBot
* Special:ListFiles and Special:NewFiles no longer allows to search for parts of
  file names (option was not available for $wgMiserMode = true)
* DBAccessBase, deprecated since 1.37, has been removed.
* The UserNamePrefixSearch service no longer supports a UserIdentity parameter
  to search(), to check for a specific audience an Authority object is required.
* The methods CoreParserFunctions::register() and CoreTagHooks::register() have
  been marked @internal, and had a seconds parameter added. These methods are
  intended for use in Parser's constructor, and are not used by any known
  extension.
* LoadBalancer::openConnection(), deprecated since 1.34, has been removed.
* Skin::preloadExistence has been made private. There is no known usages outside
  of MediaWiki core.

=== Deprecations in 1.38 ===
* The MWGrants class is deprecated in favor of the new GrantsInfo and
  GrantsLocalization services.
* The global functions wfReadOnly() and wfReadOnlyReason() have been deprecated
  in favor of the ReadOnlyMode service.
* PageProps::getInstance() has been deprecated. Use
  MediaWikiServices::getPageProps() instead.
* User::setOption(), deprecated since 1.35, now emits deprecation warnings.
* Linker::formatComment(), ::formatLinksInComment(), ::commentBlock() and
  revComment() were deprecated. Use the new CommentFormatter service.
* Several Skin methods have been deprecated.
  - Skin::setSearchPageTitle(), Skin::getSearchPageTitle(). For these,
    use SpecialPage::newSearchPage() or associated user preference instead.
  - Skin::getSkinStylePath now triggers deprecation warnings. Direct string path
  should be used instead.
  - SkinTemplate::getPersonalToolsList(), deprecated since 1.35, now emits
  deprecation warnings.
  - In preparation for SkinTemplate::getPortletData becoming a private
    function, extending the method is no longer permitted. Use
    SkinTemplate::getTemplateData instead.
  - SkinTemplate::buildContentNavigationUrls is now deprecated. Skins can
    use the runOnSkinTemplateNavigationHooks method or the
    SkinTemplateNavigation__Universal hook if they need access to this data.
* Usage of several template data keys in QuickTemplate are now deprecated:
  - searchaction, poweredbyico, copyrightico
* DatabaseBlock::purgeExpired(), deprecated since 1.36, now emits deprecation
  warnings.
* The following methods from the User class now trigger deprecation warnings:
   - ::blockedBy
   - ::getBlockId
* Content::getParserOutput and AbstractContent::fillParserOutput was
  hard-deprecated, use ContentRenderer::getParserOutput instead. Extensions
  defining a content model should override ContentHandler::fillParserOutput.
* Title::newFromIDs and TitleFactory::newFromIDs have been hard deprecated. Use
  a PageSelectQueryBuilder from a PageStore instead.
* Content::getRedirectChain() and Content::getUltimateRedirectTarget() have been
  deprecated with no replacement because support for $wgMaxRedirect will be
  removed completely. See T296430 for more information.
* WikiPage::getRedirectTarget() has been deprecated. Use the equivalent
  RedirectLookup::getRedirectTarget() instead.
* Article::doDelete() was deprecated. Use WikiPage::doDeleteArticleReal if you
  only need to delete the article. If you also need things to happen with
  OutputPage, you may want to check the hooks in DeleteAction instead.
* Instantiating the MessageContent class now emits deprecation notices.
* Message::content() now triggers deprecation warnings.
* Parser::setDefaultSort(), Parser::getDefaultSort(), and
  Parser::getCustomDefaultSort() now trigger deprecation warnings. Use
  ParserOutput::{get,set}PageProperty('defaultsort') instead.
* The following methods from the ParserOutput class now emit deprecation
  warnings:
   - ::hideNewSection()      - use ::setHideNewSection()
   - ::preventClickjacking() - use ::{get,set}PreventClickjacking()
   - ::getProperty()         - use ::getPageProperty() (return value changed)
   - ::setProperty()         - use ::setPageProperty()
   - ::unsetProperty()       - use ::unsetPageProperties()
   - ::getProperties()       - use ::getPageProperties()
   - ::getCategoryLinks()    - use ::getCategoryNames()
   - ::setCategoryLinks()    - use ::setCategories()
   - ::addTrackingCategory() - use Parser::addTrackingCategory()
                               or TrackingCategories::addTrackingCategory()
   - ::addWarning()          - use ::addWarningMsg()
   - ::hasDynamicContent()   - use ::hasReducedExpiry()
* The following methods from the ParserOutput class were deprecated:
   - ::getFlag() - use ::getOutputFlag()
   - ::setFlag() - use ::setOutputFlag()
   - ::getAllFlags() - this method is now marked @internal
   - ::addJsConfigVars() - use ::setJsConfigVar() or ::appendJsConfigVar()
   - ::addOutputHook() / ::getOutputHooks() - these hooks should be migrated
     to use the OutputPageParserOutput hook instead
* The use of ParserOutput::setExtensionData() to overwrite previous values
  stored under a given key has been deprecated; use the new
  ::appendExtensionData() to collect multiple values in the ParserOutput rather
  than destructively updating stored values. (T300981)
* The signatures of the following methods from the ParserOutput class were
  narrowed, restricting the permitted argument types:
  - ::addModules() - if you formerly passed a string, pass an array with
     the string as the only element.
   - ::addModuleStyles() - if you formerly passed a string, pass an array
     with the string as the only element.
* Access to the following public or protected properties of OutputPage was
  deprecated; they will be made private or removed in a future release.
  Use accessor functions instead.
  - ::$mCategoryLinks
  - ::$mCategories
  - ::$mIndicators
  - ::$mHeadItems
  - ::$mModules
  - ::$mModuleStyles
  - ::$mJsConfigVars
  - ::$mTemplateIds
  - ::$mEnableClientCache
  - ::$mNewSectionLink
  - ::$mHideNewSectionLink
  - ::$mNoGallery
* The following methods were deprecated; use ::setPreventClickjacking(..)
  instead:
   - OutputPage::preventClickjacking()
   - OutputPage::allowClickjacking()
   - ImageHistoryList::preventClickjacking()
   - ImageHistoryPseudoPager::preventClickjacking()
   - ContribsPager::preventClickjacking()
* OutputPage::enableClientCache() was deprecated, because it is universally used
  to do the opposite -- use OutputPage::disableClientCache() instead.
* Sanitizer::removeHTMLtags() has been deprecated. Its output can include
  unbalanced or ill-formed HTML and thus external callers may be misled about
  how to safely incorporate its output into a page. It is recommended to use the
  new Sanitizer::removeSomeTags() method instead, which will always return
  balanced HTML.
* EventRelayerKafka was deprecated. To use $wgEventRelayerConfig with Kafka,
  add a similar class to your code.
* MediaWiki\Logger\Monolog\KafkaHandler was deprecated. Consider using
  $wgMWLoggerDefaultSpi with SyslogHandler, or to use Kafka, add a similar
  Monolog handler class to your code.
* Collation::singleton() and ::factory() now trigger deprecation warnings.
* The following methods in MWNamespace, all deprecated since 1.34, now emit
  deprecation warnings:
  - isTalk()
  - exists()
  - subjectEquals()
  - getCanonicalNamespaces()
  - getCanonicalName()
  - getCanonicalIndex()
  - getValidNamespaces()
  - isContent()
  - hasSubpages()
  - getContentNamespaces()
* Return values in the parameter $pageLang of the hook PageContentLanguage with
  other types than a Language object, deprecated since 1.33, now emmits
  deprecation warnings.
* Passing a db to BlockRestrictionStore::loadByBlockId() is deprecated.
  BlockRestrictionStoreFactory should be used to fetch a correct
  BlockRestrictionStore instead.
* All external access to ParserOutput and CacheTime classes properties will now
  emit deprecation warnings. Use getters and setters instead.
* The custom jQuery event `watchpage.mw` emitted on #ca-watch and #ca-unwatch is
  now deprecated in favour of the new `wikipage.watchlistChange` hook.
* The global function wfLogProfilingData() has been deprecated without a
  replacement. The logic has been moved to the MediaWiki class.
* The "trace" option of SectionProfiler has been deprecated.
* The PageArchive class has had several methods deprecated. The replacements are
  as follows:
   - Use UndeletePage instead of ::undeleteAsUser(), ::getFileStatus() and
     ::getRevisionStatus().
   - Use the respective methods of the new ArchivedRevisionLookup service
     instead of ::listRevisions, ::getRevisionRecordByTimestamp,
     ::getArchivedRevisionRecord, ::getPreviousRevisionRecord and
     ::getLastRevisionId.
   - Use ArchivedRevisionLookup::hasArchivedRevisions instead of ::isDeleted.
* PageUpdater::isUnchanged() has been deprecated, use wasRevisionCreated()
  instead.
* The `mediawiki.pager.tablePager` module was deprecated in favor of the more
  generic `mediawiki.pager.styles`.
* wfGetCache() and wfGetMainCache(), both deprecated since 1.32, now emit
  deprecation warnings.
* LinkCache::addGoodLinkObj() has been hard deprecated.
* ApiStashEdit::parseAndStash has been hard deprecated.
* Content::prepareSave was hard-deprecated, now emits deprecation warnings.
  Use ContentHandler::validateSave instead.
* The hooks LinksUpdateAfterInsert and LinksUpdateConstructed were deprecated.
* Access to all public properties in LinksUpdate was deprecated.
* The global variable $IP has been deprecated for use in application logic.
  It will remain available for use in LocalSettings.php for now, though
  $wgBaseDirectory is preferred.
  Application logic should use the BaseDirectory setting from the main config.
  Tests and framework code that need to function without MediaWiki being
  fully initialized should use the MW_INSTALL_PATH constant.
* The global function wfWikiID(), deprecated since 1.35, now emits deprecation
  warnings.
* AbstractBlock::getBy() now takes a wikiId as a parameter and emits deprecation
  warnings in case of cross-wiki accesses.
* The `button` parameter for `bindUpdateAriaExpandedOnInput` and
  `updateAriaExpanded` in checkboxHack.js have been deprecated.
  `bindToggleOnSpaceEnter` has also been deprecated in favor of
  `bindToggleOnEnter`.
* IDatabase::lockTables() and IDatabase::unlockTables() have been deprecated
  with no replacement. Instead, callers should batch updates into atomic
  transactions, using FOR UPDATE for SELECT queries.
* EditPage::addNewLineAtEnd() was deprecated; use
  TextboxBuilder::addNewLineAtEnd instead.
* EditPage::getCopywarn() was deprecated; use EditPage::getCopyrightWarning
  instead.
* EditPage::getCopyrightWarning() without passing a MessageLocalizer parameter
  has been deprecated.
* Passing the $formCallback parameter to EditPage::showEditForm, deprecated in
  1.25 and previously emitting a warn notice, now emits a deprecation notice.
* EditPage::$action has been deprecated.
* The following properties in EditPage now emit deprecation notices when used
  from another class:
  - mArticle (use ::getArticle() instead)
  - mTitle (use ::getTitle() instead)
  - isNew (no replacement)
  - allowBlankArticle (no replacement)
  - selfRedirect (no replacement)
  - allowSelfRedirect (no replacement)
  - diff (no replacement)
  - textbox2 (no replacement)
  - undoAfter (no replacement)
  - edit (no replacement)
  - contentLength (no replacement)
* The HTMLForm methods getPreText, setPreText, addPreText, getPostText,
  setPostText, addPostText, getHeaderText, setHeaderText, addHeaderText,
  getFooterText, setFooterText and addFooterText have been renamed to
  getPreHtml, setPreHtml, addPreHtml, getPostHtml, setPostHtml, addPostHtml,
  getHeaderHtml, setHeaderHtml, addHeaderHtml, getFooterHtml, setFooterHtml and
  addFooterHtml respectively.
* The FormSpecialPage methods preText and postText have been renamed to preHtml
  and postHtml respectively.
* Article::doDelete, deprecated in 1.37, now emits deprecation notices.
* The following Less mediawiki.mixins have been deprecated:
  - .background-image()
  - .list-style-image()
* Category::getPageCount now takes a parameter. Category::COUNT_ALL_MEMBERS
  return count of all members while Category::COUNT_CONTENT_PAGES return that
  of content pages. For the former behavior use Category::getMemberCount()
* Using `new HTMLForm( … )` or `HTMLForm::factory( … )` without the $context
  parameter is now deprecated.
* BagOStuff::incr() and BagOStuff::decr() are now deprecated.
* Action::exists() and ActionFactory::actionExists() are deprecated, use
  (bool)ActionFactory::getAction().

=== Other changes in 1.38 ===
* The following things were changed in the file deletion form:
   - The name and ID of the submit button are now `wpConfirmB`, not
      `mw-filedelete-submit`
   - The ID of the form is now `deleteconfirm`, not `mw-img-deleteconfirm`
   - The `mw-filedelete-editreasons` class was replaced with
     `mw-delete-editreasons`
  The goal of these changes is to make the HTML more similar to that of
  normal page deletion.
* ParserOptions created with ::newFrom* or ::newCanonical are now identical.
* MediaWiki initialization order have been changed to load vendor autoload
  earlier. This means that extensions that are installed via composer and
  execute code upon autoloading can not depend on any MediaWiki classes,
  constants or globals in that code.
* The source of truth for configuration defaults is now the MainConfigSchema
  class. DefaultSettings.php still exists for backwards compatibility. A PHP
  file generated for optimized loading will be used in Setup.php to initialize
  configuration variables. Setup.php can be made to load DefaultSettings.php
  as before by setting MW_USE_LEGACY_DEFAULT_SETTINGS as  an environment
  variable (e.g. via SetEnv in htaccess) or a PHP constant (e.g. via
  auto_prepend_file in php.ini).

== Compatibility ==
MediaWiki 1.38 requires PHP 7.3.19 or later and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
but support for them is somewhat less mature.

The supported versions are:

* MySQL 5.5.8 or later
* PostgreSQL 9.4 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.

= MediaWiki 1.37 =

== MediaWiki 1.37.6 ==

This is a maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.5 ===
* Fix missing use statement from backport of fix for T307278.

== MediaWiki 1.37.5 ==

This is a security and maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.4 ===
* Localisation updates.
* (T312519, T312520) Parser::extensionSubstitution() Don't run substr() on null.
* (T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
* (T312302) SpecialRedirect: Don't pass null to explode.
* RemoveInvalidEmails: Fix quoting for postgres.
* (T312678) import: UploadSourceAdapter::stream_read() don't pass null to
  strlen().
* (T312300) SpecialDiff: Don't pass null to explode().
* (T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
* (T289926) Handle null passed to wfShorthandToInteger() and Html::element().
* (T289926) Ensure that strlen() does not get passed a (valid) null.
* (T312301) SpecialDiff: Don't pass null to trim().
* Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
* (T289926) Ensure we don't pass null to mb_strlen.
* (T312305, T311572, T311571, T311578) HTMLForm: Null coalescence in trim()
  calls.
* (T289926) site: Consistently return null from Site::getDomain().
* (T307304, T289879) filebackend,jobqueue: Add signature for
  FilterIterator::accept().
* (T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
* Add application/vnd.ms-opentype to MIME list.
* Allow composer/installers plugin in composer.json.
* Change type hints for BatchRowIterator and NotRecursiveIterator for
  compatibility with PHP 8.1.
* (T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
* (T313663) parser: Mock WikiPage::getContentModel in ParserCacheTest to fix
  php8.1.
* (T313663) [php8.1] Make WikiImporterFactoryTest use better mock for
  ImportSource.
* Fix tests so getName() doesn't return null.
* (T313663) [php8] Don't use strlen on potentially null string.
* (T313663) [php8.1] Suppress test warning about providing null.
* (T313663) Parser will use current timestamp instead of null if passed a
  RevisionRecord that does not have a timestamp.
* (T313663) Add explicit null check for $sha in FileBackend [php8.1].
* (T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
* (T313663) Mock UserOptionsManager::getOption for php8.1.
* (T289879, T289926) Get rid of warnings on PHP 8.1.
* (T313663) Check for null return of preg_replace in MediaWikiTitleCodec.
* (T313663) cast db name to string when checking if it is read only [php8.1].
* (T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
* Fix a couple deprecation warnings in the installer under PHP 8.1.
* (T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
* (T313663) Mock User::getTitleKey in SpecialPreferencesTest [php 8.1].
* (T314096) Migrate use of ${var}-style string interpolation.
* (T314099) preprocessor: Add missing field declarations.
* (T313663, T313662) Make default value for optional args {{PAGESINCAT:..}} be
  '' not null.
* (T314225) SpecialCategories: Null coalescene $par.
* (T314099) User: Allow dynamic properties on PHP 8.2.
* (T314397) SpecialBlock: Better handle null in getTargetUserTitle.
* (T314099) phpunit: Fix trivial dynamic property usages in tests.
* (T314405) UploadStash: Check if us_prop is set in the fileMetadata.
* (T313663) Make ChangesListSpecialPageTest cast to string for php 8.1.
* (T313663) Do not test giving a null fragment to Title::makeTitle.
* (T314550) SpecialMergeHistory: Set timestamp to '' if no mergepoint.
* (T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
* api: Add rel=nofollow to help examples.
* (T307613) Validate length of user email on Special:ChangeEmail/
  Special:CreateAccount.
* (T314226) LoginSignupSpecialPage: Check if $value is a string before length.
* (T314824) tests: Update parser test after i18n change.
* (T295958, T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
* (T314906, T314907) SpecialBlock: Set defaults for wpPageRestrictions and
  wpNamespaceRestrictions.
* (T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
* (T315892) composer.json: Pin phpunit to 8.5.28.
* (T313049) Bump wikimedia/parsoid to v0.14.2.
* (T317750) session: Fix broken SessionTest case due to PHPUnit dependency
  change.
* (T318079) SpecialEditTags: Set default value of wpTagsToRemove to empty array.
* (T318460) SpecialChangeEmail: Set default for returntoquery.
* (T318307) Update docs for HTMLFormField::validate() to permit all data types.
* (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
  in an IP range check on Special:Contributions.
* (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
  of hidden users.
* (T307278, CVE-2022-41766) SECURITY: On action=rollback the message
  "alreadyrolled" can leak revision deleted user name.

== MediaWiki 1.37.4 ==

This is a maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.3 ===
* Localisation updates.
* (T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
* (T311559) SpecialListFiles: user parameter isn't always present.
* (T311561) ImageListPager: Don't call htmlspecialchars() on null.
* (T311920) SpecialBlockList: Prevent passing null to trim().
* (T311921) SpecialUserrights: Don't pass null to str_replace.
* (T311570) SpecialWithoutInterwiki: Don't pass null through to
  Title::capitalize().
* (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser.
* (T312059) Update guzzlehttp/guzzle to 7.4.5 in vendor.
* (T296435, T297669) cache: Add four fields to LinkCache::getSelectFields.

== MediaWiki 1.37.3 ==

This is a security and maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.2 ===
* Localisation updates.
* (T289879) Type hints for ArrayAccess and JsonSerializable.
* (T304783) TemplateParser: avoid warnings when called by NoLocalSettings.
* Rebuilt vendor with composer 2.3.3.
* Fix old_name in UserLogoutComplete hook.
* (T289879) Address some deprecations for PHP 8.1.
* (T193565) UserGroupManager: Fix dbDomain in addUserToGroup() deferred update.
* (T309114) LocalFile::prerenderThumbnails: Limit the number of thumbnail jobs
  triggered.
* (T307982) Updated wikimedia/parsoid from v0.14.0 to v0.14.1.
* (T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
* (T308473) SECURITY: Escape contributions-title msg for use within page title.
* (T311272) Call parent constructor of AddSite maintenance script first.
* MediaWiki: Don't eagerly initialize action name.
* Updated wikimedia/shellbox from v2.0.0 to v2.1.1.
* (T311384, CVE-2022-27776) Updated guzzlehttp/guzzle from 7.2.0 to 7.4.5.
* (T289926) Avoid passing null to trim() in SkinTemplate.
* (T311473) rollbackEdits: Pass user identity to RollbackPage.
* (T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
* (T311551) ShellboxClientFactory::getUrl(): Check if $this->key is null.
* (T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
* (T311569) FileBackend::isStoragePath() Handle being passed null.
* (T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
* (T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
* (T281741) ChangeTags: Fix adding CSS classes for hidden tags.
* (T296642) changetags: Fix management of a '0' tag.
* (T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
* (T303033) Handle null in ChangeTags::modifyDisplayQuery.
* Updated wikimedia/common-passwords from 0.3.0 to 0.4.0.

== MediaWiki 1.37.2 ==

This is a security and maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.1 ===
* (T298261) Fix support for Composer 2.2.
* (T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
* Update doctrine/dbal (3.0.0 => 3.1.5).
* (T296898) Add entry point name to disabled Session exception if possible.
* (T298564) MemcachedClient: Add support for IPv6.
* (T297543, CVE-2022-28202) SECURITY: properly escape output used within
  galleries and Special:RevisionDelete.
* (T289956) WatchAction: Fix bug that prevents showing proper success
  message in the noscript fallback mode.
* (T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
* (T283275) Fix PHP 8.0 failure of RefreshSecondaryDataUpdateTest.
* (T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
* (T275673) objectcache: Avoid getCurrentTime() call in MapCacheLRU::has().
* (T275673) objectcache: split up MapCacheLRU::getAge() to avoid conditional
  overhead.
* Fix the json schema and the extension processor for Parsoid extension modules.
* (T299696) update.php: Avoid passing null to substr.
* (T195807, T256401) Fix signature of DatabasePostgres::buildGroupConcatField.
* In PHP 8.1 don't throw exceptions from mysqli.
* (T289926) SiteConfiguration: Don't pass null to str_replace().
* (T264735) Fix deprecation warning from CURLPIPE_HTTP1.
* (T260735) Stop using is_resource() where possible.
* (T289879) Apply ReturnTypeWillChange to various implementations of built in
  interfaces.
* (T299312) Implement __serialize/__unserialize for PHP 8.1 support.
* ExtensionRegistry: Add process cache for lazy attributes.
* (T301041) ApiPageSet: Add "missing": true to missing revisions.
* Allow ParsoidModules extension schema to register services.
* (T300462) SpecialUndelete: Do not show empty comments as deleted.
* (T297708) Allow setting max execution time to several special pages.
* (T205349) LinkCache: Try invalidating cache before throwing.
* (T302540) composer.json: Add ext-calendar to require.
* (T302540) composer.json: Add ext-simplexml to require-dev.
* (T302540) composer.json: Add various PHP extensions to suggests.
* Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
* (T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
* (T293576) listFiles: Display file name instead of version.
* (T303871) Fix @since of Title::getId().
* (T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
* wrapOldPasswords: add \n to two output calls.
* (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion
  loop if it points to a local interwiki.
* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file
  uploads with actor as a condition can result in a DoS.
* (T297754, CVE-2022-28204) Special:WhatLinksHere can result in a DoS when a
  page is used on a extremely large number of other pages.

== MediaWiki 1.37.1 ==

This is a security and maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.0 ===
* (T296112) Allow inserting new sections named '0'.
* Fix path for ZhConversion.php.
* nukeNS: don't run purgeRedundantText() after every change.
* (T286779, T297031) installer: Fix Postgres mistakes in using changeField
  method.
* (T225888) RollbackAction: fix missing pagetitle.
* (T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in
  undo actions.
* (T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
* (T34716, T297416) SECURITY: Require 'read' right for most actions.
* (T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook
  when changing content model.

== MediaWiki 1.37.0 ==

=== Changes since MediaWiki 1.37.0-rc.2 ===
* Remove justinrainbow/json-schema from vendor.
* Updated pear/mail_mime from 1.10.9 to 1.10.11.
* Update deprecated Guzzle Psr7 function calls.
* (T281972) UserIdentityValue: Correct @since tags.
* Updated wikimedia/parsoid from v0.14.0-a19 to v0.14.0.
* Localisation updates.
* Tweak error message for missing composer dependencies.

== MediaWiki 1.37.0-rc.2 ==

=== Changes since MediaWiki 1.37.0-rc.1 ===
* (T295173) Re-add wikimedia/normalized-exception to vendor.
* Remove wikimedia/testing-access-wrapper, psr/simple-cache, psr/http-factory
  from vendor.
* (T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is set.
* (T212428) Allow populateContentTables to continue when there are bad blobs.

== MediaWiki 1.37.0-rc.1 ==

=== Changes since MediaWiki 1.37.0-rc.0 ===
* (T294043) checkStorage: pass no parameters to WikiRevision::getContent().
* (T292763, CVE-2021-44854) SECURITY: Do not cache private wiki completion
  results.
* (T293783) ApiQueryImageInfo: don't show empty comments as deleted.
* (T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
* (T294796) JobQueueRedis: Replace deprecated zSize with zCard.
* Remove duplicate settings from DefaultSettings.
* (T278037) NoLocalSettings: Pass an EmptyBagOStuff to TemplateParser.

== MediaWiki 1.37.0-rc.0 ==

== Upgrading notes for 1.37 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.27.

Some specific notes for MediaWiki 1.37 upgrades are below:
* (T280806) Deprecated methods of fetching API tokens have been removed. This
  may cause older bots and scripts to fail. Most queries are trivially
  updateable to using new methods. See the Action API changes section below
  for more information.

For notes on 1.36.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.37 ===
* (T242768) The PasswordCannotMatchUsername password policy has been removed,
  please use PasswordCannotBeSubstringInUsername instead. If you have not
  customised your password policies, there will be nothing to do here.

==== New configuration ====
* $wgBrowserFormatDetection - This setting allows the enabling or disabling
  of automatic detection of possible phone numbers in a webpage in iOS Safari.
* $wgParserEnableLegacyMediaDOM - This setting defaults to true, and enables
  the legacy media HTML structure in the output from the Parser.  The
  alternative modern HTML structure for media is described at
  https://www.mediawiki.org/wiki/Parsing/Media_structure
  In a future release of MediaWiki this option will default to false,
  so it's a good idea to test this setting on your wiki early and report
  any issues.

==== Changed configuration ====
* $wgContentHandlerTextFallback - This migration setting, which defines how to
  react if a plain text version of a non-text Content object is requested using
  ContentHandler::getContentText(), is deprecated.
* $wgActions – This setting lets sysadmins over-ride which actions can be used.
  It has been re-worked to support injecting dependencies into Action sub-
  classes as part of wider work on dependency injection. Previously, $wgActions
  was an array where the keys were the names of actions, and the values had the
  following impacts (for a given key 'Foo'):
  - `true`: use the class 'FooAction' unless for a specific page
    WikiPage::getActionOverrides() wants to override that action
  - a string: use the class with that name, and do not allow over-riding on a
    per-page basis
  - `false`: the action is disabled
  - a callable: use the Action instance returned by invoking that callback, and
    do not allow overriding on a per-page basis
  - an object: use that specific Action instance, and do not allow overr-iding
    on a per-page basis.
  As part of T253078, values can now be arrays that are not callables, which are
  treated as ObjectFactory specs, allowing for services to be injected.
  Additionally, the distinction between values that allow per-page overrides and
  those that do not was removed - all actions can now be overridden on a per-
  page basis using WikiPage::getActionOverrides().
* $wgShellboxUrl – This setting, new in 1.36 to configure the novel Shellbox
  encapsulation system, is now deprecated; use $wgShellboxUrls as a mapping of
  service => URL instead.
* $wgIncludejQueryMigrate – This setting, introduced in 1.29 to on whether to
  provide a migration layer for jQuery, has now switched its default value from
  true to false. This may break gadgets that depended on methods that were
  removed in jQuery 3 in 2017. See T280944 for more information.
* A number of settings have been renamed. The former configuration variable
  names are deprecated, but will be used as the fall back if they are still set,
  and remain temporarily available for extensions which might try to read them:
  - $wgFileBlacklist is now $wgProhibitedFileExtensions
  - $wgMimeTypeBlacklist is now $wgMimeTypeExclusions
  - $wgEnableUserEmailBlacklist is now $wgEnableUserEmailMuteList
  - $wgShortPagesNamespaceBlacklist is now $wgShortPagesNamespaceExclusions
* $wgMimeTypeExclusions - As well as being renamed, this configuration array now
  also prohibits the RFC 4329 form of JavaScript, 'application/javascript', as
  well as previous MIME types.
* $wgFragmentMode - This setting, which determines the encoding of section IDs,
  has now switched its default value from legacy-first to html5-first: both the
  HTML5 anchor and the legacy percent-encoding-style anchor will still be
  generated for section titles, but references to them will use the HTML5
  version, resulting in human-readable fragments.

==== Removed configuration ====
* $wgLegacyJavaScriptGlobals, deprecated in 1.36.
* (T274695) $wgAjaxEditStash, deprecated in 1.36.
* $wgShowDBErrorBacktrace, deprecated and non-functional since 1.32.
* $wgShowSQLErrors, deprecated and non-functional since 1.32.
* $wgLangObjCacheSize, without deprecation; the LanguageFactory service now
  always retains at most 10 objects in its LRU-cache.
* $wgDjvuToXML, without deprecation; the tool it enables is obsolete and
  abandoned upstream. Use $wgDjvuDump to use that tool instead.

=== New user-facing features in 1.37 ===
* (T161934) MediaWiki now supports JPEG2000 files, to a limited extent.

=== External library changes in 1.37 ===

==== New external libraries ====
* Added symfony/polyfill-php80 1.23.1.
* Added whatwg-fetch 3.6.2.
* Added wikimedia/normalized-exception 1.0.1.

==== Changed external libraries ====
* Updated OOjs from v5.0.0 to v6.0.0
* Updated OOjs-Router from v0.2.0 to v0.3.0
* Updated OOUI from v0.41.3 to v0.42.0
* Updated WVUI from v0.1.0 to v0.3.0
* Updated cssjanus/cssjanus from v1.3.0 to v2.1.0.
* Updated pear/mail_mime from 1.10.9 to 1.10.11.
* Updated psr/container from v1.0.0 to v1.1.1.
* Updated wikimedia/minify from v2.2.2 to v2.2.4.
* Updated wikimedia/object-factory from v3.0.0 to v3.0.2.
* Updated wikimedia/parsoid from v0.13.1 to v0.14.1.
* Updated wikimedia/relpath from v2.1.1 to v3.0.0.
* Updated wikimedia/remex-html from v2.3.1 to v2.3.2.
* Updated wikimedia/shellbox from v1.0.4 to v2.1.1.
* Updated wikimedia/wait-condition-loop from v2.0.1 to v2.0.2.
* Updated zordius/lightncandy from v1.2.5 to v1.2.6.
* Updated guzzlehttp/guzzle from 7.2.0 to 7.4.5.
* Updated wikimedia/common-passwords from 0.3.0 to 0.4.0.

===== Changed development-only external libraries =====
* Updated qunit from 2.10.0 to 2.16.0.

==== Removed external libraries ====
* The pimple/pimple development-only library has been removed.

=== Action API changes in 1.37 ===
* (T280806) The API methods for fetching tokens which were deprecated in
  MediaWiki 1.24 have been removed. action=query&meta=tokens&type= should be
  used instead. Please note some token types no longer exist, and you should
  just use type=csrf for those instead.
  - action=query&prop=info&intoken ->
      action=query&meta=tokens&type=csrf
  - action=tokens&type= ->
      action=query&meta=tokens&type=
  - action=query&list=recentchanges&rctoken ->
      action=query&meta=tokens&type=csrf
  - action=query&prop=revisions&rvtoken=rollback ->
      action=query&meta=tokens&type=rollback
  - action=query&meta=userinfo&uiprop=preferencestoken ->
      action=query&meta=tokens&type=csrf
  - action=query&list=users&ustoken=userrights ->
      action=query&meta=tokens&type=userrights

=== Languages updated in 1.37 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T280435) LRM and RLM characters were removed from names of languages with
  parentheses in Names.php
* (T283422) Add namespace name translations and change the autonym of
  the Kinyarwanda language to "Ikinyarwanda".
* (T283423) Change the autonym of the Lombard language from "lumbaart"
  to "lombard".
* (T279619) Added language support for Dagbani (dag).
* (T282085) Added language support for Malay in Arabic (Jawi) script (ms-arab).
* (T283053) Added language support for Ojibwe (ojb).
* (T283480) Added language support for Wallisian (wls, Fakaʻuvea).
* (T284002) Added language support for Paiwan (pwn).
* (T284044) Added language support for Carpathian Romani (rmc).
* (T286460) Added language support for Gun (guw, Gungbe).
* (T287345) Added language support for Baoulé (bci).
* (T290126) Added language support for Kildin Sami (sjd).
* (T290408) Added language support for Pite Sami (sje).
* (T25216) Started the renaming of the language code for Norman from nrm to
  nrf.

=== Breaking changes in 1.37 ===
* The Revision class, emitting deprecation warnings since 1.35, was removed
  entirely. As part of this, the following hooks that included a Revision object
  were removed:
    - ArticleRevisionUndeleted - use RevisionUndeleted
    - ArticleRollbackComplete - use RollbackComplete
    - DiffRevisionTools - use DiffTools
    - DiffViewHeader - use DifferenceEngineViewHeader
    - HistoryRevisionTools - use HistoryTools
    - NewRevisionFromEditComplete - use RevisionFromEditComplete
    - PageContentInsertComplete - use PageSaveComplete
    - PageContentSaveComplete - use PageSaveComplete
    - ParserFetchTemplate - use BeforeParserFetchTemplateRevisionRecord
    - RevisionInsertComplete - use RevisionRecordInserted
    - TitleMoveComplete - use PageMoveComplete
    - TitleMoveCompleting - use PageMoveCompleting
    - UndeleteShowRevision - no replacement
    - UserRetrieveNewTalks - no replacement
  … the following methods and variables have been removed:
    - Article::$mRevision
    - Article::getRevisionFetched()
    - ContribsPager::tryToCreateValidRevision()
    - EditPage::$mBaseRevision
    - EditPage::getBaseRevision()
    - LinksUpdate::getRevision()
    - LinksUpdate::setRevision()
    - PageArchive::getArchivedRevision()
    - PageArchive::getPreviousRevision()
    - PageArchive::getRevision()
    - Parser::$mRevisionObject
    - Parser::fetchCurrentRevisionOfTitle()
    - Parser::getRevisionObject()
    - Parser::statelessFetchRevision()
    - ParserOptions::getCurrentRevisionCallback()
    - ParserOptions::setCurrentRevisionCallback()
    - Title::countAuthorsBetween()
    - Title::getFirstRevision()
    - User::getNewMessageLinks()
    - User::getNewMessageRevisionId()
    - User::setNewtalk()
    - WikiPage::getOldestRevision()
    - WikiPage::getRevision()
    - WikiPage::getUndoContent()
    - WikiPage::updateIfNewerOn()
  … and the following methods no longer accept Revision objects as parameters:
    - CategoryMembershipChange::__construct()
    - ContentHandler::getUndoContent()
    - DerivedPageDataUpdater::prepareUpdate()
    - DifferenceEngine::getRevisionHeader()
    - Linker::buildRollbackLink()
    - Linker::generateRollback()
    - Linker::getRevDeleteLink()
    - Linker::getRollbackEditCount()
    - Linker::revComment()
    - Linker::revUserLink()
    - Linker::revUserTools()
    - WikiPage::doDeleteUpdates()
    - WikiPage::doEditUpdates()
    - WikiPage::hasDifferencesOutsideMainSlot()
    - WikiPage::onArticleEdit()
    - WikiPage::prepareContentForEdit()
    - WikiPage::updateRevisionOn()
  The following methods return arrays that formerly included a 'revision'
  key that would emit deprecation warnings when accessed and return a
  Revision object. The Revision object has been removed from the arrays,
  and the 'revision-record' key should be used to get the relevant
  RevisionRecord instead:
    - PageUpdater::doCreate()
    - PageUpdater::doModify()
    - Parser::statelessFetchTemplate()
    - WikiPage::doEditContent()
  Finally, the ParserOptions `templateCallback` option is a callback that is
  called in Parser::fetchTemplateAndTitle() and should return an array - the
  'revision' key to that array used to be a Revision object and was used if
  no 'revision-record' was returned - is now ignored.
* Previously, the classes RevisionTestModifyableContent and
  RevisionTestModifyableContentHandler were loaded for use in tests, but were
  only used within the tests for the since-removed Revision class. This content
  and content handler class were removed without deprecation.
* WANObjectCache::HOLDOFF_NONE, deprecated since 1.35, was removed. Use
  WANObjectCache::HOLDOFF_TTL_NONE instead.
* Calling ResourceLoader::makeVersionQuery() without $modules parameter,
  deprecated since MediaWiki 1.34, is no longer supported.
* LocalFile::recordUpload2(), deprecated since 1.35, was removed.
* The following methods and fields in the Language class, deprecated since 1.35,
  have been removed:
   - ::classFromCode()
   - ::clearCaches()
   - ::convertTitle()
   - ::findVariantLink()
   - ::$mConverter
   - ::updateConversionTable()
* The following methods in the Parser class have been removed after having been
  deprecated in 1.35:
   - fetchTemplate()
   - Title()
* (T273354) When an edit is prevented by an 'EditFilterMergedContent' hook
  handler without changing the status, the edit form will now be displayed.
* User::clearNotification() which had been deprecated in 1.35 has been removed.
  Use WatchlistManager::clearTitleUserNotification() instead.
* User::getNewtalk() which had been deprecated in 1.35 has been removed. Use
  TalkPageNotificationManager::userHasNewMessages() instead.
* The Autopromote class, deprecated since 1.35, was removed. Use
  UserGroupManager instead.
* The CachedAction, SpecialCachedPage, CacheHelper, and ICacheHelper classes,
  all emitting deprecation warnings since 1.36, have been removed.
* The hooks BeforeHttpsRedirect, CanIPUseHTTPS and UserRequiresHTTPS, deprecated
  in 1.35, were removed.
* The TitleArrayFromResult hook, deprecated in 1.36, was removed.
* The deprecated "es6-promise" alias ResourceLoader module has been removed. Use
  the "es6-polyfills" module directly intead.
* The deprecated "mediawiki.legacy.protect" ResourceLoader module, deprecated
  since 1.36, has been removed. Use "mediawiki.action.protect" instead.
* The JavaScript alias $j for references to jQuery, deprecated since 1.23, has
  been removed. Use $ instead.
* The AuthenticationProvider interface and the SessionProvider class no longer
  extend the PSR LoggerAwareInterface concept, so they can't be typehinted as
  LoggerAwareInterface.
* User::getGrantName(), emitting deprecation warnings since 1.36, has been
  removed. Use MWGrants::grantName() instead.
* The following ApiBase methods, deprecated since 1.35, have been removed:
  - ApiBase::explodeMultiValue
  - ApiBase::parseMultiValue
  - ApiBase::validateLimit
  - ApiBase::validateTimestamp
* The User::idCacheByName() public static field was removed without deprecation.
  Instead of using it, get a UserIdentity by name from the UserIdentityLookup
  service.
* IDatabase::upsert() and IDatabase::replace() now only accept a single unique
  key. Previously, a warning was issued if there were multiple unique keys
  provided.
* The MediaWiki:Autoblock_whitelist block exemption control was moved in 1.36 to
  MediaWiki:Block-autoblock-exemptionlist. The backward-compatibility of reading
  the old MediaWiki:Autoblock_whitelist page has now been dropped.
* The following overridable methods in File hierarchy have changed signatures:
  - File::deleteFile() - now accepts UserIdentity instead of User
  - File::getDescription() - now accepts Authority instead of User
  - File::userCan() - now accepts Authority instead of User
  - LocalFile::deleteOldFile() - now accepts UserIdentity instead of User
* The following global methods, each deprecated since 1.36, have been removed:
  - wfAppendToArrayIfNotDefault()
  - wfAcceptToPrefs()
  - wfConfiguredReadOnlyReason()
  - wfDebugMem()
  - wfGetPrecompiledData()
  - wfNegotiateType()
* The following deprecated methods of the Title class have been removed:
  - ::nameOf(), deprecated in 1.36
  - ::getPreviousRevisionID(), deprecated in 1.34
  - ::getNextRevisionID(), deprecated in 1.34
  - ::getEarliestRevTime(), deprecated in 1.35
* UploadBase::stashFile(), deprecated since 1.28, was removed.
* wfGetRusage(), deprecated since 1.35, has been removed.
* The following CLI options were removed from tests/phpunit.php:
    - use-filebackend
    - use-jobqueue
    - use-bagostuff
  The following options (inherited from Maintenance) were also removed:
    - conf
    - dbuser
    - dbpass
    - dbdefaultgroup
    - globals
    - memory-limit
    - profiler
    - server
  The following options were changed to environment variables:
    - wiki => PHPUNIT_WIKI
    - use-normal-tables => PHPUNIT_USE_NORMAL_TABLES
    - use-filebackend => PHPUNIT_USE_FILEBACKEND
    - use-bagostuff => PHPUNIT_USE_BAGOSTUFF
    - use-jobqueue => PHPUNIT_USE_JOBQUEUE
  This is so that we can use the default PHPUnit entry point (T90875).
* The PHPUNIT_REUSE_DB / --reuse-db option was removed from the phpunit.php
  runner. It had been broken for at least three years already. The original use
  case was speeding up tests on Oracle, but Oracle support was dropped several
  releases ago.
* The MediaWikiPHPUnitTest__endTestHook and MediaWikiPHPUnitTest__startTestHook
  PHPUnit hooks were removed. MediaWikiHooksPHPUnitExtension was also removed.
* EntryPoint::getTextFormatters() was made private without a deprecation period;
  it had no known external callers.
* DatabaseBlock::chooseBlock(), deprecated since 1.35, was removed.
* SpecialPageFactory::getRestrictedPages(), deprecated since 1.36, was removed.
* SpecialBlock::validateTarget(), deprecated since 1.36, was removed.
* The PatchFileLocation trait was removed without deprecation.
* ActorMigrationBase::getExistingActorId() and ::getNewActorId(), emitting
  deprecation warnings since 1.36, were removed.
* Hook handlers implementing the MediaWikiServicesHook hook are now prohibited
  from having services injected. This is because by definition, this hook runs
  before the service container is fully initialized.
* The protected property LocalFile::$metadata was removed without deprecation.
* WatchedItem::getUser(), emitting deprecation warnings since 1.36, has been
  removed.
* AuthManager::singleton(), emitting deprecation warnings since 1.36, has been
  removed.
* The AugmentPageProps class was removed without deprecation. It had no known
  uses.
* Html::infobox(), deprecated since 1.36, was removed.
* ParserOptions::__construct() now requires that the first parameter is a
  UserIdentity object - passing `null` used to fallback to the global
  $wgUser but was deprecated since 1.36.
* ParserOptions::newCanonical() no longer supports the first parameter being
  null (or omitted entirely), which would fallback to the global $wgUser but
  was deprecated since 1.35.
* The SkinTemplatePreventOtherActiveTabs hook, deprecated in 1.35, was removed
  entirely.
* The SkinTemplateTabAction hook, deprecated in 1.35, was removed entirely.
* The SkinTemplateBuildNavUrlsNav_urlsAfterPermalink hook, deprecated in 1.35,
  was removed entirely.
* The SkinTemplateToolboxEndHook, deprecated in 1.35, was removed entirely.
* The following methods of RevisionStore class, formerly emitting deprecation
  warnings, were removed:
  - ::newMutableRevisionFromArray()
  - ::loadRevisionFromPageId()
  - ::loadRevisionFromTitle()
  - ::loadRevisionFromTimestamp()
  - ::listRevisionSizes()
* LogEntry::getPerformer(), deprecated since 1.36, was removed along with
  methods in sub-classes: DatabaseLogEntry, ManualLogEntry, RCDatabaseLogEntry.
* Skin::getRelevantUser() now returns an instance of UserIdentity, and not
  necessarily a User object. There is no known usages in MediaWiki ecosystem
  that were not satisfied with UserIdentity.
* Direct construction of MergeHistory class, deprecated since 1.35, is no longer
  supported. Use MergeHistoryFactory instead. MergeHistory::checkPermissions,
  deprecated since 1.36, was removed.
* Skin::generateDebugHTML(), deprecated since 1.35, was removed. Call
  MWDebug::getHTMLDebugLog() directly.
* The ApiTestCase class no longer interacts with the global $wgUser.
  Previously, the global variable was set at the start of each test, and in
  ApiTestCase::doApiRequest() if a performer was specified $wgUser was
  updated to match, and if no performer was specified $wgUser was used
  instead. Now, $wgUser is not updated, and if no performer is specified
  the reusable TestUser object for the sysop is relied on. Extensions
  or skins that rely on the global $wgUser variable (which has been
  deprecated since 1.35) should instead retrieve the acting user from the
  relevant context source.
* SkinTemplate::makeArticleUrlDetails(), deprecated since 1.35, was removed.
* Skin::makeNSUrl(), deprecated since 1.35, was removed.
* Skin::getRevisionId(), deprecated since 1.34, was removed. Use
  OutputPage::getRevisionId() instead.
* Skin::isRevisionCurrent(), deprecated since 1.34, was removed. Use
  OutputPage::isRevisionCurrent() instead.
* AbstractBlock::parseTarget(), deprecated since 1.36, was removed.
* The ArticleEditUpdates hook, deprecated since 1.35, was removed.
* The `@stable to extend` class CentralIdLookup has following changes:
  - The protected ::checkAudience() method now returns an Authority instead of a
    User instance.
  - A number of its `@stable to override` methods now accept an Authority
    instead of a User instance as the $audience parameter.
  - A number of methods now accept a UserIdentity instead of their User
    parameter.
  - The ::localUserFromCentralId() method now returns UserIdentity and not
    necessarily a User object.
  All extensions that extend this class or use this method were updated to be
  ready to the new behavior.
* WatchedItemStoreInterface::enqueueWatchlistExpiryJob(), deprecated since 1.36,
  was removed.
* ResultWrapper is now abstract. It cannot be directly constructed (T286694).
* The SecondaryDataUpdates hook, deprecated in 1.32, was removed entirely.
* Content::getDeletionUpdates(), was removed. Use
  ContentHandler::getDeletionUpdates() instead.
* Content::getSecondaryDataUpdates(), was removed. Use
  ContentHandler::getSecondaryDataUpdates() instead.
* wfDiff(), deprecated since 1.25, has been removed.
* Language::$mLangObjCache, deprecated since 1.35, was removed.
* Language::$transformData, deprecated since 1.35, was removed.
* Language::transformUsingPairFile() was marked @internal. Its deprecated
  parameters are no longer supported.
* SpecialMute::getTarget(), unused outside of the SpecialMute class, was
  made private.
* The Skin::setupSkinUserCss() method, deprecated in 1.32, was removed. Please
  use skin registration instead.
* The ResourceLoaderSkinModule `legacy`, `content` and `content-thumbnails`
  features were deprecated. Skins should instead select from the features
  listed on [[mw:Manual:ResourceLoaderSkinModule]].
* ParserCache::getKey() and ::getEtag(), deprecated since 1.36, were removed.
* The BaseTemplateToolbox hook, deprecated since 1.35, was removed.
* Previously a capitalize-all-nouns class was added to the body element of
  languages where nouns must be capitalized. This class is no longer added to
  the body tag and must be provided by skins.
* The SkinTemplateOutputPageBeforeExec hook, deprecated since 1.35, was removed.
* Calling Message::toString() without a parameter, which triggered deprecation
  warnings since 1.36, is no longer supported. You can instead use the explicit
  formatting methods directly, such as Message::text() and Message::escaped().
* Article::getContentObject(), deprecated since 1.32, was removed.
* Article::delete(), Article::confirmDelete() and ImagePage::delete() were
  removed. The logic responsible for building the form is being
  moved to DeleteAction, while the actual deletion logic will be moved to a
  separate service.
* WikiImporter::debugRevisionHandler(), unused and for debug only, was removed.
* Content::preloadTransform() now emits deprecation warnings. Instead, please
  use ContentTransformer::preloadTransform(). Extensions defining a content
  model should override ContentHandler::preloadTransform().
* Content::preSaveTransform() now emits deprecation warnings. Instead, please
  use ContentTransformer::preSaveTransform() instead. Extensions defining
  a content model should override ContentHandler::preSaveTransform().
* Constructing WikiPage objects from Title instances that cannot exist, emitting
  deprecation warnings since 1.36, now throws an exception. Additionally,
  WikiPage now implements ProperPageIdentity, rather than just PageIdentity.
* The Skin::bottomScripts() method is deprecated. Please instead use
  OutputPage::getBottomScripts().
* LinksUpdate::getTriggeringUser() now returns ?UserIdentity instead of ?User.
* The LESS mixin `.box-shadow()` (from mediawiki.mixins.less), deprecated since
  1.36, was removed. Use CSS property `box-shadow` unprefixed for all basic
  supported browsers instead.
* The LESS mixin `.flex()` now no longer tries to support the 2009 version of
  the Flexbox specification; support for the 2012 and modern standard versions
  remains unchanged.
* The StorageAwareness::ATTR_SYNCWRITES, StorageAwareness::QOS_SYNCWRITES_*,
  StorageAwareness::ATTR_LOCALITY, and StorageAwareness::QOS_LOCALITY_*
  constants were removed.

=== Deprecations in 1.37 ===
* JobQueue::getWiki(), deprecated in 1.33, now emits deprecation warnings.
* AbstractBlock::getTargetAndType() and ::getTarget() now emit deprecation
  warnings. Use ::getTargetName() and ::getTargetUserIdentity() together with
  ::getType().
* Passing a UserIdentity to WatchlistManager::clearAllUserNotifications() and
  WatchlistManager::clearTitleUserNotifications() is now deprecated. Pass an
  Authority instead.
* Passing LinkTarget to WatchlistManager::clearTitleUserNotifications() and
  WatchlistManager::getTitleNotificationTimestamp(). Pass PageIdentity instead.
* The User class methods ::isWatched(), ::isTempWatched(), ::removeWatch(), and
  ::addWatch() have been deprecated. Use corresponding methods in
  WatchlistManager instead.
* Multiple WatchAction methods have been deprecated in lieu of WatchlistManager:
   - ::doWatchOrUnwatch() use WatchlistManager::setWatch()
   - ::doWatch() -> WatchlistManager::addWatch()
   - ::doUnwatch() -> WatchlistManager::removeWatch()
* WatchAction::getWatchToken() now emits deprecation warnings. Instead use
  CsrfTokenSet::getToken().
* Action::getHookContainer() has been marked as internal. Actions that require
  access to a hook container should have one injected instead.
* The ::getTitle() and ::setTitle() methods in Parser have been deprecated.
  Use ::getPage() and ::setPage() instead.
* Title::isWatchable() has been deprecated. Use WatchlistManager::isWatchable()
  instead.
* Methods and classes related to the primary database, previously referred to as
  'master', have been deprecated, with the new ones replacing them as follows:
  - The DBMasterPos and MySQLMasterPos classes have been respectively renamed to
    DBPrimaryPos and MySQLPrimaryPos.
  - LocalRepo::getMasterDB() -> ::getPrimaryDB()
  - ForeignDBRepo::getMasterDB() -> ::getPrimaryDB()
  - JobQueueDB::getMasterDB() -> ::getPrimaryDB()
  - ForeignDBViaLBRepo::getMasterDB() -> ::getPrimaryDB()
  - DBFileJournal::getMasterDB() -> ::getPrimaryDB()
  - ILoadBalancer::getMasterPos() -> ::getPrimaryPos()
  - IDatabase::getMasterPos() -> ::getPrimaryPos()
  - ILoadBalancer::finalizeMasterChanges() -> ::finalizePrimaryChanges()
  - ILoadBalancer::approveMasterChanges() -> ::approvePrimaryChanges()
  - ILoadBalancer::beginMasterChanges() -> ::beginPrimaryChanges()
  - ILBFactory::beginMasterChanges() -> ::beginPrimaryChanges()
  - ILoadBalancer::commitMasterChanges() -> ::commitPrimaryChanges()
  - ILBFactory::commitMasterChanges() -> ::commitPrimaryChanges()
  - IDatabase::getTopologyRootMaster() -> ::getTopologyRootPrimary()
  - IDatabase::masterPosWait() -> ::primaryPosWait()
  - ILoadBalancer::runMasterTransactionIdleCallbacks() ->
      ::runPrimaryTransactionIdleCallbacks()
  - ILoadBalancer::runMasterTransactionListenerCallbacks() ->
      ::runPrimaryTransactionListenerCallbacks()
  - ILoadBalancer::rollbackMasterChanges() -> ::rollbackPrimaryChanges()
  - ILBFactory::rollbackMasterChanges() -> ::rollbackPrimaryChanges()
  - ILoadBalancer::flushMasterSnapshots() -> ::flushPrimarySnapshots()
  - ILoadBalancer::hasMasterConnection() -> ::hasPrimaryConnection()
  - ILoadBalancer::hasMasterChanges() -> ::hasPrimaryChanges()
  - ILBFactory::hasMasterChanges() -> ::hasPrimaryChanges()
  - ILoadBalancer::lastMasterChangeTimestamp() -> ::lastPrimaryChangeTimestamp()
  - ILoadBalancer::hasOrMadeRecentMasterChanges() ->
      ::hasOrMadeRecentPrimaryChanges()
  - ILBFactory::hasOrMadeRecentMasterChanges() ->
      ::hasOrMadeRecentPrimaryChanges()
  - ILoadBalancer::pendingMasterChangeCallers() ->
      ::pendingPrimaryChangeCallers()
  - ILoadBalancer::forEachOpenMasterConnection() ->
      ::forEachOpenPrimaryConnection()
  - ILoadBalancer::waitForMasterPos() -> ::waitForPrimaryPos()
  - Database::assertIsWritableMaster() -> ::assertIsWritablePrimary()
  - RevDelList::reloadFromMaster() -> ::reloadFromPrimary()
  - ExternalStoreDB::getMaster() -> ::getPrimary()
  - DatabaseMysqlBase::getMasterServerInfo() -> ::getPrimaryServerInfo()
  - MWExceptionHandler::rollbackMasterChangesAndLog() ->
      ::rollbackPrimaryChangesAndLog()
* wfGetLB(), deprecated since 1.27, now emits deprecation warnings.
* wfLocalFile(), deprecated since 1.34, now emits deprecation warnings.
* wfFindFile(), deprecated since 1.34, now emits deprecation warnings.
* wfIncrStats(), deprecated in 1.36, now emits deprecation warnings.
* wfCanIPUseHTTPS() is now deprecated, and always returns true.
* The UserLoadFromDatabase hook has been deprecated. It had no known uses.
* The following methods in ApiPageSet have been deprecated:
   - ::getTitles(), use ::getTargets() instead.
   - ::getGoodTitles(), use ::getGoodPages() instead.
   - ::getMissingTitles(), use ::getMissingPages() instead.
   - ::getGoodAndMissingTitles(), use ::getGoodAndMissingPages() instead.
   - ::getRedirectTitles(), use ::getRedirectTargets() instead.
   - ::getSpecialTitles(), use ::getSpecialPages() instead.
* The following methods from the User class, deprecated in 1.35, now each emit
  deprecation warnings:
   - ::getOptions()
   - ::isIP()
   - ::isUsableName()
   - ::isCreatableName()
   - ::getCanonicalName()
   - ::addAutopromoteOnceGroups()
   - ::getEffectiveGroups()
   - ::getAutomaticGroups()
   - ::getFormerGroups()
   - ::getIntOption()
   - ::getBoolOption()
* The following methods in User were deprecated:
  - ::idFromName() - use UserIdentityLookup::getUserIdentityByName() instead.
  - ::resetIdByNameCache() - in tests, reset service container. No replacement
    needed in production code.
* Use of ActorMigration for any table except revision, deprecated in 1.34, now
  emits deprecation warnings. Instead of getInsertValues(), use
  ActorNormalization::acquireActorId(). Instead of getWhere() and getJoin(),
  do your own join on the actor table.
* DatabasePostgres::remappedTableName() and its dependent constructor parameter
  'keywordTableMap' are deprecated. Reserved identifiers that are used as table
  names should be quoted where necessary.
* LinkCache::singleton(), deprecated since 1.28, now emits deprecation warnings.
* MessageCache::singleton(), deprecated since 1.34, now emits deprecation
  warnings.
* LockManagerGroup::singleton() and ::destroySingletons(), deprecated since
  1.34, now emit deprecation warnings.
* HtmlFileCacheUpdate::newFromTitles() is now deprecated and emitting warnings.
  Use newFromPages() instead.
* SessionProvider ::setLogger(), ::setManager(), ::setConfig(), and
  ::setHookContainer() were deprecated. Use ::init() to inject dependencies, or
  override ::postInitSetup() to do any custom post-initialization configuration.
* AbstractAuthenticationProvider ::setLogger(), ::setManager(), ::setConfig(),
  and ::setHookContainer() now emit deprecation warnings. Use ::init() to inject
  dependencies, or override ::postInitSetup() to do any custom post-
  initialization configuration.
* User::isLoggedIn(), deprecated since 1.36, now emits deprecation warnings. Use
  the method it wraps, User::isRegistered(), instead.
* FileBackendGroup::singleton() and ::destroySingletons(), deprecated since
  1.35, now emit deprecation warnings.
* The first parameter of User::getBlock() should now be an integer using the
  Authority::FOR_XXX constants. Providing a boolean is deprecated.
* ApiBase::addBlockInfoToStatus() is deprecated for use by extensions. It is now
  marked as @internal and may be deleted in the future.
  It should not be necessary to call this method, Authority should be providing
  all relevant information via a PermissionStatus object.
* JobQueueGroup::singleton() was deprecated - use
  MediaWikiServices::getJobQueueGroup() instead.
* JobQueueGroup::destroySingletons() was deprecated. JobQueueGroups are now
  automatically destroyed after tests.
* LinkCache::addGoodLinkObj() has been deprecated, since it is prone to
  corrupting the cache with invalid information. Use addGoodLinkObjFromRow()
  instead. PHPUnit tests must use LinkCacheTestTrait::addGoodLinkObject().
* ContentHandler::getContentText() is now deprecated. Use Content::getText()
  instead.
* LinkCache::addLinkObj() has been deprecated, use PageStore::getPageForLink()
  instead.
* MediaWiki\User\UserNamePrefixSearch::search() previously accepted as its first
  parameter either the string 'public' or a UserIdentity object, to filter
  results for. It now expects an Authority object instead of UserIdentity, and
  providing just a UserIdentity will now trigger a deprecation warning.
* User::getRights(), deprecated since 1.34, now emits deprecation warnings.
* User::changeableGroups() and ::changeableByGroup() now emit deprecation
  warnings, use corresponding methods in UserGroupManager instead.
* User::incEditCount() was deprecated in favor of the new method
  UserEditTracker::incrementUserEditCount().
* RepoGroup::singleton(), ::destroySingleton() and ::setSingleton(), deprecated
  since 1.34, now emit deprecation warnings.
* RecentChange::getPerformer(), deprecated since 1.36, now emits deprecation
  warnings. Use ::getPerformerIdentity() instead.
* ContentHandler::cleanupHandlersCache(), deprecated since 1.35, now emits
  deprecation warnings.
* Category::getTitle() was deprecated in favor of Category::getPage()
* File::getUser() method now emits deprecation warnings, along with its over-
  rides in LocalFile and ForeignApiFile in favor of ::getUploader().
* SpecialBlock::checkUnblockSelf(), deprecated in 1.36, now emits deprecation
  warnings.
* (T284179) The mediawiki.viewport ResourceLoader module is deprecated. You can
  now just use MutationObserver or InterSectionObserver directly, which are
  widely available in all supported JavaScript browsers.
* The following constructor options of DatabaseBlock class will now trigger
  deprecation warnings:
    - the 'byText' property with blocker's name,
    - the 'by' property with blocker's ID,
  For both of these, use the 'by' property with UserIdentity value instead.
* The BeforeResetNotificationTimestamp hook was deprecated.
* ArchivedFile::getUser() ::getRawUser() ::getRawUserText() were deprecated in
  favor of ::getUploader.() ::getRawDescription() was deprecated in favor of
  ::getDescription() with RAW audience parameter.
* When calling LocalFile::newFromRow() or LocalFile::loadFromRow(), passing
  extra fields not requested by ::getQueryInfo() will now trigger deprecation
  warnings. This is to warn callers that deprefixing and automatic assignment of
  such fields will not be done in a future version.
* JobSpecification::getTitle() was deprecated without providing a replacement.
  It wasn't used and job given the purpose of JobSpecification class it is not
  needed.
* The protected method File::getImageSize() is now deprecated.
* BacklinkCache::get() was deprecated, use
  BacklinkCacheFactory::getBacklinkCache() instead.
* Title::getBacklinkCache() now emits deprecation warnings. Instead, use the
  ::getBacklinkCache() method in the BacklinkCacheFactory service.
* MediaHandler::getImageSize(), ::getMetadata(), and ::isMetadataValid() were
  deprecated and should no longer be overridden. Instead, sub-classes should
  override getSizeAndMetadata().
* Deprecated File::getMetadata(). Instead use ::getMetadataArray(),
  ::getMetadataItem() and ::getMetadataItems().
* Message::title() has been deprecated; use Message::page() instead.
* BaseTemplate::getAfterPortlet(), BaseTemplate::renderAfterPortlet(), and the
  BaseTemplateAfterPortlet hook, which were deprecated in 1.35,
  now emit deprecation warnings.
* The LocalFile::getHistory() hook is deprecated.
* Previously the Skin templateDirectory option inside skin.json had to be
  relative to MediaWiki core. This should now be relative to the skin.
* Calling WikiPage::prepareContentForEdit() without a UserIdentity is now
  deprecated.
* User::getEditTokenObject(), ::getEditToken(), and ::matchEditToken() were each
  deprecated. Use CsrfTokenRepository, which is available via IContextSource,
  instead. ::matchEditTokenNoSuffix() was deprecated without replacement.
  It was introduced to be able to provide custom error message if the token
  was submitted, but ending slashes were stripped by some ASCII mangling proxy.
  Use ::matchToken() instead, such proxies are much less common now and there's
  not much benefit in customising the error message.
* ContentHandler::getForTitle(), deprecated since 1.35, now emits deprecation
  warnings.
* User::listOptionKinds(), deprecated since 1.35, now emits deprecation
  warnings.
* WikiPage::doEditContent(), deprecated since 1.32, now emits deprecation
  warnings.
* CentralIdLookup::factory() and ::factoryNonLocal() now emit deprecation
  warnings; obtain an instance from MediaWikiServices instead.
* The class RandomPage was renamed to SpecialRandomPage. The class RandomPage
  is now deprecated.
* BotPassword::invalidateAllPasswordsForCentralId() was deprecated.
* BotPassword::removeAllPasswordsForCentralId() was deprecated.
* The Title class members: $mTextform, $mUrlform, $mDbkeyform, $mNamespace,
  $mInterwiki, and $mFragment have been deprecated to not be used directly.
  Instead, their corresponding accessor methods should be used.
* IDatabase::fetchObject(), ::fetchRow(), ::numRows(), ::numFields(),
  ::fieldName(), ::freeResult() and ::dataSeek() are deprecated. Use the
  corresponding methods in IResultWrapper instead.
* ResultWrapper::unwrap(), DatabaseMysqlBase::fieldType() and
  DatabasePostgres::fieldType() each now emit deprecation warnings.
* Sub-classes implementing Database::doQuery() should return either boolean or
  an IResultWrapper. To do otherwise will now trigger a deprecation warning.
* User::getOptionKinds() and ::resetOptions(), both deprecated since 1.35,
  now emit deprecation warnings.
* The following methods in MWNamespace, all deprecated since 1.34, now emit
  deprecation warnings:
  - ::isMovable()
  - ::isSubject()
  - ::getTalk()
  - ::getSubject()
  - ::getAssociated()
  - ::equals()
  - ::subjectEquals()
  - ::hasTalkNamespace()
  - ::wantSignatures()
  - ::isWatchable()
  - ::getSubjectNamespaces()
  - ::getTalkNamespaces()
  - ::isCapitalized()
  - ::hasGenderDistinction()
  - ::isNonincludable()
  - ::getNamespaceContentModel()
  - ::getRestrictionLevels()
  - ::getCategoryLinkType()
* LogFormatter::styleRestricedElement() has been deprecated in favor of
  LogFormatter::styleRestrictedElement()
* The following hooks related to user preferences were deprecated:
  - UserLoadOptions: use LoadUserOptions instead.
  - UserSaveOptions: use SaveUserOptions instead.
  - UserResetAllOptions: no replacement was provided, the hook is not used.
* Title::isNamespaceProtected(), deprecated in 1.34, now emits deprecation
  warnings.
* UserSelectQueryBuilder::userIds(), ::userNames(), and ::userNamePrefix() has
  been deprecated in favor of ::whereUserIds(), ::whereUserNames(), and
  ::whereUserNamePrefix().
* Manually constructing a MovePage object, deprecated in 1.34, now emits
  deprecation warnings. Use MovePageFactory instead.
* The following deletion-related methods were deprecated:
  - WikiPage::doDeleteArticleReal() (soft) - use DeletePage
  - WikiPage::doDeleteArticleBatched() (soft) - no replacement
  - WikiPage::isBatchedDelete() (soft) - use DeletePage
  - WikiPage::doDeleteUpdates() (hard) - no replacement
  - WikiPage::getDeletionUpdates() (hard) - no replacement
  - Title::isBigDeletion (soft) - no replacement
* Relying on PermissionManager or Authority to check for big deletions
  was deprecated. This is now automatically checked if you use
  DeletePage::deleteIfAllowed(). (T288759)
* The userCan hook now emits deprecation warnings. Use the
  getUserPermissionsErrors or getUserPermissionsErrorsExpensive hooks instead.
* Parser::$mUser public access, and the methods ParserOptions::getUser() and
  Parser::getUser() each now emit deprecation warnings.
* The following methods in the Title class have been deprecated in favor of the
  corresponding methods in the new RestrictionStore service (with different
  names where indicated):
  - ::areCascadeProtectionSourcesLoaded()
  - ::areRestrictionsCascading()
  - ::areRestrictionsLoaded()
  - ::getAllRestrictions()
  - ::getCascadeProtectionSources()
  - ::getFilteredRestrictionTypes()
      -> ::listAllRestrictionTypes()
  - ::getRestrictionExpiry()
  - ::getRestrictionTypes()
      -> ::listApplicableRestrictionTypes()
  - ::getRestrictions()
  - ::isCascadeProtected()
  - ::isProtected()
  - ::isSemiProtected()
  - ::loadRestrictionsFromRows()
* The following Title methods have been deprecated with no direct public
  replacement:
  - ::deleteTitleProtection()
  - ::getTitleProtection()
  - ::flushRestrictions()
  - ::loadRestrictions()
* User::isAllowUsertalk() now emits deprecation warnings. Use User::getBlock()
  and AbstractBlock::isUsertalkEditAllowed() instead.
* Classes used by Preprocessor_DOM have been merged with classes used by
  Preprocessor_Hash, as Preprocessor_DOM was removed in 1.35.
   - PPDPart has been merged into PPDPart_Hash
   - PPDStack has been merged into PPDStack_Hash
   - PPDStackElement has been merged into PPDStackElement_Hash
* By default, the global variable $wgUser is now an instance of the new class
  StubGlobalUser rather than User, and the first time it is used it will emit
  deprecation warnings (the $wgUser variable was deprecated in 1.35). For
  extensions that read from this variable, please use a relevant ContextSource
  instead, falling back to RequestContext::getMain() if none is available.
* Collation::singleton() and ::factory() were deprecated; obtain an instance of
  the CollationFactory from MediaWikiServices instead.
* Title::getDefaultNamespace() has been deprecated to be removed because there
  are no known callers/consumers.
* With removal of the stub threshold feature, the following methods now emit
  deprecation warnings:
  - LinkRenderer::setStubThreshold() and ::getStubThreshold() - no replacement.
  - LinkRendererFactory::createForUser() - calling ::create() is now sufficient
  - ParserOptions::setStubThreshold() and ::getStubThreshold() - no replacement.
  - User::getStubThreshold() - no replacement.
* The ArticleDelete and ArticleDeleteComplete hooks were deprecated. Use
  PageDelete and PageDeleteComplete instead.
* The ArticleUndeleteLogEntry hook was deprecated without replacement.
* The following LESS mediawiki.mixins have been deprecated:
  - .box-sizing()
  - .transform()
  - .transform-origin()
  - .transition()
  - .transition-transform()
* The `UndeleteForm::undelete` hook was deprecated. A new hook was
  introduced, `PageUndelete`, that provides handlers with more information and
  is also called for non-UI requests. The capability of replacing the
  PageArchive object has been removed, as that violates the laws of nature.

=== Other changes in 1.37 ===
* WatchlistManager::addWatch() and WatchlistManager::addWatchIgnoringRights(),
  which replace User::addWatch(), now call the WatchArticle and
  WatchArticleComplete hooks.
* WatchlistManager::removeWatch() and
  WatchlistManager::removeWatchIgnoringRights(), which replace
  User::removeWatch(), now call the UnwatchArticle and UnwatchArticleComplete
  hooks.
* The overridable postInitSetup() method was added to the
  AbstractAuthenticationProvider class. A provider can override postInitSetup()
  to do any custom post-initialization configuration.
* The overridable postInitSetup() method was added to the SessionProvider
  class. A provider can override postInitSetup() to do any custom
  post-initialization configuration.
* The protected getConfig() method was added to the SessionProvider class.
  Use SessionProvider::getConfig() to get a config.
* The DBAccessBase class is deprecated. Classes that used to extend it
  should get a load balancer (factory) injected in the constructor instead.
* ActorNormalization::acquireActorId() now requires IDatabase parameter.
  Not providing one emitted deprecation warnings since 1.36.
* Anti-lock constants ALF_PRELOAD_LINK, ALF_NO_BLOCK_LOCK, ALF_NO_LINK_LOCK
  and ALF_PRELOAD_EXISTENCE have been removed. They're unused since 1.25.
* (T278036) CSS class 'mw-htmlform-field-autoinfuse' used by some forms has been
  renamed to 'mw-htmlform-autoinfuse'.
* User::newFromRow() does not accept pre-loaded user preferences under
  $data['user_properties'] anymore. This optimization was not used.
* The following files change the letter case of the file names:
  - SpecialRandompage.php -> SpecialRandomPage.php
  - SpecialRandomredirect.php -> SpecialRandomRedirect.php
  - SpecialRandomrootpage.php -> SpecialRandomRootPage.php
* Media files which are uploaded server side using the importImages.php
  maintenance script will now have the "mw-server-side-upload" change tag.
* (T284917) The stub threshold feature has been removed.
* Skin::getPoweredBy() and Skin::getCopyrightIcon() have been deprecated as they
  are only designed for use by skins extended BaseTemplate. You can move calls
  to instead use BaseTemplate::getPoweredByHTML() and ::getCopyrightIconHTML()
  respectively.
* The SkinGetPoweredBy hook is deprecated. No replacement is provided.
* HTMLTitleTextField didn't support interwiki titles well previously.
  Starting with 1.37, HTMLTitleTextField has a new parameter, 'interwiki',
  which can be used to control acceptance of interwiki titles. To provide
  a transitional period, the default value ('interwiki' => null) ensures
  MW will have the same behavior as before (logging a deprecation warning).
  In 1.38, the default behavior will change to "interwiki links aren't allowed".

== Compatibility ==

MediaWiki 1.37 requires PHP 7.3.19 or later, or PHP 7.4.3 or later, and the
following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

Support for PHP 8.0 is not yet complete.

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
but support for them is somewhat less mature.

The supported versions are:

* MySQL 5.5.8 or later
* PostgreSQL 9.4 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.

= MediaWiki 1.36 =

== MediaWiki 1.36.4 ==

This is a security and maintenance release of the MediaWiki 1.36 branch.

=== Changes since MediaWiki 1.36.3 ===
* (T298261) Fix support for Composer 2.2.
* (T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
* Update doctrine/dbal (3.0.0 => 3.1.5).
* (T296898) Add entry point name to disabled Session exception if possible.
* (T298564) MemcachedClient: Add support for IPv6.
* (T297543, CVE-2022-28202) SECURITY: properly escape output used within
  galleries and Special:RevisionDelete.
* (T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
* (T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
* Fix the json schema and the extension processor for Parsoid extension modules.
* (T299696) update.php: Avoid passing null to substr.
* In PHP 8.1 don't throw exceptions from mysqli.
* (T289926) SiteConfiguration: Don't pass null to str_replace().
* (T264735) Fix deprecation warning from CURLPIPE_HTTP1.
* (T260735) Stop using is_resource() where possible.
* (T289879) Apply ReturnTypeWillChange to various implementations of built in
  interfaces.
* (T299312) Implement __serialize/__unserialize for PHP 8.1 support.
* ExtensionRegistry: Add process cache for lazy attributes.
* (T301041) ApiPageSet: Add "missing": true to missing revisions.
* Allow ParsoidModules extension schema to register services.
* (T297708) Allow setting max execution time to several special pages.
* (T302540) composer.json: Add ext-calendar to require.
* (T302540) composer.json: Add ext-simplexml to require-dev.
* (T302540) composer.json: Add various PHP extensions to suggests.
* Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
* (T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
* (T293576) listFiles: Display file name instead of version.
* (T303871) Fix @since of Title::getId().
* (T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
* wrapOldPasswords: add \n to two output calls.
* (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion
  loop if it points to a local interwiki.
* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file
  uploads with actor as a condition can result in a DoS.

== MediaWiki 1.36.3 ==

This is a security and maintenance release of the MediaWiki 1.36 branch.

=== Changes since MediaWiki 1.36.2 ===
* (T280363) mediawiki.page.ready: Introduce wikipage.indicators hook.
* (T290697) Add symfony/polyfill-php80.
* IcuCollation: Add some more icu to unicode version mappings.
* ApiBase: Annotate deprecated constants individually.
* PHPVersionCheck: Mark PHP 7.4.0 - 7.4.2 as buggy.
* (T293044) installer: Fix 5th param to sourceFile() in DatabaseUpdater.
* (T291127) Always encode spaces in cookie values as "%20".
* Use LocalFile::getHookRunner instead of LocalFile::hookRunner.
* (T293564) mediawiki.page.ready: Fire hook 'wikipage.indicators' with
  children.
* HistoryBlobStub: add getLocation() to get $mOldId.
* Fix checkStorage.php.
* checkStorage: pass no parameters to WikiRevision::getContent().
* (T292763, CVE-2021-44854) SECURITY: Do not cache private wiki completion
  results.
* (T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
* (T294796) JobQueueRedis: Replace deprecated zSize with zCard.
* (T278037) NoLocalSettings: Pass an EmptyBagOStuff to TemplateParser.
* (T212428, T267468) Allow populateContentTables to continue when there are
  bad blobs.
* (T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is
  set.
* Update pear/mail_mime to 1.10.11.
* Update deprecated Guzzle Psr7 function calls.
* (T281972) Follow-Up: I10fbd4b6a: Update @since tags as those were backported.
* Tweak error message for missing composer dependencies.
* (T296112) Allow inserting new sections named '0'.
* nukeNS: don't run purgeRedundantText() after every change.
* (T286779, T297031) installer: Fix Postgres mistakes in using changeField
  method.
* (T225888) RollbackAction: fix missing pagetitle.
* (T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in
  undo actions.
* (T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
* (T34716, T297416) SECURITY: Require 'read' right for most actions.
* (T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook
  when changing content model.

== MediaWiki 1.36.2 ==

This is a security and maintenance release of the MediaWiki 1.36 branch.

=== Changes since MediaWiki 1.36.1 ===
* Don't access MWServices prematurely in Maintenence.php.
* (T283394) Mark ApiClientLogin/ApiLogin as requiring write mode.
* Installer: Fix foundation.wikimedia.org link in config-pingback-help.
* (T283273) Make postgres IRC channel point to libera.chat.
* composer.json: Promote and pin monolog/monolog to require from require-dev.
* (T287526) JavaScriptMinifer: Recognize `...` as a single token.
* (T287526) Update wikimedia/minify to 2.2.4.
* (T289108) ExtensionProcessor: Remove loaderScripts from extension.json
  schemas.
* (T281549) Installer: Fix mediawiki-announce auto subscription code.
* FormatJson: Optimize encode() for supported PHP versions.
* (T290398) renameRestrictions.php: Update protected_titles as well.
* (T290489) objectcache: Fix PHP warning for ReplicatedBagOStuff::setMulti.
* $wgMimeTypeBlacklist - This configuration array now prohibits the RFC 4329
  form of JavaScript, 'application/javascript', as well as previous MIME types.
* (T51097, T290273) resourceloader: Call getStyleFiles from
  FileModule::getFileHashes.
* (T277788) parser: Avoid calling ParserOptions::getOption() too many times.
* (T291244) Unserialize objects in ParserCache->mExtensionData as objects.
* MysqlUpdater: Add updatelog entries for dropDefault.
* (T290776) Fix $phase check in OutputHandler.
* The wikimedia/parsoid library has been upgraded from v0.13.0 to v0.13.1.
* (T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
* (T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
  table scan.
* (T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
  Special:Contributions.

== MediaWiki 1.36.1 ==

This is a security and maintenance release of the MediaWiki 1.36 branch.

=== Changes since MediaWiki 1.36.0 ===
* (T283942) DatabaseInstaller.php: Only run core schema file if specified table
  doesn't already exist.
* (T247223) Optimise MessageCache::isMainCacheable() for the single-message
  case.
* (T283244) JavaScriptMinifer: Fix handling of "delete" as object property.
* (T284391) Fix SkinModule to correctly prepend remote path on document root
  installs.
* (T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
* (T278579) Don't send headers on ob_end_clean().
* (T285287) MultiHttpClient: Replace PHP version check with defined().
* (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging pages.

== MediaWiki 1.36.0 ==

=== Changes since MediaWiki 1.36.0-rc.0 ===
* (T248481) rdbms: Use server time in
  DatabaseMysqlBase::getLagFromPtHeartbeat().
* (T281549) WebInstaller: Don't show the announce-l subscribe checkbox for now.
* (T264214) Follow-ups for UserGroupManager.
* (T282280) resourceloader: Fix path-only URLs in wiki modules when script path
  is docroot.
* (T281972) UserIdentityValue: Introduce convenience static factory methods.
* (T230428) Make page_is_redirect and page_is_new unsigned.
* (T280292) Legacy feature should not load thumbnail style rules (only layout).
* (T283247) Freenode -> Libera per wikimedia moving from freenode to libera.
* (T280270) composer: Lock Parsoid version to specific 0.13.0 release.
* (T142663) Add extension.json merge strategy "provide_default".
* (T283540) HookContainer: Fix normalization of callback for static handler.
* (T283464) registration: Fix array order for array_replace_recursive merge
  strategy.
* (T283539) Interwiki: Fix calling "onInterwikiLoadPrefix" hook.
* (T282594) Timeless: Re-branch to 40eb3dad1for REL1_36.

== MediaWiki 1.36.0-rc.0 ==

== Upgrading notes for 1.36 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.27.

Some specific notes for MediaWiki 1.36 upgrades are below:
* MediaWiki 1.36 now requires the PHP internationalization extension (commonly
  referred to as Intl, ext-intl, or php-intl).
* The MediaWiki:Autoblock_whitelist block exemption control has been moved to
  MediaWiki:Block-autoblock-exemptionlist. If you use this feature, please move
  the MediaWiki:Autoblock_whitelist page.
* (T275334) $wgExtensionFunctions is sometimes used to change configuration
  settings. This is not safe; extension functions are run relatively late, some
  services are already initialized by that point and so they use the old
  configuration. Changes in 1.36 make this kind of breakage even more common.
  You can use the MediaWikiServices hook instead. (In the future there might be
  a dedicated hook for configuration changes.)

For notes on 1.35.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.36 ===
The MediaWiki update script, maintenance/update.php, used to accept `--nopurge`
as an option to prevent clearing caches stored in the database during upgrade.
This is no longer encouraged, and the option has been removed.

==== New configuration ====
* (T256001) $wgManualRevertSearchRadius – This setting controls a new feature
  that marks edits as reverts if they restore the page to an exact previous
  state. This configuration variable sets the maximum number of revisions of a
  page that will be checked against every new edit. Set this to 0 to disable the
  feature entirely.
* (T244058) $wgOldRevisionParserCacheExpireTime — This setting was added to
  control caching of ParserOutput for old (non-current) revisions.
* (T265263) $wgRememberMe - This setting configures the "remember me" checkbox
  on account log-in systems via RememberMeAuthenticationRequest.
* (T157145) $wgSkinMetaTags – This setting lets sysadmins configure skins that
  support meta tags. These tags make sharing of MediaWiki pages on a variety of
  social platforms more contentful and thus useful.
* (T280944) $wgIncludejQueryMigrate - This setting lets sysadmins disable the
  jQuery Migrate plugin. It has been enabled by default since MediaWiki 1.27.
  In future releases it will be disabled by default.

==== Changed configuration ====
* $wgLogos – This setting selects the logo shown on the site. The default value
  for the site logo, which is shown in an install if you have not set one, will
  now be the new logo of MediaWiki.
* (T274695) $wgAjaxEditStash — This setting, to disable the edit stashing
  feature when users start writing an edit summary, has been deprecated. In
  future releases, this feature will always be enabled.
* $wgUploadStashScalerBaseUrl – This setting, to enable remote on-demand media
  scaling, was deprecated. Use the `thumbProxyUrl` setting in $wgLocalFileRepo
  instead.
* $wgSlaveLagWarning and $wgSlaveLagCritical – These settings have been renamed,
  to $wgDatabaseReplicaLagWarning & $wgDatabaseReplicaLagCritical respectively.
  The former configuration variable names are deprecated, but will be used as
  the fall back if they are still set, and remain temporarily available for
  extensions which try to read them.
* $wgWANObjectCaches - The "coalesceKeys" option was removed without deprecation
  and replaced by a new "coalesceScheme" option, set to "hash_stop" by default.
  If you use Dynomite, then set the new "coalesceKeys" option to "hash_tag". The
  "cluster" and "mcrouterAware" options were also removed without deprecation.
  Use "broadcastRoutingPrefix" instead.

==== Removed configuration ====
* $wgUseTwoButtonsSearchForm — This setting, deprecated in 1.35, has been
  removed.
* $wgAllowImageMoving — This setting, deprecated in 1.35, has been removed. Use
  group permission settings instead. For example, to prevent sysops from
  moving files, set `$wgGroupPermissions['sysop']['movefile'] = false;`
* $wgExtNewTables, $wgExtNewFields, $wgExtNewIndexes, $wgExtPGNewFields,
  $wgExtPGAlteredFields, $wgExtModifiedFields — These settings were removed.
  They became obsolete after 1.17 overhauled the database updater, but were kept
  for backwards compatibility. The LoadExtensionSchemaUpdates hook should be
  used instead.
* $wgParserConf - This setting, deprecated in 1.35, has been removed. The last
  use of this setting was for pre-processor configuration, which was deprecated
  in 1.34 and removed in 1.35.
* $wgEnableRestAPI - This setting, ignored since 1.35, has been removed.
* $wgPagePropsHaveSortkey – This temporary setting has been removed, along with
  the schema change upgrade path it controlled. If your site is still using it,
  meaning you have not yet applied the `pp_sortkey` schema change from 1.24, you
  must now apply it before upgrading.
* The deprecated password policies PasswordCannotMatchBlacklist and
  PasswordNotInLargeBlacklist were removed. Please use
  PasswordCannotMatchDefaults and PasswordNotInCommonList respectively instead.

=== New user-facing features in 1.36 ===
* The logo of MediaWiki has changed. This means that the "Powered By MediaWiki"
  button shown in the skin footer will be different.
* All HTML5 named entities are now accepted in wikitext.
* (T106263) The file description page's alternate sizes now include 2048px.

=== New developer features in 1.36 ===
* Parser test files can now declare a dependency on a specific extension being
  loaded, not just on the presence of a certain extension tag hook. This is a
  better fit for extensions like TimedMediaHandler, which affect the output but
  don't register parser hooks. Use `extension:Foo` in the `!! hooks` section of
  your parser test file to declare a dependency on the `Foo` extension being
  loaded.
* To expose code previously present in SpecialBlock/SpecialUnblock to other
  parts of the code, or to extensions, the new BlockUser and UnblockUser command
  objects were added. Use the BlockUserFactory and UnblockUserFactory services
  to create them.
* The hook UsersPagerDoBatchLookupsHook takes now a \Wikimedia\Rdbms\IDatabase,
  instead of \Wikimedia\Rdbms\DBConnRef, as the first parameter.
* MediaHandlers can now customize the formatting of the metadata they emit by
  over-riding MediaHandler::formatTag( $key, $value ). The default for unknown
  tags is numeric formatting; non-EXIF tags which are non-numeric should always
  use this method to specify the desired formatting.
* The new 'title' type can be used to validate action API and REST API inputs.
* The new ArticleParserOptions hook allows customizing the parser options used
  to parse wikitext for an article, based on user preferences, title, etc.
* The new 'raw' type can be used to validate action API inputs. It bypasses the
  Unicode NFC normalization done on inputs of type 'string', so it more suitable
  when the input is binary or may contain deprecated Unicode sequences or
  characters (such as U+2001) that should be passed unmodified.
* (T260330) A new abstraction for running shell commands has been introduced,
  called BoxedCommand. A BoxedCommand object can be obtained with
  MediaWikiServices::getInstance()->getCommandFactory()->createBoxed().
* ResourceLoader modules can now mark themselves as ES6-only by setting
  `'es6' => true` in their module definition. ES6-only modules will not be
  executed in browsers that don't support ES6, such as IE11.

=== External library changes in 1.36 ===

==== New external libraries ====
* Added wikimedia/minify 2.2.2.
* Added wikimedia/request-timeout 1.1.0.
* Added wikimedia/shellbox 1.0.4.
* Added WVUI 0.1.0.
* Added symfony/symfony/polyfill-php80 1.23.1.

==== Changed external libraries ====
* Updated composer/semver from 1.5.1 to 3.2.4.
* Updated guzzlehttp/guzzle from 6.5.4 to 7.2.0.
* Updated jQuery from v3.4.1 to v3.6.0.
* Updated jQuery Migrate from v3.1.0 to v3.3.2.
* Updated jquery.client from 2.0.2 to 3.0.0.
* Updated OOUI from 0.39.3 to 0.41.3.
* Updated pear/mail_mime from 1.10.8 to 1.10.9.
* Updated pear/net_smtp from 1.9.1 to 1.9.2.
* Updated pimple/pimple from 3.3.0 to 3.3.1.
* Updated wikimedia/at-ease from 2.0.0 to 2.1.0.
* Updated wikimedia/cldr-plural-rule-parser from 1.0.0 to 2.0.0.
* Updated wikimedia/common-passwords from 0.2.0 to 0.3.0.
* Updated wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1.
* Updated wikimedia/html-formatter from 1.0.2 to 3.0.1.
* Updated wikimedia/ip-set from 2.1.0 to 3.0.0.
* Updated wikimedia/ip-utils from 1.0.0 to 3.0.2.
* Updated wikimedia/less.php from 3.0.0 to 3.1.0.
* Updated wikimedia/object-factory from 2.1.0 to 3.0.0.
* Updated wikimedia/php-session-serializer from 1.0.7 to 2.0.0.
* Updated wikimedia/remex-html from 2.2.0 to 2.2.2.
* Updated wikimedia/utfnormal from 2.0.0 to 3.0.2.
* Updated wikimedia/wait-condition-loop from 1.0.1 to 2.0.1.
* Updated wikimedia/xmp-reader from 0.7.0 to 0.8.1.

===== Changed development-only external libraries =====
* Updated composer/spdx-licenses from 1.5.3 to 1.5.4.
* Updated doctrine/dbal from 2.10.2 to 3.0.0.
* Updated doctrine/sql-formatter from 1.1.0 to 1.1.1.
* Updated mediawiki/mediawiki-phan-config from 0.10.2 to 0.10.6.
* Updated monolog/monolog from 1.25.3 to 2.2.0.
* Updated nikic/php-parser from 4.4.0 to 4.10.2.
* Updated psy/psysh from 0.10.4 to 0.10.5.
* Updated seld/jsonlint from 1.7.1 to 1.8.3.
* Updated symfony/yaml from ~3.4|~4.3|~5.0.5 to ~3.4|~5.1.
* Updated wikimedia/testing-access-wrapper from 1.0.0 to 2.0.0.

==== Removed external libraries ====
* The html5shiv library has been removed, as support for Internet Explorer 8 has
  been dropped.
* The wikimedia/avro suggested development-only library has been removed, as the
  support for logging in Avro format has been dropped.

=== Bug fixes in 1.36 ===
* (T190285) ApiEditPage module used to switch 'undo' and 'undoafter' parameters,
  if it founds you reversed them (based on assumption that higher revision ID
  indicates a later revision). The assumption is not always true, and is
  hindering proper edit undoing in some cases, hence the logic has been removed.
  Reversing the parameters will now lead to edit conflict or undefined behavior.
* (T263340) In history merging, pages with a content model that does not support
  redirects will now be recorded as deleted if no revision is being left in the
  source page (that's if all revisions of the page have been merged to another).

=== Action API changes in 1.36 ===
* (T269636) `Access-Control-Max-Age` was added to the default list of headers
  allowed for cross-origin API requests ($wgAllowedCorsHeaders).
* (T258108) Accounts with the 'bot' right no longer have pages automatically
  added to the watchlist when making API edits, regardless of their preferences.
  This is to reduce the size of the watchlist data in the database. To add API
  bot edits to the watchlist, explicitly set the 'watch' option.

=== Languages updated in 1.36 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T258975) Added a Latin/Cyrillic script converter for the Talysh language.
* (T245359) Split Bali script locale from "ban" (Balinese) (ban-bali).
* (T264582) Added language support for Madurese (mad).
* (T259330) Added language support for Mara (mrh).
* (T263968) Added language support for Nias (nia).
* (T270365) Added language support for Tyap (kcg).
* (T276745) Added language support for Wayuu (guc).

=== Breaking changes in 1.36 ===
* Grade C (non-JavaScript) support for Internet Explorer 8 has been dropped.
* (T249459) wfIsBadImage(), deprecated in 1.34, has been removed.
* (T176526) EditPage::getContextTitle() will now throw an exception if a context
  title was not set using setContextTitle(). Previously, this mis-use would only
  cause a deprecation warning to be emitted.
* The DeferredStringifier class, deprecated since 1.31, was removed.
* Multiple methods that fell back to the $wgUser global variable were
  individually hard deprecated previously. The following have now been removed:
  - ApiTestCase::doLogin
  - Article::doDeleteArticle
  - Article::doDeleteArticleReal
  - Article::getComment
  - Article::getCreator
  - Article::getUser
  - Article::getUserText
  - Article::insertProtectNullRevision
  - File::delete
  - File::recordUpload
  - ForeignDBFile::delete
  - ForeignDBFile::recordUpload
  - LocalFile::delete
  - LocalFile::deleteOld
  - LocalFile::recordUpload
  - PageArchive::undelete
  - RecentChange::markPatrolled
  - Title::getUserPermissionsErrors
  - Title::quickUserCan
  - Title::userCan
  - WebRequest::getLimitOffset
  - WikiPage::doDeleteArticle
  - WikiPage::insertProtectNullRevision
* The SpecialPageFactory class, deprecated in 1.32, has been removed. Use the
  SpecialPageFactory service instead.
* Multiple methods previously had optional User parameters, with fallbacks
  to the $wgUser global variable. Not passing a User to those methods was
  previously hard deprecated, and support for not passing a User has now
  been removed:
   - ArchivedFile::userCan
   - File::userCan
   - FileDeleteForm::__construct
   - FileDeleteForm::doDelete
   - LocalFileDeleteBatch::__construct
   - LogEventsList::getExcludeClause (only needed for the 'user' audience)
   - LogEventsList::userCan
   - LogEventsList::userCanBitfield
   - LogEventsList::userCanViewLogType
   - LogPage::addEntry (also accepts user id instead)
   - OldLocalFile::userCan
   - PatrolLog::record
   - Title::getNotificationTimestamp (though the entire method is deprecated)
   - WikiPage::getComment (only needed for the FOR_THIS_USER audience)
   - WikiPage::getCreator (only needed for the FOR_THIS_USER audience)
   - WikiPage::getUser (only needed for the FOR_THIS_USER audience)
   - WikiPage::getUserText (only needed for the FOR_THIS_USER audience)
* The following hooks have been removed:
   - APIQueryInfoTokens
   - APIQueryRecentChangesTokens
   - APIQueryRevisionsTokens
   - APIQueryUsersTokens
   - ApiTokensGetTokenTypes
* LogEventsList::typeAction previously accepted an optional right parameter, and
  checked if the context user ($wgUser) had that right. Passing a right was hard
  deprecated in 1.35, and support for passing a right has now been removed.
* WikiPage::doDeleteArticleReal previously accepted an optional user as its
  fifth parameter, and fell back to $wgUser if not user was provided. The
  signature changed to have the user as the second parameter, and the old
  signature was hard deprecated in 1.35. Support for the old signature has now
  been removed.
* User::addNewUserLogEntry, deprecated since 1.27, was removed.
* As part of refactoring the EditPage class, EditPage::setPreloadedContent,
  which had no known callers was removed entirely. Additionally, the following
  public methods were made private:
  - ::extractSectionTitle
  - ::getSummaryInputWidget
  - ::noSuchSectionPage
  - ::initialiseForm
* EditPage::matchSpamRegex and ::matchSummarySpamRegex, deprecated in 1.35,
  were removed. Use the SpamChecker service instead.
* The global function `wfWaitForSlaves`, deprecated in 1.27 and hard-deprecated
  in 1.35, has been removed. Use LBFactory::waitForReplication() instead.
* Calling Action::factory() with null as the first parameter, rather than a
  string, was deprecated in 1.35 and support was now removed.
* Calling Action::factory() with an object that wasn't an Article as the second
  parameter was deprecated in 1.35 and support was now removed.
* The global variable $wgMemc, deprecated since 1.35, has been removed. Usage
  should generally be migrated to WANObjectCache, or if you really need the
  internal object, use ObjectCache::getLocalClusterInstance instead.
* The preprocessDump.php maintenance script was removed.
* CategoryFinder, which was deprecated in 1.31 and hard-deprecated in 1.35,
  has been removed.
* GenderCache::singleton(), which was deprecated in 1.28 and hard-deprecated
  in 1.35, has been removed.
* Sanitizer::escapeId(), deprecated in 1.30, has been removed.
* Direct invocation of Parser::__construct() (instead of via a ParserFactory)
  now throws an exception; support has also been removed for several
  deprecated variants on the arguments passed to Parser::__construct.
  Direct invocation of Parser::__construct was deprecated in 1.34.
* Parser::setFunctionTagHook(), deprecated in 1.35, has been removed.
* The following properties of Parser, deprecated in 1.35, have been made
  private:
  - $mTagHooks - use Parser::getTags()
  - $mFunctionHooks - use Parser::getFunctionHooks()
  - $mOutput - use Parser::getOutput()
  - $mPreprocessor - use Parser::getPreprocessor()
* The ParserBeforeTidy hook, deprecated in 1.35, has been removed.
* The ParserBeforeTidy, ParserBeforeStrip, and ParserAfterStrip hooks,
  deprecated in 1.35, have been removed.
* All methods of MWTidy except for MW::tidy() have been removed. These were each
  either marked as @internal or deprecated in 1.35.
* (T248062) Mixins `.background-image-svg()` and `.background-image-svg-quick()`
  (provided by mediawiki.mixins.less), which have been deprecated since 1.35,
  have now been removed. MediaWiki no longer supports any browser which would
  require this SVG-fallback PNG support, so you can simply use the regular CSS
  `background-image:` declaration instead.
* The ResourceLoader module `mediawiki.legacy.oldshared` and its file
  'oldshared.css', deprecated since 1.35 has been removed (T248357).
* `ResourceLoader::__construct` now requires a Config parameter. The optional
  nature of this parameter was deprecated in 1.34.
* The LinkBegin and LinkEnd hooks, deprecated in 1.28, have been removed. You
  can instead use the HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd
  hooks, respectively.
* The EmailUser hook passes its fifth param, $error, by reference, to allow
  hook handlers to add error messages, indicate that they have sent the email
  instead of core, etc. Setting the parameter to something other than a
  Status object, true, false, an empty string, an array, or a MessageSpecifier,
  object, which had been deprecated in 1.29, is no longer supported, and now
  results in an MWException being thrown.
* Skin::getDynamicStylesheetQuery(), deprecated in 1.32, has been removed. You
  should use action=raw&ctype=text/css directly.
* Skin::makeI18nUrl(), deprecated in 1.35, has been removed.
* The following User methods, deprecated and moved to BlockManager in 1.34, were
  removed:
  - ::isDnsBlacklisted
  - ::inDnsBlacklist
  - ::isLocallyBlockedProxy
  - ::trackBlockWithCookie
* Support for v1 of the parser tests file format has been removed; it was
  deprecated in 1.35. (T174199)
* SpecialUnblockUser::processUIUnblock() now returns a Status object instead of
  an array of messages or a boolean value. This function was also marked as
  @internal and is no longer safe to call it publicly.
* mw.Title.getDotExtension() from the 'mediawiki.Title' module was removed
  without deprecation. You should use mw.Title.getExtension() and prepend the
  dot if need be.
* Profiler::getTemplated and Profiler::setTemplated, deprecated in 1.34, have
  been removed.
* DatabaseMysqlBase now requires MySQL version 5.6.4+ when "lagDetectionMethod"
  is set to "pt-heartbeat".
* Removed HookContainer::getOriginalHooksForTest() without deprecation. This
  method was introduced in 1.35 for internal use, and appears unused outside of
  MediaWiki core.
* ParserCache::__construct() now requires three parameters.
* Message->getFormat(), deprecated in 1.29, has been removed.
* Support for passing Article to ParserCache::get, deprecated in 1.35, has been
  removed.
* ParserCache::singleton(), deprecated in 1.30, has been removed.
* DatabaseBlock::deleteIfExpired and ::fromMaster, deprecated in 1.35, have been
  removed.
* Some deprecated AbstractBlock methods have been removed:
  - ::prevents, deprecated in 1.33
  - ::shouldTrackWithCookie, deprecated in 1.34
  - ::getBlocker, deprecated in 1.35
  - ::setBlocker, deprecated in 1.35
  - ::getBlockErrorParams, deprecated in 1.35
* Multiple DatabaseBlock methods dealing with cookies, deprecated in 1.34,
  have been removed:
  - ::setCookie
  - ::clearCookie
  - ::getCookieValue
  - ::getIdFromCookieValue
  - ::shouldTrackWithCookie
* The public static callback function SpecialUnblock::processUIUnblock has been
  removed. This method was for internal use only, and appears unused outside of
  MediaWiki core.
* ChangeTags::truncateTagDescription, deprecated in 1.35, has been removed.
* Deprecated null fallbacks in PasswordReset constructor have been removed.
* User::isEveryoneAllowed and User::getAllRights, deprecated in 1.34, has been
  removed.
* The following methods of the UserGroupMembership class, deprecated in 1.35,
  has been removed:
  - ::initFromRow
  - ::newFromRow - use UserGroupManager::newGroupMembershipFromRow
  - ::selectFields - use UserGroupManager::getQueryInfo
  - ::delete - use UserGroupManager::removeUserFromGroup
  - ::insert - use UserGroupManager::addUserToGroup
  - ::purgeExpired - use UserGroupManager::purgeExpired
  - ::getMembershipsForUser - use UserGroupManager::getUserGroupMemberships
  - ::getMembership - use UserGroupManager::getUserGroupMemberships
* The public static callback function SpecialBlock::validateTargetField has been
  removed. This method was for internal use only, and appears unused outside of
  MediaWiki core.
* The public static callback function SpecialUploadStash::tryClearStashedUploads
  has been removed. This method was for internal use only, and appears unused
  outside of MediaWiki core.
* SpecialComparePages::showDiff() ::revOrTitle(), ::checkExistingTitle(), and
  ::checkExistingRevision() were marked as @internal to allow for breaking
  changes. They are no longer safe to call. The methods were unused outside of
  MediaWiki core.
* Each special page within core now uses service injection via it constructor.
  When extending these special pages, a call to the grandparent constructor
  (`SpecialPage::__construct()`) in the sub-class would now break the derived
  special page, as the fallback code in the parent constructor cannot set the
  services as needed. Be sure to call the parent constructor when extending
  core special pages. Extending core's special pages is not part of the stable
  interface, and should generally be avoided.
* Language::getExtraUserToggles and ::viewPrevNext, deprecated in 1.34, have
  been removed.
* StreamFile::send404Message and ::parseRange, deprecated in 1.34, have been
  removed.
* SVGMetadataExtractor class, deprecated in 1.34, has been removed.
* ProcessCacheLRU class, deprecated in 1.32, has been removed.
* wfForeignMemcKey(), deprecated in 1.35, has been removed.
* LoadBalancer::safeWaitForMasterPos(), deprecated in 1.34, has been removed.
* JobQueue::factory() now requires its `idGenerator` option. The optional
  nature of this option was deprecated in 1.35.
* ApiFeedRecentChanges::getFeedObject has been changed to private, and appears
  unused outside of MediaWiki core.
* Skin::subPageSubtitle() has been changed to private method. Callers should
  use Skin::prepareSubtitle().
* RevisionDeleter::checkRevisionExistence was removed without deprecation.
  It had no known callers.
* wfForeignMemcKey() and wfMemcKey(), deprecated in 1.35, have been removed.
* MediaWiki now also requires the php-intl extension.
* BotPassword::save() now returns a Status object for the result rather than
  a bool.
* The methods in CoreTagHooks have been marked @internal and type hints have
  been added. The methods appeared to be unused outside of MediaWiki core.
* SquidPurgeClient and SquidPurgeClientPool, deprecated since 1.35, have been
  removed.
* Several methods on WikiPage will now throw an exception when called on a
  WikiPage instance that where constructed on a title that does not refer to a
  proper page (but rather a special page or interwiki link). The behavior was
  previously undefined and could in some cases lead to data corruption. Affected
  methods are: getId(), insertOn(), newPageUpdater(), doUpdateRestrictions(),
  doDeleteArticleReal(), doRollback(), and doEditContent().
* The ParserTestRunner no longer invokes the ParserTestTables hook. Instead, it
  clones all database tables before running tests, like MediaWikiIntegrationTest
  does. If an extension was mis-using the hook to *exclude* tables from the
  clone, that will no longer occur, and tests may fail.
* The following classes, which were only loaded for tests and had no uses found
  in public MediaWiki-related git, were removed:
   - MockWebRequest
   - UserWrapper
* Passing Title as a second parameter to RevisionStore::getPreviousRevision and
  getNextRevision, hard deprecated since 1.31, was prohibited.
* (T275619) Maintenance::hasOption and Maintenance::getOption now behave as
  documented and are not altered by previous calls to these methods.
* The internal class FirejailCommand was removed.
* Command::execute() now returns a Shellbox\Command\UnboxedResult instead of a
  MediaWiki\Shell\Result. Any type hints should be updated.
* WikiPage::$mIsRedirect was removed.
* ObjectCache::detectLocalServerCache(), deprecated in 1.35, was removed.
* The following functions from the Title class have been removed:
   - countRevisionsBetween
   - getAuthorsBetween
* The PageProps class was converted to a service. PageProps::overrideInstance
  was removed, and MediaWikiServices::redefineService should be used
  instead.
* Support for creating a MediaWikiTitleCodec object without the InterwikiLookup
  and NamespaceInfo services, deprecated in 1.34, was removed. Note that the
  MediaWikiTitleCodec class is not @newable or @stable to create, and should
  be retrieved from MediaWikiServices instead.
* The $wgContLang variable, deprecated in 1.32, was removed. You can instead use
  MediaWikiServices::getInstance()->getContentLanguage().
* User::clearAllNotifications(), hard deprecated in 1.35, was removed. Use
  WatchlistManager::clearAllUserNotifications() instead.
* DatabaseBlock::getBlocker can return any UserIdentity instance, not just User.
* MediaWiki::triggerJobs(), deprecated in 1.34, was removed.
* The following Article methods, deprecated in 1.35, were removed:
  - checkFlags
  - checkTouched
  - clearPreparedEdit
  - doDeleteUpdates
  - doEditUpdates
  - doPurge
  - doViewUpdates
  - exists
  - followRedirect
  - getAutoDeleteReason
  - getCategories
  - getContentHandler
  - getContentModel
  - getContributors
  - getDeletionUpdates
  - getHiddenCategories
  - getId
  - getLatest
  - getLinksTimestamp
  - getMinorEdit
  - getOldestRevision
  - getRedirectTarget
  - getRedirectURL
  - getRevision
  - getTouched
  - getUndoContent
  - hasViewableContent
  - insertOn
  - insertRedirect
  - insertRedirectEntry
  - isCountable
  - isRedirect
  - loadFromRow
  - loadPageData
  - lockAndGetLatest
  - makeParserOptions
  - pageDataFromId
  - pageDataFromTitle
  - prepareContentForEdit
  - protectDescription
  - protectDescriptionLog
  - replaceSectionAtRev
  - replaceSectionContent
  - setTimestamp
  - shouldCheckParserCache
  - supportsSections
  - triggerOpportunisticLinksUpdate
  - updateCategoryCounts
  - updateIfNewerOn
  - updateRedirectOn
  - updateRevisionOn
  - doUpdateRestrictions
  - updateRestrictions
  - doRollback
  - commitRollback
  - generateReason
* The monolog-based logging system has dropped the Avro format. Because of this,
  the AvroFormatter class and the AvroValidator utility class have been removed
  without deprecation.
* AbstractBlock::$mReason, deprecated in 1.34, was removed.
  Use AbstractBlock::getReasonComment and AbstractBlock::setReason instead.

=== Deprecations in 1.36 ===
* (T278026) The DB_MASTER constant has been deprecated in favour of DB_PRIMARY.
* (T245963) User::getGrantName() is now hard deprecated and will be removed in
  a subsequent release. Use MWGrants::grantName() instead.
* wfIncrStats() is now deprecated. Use MediaWikiServices::getInstance()
  ->getStatsdDataFactory()->updateCount() instead.
* WikiPage::doEditContent() is now deprecated. Use
  WikiPage::doUserEditContent() instead. Note that doEditContent() was also
  deprecated in 1.32 for unrelated reasons and doUserEditContent() is
  deprecated for other reasons, however, using doUserEditContent() is
  recommended over using doEditContent().
* WikiPage::doUserEditContent() is now deprecated. Use
  PageUpdater::saveRevision instead. Note that the new method expects callers
  to take care of checking EDIT_MINOR against the minoredit right, and to apply
  the autopatrol right as appropriate.
* LocalFile::recordUpload2, soft deprecated in 1.35, now emits deprecation
  warnings. Use ::recordUpload3 instead.
* Constructing a new instance of the ParserOptions class without providing
  a User object, which falls back to the global $wgUser, is now deprecated.
* The User class, which was marked as @newable in 1.35, is no longer newable,
  meaning that it is no longer safe to manually call the constructor via
  `new User`. Instead, use the UserFactory service. Additionally, the
  following static constructor methods were deprecated in favor of using the
  UserFactory service:
   - User::newFromName
   - User::newFromId
   - User::newFromActorId
   - User::newFromIdentity
   - User::newFromAnyId
   - User::newFromConfirmationCode
* The following User methods have been hard deprecated in favor of the new
  UserEditTracker service:
   - User::getFirstEditTimestamp
   - User::getLatestEditTimestamp
* The confusingly-named User->isLoggedIn() method has been deprecated in favour
  of the method it wraps, User->isRegistered().
* Use of the `preprocessor=Preprocessor_DOM` option in parser test files has
  been deprecated. Preprocessor_DOM was removed in 1.35.
* ParserOptions::setTidy() has been deprecated. It has had no effect since
  1.35.
* Sanitizer::escapeIdReferenceList() has been deprecated; it will eventually
  be made private to the class, as it appears to have no uses outside the
  Sanitizer class.
* Sanitizer::hackDocType() is deprecated; it will eventually be made private.
* Skin::getIndicatorsHTML() is deprecated. The functionality can be retained
  by reimplementing the method using the raw indicators data from
  OutputPage::getIndicators.
* Skin::makeVariablesScript() has been deprecated. Use
  ResourceLoader::makeInlineScript() instead.
* SpecialPageFactory::getRestrictedPages() has been deprecated.
  Use SpecialPageFactory::getUsablePages() instead.
* Title::nameOf() is deprecated; use Title::newFromID()->getPrefixedDBkey()
  instead.
* DatabaseBlock::insert, DatabaseBlock::update, DatabaseBlock::purgeExpired and
  DatabaseBlock::delete are deprecated. Use DatabaseBlockStore::insertBlock,
  DatabaseBlockStore::updateBlock, DatabaseBlockStore::purgeExpiredBlocks and
  DatabaseBlockStore::deleteBlock instead.
* SpecialBlock::getTargetAndType and AbstractBlock::parseTarget are deprecated.
  Call BlockUtils::parseBlockTarget instead.
* SpecialUnblock::processUnblock was deprecated - use UnblockUserFactory
  service instead.
* Deprecated MediaWikiIntegrationtestCase::removeTemporaryHook() in favor of
  MediaWikiIntegrationtestCase::clearHook().
* Skin::getSearchLink(), also exposed as 'searchaction' option in SkinTemplate,
  has been deprecated. Use Title or SpecialPage methods directly.
* Skin::getAllowedSkins and ::getSkinNames have been deprecated. Use their
  respective equivalents in SkinFactory instead.
* The RollbackComplete hook has been deprecated, use the PageSaveComplete hook
  instead.
* Skin::makeUrl() has been deprecated. Title methods should be used instead.
* Skin::privacyLink(), Skin::disclaimerLink() and Skin::aboutLink() have been
  deprecated. Please use Skin::footerLink() instead.
* Skin::getLogo() has been deprecated. Use ResourceLoaderSkinModule instead.
* The module `mediawiki.toc.styles` has been replaced by
  ResourceLoaderSkinModule. If you are having problems styling table of contents
  ensure you have an updated skin.
* Skin::mainPageLink() has been deprecated. Use LinkRenderer service instead.
* BaseTemplate::getToolbox() method has been hard deprecated. The toolbox data
  is now available in a sidebar data array which you can get from any class
  that's extending QuickTemplate class.
* Constructing a DefaultPreferencesFactory, LinkHolderArray or PasswordReset
  without a $hookContainer parameter is deprecated.
* Autopromote class, soft deprecated since 1.35, now emits deprecation warnings.
  Use UserGroupManager instead.
* SpecialBlock::canBlockEmail has been deprecated. Please use
  BlockPermissionChecker::checkEmailPermissions instead.
* SpecialBlock::checkUnblockSelf has been deprecated. Please use
  BlockPermissionChecker::checkBlockPermissions instead.
* SpecialBlock::parseExpiryInput was deprecated - use
  BlockUser::parseExpiryInput instead.
* SpecialBlock::validateTarget has been deprecated, use BlockUtils instead.
* SpecialBlock::validateTargetField has been deprecated for external use,
  use BlockUtils instead.
* SpecialPage::getLanguageConverter has been deprecated, use
  LanguageConverterFactory::getLanguageConverter() directly.
* ParserCache::getKey has been deprecated. Use ParserCache::getMetadata and
  ParserCache::makeParserOutputKey instead.
* The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4,
  was removed. MediaWiki support for PHPUnit 4 ended with the removal of HHVM
  support.
* The PHPUnit6And8Compat class, used to provide compatibility with PHPUnit 6,
  was removed without deprecation. This class was introduced during the
  upgrade to PHPUnit 8, but never used.
* MediaWikiIntegrationTestCase::assertType, hard-deprecated in 1.35 due to
  incompatibility with PHPUnit 8, was removed.
* ParserCache::getETag has been deprecated, instead build suitable etag
  explicitly.
* The following functions from the Language class have been hard deprecated
  and will be removed in a subsequent release:
   - findVariantLink
   - convertTitle
   - updateConversionTable
   - commafy
* The following functions from the Title class have been hard deprecated:
   - getPreviousRevisionID
   - getNextRevisionID
   - getEarliestRevTime
* The following functions from the User class have been hard deprecated:
   - getDefaultOptions
   - getDefaultOption
* The mw.language.commafy client-side method has been deprecated, to match
  the deprecation of Language::commafy. Use mw.language.convertNumber
  instead.
* The "es6-promise" module has been deprecated. Use "es6-polyfills" instead.
* Title::isDeleted() and Title::isDeletedQuick() have been deprecated. Please
  use Title::getDeletedEditsCount() and Title::hasDeletedEdits() instead.
* Article::getContentObject, soft-deprecated since 1.32, was hard-deprecated.
* WikiRevision::importUpload, soft-deprecated since 1.31, was hard-deprecated.
* Html::infoBox() has been deprecated. There's no replacement.
* Message::toString() without a $format parameter, soft-deprecated since 1.28,
  was hard-deprecated. Use explicit formatting methods instead, such as
  Message::text() and Message::escaped().
* BagOStuff::makeKeyInternal() usage outside of BagOStuff has been deprecated.
* BagOStuff::setDebug() is deprecated and calls to it are ignored. Debug logs
  are now unconditionally enabled.
* The following global functions have been hard deprecated:
   - wfAppendToArrayIfNotDefault
   - wfAcceptToPrefs
   - wfClearOutputBuffers
   - wfConfiguredReadOnlyReason
   - wfDebugMem
   - wfGetPrecompiledData
   - wfNegotiateType
* BeforeParserFetchTemplateAndtitleHook has been deprecated; replace
  with the new BeforeParserFetchTemplateRevisionRecord hook. (The
  similar ParserFetchTemplateHook was deprecated in 1.35; the new hook
  replaces both.)
* The InterwikiLoadPrefix hook has been deprecated; it is not compatible
  with future wikitext parsers (which need to enumerate all interwiki
  prefixes). In test cases please use $wgInterwikiCache instead.
* WikiPage instances should no longer be constructed for titles that do not
  represent editable pages (e.g. special pages). WikiPages were always
  documented to represent "MediaWiki article and history".
* Skin::getSkinStylePath() has been deprecated. Please replace usages with
  the direct path to the resources.
* The second argument of EnhancedChangesList::getDiffHistLinks, $query, has
  been deprecated.
* The ParserTestTables hook has been deprecated; it is no longer necessary
  after a ParserTestRunner refactoring.
* The following classes have been hard deprecated: CachedAction,
  SpecialCachedPage, CacheHelper, ICacheHelper. They were unused in MediaWiki
  ecosystem, so no replacement was provided.
* The ProtectionForm::buildForm hook has been deprecated. Please use the
  ProtectionFormAddFormFields hook instead.
* RevisionStore::newMutableRevisionFromArray has been hard deprecated. Instead,
  MutableRevisionRecord should be constructed directly via constructor.
* UserIdentity::getActorId() is deprecated. The actor ID should not be exposed
  to application logic. Storage layer code should use the ActorNormalization
  service for normalizing and denormalizing user names.
* Constructing a UserIdentityValue with an actor ID as the third parameter is
  deprecated. The parameter should be omitted. Storage layer code should use
  the ActorNormalization service for normalizing and denormalizing user names.
* Command::cgroup() is deprecated and no longer functional. $wgShellCgroup is
  now implemented as an Executor option.
* Command::restrict() is deprecated. Instead use the new separate accessors.
* MWTidy::tidy() is deprecated. Use MediaWikiServices::getTidy()-tidy() instead.
* TidyDriverBase::supportsValidate() is deprecated; it has always returned
  false since 1.33.
* WatchedItem::getUser hard-deprecated in favor of ::getUserIdentity.
* WatchedItemStoreInterface::enqueueWatchlistExpiryJob was hard deprecated in
  favor of the new method maybeEnqueueWatchlistExpiryJob that takes care of
  relevant configuration checks.
* LogEntry::getPerformer() and its implementations have been hard-deprecated, in
  favor of ::getPerformerIdentity().
* AuthManager::singleton(), deprecated in 1.35, is hard deprecated. Use
  MediaWikiServices::getAuthManager() instead.
* User::clearNotification(), deprecated in 1.35, is hard deprecated. Use
  WatchlistManager::clearTitleUserNotification() instead.
* Passing string to DatabaseBlock::setBlocker was deprecated. Only UserIdentity
  is now allowed.
* DatabaseBlock constructor 'byText' option was deprecated in favour of 'by'
  option, which now accepts UserIdentity. Passing user ID is deprecated.
* Parser::getUser was deprecated. Use Parser::getUserIdentity instead.
* DatabaseBlock::isWhitelistedFromAutoblocks was deprecated. Use
  DatabaseBlock::isExemptedFromAutoblocks instead.
* User::isIPRange(), deprecated in 1.35, is hard deprecated.
  Use the UserNameUtils service or IPUtils directly.
* BaseTemplate::getFooterIcons(), deprecated in 1.35, is hard deprecated. Read
  footer icons from template data requested via $this->get('footericons').
* `box-shadow()` LESS mixin from mediawiki.mixins is deprecated due to updated
  basic browser support. Use unprefixed property `box-shadow:` instead.
* MergeHistory::checkPermissions was deprecated. Use ::probablyCanMerge or
  ::authorizeMerge instead.
* User::isValidUserName(), deprecated in 1.35, is hard deprecated.
  Use the UserNameUtils service instead.
* The TitleArrayFromResult hook has been deprecated.
* The EditPageBeforeEditToolbar hook has been deprecated; it has become
  defunct after the classic edit toolbar was removed. Use one of the many
  other EditPage hooks instead.
* Deprecated the class name MediaWiki\User\WatchlistNotificationManager; use
  MediaWiki\Watchlist\WatchlistManager instead. Deprecated the method
  MediaWikiServices->getWatchlistNotificationManager(); use
  MediaWikiServices->getWatchlistManager() instead.
* The "ArticleEditUpdatesDeleteFromRecentchanges" hook, deprecated in 1.35, has
  been removed. Other hooks like "RecentChange_save" can be used instead.

=== Other changes in 1.36 ===
* The 'tidy' key in ParserOptions (used in the parser cache) has been removed.
  It has had no effect since 1.35.
* A future release of MediaWiki will make `{{=}}` a built-in parser function,
  for use when automatically escaping the `=` character in template arguments.
  A tracking category and parser warning have been added to this release when
  `{{=}}` is used and it expands to something other than `=`.
* The implementation of TestFileReader::read has been changed to use Parsoid's
  parser test file parser. This should be compatible with existing code, but it
  only supports version 2 of the test file specification and may be more strict
  when parsing invalid input, including duplicate tests.
* BeforeParserFetchTemplateRevisionRecord, a new hook, unifies and replaces the
  old BeforeParserFetchTemplateAndtitleHook and ParserFetchTemplateHook.
* The SkinLessImportPaths attribute was added, allowing skins to add a directory
  to the import path for LESS stylesheets. Skins can use this to provide a
  custom version of mediawiki.skin.variables.less, setting skin-specific values
  for certain LESS variables.
* The interaction between ContentHandler::getParserOutputForIndexing() and
  ContentHandler::getDataForSearchIndex() has been clarified (the latter should
  only be called with the result of the former). Extensions may override
  getParserOutputForIndexing() to skip generating HTML, which may improve
  indexing performance. (The default implementation still generates HTML, and
  getDataForSearchIndex() implementations can still rely on it if they do not
  over-ride getParserOutputForIndexing().)
* Article::fetchContentObject, ::mContentObject, ::mContentLoaded,
  ::mRevIdFetched, all deprecated since 1.32, were removed.
* Article::mParserOptions and ::setParserOptions were removed.
* Article and ImagePage::getEmptyPageParserOutput, unused, were removed.
* ParserCache's default serialization format was changed from PHP serialization
  to JSON serialization. In case some installed extension do not support JSON
  yet, $wgParserCacheUseJson can be used to revert back to PHP serialization.
* PermissionManager::groupHasPermission, ::getGroupPermissions and
  ::getGroupsWithPermission were deprecated, use GroupPermissionsLookup
  service instead.
* WatchedItemStoreInterface now accepts PageIdentity where it accepted
  LinkTarget, calling with LinkTarget was deprecated.
* 'movable' attribute has been added to the 'namespaces' property of
  extension.json schema. Extensions that define namespaces can set it to
  `false` to disallow moving pages in the specified namespace. Extensions
  should either use this or NamespaceIsMovableHook, but not both. The hook
  overrides the attribute.

== Compatibility ==

MediaWiki 1.36 requires PHP 7.3.19 or later and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
but support for them is somewhat less mature.

The supported versions are:

* MySQL 5.5.8 or later
* PostgreSQL 9.4 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.

= MediaWiki 1.35 =

MediaWiki 1.35 should mostly work on PHP 8.0/8.1, however it is not
currently actively supported. Testing (on a development wiki!) is
appreciated, and bugs with PHP 8.0/8.1 on MediaWiki 1.35 will be accepted.

It is anticipated that in a later MediaWiki 1.35 point release, we can
declare 1.35 as supporting PHP 8.0/8.1.

PHP 8.0 workboard: https://phabricator.wikimedia.org/tag/php_8.0_support/
PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
PHP 8.2 workboard: https://phabricator.wikimedia.org/tag/php_8.2_support/
PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/

== MediaWiki 1.35.13 ==

This is a maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.12 ===
* Tarball release to fix backport issues with patch for T341529.

== MediaWiki 1.35.12 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.11 ===
* Localisation updates.
* (T333050, CVE-2023-45363) SECURITY: Fix infinite loop for
  self-redirects with variants conversion.
* (T341434) WikiImporter: Improve error message output.
* (T341737) ApiBase: Cast $id to string in filterIDs.
* (T342632) ApiComparePages: Add help url.
* (T347227) ImportReporter: Make callback functions public.
* doc: Improve description of type in extension.schema.v1.json.
* (T340221, CVE-2023-45360) SECURITY: XSS via
  'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
* (T341529, CVE-2023-45362) SECURITY: diff-multi-sameuser
  ("X intermediate revisions by the same user not shown") ignores username
  suppression.
* (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML
  file to Special:Upload (non-standard configuration).

== MediaWiki 1.35.11 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.10 ===
* Localisation updates.
* (T333990) composer.json: Explicitly pin psr/http-message to 1.0.1.
* (T335203, CVE-2023-29197) SECURITY: Upgrading guzzlehttp/psr7
  (1.9.0 => 1.9.1).
* (T269636) Add Access-Control-Max-Age to $wgAllowedCorsHeaders.
* (T322944) Add Authorization to default $wgAllowedCorsHeaders.
* (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.
* (T297917) objectcache: avoid use of ctype_digit() in
  WANObjectCache::adaptiveTTL().
* (T330464) Work around argument corruption bug in XMLReader::open.
* (T313157) IndexPager: Also protect against $offset being 0.
* (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

== MediaWiki 1.35.10 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.9 ===
* Localisation updates.
* (T324895) MWCallbackStream: Add explicit $stream property.
* Remove /images .htaccess rules that are no longer relevent.
* Disable php in .htaccess of images directory as a hardening measure.
* (T322583) Include missing message parameter in message.
* Fix phan error when Excimer is enabled.
* (T274966) tests: Make pass on php8.0.
* (T323373) Parser: Fix extractSections() behavior for PHP >= 8.0.
* (T326021) Add matrix: to $wgUrlProtocols.
* api/en.json: api-help-datatype-expiry add missing 'may'.
* (T225218) Wait until the recent changes are updated.
* (T328222) Pass empty string to strlen() if schema is null for
  PostgresDatabase.
* (T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
* (T289926) SpecialRevisionDelete: Set default of '' for wpReason.
* (T155582, T328503) Fix XML dumps for content types with non-string
  getNativeData().
* (T295958, T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
* (T314099) revisiondelete: Replace dynamic property Status::$itemStatuses.
* (T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
* (T292348) WikiImporter: do not fail if upload entry in dump lacks 'text'
  tag.
* (T329484) API: Fix query+allimages user parameter description.
* (T330529) SpecialEditTags: Set default of '' for wpReason.
* (T330526) htmlform: Handle null from HTMLFormField::getDefault in
  multiselects.
* (T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted
  XFF headers.

== MediaWiki 1.35.9 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.8 ===
* Localisation updates.
* (T319000) WebInstaller: Don't try and run trim() on null.
* (T320864) When calling mail(), use an array for headers.
* (T311567) In ManualLogEntry, cast the comment to string.
* (T323082) Upgrading wikimedia/xmp-reader (0.7.0 => 0.8.5).
* Language: Handle ronna and quetta.
* (T304515) LCStoreStaticArray: atomically replace the cache file.
* (T324890, T324891, T324901) Parser: Allow dynamic properties on PHP 8.2.
* (T322637) SECURITY: sqlite should not create DB file world-readable.

== MediaWiki 1.35.8 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.7 ===
* Localisation updates.
* (T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
* (T311559) SpecialListFiles: user parameter isn't always present.
* (T311561) ImageListPager: Don't call htmlspecialchars() on null.
* (T311920) SpecialBlockList: Prevent passing null to trim().
* (T311921) SpecialUserrights: Don't pass null to str_replace.
* (T311570) SpecialWithoutInterwiki: Don't pass null through to
  Title::capitalize().
* (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser.
* (T312519, T312520) Parser::extensionSubstitution() Don't run substr() on null.
* (T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
* (T312302) SpecialRedirect: Don't pass null to explode.
* RemoveInvalidEmails: Fix quoting for postgres.
* (T312678) import: UploadSourceAdapter::stream_read() don't pass null to
  strlen().
* (T312300) SpecialDiff: Don't pass null to explode().
* (T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
* (T289926) Handle null passed to wfShorthandToInteger() and Html::element().
* (T289926) Ensure that strlen() does not get passed a (valid) null.
* (T312301) SpecialDiff: Don't pass null to trim().
* Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
* (T289926) Ensure we don't pass null to mb_strlen.
* (T312305, T311572, T311571, T311578) HtmlForm: Null coalescence in trim()
  calls.
* (T289926) site: Consistently return null from Site::getDomain().
* (T307304, T289879) filebackend,jobqueue: Add signature for
  FilterIterator::accept().
* (T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
* Add application/vnd.ms-opentype to MIME list.
* Allow composer/installers plugin in composer.json.
* (T313663) Make HandlerTestTrait compatible with php8.1.
* (T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
* Change type hints for BatchRowIterator and NotRecursiveIterator for
  compatibility with PHP 8.1.
* (T313663) [php8] Don't use strlen on potentially null string.
* (T313663) [php8.1] Suppress test warning about providing null.
* (T313663) Parser will use current timestamp instead of null if passed a
  RevisionRecord that does not have a timestamp.
* (T313663) Add explicit null check for $sha in FileBackend [php8.1].
* (T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
* (T289879, T289926) Get rid of warnings on PHP 8.1.
* rdbms: fix some PHP 8 warnings in Database/LoadBalancer/LBFactory.
* (T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
* Fix a couple deprecation warnings in the installer under PHP 8.1.
* (T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
* (T314096) Migrate use of ${var}-style string interpolation.
* (T313663, T313662) Make default value for optional args {{PAGESINCAT:..}} be
  '' not null.
* (T314225) SpecialCategories: Null coalescene $par.
* (T314099) User: Allow dynamic properties on PHP 8.2.
* (T314404) SpecialGoToInterwiki: Null coalescene $par.
* (T314397) SpecialBlock: Better handle null in getTargetUserTitle.
* (T314099) phpunit: Fix trivial dynamic property usages in tests.
* (T314405) UploadStash: Check if us_prop is set in the fileMetadata.
* (T314550) SpecialMergeHistory: Set timestamp to '' if no mergepoint.
* (T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
* api: Add rel=nofollow to help examples.
* (T314824) tests: Update parser test after i18n change.
* (T263927) Add autocomplete HTML attribute to common auth form fields.
* (T307613) Validate length of user email on Special:ChangeEmail/
  Special:CreateAccount.
* (T314906, T314907) SpecialBlock: Set defaults for wpPageRestrictions and
  wpNamespaceRestrictions.
* (T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
* (T315892) composer.json: Pin phpunit to 8.5.28.
* (T229092) MigrateActors.php: ignore duplicate creations of actors.
* (T313049) Bump wikimedia/parsoid to v0.12.3.
* (T317750) session: Fix broken SessionTest case due to PHPUnit dependency
  change.
* (T318460) SpecialChangeEmail: Set default for returntoquery.
* (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
  in an IP range check on Special:Contributions.
* (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
  of hidden users.

== MediaWiki 1.35.7 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.6 ===
* Localisation updates.
* (T289879) Type hints for ArrayAccess.
* (T304783) TemplateParser: avoid warnings when called by NoLocalSettings.
* Rebuilt vendor with composer 2.3.3.
* (T289879) Address some deprecations for PHP 8.1.
* Fix old_name in UserLogoutComplete hook.
* (T286260, T307979) objectcache: normalize $exptime to a TTL in
  APCUBagOStuff/WinCacheBagOStuff.
* MediaSearchWidget should declare an explicit dependency on mediawiki.user
  module.
* (T288423) WikiImporter: Replace deprecated WikiRevision::setText.
* (T309377, CVE-2022-29248, T311384, CVE-2022-27776) Updating guzzlehttp/guzzle
  (6.5.5 => 6.5.8).
* (T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
* (T311272) Call parent constructor of AddSite maintenance script first.
* MediaWiki: Don't eagerly initialize action name.
* (T289926) Avoid passing null to trim() in SkinTemplate.
* (T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
* (T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
* (T311569) FileBackend::isStoragePath() Handle being passed null.
* (T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
* (T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
* (T281741) ChangeTags: Fix adding CSS classes for hidden tags.
* (T296642) changetags: Fix management of a '0' tag.
* (T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
* (T303033) Handle null in ChangeTags::modifyDisplayQuery.

== MediaWiki 1.35.6 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.5 ===
* (T298261) Fix support for Composer 2.2.
* (T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
* Update doctrine/dbal (3.0.0 => 3.1.5).
* (T298564) MemcachedClient: Add support for IPv6.
* (T297543, CVE-2022-28202) SECURITY: properly escape output used within
  galleries and Special:RevisionDelete.
* (T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
* (T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
* (T274966) Upgrading wikimedia/html-formatter (1.0.2 => 2.0.1).
* Fix the json schema and the extension processor for Parsoid extension modules.
* (T299696) update.php: Avoid passing null to substr.
* In PHP 8.1 don't throw exceptions from mysqli.
* (T289926) SiteConfiguration: Don't pass null to str_replace().
* (T264735) Fix deprecation warning from CURLPIPE_HTTP1.
* (T260735) Stop using is_resource() where possible.
* (T289879) Apply ReturnTypeWillChange to various implementations of built in
  interfaces.
* (T299312) Implement __serialize/__unserialize for PHP 8.1 support.
* ExtensionRegistry: Add process cache for lazy attributes.
* (T301041) ApiPageSet: Add "missing": true to missing revisions.
* Allow ParsoidModules extension schema to register services.
* (T297708) Allow setting max execution time to several special pages.
* Upgrading wikimedia/object-factory (v2.1.0 => v2.2.0).
* (T302540) composer.json: Add ext-calendar to require.
* (T302540) composer.json: Add ext-simplexml to require-dev.
* (T302540) composer.json: Add various PHP extensions to suggests.
* Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
* (T303871) Add Title::getId() as an alias for ::getArticleId().
* (T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
* (T293576) listFiles: Display file name instead of version.
* (T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
* wrapOldPasswords: add \n to two output calls.
* (T304993) Make editcontentmodel a part of editpage grant.
* (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion
  loop if it points to a local interwiki.
* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file
  uploads with actor as a condition can result in a DoS.

== MediaWiki 1.35.5 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.4 ===
* (T290697) Add symfony/polyfill-php80.
* IcuCollation: Add some more icu to unicode version mappings.
* ApiBase: Annotate deprecated constants individually.
* PHPVersionCheck: Mark PHP 7.4.0 - 7.4.2 as buggy.
* (T293044) installer: Fix 5th param to sourceFile() in DatabaseUpdater.
* (T291127) Always encode spaces in cookie values as "%20".
* Use LocalFile::getHookRunner instead of LocalFile::hookRunner.
* HistoryBlobStub: add getLocation() to get $mOldId.
* Fix checkStorage.php.
* checkStorage: pass no parameters to WikiRevision::getContent().
* (T292763, CVE-2021-44854) SECURITY: Do not cache private wiki completion
  results.
* (T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
* (T250068) resources: Upgrade jQuery from 3.4.1 to 3.6.0.
* (T250068) resources: Upgrade jquery-migrate from 3.1.0 (patched) to 3.3.2
  (patched).
* (T294796) JobQueueRedis: Replace deprecated zSize with zCard.
* (T212428, T267468) Allow populateContentTables to continue when there are
  bad blobs.
* (T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is
  set.
* Update pear/mail_mime to 1.10.11.
* Update deprecated Guzzle Psr7 function calls.
* Tweak error message for missing composer dependencies.
* (T296112) Allow inserting new sections named '0'.
* nukeNS: don't run purgeRedundantText() after every change.
* (T225888) RollbackAction: fix missing pagetitle.
* (T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in
  undo actions.
* (T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
* (T34716, T297416) SECURITY: Require 'read' right for most actions.
* (T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook
  when changing content model.

== MediaWiki 1.35.4 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.3 ===
* (T283394) Mark ApiClientLogin/ApiLogin as requiring write mode.
* (T283273) Make postgres IRC channel point to libera.chat.
* (T289108) ExtensionProcessor: Remove loaderScripts from extension.json
  schemas.
* (T281549) Installer: Fix mediawiki-announce auto subscription code.
* FormatJson: Optimize encode() for supported PHP versions.
* (T290398) renameRestrictions.php: Update protected_titles as well.
* $wgMimeTypeBlacklist - This configuration array now prohibits the RFC 4329
  form of JavaScript, 'application/javascript', as well as previous MIME types.
* (T51097, T290273) resourceloader: Call getStyleFiles from
  FileModule::getFileHashes.
* (T277788) parser: Avoid calling ParserOptions::getOption() too many times.
* (T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
* (T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
  table scan.
* (T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
  Special:Contributions.

== MediaWiki 1.35.3 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

=== Changes since MediaWiki 1.35.2 ===
* (T259685) SQLite compatibility with ZeroConf VisualEditor was fixed in 1.35.2.
* (T196906, T242751) Fix the test MonologSpiTest::testDefaultChannel.
* (T279964) Parser: Trim trailing whitespace as the last step in pre-save
  transform.
* (T278026) rdbms: Add DB_PRIMARY to replace DB_MASTER.
* (T252853) Update updateSearchIndex.php to 2006+ standards.
* (T276945) Define a batch size in maintenance/manageJobs.php.
* (T276945) Implement JobQueueDB::getAllAbandonedJobs.
* (T269676) authevents: strval() variables passed to status when logging.
* (T280944) $wgIncludejQueryMigrate - This setting allows the jQuery Migrate
  plugin to be disabled. It has been enabled by default since MediaWiki 1.27.
* (T281584) apihelp-query+iwlinks-param-prop: s/interlanguage/interwiki/.
* (T281635) Delete maintenance/cleanupAncientTables.php.
* (T282133) RedisConnectionPool: Suppress phan issue.
* (T281549) WebInstaller: Don't show the announce-l subscribe
  checkbox temporarily.
* (T278266) Fix annoying E_NOTICE about undefined 'alt' index in
  Skin#makeFooterIcon.
* (T264214) UserRightsProxy::addGroup has to be allowed to update the
  old group as well, which is used for granting interwiki rights.
* (T269776, T278266) getFooterIcons should not return empty arrays.
* (T274966) Skip AvroFormatterTest::testSchemaNotAvailable on PHP 8.0.
* phpunit: fail on warnings.
* (T283247) Freenode -> Libera per wikimedia moving from
  freenode to libera.
* (T243124) Make phpunit:unit accept extension*.json to populate the classes.
* (T142663) Add extension.json merge strategy "provide_default".
* (T283540) HookContainer: Fix normalization of callback for static handler.
* (T283464) Fix array order for array_replace_recursive merge strategy.
* (T247223) Optimise MessageCache::isMainCacheable() for the single-message
  case.
* (T278579) Don't send headers on ob_end_clean().
* (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging
  pages.

== MediaWiki 1.35.2 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

MediaWiki 1.35.2 supports Composer 2.0. It is recommended to make sure your
libraries are up to date on Composer 1.x, before running Composer 2.x.

While normally running update.php isn't required for point releases,
it is recommended to run it for 1.35.2 so that iwlinks.iwl_prefix is
updated to take 32 characters.

=== Changes since MediaWiki 1.35.1 ===
* (T270450) The confusingly-named User->isLoggedIn() method has been deprecated
  in favour of the method it wraps, User->isRegistered().
* Upgrade pimple/pimple from 3.3.0 to 3.3.1 for PHP 8.0 support.
* Upgrade seld/jsonlint from 1.7.1 to 1.8.3 for PHP 8.0 support.
* Upgrade doctrine/dbal from 2.10.4 to 3.0.0 for PHP 8.0 support.
* (T270734) Fix display of Special:Preferences URL in password reset email.
* (T252774, T271441) resourceloader: Give SkinModule 'features' option an
  extensible default.
* (T271441) Unknown features shouldn't break style output.
* (T264986) Make use of CURLMOPT_MAX_HOST_CONNECTIONS conditional on having
  curl >= 7.30.0.
* DefaultSettings.php: Update $wgPingback documentation.
* Fix docs for LanguageConverter::translate.
* (T272250) Don't rely on implicit string->int cast in comparison.
* (T272327) Exif::isSlong: Cast input to float so PHP 8.0 abs() doesn't whine.
* (T272328) UploadBase: Don't call MimeAnalyzer if mTempPath is null.
* Remove nonfunctional default sampling for WANObjectCache metrics.
* (T258851) Prevent service injection to LoadExtensionSchemaUpdates hook.
* (T270852) Hooks: Map dash character to underscore when generating hook names.
* (T271551, T270145) Fix fetching ipblock-exempt within
  BlockManager::getUserBlock.
* PHPVersionCheck: The PHP Group only supports PHP >= 7.3.0.
* (T248925) Set empty closures in DatabaseTest to fix PHP 8 tests.
* (T34217) rdbms: Remove outdated MySQL 4 references and fix doc URLs.
* (T248925) Special:Contributions reports negative namespace error on PHP 8.
* (T248925) objectcache: Fix non-numeric string check in HashBagOStuff for
  PHP 8.
* (T248925) Fix CacheTime::getCacheExpiry for PHP 8.
* (T259685) Allow REST API POST handlers to opt out of mandatory SQLite locking.
* (T91820, T259685) MWLBFactory: rename magic HTTP header for opting out of
  SQLite write lock.
* (T272326) Fix DeprecationHelperTest on PHP 8.
* Upgrade wikimedia/less.php from 3.0.0 to 3.1.0 for PHP 8.0 support.
* (T236639) OutputPage: Make $wgDebugRedirects work again.
* (T274648) registration: Allow reusing cached metadata between wikis.
* CdnCacheUpdate: Send full URL instead of path to Curl for purge.
* Upgrade monolog/monolog from 1.25.3 to 2.2.0 for PHP 8.0 support.
* FileBackend: Do not use SOCKET_ENOENT on windows.
* (T275441) ApiQueryUserInfo: Allow all uiprops to be requested at once.
* (T275261) Escape wikitext in the title in invalid title error messages.
* (T275242) Extend iwlinks.iwl_prefix to VARBINARY(32) on MySQL.
* (T246594, T270228) PHPVersionCheck: Complain about known-bad versions above
  minimum.
* (T275824) Upgrade wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1 for
  Composer 2.0 support.
* (T269293) Record all used options in metadata.
* Allow usage of Composer 2.0 to install MediaWiki's dependencies.
* (T259872) skins: Call headElement() after getTemplateData() in SkinMustache.
* (T277009, CVE-2021-30158) SECURITY: Allow blocked users to access
  Special:ResetTokens.
* (T272412) Add "Account data" section to user preferences.
* (T268310) Add list of thumbnail urls to LocalFilePurgeThumbnails hook.
* (T277520) registration: Allow specifying immovable namespaces in
  extension.json.
* (T275619) Maintenance::hasOption and Maintenance::getOption now behave as
  documented and are not altered by previous calls to these methods.
* (T254688) Remove page inner join from subquery in SpecialWhatLinksHere.
* (T122124) signup: added help message for security.
* (T278014, CVE-2021-30154) SECURITY: Escape mediastatistics-header-* messages
  on Special:NewFiles.
* (T278058, CVE-2021-30157) SECURITY: Escape rcfilters-filter-* messages on
  ChangesList pages.
* (T277414) HTMLFormField: Use non namespaced class name rather than
  static::class.
* (T268673) maintenance: Don't create SearchUpdate in rebuildtextindex.php
  for page_namespace below 0.
* (T246594, T270228) Mark ParserOptionsTests skipped on PHP 7.4.0-7.4.8.
* (T268230) Switch to new MediaWiki logo by Serhio Magpie.
* (T271735) Expand config-pingback-help, link to privacy policy in
  config-pingback.
* Fix documentation of user-global in $wgRateLimits.
* BackupDumper: Add -o as shortcode for --output.
* (T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
* (T270713, CVE-2021-30152) SECURITY: Allow user to only apply protection they
  have right to do so via action=protect.
* (T272386, CVE-2021-30159) SECURITY: Non-admin deleted enwiki page in fast
  double move.
* (T270988, CVE-2021-30155) SECURITY: ContentModelChange: Check that user can
  create pages.
* (T279451, CVE-2021-30458) SECURITY: Parsoid comment fostering allows for
  inserting mostly arbitrary <meta> tags.

== MediaWiki 1.35.1 ==

This is a security and maintenance release of the MediaWiki 1.35 branch.

While normally running update.php isn't required for point releases,
it is recommended to run it for 1.35.1 so that sites.site_language is
updated to take 35 characters.

Watchlist Expiry is no longer considered experimental, but is off by default.
To enable it, set $wgWatchlistExpiry = true; in your LocalSettings.php.

=== Changes since MediaWiki 1.35.0 ===
* (T263929) purgeList.php Fix all-namespaces option to match one used in code.
* (T248719) ParserCache::get - fix wfDeprecated call.
* (T261430) WatchlistExpiryWidget: Move focus to expiry dropdown after hitting
  Tab.
* Preload mediawiki.watchstar.widgets before api request.
* (T261030) ApiEditPage: Show existing watchlist expiry if status is not being
  changed.
* (T264502) Fix PHP 8 compat with strcspn() $length parameter exceeding string.
* (T248925) Remove final modifier on private function.
* (T264683) Remove ipb_anon_only from ipb_address_unique index addition.
* (T261415) Add days left messages to changes-lists' clock icons.
* Fix order of wfDeprecated parameters in ExternalStoreDB::getSlave.
* (T261260) Preload class used in HeaderCallback.
* (T260868, T260009) Normalize WatchedItem expiry field.
* (T264683) Remove doTable check from (Mysql|Sqlite)Updater::indexHasFields.
* (T264534) ApiPageSet: Avoid infinite loop when merging redirects.
* (T196906) Empty Monolog loggers are now real blackholes.
* (T258649) WatchAction: avoid UPDATE when old and new watch period is
  indefinite.
* Parser: Adjust typehint to show that getTitle can return null.
* (T263592) media: Fix case of FlashPixVersion in
  FormatMetadata::makeFormattedData().
* (T265223) BaseTemplate: Guard against passing zero arg to array_merge().
* (T264965) Fix base path handling for MessagePosterModule registration.
* (T252183) Fix Database::getTempTableWrites for multi table DDLs.
* (T182546) Fix switch/case indentation per mediawiki coding conventions.
* Flip Yoda conditionals.
* (T263213) Move SkinTemplate::getFooterLinks() to Skin.
* build: Updating mediawiki/mediawiki-codesniffer to 33.0.0.
* (T267105) Make ImageBuilder::checkMissingImage public.
* Updating guzzlehttp/guzzle (6.5.4 => 6.5.5).
* (T266681) Support new style hook registration on install and update.
* (T266980) Fix unsetting of copyright icon in FooterIcons.
* upload.js: Don't assume that warnings array will include 'code' key.
* upload.js:  Fix typo in upload API.
* (T264333, T190988, T266903) Pass along ignorewarnings param to all
  individual chunks being uploaded.
* (T267558) importTextFiles.php: Replace deprecated WikiRevision:setText().
* (T266418) composer.json: add requirement for composer-plugin-api ^1.1.
* (T261431) Add ARIA attributes to watchlink and its notification.
* (T258877) Change invalid 'Content-Encoding: none' header.
* Fix trailing ; in patch-sites-site_language-35.sql.
* (T248852) wfAssembleUrl: Handle empty query field in URL bits.
* (T268846) Updating wikimedia/testing-access-wrapper (1.0.0 => 2.0.0).
* (T268887) migrateComments: Cast array keys back to string before passing
  to the DB.
* (T266619) Introduce new $wgThumbPath config.
* (T269178) MemcachedClient: Cast Resource to integer.
* (T263925) Use the old HookContainer to set up the post-reset services.
* Change "site cache" to just "cache" in the right-purge message.
* [UploadedFileStreamTest] Skip test with chmod.
* (T269710) Updating composer/semver (1.5.1 => 1.7.2).
* (T269710) Updating mediawiki/mediawiki-codesniffer (33.0.0 => 34.0.0).
* (T260631, T260633), BotPassword::save() now returns a Status object for the
  result rather than a bool. The length of the bot password grants and
  restriction fields are now validated, and an error will be thrown if it
  would be truncated by the database.
* (T265778) Fix English/*nix specific error messages in FSFileBackend.
* (T267543) Split dropping of image.img_user_timestamp.
* [FileTest] Do not assume /tmp exists on windows.
* Clean up temp files correctly after unit tests.
* Skip undo related phpunit tests when diff3 is missing.
* (T269964) rdbms: Remove outer parentheses in insert query for Postgres.
* (T263911) In MWExceptionHandler::report(), catch all throwables.
* (T268894, CVE-2020-35474) SECURITY: Use Html::element in
  ChangeListSpecialPage for sanity.
* (T268917) Use Xml::element in SpecialUserrights for sanity.
* (T268938, CVE-2020-35478, CVE-2020-35479) SECURITY: Pass escaped html
  to LogFormatter::makePageLink for sanity.
* (T268938) Fixed mixed escaping in Language::translateBlockExpiry.
* (T263911) UserOptionsManager: don't differentiate anons caches.
* (T261260) HeaderCallback: pre-cache request ID.
* Parsoid updated to v0.12.1.
* (T205908, CVE-2020-35477) SECURITY: Unable to change visibility of log
  entries when MediaWiki:Mainpage uses Special:MyLanguage.
* (T120883, CVE-2020-35480) SECURITY: Divergent behavior for contributions
  and user pages of hidden users and missing users.
* (T270145) Fix condition that can lead to using APCOND_BLOCKED in
  $wgAutopromote to cause an OOM in PHP.

== MediaWiki 1.35.0 ==

=== Changes since MediaWiki 1.35.0-rc.3 ===
* (T261258) Remove checks for ancient ImageMagick versions in BitmapHandler.
* (T260232) Don't include null page ids in query list for category dumps.
* (T260009) Check existing watchitem when saving action=watch.
* (T259055) Correct success messages for action=watch.
* mediawiki.page.ready: Simpler tablesorter/makeCollapsible call.
* mediawiki.page.ready: Fix skin override config flags, wrong way round.
* (T262175, T248512) Remove requirement for ApiWatchlistTrait to be in ApiBase.
* (T259053, T260434) Watchlist: Fix updateWatchLink removing css class when
  action=watch.
* (T261901, T261476) mediawiki.notification: Don't close notif when clicking
  <select> element.
* (T251506) Sanitizer: Truncate IDs to a reasonable length.
* (T259452) Parsoid updated to v0.12.0.
* (T261970) watch.ajax: Add expiry support to watchpage.mw event.
* (T262900) Fix failure of rebuildLocalisationCache.php due to ResourceLoader
  hook.
* (T263014) Hard deprecate File::userCan() with $user=null.
* (T262547) Use localized success message after watching via action=watch.
* (T201491) Fix typo 'Watchlst' in `apihelp-edit-param-watchlistexpiry`.
* (T261081) Installer: consistently reset Language objects.
* (T250449, T250450) Installer: consistently reset Language objects.
* Explicitly wrap some XML calls in libxml_disable_entity_loader().
* (T262934) Ensure dropdown label is always on its own line.
* (T246855) resourceloader: Use a local HookRunner.
* (T263604) Have findBadBlobs.php require Maintenance.php rather than
  cleanupTable.inc.
* (T263606) Set fake time, to avoid flaky tests.
* (T261325) Add FindMissingActors script.
* (T262364) shell: Don't blacklist /run/firejail.
* (T263655) NewPagesPager: Ignore nonexistent namespaces.
* Update specialPageAliases and magicWords for Egyptian Arabic (arz).
* (T261347) ParserOutput: don't throw on bad editsection.
* (T232568, CVE-2020-25813) SpecialUserrights: If a viewer lacks `hideuser`,
  ignore hidden users.
* (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on
  Special:Contributions.
* (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within
  LogEventsList.
* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
  firejail's --output functionality.
* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
  'style' attribute.
* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
  mw.message( ... ).parse().
* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
  database.
* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.
* Add Finnish special page aliases.
* Fix GuzzleHttpRequest request headers.
* Fix description for pruneFileCache.php.
* emptyUserGroup.php: handle more than 5000 users.
* Make ApiSandbox copyable URL absolute.
* (T261087) Add a link from a deleted page to that page's logs.

== MediaWiki 1.35.0-rc.3 ==

=== Changes since MediaWiki 1.35.0-rc.2 ===
* (T258662) mediawiki.visibleTimeout: Update the nextVisibleTimeoutId value.
* Ensure Parsoid doesn't throw when <ref> is used w/o Cite installed.
* Remove maintenance/createCommonPasswordCdb.php.
* (T260468) Increase "sites.site_global_key" to varbinary(64).
* (T183759) Fix shell edge-cases in Windows.
* (T257879) Drop PHP 7.2 support; require 7.3.19.
* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global
  rate limit type.
* (T246991) User: enforce pingLimiter() expiry time.
* (T256831) Rest: Handle Uri constructor exception.
* (T259094) Fix RequestFromGlobalsTest failing in Travis CI.
* (T256831, T261344) Rest: Use try/catch to handle URIs with embedded colon.

== MediaWiki 1.35.0-rc.2 ==

=== Changes since MediaWiki 1.35.0-rc.1 ===
* (T259693) uuid: Fix filenames on Windows.
* Remove Gruntfile.js and package-lock.json from the tarball.
* firejail: Strengthen by copying from Wikimedia's profile.
* (T260059) ResourceLoaderOOUIImageModule: loadOOUIDefinition() may return
  false.
* (T30162, T245387) The installer supports using a Postgres server running
  on a custom port other than 5432.
* (T260201) Support private wikis in Parsoid zero configuration mode.
* Fix bad use of `|=` PHP bit operation where `= … ||` bool is intended.
* (T259212) SpecialBlock: Show error if a block could not be inserted or found.
* (T255842) UserOptionsManager: fix options reset.
* (T258649) WatchAction: avoid unnecessary UPDATEs when expiry is unchanged.
* (T250851) Allow skins to override mediawiki.page.ready initialisation.
* (T250851) mediawiki.page.ready: Allow skins to disable search lazy load.
* (T253135, T255632) Update language in watchlist expiry.
* Use IPset in MWRestrictions::checkIP.
* (T259564) Fix race condition on edit page.
* (T260759) Hide watchlist expiry label in edit form.
* mime: Fix docs of MIME_EXTENSIONS, they're arrays, not space-seperated.
* (T260031) Add application/font-sfnt to MimeMap for ttf files.
* (T259379) WatchedItemStore: Cache single WatchedItems with preexisting expiry.
* Add a maintenance script to create bot passwords.
* (T201269) Add Traditional Chinese zh-hant as fallback for Amis (ami).
* Improve wfParseUrl docs.
* (T251038) Add multi index fields in ImageListPager for unique paginate.
* (T259916) Guard against 'Widget not found' error.

== MediaWiki 1.35.0-rc.1 ==

=== Changes since MediaWiki 1.35.0-rc.0 ===
* (T252136) Fix RecentChanges watchlist filters when WatchlistExpiry is off.
* (T258662) Update time period for watchlist expiry pop-up.
* (T258443) Fix expiry dropdown not getting disabled on edit page.
* (T259398) Add license information for promise-polyfill.
* Remove executable bit from scripts without shebang.
* (T256526) Fix bold of watched items on Special:RecentChangesLinked.
* (T259060) Edit page expiry dropdown should keep state after
  disabling/enabling.
* (T259009) Translate expiry period in pop-up message for watchlist expiry.
* (T258310) Add watchlist clock icon to RecentChanges.
* (T259362) Permit temporary table writes on replica DB connections.
* (T250214) Add UI support in Special:EditWatchlist for watchlist expiry.
* (T72470) Disable wgLegacyJavaScriptGlobals by default.
* (T130906) Add Edge to MediaWiki:Clearyourcache.
* (T257279) Add mediawiki.ui Less variable deprecation note.
* (T249521) Fixed reassignEdits.php to work with anonymous users.
* (T259448) Fix Circular dependency when creating service in
  DBLoadBalancerFactory.
* (T257259) Default to using watchlist expiry of old page when moving pages.

== MediaWiki 1.35.0-rc.0 ==

== Upgrading notes for 1.35 ==
1.35 requires PHP 7.3.19 or above (up from 7.2.9). (T257879)

1.35 has several database changes since 1.34, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).

Don't forget to always back up your database before upgrading!

MediaWiki 1.35 is the next LTS after 1.31, and will be supported for around 3
years.

MediaWiki has a lot of both soft and hard deprecations, and code removed. As
always, make sure your versions of extensions match the MediaWiki version,
and updates may be required to any custom extensions.

See the file UPGRADE for more detailed upgrade instructions, including
important information when upgrading from versions prior to 1.11.

Some specific notes for MediaWiki 1.35 upgrades are below:
* (T259685) When using SQLite as the database backend for MediaWiki,
  Zeroconf (zero-configuration) VisualEditor/Parsoid only works with
  MediaWiki 1.35.2 and above.  It is still recommended to use
  MySQL/MariaDB rather than SQLite when using VisualEditor.

For notes on 1.34.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.35 ===

* (T72470) $wgLegacyJavaScriptGlobals is now false by default. This feature
  will be completely removed in a later MediaWiki release.

==== New configuration ====
* $wgDiffEngine — This can be used to specify the difference engine to use,
  rather than MediaWiki choosing the first of $wgExternalDiffEngine, wikidiff2,
  or php that is usable.
* $wgSearchMatchRedirectPreference — This configuration setting controls whether
  users can set a new preference, search-match-redirect, which decides if search
  should redirect them to exact matches is available. By default, this is set to
  false, which maintains the previous behaviour without preference bloat. Change
  your site's default by setting $wgDefaultUserOptions['search-match-redirect'].
* $wgPoolCounterConf['SpecialContributions'] — Per-user concurrency in the use
  of SpecialContributions can now be limited by setting this appropriately.
* $wgPasswordPolicy — PasswordCannotBeSubstringInUsername is a new password
  policy check. Similar to the existing PasswordCannotMatchUsername check, this
  check ensures that a user's (case-insensitive) password cannot be a part of
  their username. e.g. password = MyPass, username = ThisUsersPasswordIsMyPass.
* $wgLogos — This new configuration setting combines the now-deprecated $wgLogo
  and $wgLogoHD settings into a single, associative array. It provides support
  for a new key, 'wordmark', for setting a horizontal wordmark to show next to
  the graphical logo. To do this, set 'wordmark' to an array with 'src' set to
  the path of the wordmark image, and 'width' and 'height' for its dimensions
  in pixels. $wgLogos inherits the existing support provided by its predecessor
  settings: '1x' mapping to the path of the logo as a 135x135px raster image
  (equivalent to $wgLogo), and '1.5x', '2x', and 'svg' operating as before for
  $wgLogoHD. If $wgLogos is unset, $wgLogo and $wgLogoHD values are read for
  temporary backwards compatibility. (T232140)
* $wgWatchlistExpiry — (EXPERIMENTAL) This enables the new watchlist expiry
  feature. The database table (watchlist_expiry) for this is created regardless
  of this setting, but all other aspects of the expiry feature are controlled
  by it. Enabling in production is discouraged for the time being. A future
  MediaWiki 1.35 release will advertise this feature once it is stable.
* $wgWatchlistPurgeRate — This sets the chance of expired watchlist items being
  purged on each page edit. Only has effect if $wgWatchlistExpiry is true.
* $wgWatchlistExpiryMaxDuration — This is the maximum definite relative duration
  for watchlist expiries. Only has effect if $wgWatchlistExpiry is true.
* $wgImgAuthPath – This can be used to override the path prefix used when
  handling img_auth.php requests. (T235357)
* $wgAllowedCorsHeaders — This is a list of headers which can be used in a
  cross-site API request.
* $wgHTTPMaxTimeout and $wgHTTPMaxConnectTimeout — These allow site
  administrators to limit the timeouts used by the HTTP client libraries.
  This only affects callers using HttpRequestFactory and the deprecated
  wrappers in the Http class.
* $wgCdnMaxageStale — This controls the Cache-Control s-maxage header for page
  views when PoolCounter lock contention indicates that a stale cache entry
  should be sent.
* $wgForceHTTPS — This makes the HTTP to HTTPS redirect be unconditional and
  suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
  recommend this be set to true on pure HTTPS wikis.
* $wgCookieSameSite — This setting allows login cookies to be sent with
  SameSite=None. This is required for cross-site CentralAuth auto-login after
  Chrome 84.
* $wgUseSameSiteLegacyCookies — This adds a compatibility hack to
  SameSite=None cookies for browsers which implemented an incompatible draft
  version of the specification.

==== Changed configuration ====
* $wgResourceLoaderMaxage (T235314) — This configuration array controls the
  max-age for HTTP caching through the Cache-Control header. It has uses the
  "versioned" key for urls that do have a version parameter, and the
  "unversioned" key for urls without a version parameter. The sub keys for
  "client" and "server" are no longer supported in MediaWiki 1.35.
* $wgEnableOpenSearchSuggest — This boolean variable is deprecated and no longer
  used. The OpenSearch API is now always enabled.
* $wgAuthManagerConfig and $wgAuthManagerAutoConfig — These can now use the
  'services' option in provider specifications.
* $wgVirtualRestConfig['modules']['parsoid'] —
  - The defaults have been updated. If you were relying on the default values,
    you may need to update your configuration.
  - The 'URL' parameter, previously allowed for backwards-compatibility, has
    been deprecated. Use 'url' instead.
* $wgXmlDumpSchemaVersion — Default is now set to XML_DUMP_SCHEMA_VERSION_11, so
  dumps use the new dump format per default. Consumers of XML dumps should not
  be affected if they ignore any unknown tags they encounter. Also, the format
  is effectively unchanged for revisions that only contain the main slot. The
  --schema-version option can be used with the dumpBackup.php script to set the
  dump format. (T238921)
* $wgParserConf — This configuration is now deprecated. It has been
  effectively constant since 2008, and is ignored by core code.
  Configure the ParserFactory service in order to customize the Parser used.
* $wgAutoloadAttemptLowercase — This has been deprecated, and the default value
  changed to false.
* $wgAllowImageMoving — This configuration setting is now deprecated. Instead,
  use $wgGroupPermissions; e.g., to revoke sysops' ability to move images use
  $wgGroupPermissions['sysop']['movefile'] = false.
* $wgAllowImageTag — This configuration is now deprecated; future parsers will
  not support direct use of the HTML <img> tag in wikitext.
* $wgUseTwoButtonsSearchForm — This has been deprecated. If you maintain a skin
  that relies on this and wishes to let system administrators change it, you
  should convert it to a config variable specific to your skin. If you're using
  it to configure your wiki, you should check individual skins to see whether
  they have local skin config for the feature and use that.
* $wgPasswordPolicy — The deprecated policy 'PasswordCannotBePopular' has been
  removed. Use PasswordNotInCommonList instead which covers many more passwords.
* Backwards compatibility for using an associative array
  (e.g. [ '127.0.0.1' => 'bad-ip' ]) for $wgProxyList has been removed. This
  was deprecated since 1.30. Please convert these arrays to indexed/sequential
  ones (e.g. [ '127.0.0.1' ]).
* $wgShellRestrictionMethod — This now defaults to 'autodetect', which will
  enable sandboxing for shell commands using firejail, if it's installed. To
  disable restrictions, set it to false.
* $wgLegacyJavaScriptGlobals – This deprecated setting now default to false,
  instead of true, ahead of its planned removal.

==== Removed configuration ====
* $wgSysopEmailBans — This setting, deprecated in 1.34, was removed. To let
  sysops block email access, use $wgGroupPermissions['sysop']['blockemail'].
* $wgDBWindowsAuthentication — This setting had no effect anymore after support
  for SQL Server was removed in 1.34. (T230418)
* $wgProfileOnly — This setting, deprecated in 1.23, was removed. The profiler
  output should instead be configured via $wgProfiler['output'].
* $wgProfileLimit — This setting, deprecated in 1.25, was removed.
  Set $wgProfiler['threshold'] instead.
* $wgDebugTimestamps — This setting was removed. It affected the text output
  produced via $wgDebugComments, if enabled.
* $wgSkipSkin — This setting, deprecated in 1.23, was removed. To disable a
  skin from being shown, use $wgSkipSkins.
* $wgUseSquid, $wgSquidServers, $wgSquidServersNoPurge, and $wgSquidMaxage —
  These, deprecated in 1.34, have been removed. Use $wgUseCdn, $wgCdnServers,
  $wgCdnServersNoPurge, or $wgCdnMaxAge instead.
* $wgDisableCounters — This, deprecated in 1.25, was removed. The feature that
  it controlled was already removed in 1.26, but the variable remained existent
  with a value of `false` for backward-compatibility.
* $wgMaxGeneratedPPNodeCount — This setting was removed. It only affected
  Preprocessor_DOM, which was deprecated in 1.34 and removed in this release.
* $wgFixArabicUnicode and $wgFixMalayalamUnicode — These, deprecated in 1.33,
  were removed. The fixes are now always enabled for their respective languages.
* $wgAllowTitlesInSVG — This, unused and deprecated since 1.34, was removed.
* $wgEnablePartialBlocks — This setting, deprecated when it was added in 1.33,
  was removed. Partial blocks are now always enabled.
* $wgLocalInterwiki — This setting, deprecated in 1.23, has been removed.
* $wgContentHandlerUseDB — This setting, deprecated in 1.34, has been removed.
* $wgMultiContentRevisionSchemaMigrationStage — This setting must no longer
  be set locally. If the migration stage was set to anything other than
  SCHEMA_COMPAT_NEW locally, update.php must be run after removing the setting.
  Usage of the setting in code is deprecated. The setting will be removed
  completely in 1.36.
* $wgEnableRestAPI — This setting is no longer obeyed by MediaWiki core, and
  should not be set set locally. Usage of the setting in code is deprecated; it
  is now set true by default. The setting will be removed completely in 1.36.
* $wgObjectCaches — The 'slaveOnly' option for SqlBagOStuff, deprecated in 1.34,
  was removed. Use 'replicaOnly' instead.

=== New user-facing features in 1.35 ===
* (T204618) Whitelisted the aria-hidden HTML attribute for all elements in
  wikitext.
* (T13456) Special:EditPage, Special:PageHistory, Special:PageInfo, and
  Special:Purge have been created as shortcuts for each action.
  Special:EditPage/Foo redirects to title=foo&action=edit, with PageHistory,
  PageInfo, and Purge corresponding to action= history, info, and purge
  respectively. When linked to, its subpage is used as the target. Otherwise,
  it displays a basic interface to allow the end user to specify the target
  manually.
* (T139221) The generated table of contents is now a navigation landmark role
  for assistive technologies.
* (T245931) interwiki map API doesn't report foreign language if
  $wgInterwikiMagic=false
* The form at ?action=watch has a new dropdown list to support expiry dates for
  watchlist items (if $wgWatchlistExpiry is true).

=== New developer features in 1.35 ===
* A Docker based local development develpoment environment configuration is
  included (T238224) and DEVELOPERS.md has been added with usage documentation
  and links to further help.
* If CSP is enabled, extensions can now add additional sources using the
  ContentSecurityPolicy::addDefaultSource, ::addStyleSrc and ::addScriptSrc
  methods (e.g. $context->getOutput()->getCSP()->addDefaultSrc( 'example.com' ))
* Extensions can now specify classes and namespaces to be autoloaded by the
  test autoloader, by setting the "TestAutoloadNamespaces" and
  "TestAutoloadClasses" properties in extension.json. (T196090)
* (T250977) extension.json now allows "SearchMappings" which maps the canonical
  name of the search engine (used in wgSearchType and wgSearchTypeAlternatives)
  to a specification using the ObjectFactory specification. This allows
  extensions to register Search Engines using namespaced classes.
* Added getters for OutputPage's robot, index and follow policies;
  getRobotPolicy() returns the entire policy as a string in the form
  <index policy>,<follow policy> while getIndexPolicy() and getFollowPolicy()
  return their respective policies as a string.
* The ResourceLoaderSiteModulePages and ResourceLoaderSiteStylesModulePages
  hooks were added to allow changing which wiki pages these modules contain.
* The SkinFactory now allows skins to be specified as an ObjectFactory spec,
  allowing the construction of skins with services injected.
* ContentHandlerFactory for most ContentHandler static methods. It has been
  added to the constructors for many classes to improve SOLID / GRASP.
* FileDeleteForm's constructor now accepts a user as the second parameter.
  Support for not passing a user has also been hard-deprecated and will be
  removed in 1.36.
* The ParserPreSaveTransformComplete hook was added.
* The ParserBeforePreprocess hook was added.
* The ResourceLoaderSkinModule class now has a "legacy" feature that loads
  the stylesheets previously part of the "mediawiki.legacy.shared" and
  "mediawiki.legacy.commonPrint" module.
  Those modules are now deprecated and no longer loaded by skins.
  For skins needing to retain these styles, you will need to load these
  styles via a module using the ResourceLoaderSkinModule class.
  See Vector and Monobook for examples.
* ParserOutput now has methods addExtraCSPStyleSrc, addExtraCSPDefaultSrc
  addExtraCSPScriptSrc for parser tags/functions to be able to add sources
  to the Content Security Policy.
* The HtmlCacheUpdater service was added to unify the logic of purging CDN cache
  and HTML file cache to simplify callers and make them more consistent.
* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
* Preferences which use HTMLTitlesMultiselectField can make use of
  MultiTitleFilter class for saving title text to/from article IDs in user
  preferences.
* OutputPage::addHtmlClasses() was added to allow injecting CSS classes on
  to the <html> element on page load.
* The SkinAddFooterLinks hook is added to allow extensions to add items to skin
  footers. Previously this had to be done via SkinTemplateOutputPageBeforeExec.
  Doing so using that hook is now hard deprecated.
* A new BlockPermissionChecker service was introduced for checking
  block-related permissions.
* The support of 'database' type of extensions has been added to allow 3d party
  databases like Percona be used as storage. See T226857, T253248.
* Three new return parameters have been added to the
  EditPageGetCheckboxesDefinition hook. Handlers of this hook are no longer
  restricted to defining checkboxes. See the documentation of
  EditPage::getCheckboxesDefinition() for more details.
* New flag File::RENDER_TMP was added in order to allow
  File::generateAndSaveThumb and File::trasform to render a thumbnail without
  saving it to the storage.

=== External library changes in 1.35 ===

==== New external libraries ====
* Added wikimedia/ip-utils 1.0.0.
* Added wikimedia/parsoid 0.12.3.
* Added wikimedia/services 2.0.1.
* Added taylorhakes/promise-polyfill v8.1.3.
* Added vuejs v2.6.11.
* Added vuex v3.1.3.
* Added symfony/symfony/polyfill-php80 1.25.0.

===== New development-only external libraries =====
* Added doctrine/dbal 3.1.5.
* Added doctrine/sql-formatter 1.1.0.
* Added pimple/pimple 3.3.1.

==== Changed external libraries ====
* pear/mail_mime was upgraded from 1.10.2 to 1.10.11.
* wikimedia/less.php was upgraded from 1.8.0 to 3.1.0.
* Updated oojs from 3.0.0 to 5.0.0.
* Updated OOUI from 0.35.1 to 0.39.3.
* zordius/lightncandy was upgraded from 0.23.0 to 1.2.5.
* Updated jQuery from v3.3.1 to v3.6.0.
* Updated jQuery Migrate from v3.0.1 to v3.3.2.
* Updated wikimedia/assert from 0.2.2 to 0.5.0.
* Updated pear/net_smtp from 1.8.1 from to 1.9.1.
* Updated psr/log from 1.0.2 to 1.1.3.
* Updated jquery.i18n from 1.0.5 to 1.0.7.
* Updated guzzlehttp/guzzle from 6.3.3 to 6.5.8.
* Updated wikimedia/xmp-reader from 0.6.3 to 0.8.5.
  Fixes error log spam with too-large XMP data, and adds support for GPano tags.
* Updated wikimedia/base-convert from v2.0.0 to v2.0.1.
* Updated composer/semver from 1.5.0 to 1.7.2.
* Updated wikimedia/remex-html from 2.1.0 to 2.2.0.
* Replaced wikimedia/password-blacklist 0.1.4 with wikimedia/common-passwords
  0.2.0.
* Updated wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1.
* Updated wikimedia/html-formatter from 1.0.2 to 2.0.1.
* Updated wikimedia/object-factory from 2.1.0 to 2.2.0.

===== Changed development-only external libraries =====
* Updated symfony/yaml from 3.4.28 to 5.0.5.
* Updated nikic/php-parser from 3.1.5 to 4.4.0.
* Updated php-parallel-lint/php-console-highlighter from v0.3.2 to v0.5.
* Updated php-parallel-lint/php-parallel-lint from v0.9.2 to v1.2.0.
* Updated psy/psysh from 0.9.9 to 0.10.4.
* Updated monolog/monolog from 1.24.0 to 2.2.0.
* Upgrade mediawiki-codesniffer from 28.0.0 to 38.0.0.
* Updated composer/spdx-licenses from 1.5.1 to 1.5.3.
* Updated monolog/monolog from 1.25.2 to 1.25.3.
* Updated qunit from 2.9.1 to 2.10.0.
* Updating wikimedia/testing-access-wrapper from 1.0.0 to 2.0.0.
* Updated seld/jsonlint from 1.7.1 to 1.8.3.

==== Removed external libraries ====
* phpunit/php-invoker (dev-only).
  Removing this unbreaks development on Windows systems, in exchange for losing
  time limits in running unit tests.
* The jquery.getAttrs module was removed.

=== Action API changes in 1.35 ===
* The 'suggest' parameter of action=opensearch has been deprecated.
  The API behaves the same with and without this parameter.
  It was previously used by $wgEnableOpenSearchSuggest to partially
  disable the API if set to false. Specifically, it would deny internal
  frontend requests carrying this parameter, whilst accepting other requests.
* Integer-type parameters are now validated for syntax rather than being
  interpreted in surprising ways. For example, the following will now return a
  badinteger error:
  - "1.9" (formerly interpreted as "1")
  - " 1" (formerly interpreted as "1")
  - "1e1" (formerly interpreted as "1" or "10", depending on the PHP version)
  - "1foobar" (formerly interpreted as "1")
  - "foobar" (formerly intepreted as "0")
  parameters. Ranges should be assumed to be enforced.
* Many user-type parameters now accept a user ID, formatted like "#12345".
* The 'assert' parameter used by all API modules now supports the value 'anon'.
  When specified, the API will return the 'assertanonfailed' error if the user
  is logged in.
* action=edit now supports  the 'baserevid' parameter for edit conflict
  detection, as an alternative to 'basetimestamp'. Note that self-conflicts
  will continue to be ignored if 'basetimestamp' is set, but not if only
  'baserevid' is set.
* A new module was added to change the content model of existing pages.
  Use action=changecontentmodel. Unlike Special:ChangeContentModel, the api
  module does not work for pages that do not already exist.
* If $wgWatchlistExpiry is true, the following API changes are made:
  - action=watch accepts a new 'expiry' parameter analagous to the expiry
    accepted by action=userrights, action=block, etc., except it must be no
    greater than $wgWatchlistExpiryMaxDuration, or an infinity value.
  - action=query&list=watchlistraw returns pages' watchlist expiry dates.
* (T249526) action=login will now return Failed rather than NeedToken on
  session loss.

=== Action API internal changes in 1.35 ===
* The Action API now uses the Wikimedia\ParamValidator library for parameter
  validation, which brings some new features and changes. For the most part
  existing module code should work as it did before, but see subsequent notes
  for changes.
  - The values for all ApiBase PARAM_* constants have changed. Code should have
    been using the constants rather than hard-coding the values.
  - Several ApiBase PARAM_* constants have been deprecated, see the in-class
    documentation for details. Use the equivalent ParamValidator constants
    instead.
  - The value returned for 'upload'-type parameters has changed from
    WebRequestUpload to Psr\Http\Message\UploadedFileInterface.
* Validation of 'user'-type parameters is more flexible. PARAM constants exist
  to specify the type of "user" allowed and to request UserIdentity objects
  rather than name strings. The default is to accept all types (name, IP,
  range, and interwiki) that were formerly accepted.
* Maximum limits are no longer ignored in "internal mode".
* The $paramName to ApiBase::handleParamNormalization() should now include the
  prefix.
* (T245931) meta=siteinfo&siprop=interwikimap no longer reports language or
  extralanglink when $wgInterwikiMagic is false.

=== Languages updated in 1.35 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* The default targets for the ISBN search from Special:BookSources in English
  have been updated for better international suppport. They will now be
  BetterWorldBooks.com, OpenLibrary.org and Worldcat.org.
* (T237672) Changed the Moroccan Arabic language (ary) to the Arabic script.
* (T201269) Added language support for Amis (ami).
* (T248299) Added language support for Inari Sami (smn).
* (T251369) Added language support for Ladin (lld).
* (T251369) Added language support for Seediq (trv), also known as Taroko.
* (T254854) Added language support for Southern Altay (alt).

=== Breaking changes in 1.35 ===
* MediaWiki no longer supports PHP 7.2; use PHP 7.3.19+ (T228346, T257879).
* ResourceLoader::getLessVars(), deprecated in 1.32, was removed.
  Use ResourceLoaderModule::getLessVars() instead.
* The jquery.tabIndex module, deprecated in 1.34, has been removed.
* The mediawiki.RegExp module alias, deprecated in 1.34, was removed.
  Use the mediawiki.util module instead.
* The easy-deflate.inflate module, unused since 1.32, was removed.
* The easy-deflate.deflate module was removed. Use the mediawiki.deflate
  module instead.
* The mediawiki.notify module was removed. The mw.notify() shortcut is now
  available by default, without any dependency.
* (T219604) The "jquery.ui.*" and "jquery.effects.*" module aliases,
  deprecated in 1.34, have been removed. Use "jquery.ui" instead.
* (T235457) The "user.tokens" module has been removed.
  Use "user.options" instead.
* (T251855) The mw.Map#exists method in JavaScript no longer supports checking
  multiple keys. This affects mw.config.exists() and mw.user.tokens.exists().
* The internal variable $constructorOptions for the Parser & SpecialPageFactory,
  exposed only for integration purposes, are now each replaced by a const called
  CONSTRUCTOR_OPTIONS. This was a breaking change made without deprecation.
* ObjectCache::getWANInstance, deprecated in 1.34, was removed.
  Use MediaWikiServices::getMainWANObjectCache instead.
* ObjectCache::newWANCacheFromParams, deprecated in 1.34, was removed.
  Construct WANObjectCache directly instead, or use MediaWikiServices.
* (T231366) The ProfilerOutputDb class and profileinfo.php entry point,
  deprecated in 1.34, was removed.
* SiteConfiguration->localVHosts, deprecated in 1.25, was removed.
  Use $wgLocalVirtualHosts instead.
* The $wgContLanguageCode read-only variable was removed.
  It has been a non-configurable copy of $wgLanguageCode since MW 1.8 (2006).
  Use $wgLanguageCode directly instead.
* ApiQueryUserInfo::getBlockInfo, deprecated in 1.34, was removed. Use
  ApiBlockInfoTrait::getBlockDetails instead.
* Password::equals(), deprecated in 1.33, was removed. Use Password::verify().
* QuickTemplate::setRef(), deprecated in 1.31, was removed. Use set().
* The mediawiki.ui.text module, deprecated in 1.28 and unused, was removed.
* AbstractBlock::mReason, deprecated in 1.34, is no longer public.
* The GetBlockedStatus and UserIsHidden, deprecated in 1.34, has been removed.
  Instead, use the GetUserBlock hook.
* As part of work to replace the Parser, a large number of breaking changes have
  been made, principally in related methods and properties being removed or made
  private:
  - disableCache(), deprecated in 1.28.
  - serializeHalfParsedText() and the helpers unserializeHalfParsedText(),
    isValidHalfParsedText(), and StripState::getSubState() and
    StripState::merge(), all deprecated in 1.31. The helper functions
    LinkHolderArray::mergeForeign() and LinkHolderArray::getSubArray()
    were also removed.
  - getConverterLanguage(), deprecated in 1.32. Use getTargetLanguage() instead.
  - A large set of methods exposed only for historical reasons, deprecated in
    1.34, have now been removed or made private:
    - areSubpagesAllowed()
    - armorLinks()
    - createAssocArgs()
    - doAllQuotes()
    - doDoubleUnderscore()
    - doHeadings()
    - doMagicLinks()
    - formatHeadings()
    - getImageParams()
    - getVariableValue()
    - initialiseVariables()
    - makeKnownLinkHolder()
    - maybeDoSubpageLink()
    - parseLinkParameter()
    - replaceExternalLinks()
    - replaceInternalLinks()
    - replaceInternalLinks2()
    - replaceLinkHoldersText().
    - splitWhitespace()
    - stripAltText()
    - testPreprocess()
    - testPst()
    - testSrvus()
  - incrementIncludeSize(), setTransparentTagHook(), replaceTransparentTags(),
    and $mTransparentTagHooks have been removed without deprecation.
  - The following constants have been made private without deprecation:
    - ::EXT_LINK_ADDR
    - ::EXT_IMAGE_REGEX
    - ::SPACE_NOT_NL
  - The following properties have been removed without deprecation:
    - ::$mDefaultStripList
    - ::$mIncludeCount
    - ::$mRevIdForTs
  - The following properties have been made private without deprecation:
    - ::$mFunctionSynonyms
    - ::$mFunctionTagHooks
    - ::$mStripList
    - ::$mVarCache
    - ::$mImageParams
    - ::$mImageParamsMagicArray
    - ::$mSubstWords
    - ::$mVariables
    - ::$mConf (deprecated in 1.34)
    - ::$mExtLinkBracketedRegex
    - ::$mUrlProtocols
    - ::$mAutonumber
    - ::$mLinkHolders
    - ::$mDefaultSort
    - ::$mTplRedirCache
    - ::$mForceTocPosition
    - ::$mTplDomCache
    - ::$mOutputType
    - ::$mLangLinkLanguages
    - ::$currentRevisionCache
    - ::$mProfiler
    - ::$mLinkRenderer
  - Parser::getTitle() will now throw a TypeError if $mTitle is uninitialized.
    This use pattern was deprecated in 1.34.
  - ContentHandler::makeParserOptions(), deprecated in 1.32, was removed. Use
    WikiPage::makeParserOptions() or ParserOptions::newCanonical() instead.
  - The ParserAfterUnstrip hook, believed to be unused, was removed without
    deprecation.
  - Preprocessor_DOM and related classes, deprecated in 1.34, have been removed.
    Consequently, the related ParserOptions::getMaxGeneratedPPNodeCount() and
    ::setMaxGeneratedPPNodeCount() have been removed without deprecation.
  - The support for the old signature for ParserFactory::__construct, which was
    deprecated in 1.34, has been removed.
  - Parser::getDefaultPreprocessorClass(), deprecated in 1.34, has been removed.
* MediaWikiTestCase::prepareServices(), deprecated in 1.32, has been removed
* The method ContentHandler::getSlotDiffRendererInternal is replaced with
  ContentHandler::getSlotDiffRendererWithOptions. This breaks consumers which
  call parent::getSlotDiffRendererInternal (no instances of which are known).
* TextContent::getHighlightHtml, deprecated since 1.24, has been removed. Use
  TextContent::getHtml instead.
* ExtensionRegistry::load(), deprecated in 1.34, was removed. Instead, use
  ExtensionRegistry::queue().
* MWMessagePack class, deprecated in 1.34, was removed.
* The cdb.php maintenance script was removed. Use the 'cdb' command from the
  wikimedia/cdb library instead.
* User::addNewUserLogEntryAutoCreate, deprecated in 1.27, was removed.
* FileBasedSiteLookup class, deprecated in 1.33, was removed.
* The wfGlobalCacheKey global function, deprecated in 1.30, was removed.
* The APCBagOStuff class was removed. MediaWiki requires PHP 7.2+ (support
  for HHVM was dropped) and these versions of PHP only support apcu. The default
  "apc" entry in $wgObjectCaches now refers to APCUBagOStuff.
* Database::bufferResults(), deprecated in 1.34, has been removed.
* CannotReplaceActiveServiceException, ContainerDisabledException,
  DestructibleService, NoSuchServiceException, SalvageableService,
  ServiceAlreadyDefinedException, ServiceContainer and ServiceDisabledException
  in the global namespace, deprecated in 1.33, were removed. Use the classes in
  the MediaWiki\\Services namespace instead.
* The following methods in the Interwiki class were removed: ::fetch(),
  ::isValidInterwiki(), ::invalidateCache(), and ::getAllPrefixes().
* The UsersMultiselectWidget config 'allowArbitrary' is now false by default. To
  accept arbitrary entries, pass in true for this config.
* OutputPage::parse() and OutputPage::parseInline(), deprecated in 1.32, have
  been removed. Use ::parseAsContent() or ::parseAsInterface(), as
  appropriate.
* WikiPage::selectFields, deprecated in 1.31, was removed. Use ::getQueryInfo.
* The remaining static methods for MagicWord, deprecated in 1.32, were removed.
  These were MagicWord::get(), ::getSubstIDs(), ::getDoubleUnderscoreArray(),
  ::getVariableIDs(), and ::getCacheTTL(). Instead, use MagicWordFactory (via
  MediaWikiServices).
* ApiBase::checkTitleUserPermissions no longer accepts a User as the third
  parameter. Passing a user was deprecated in 1.33.
* Sanitizer::setupAttributeWhitelist() and Sanitizer::attributeWhitelist(),
  deprecated in 1.34, have been removed. They should not have been public.
* Passing a sequential array as the second parameter to
  Sanitizer::validateAttributes() has been deprecated; use an associative
  array where keys are the allowed attributes.
* The $warnCallback parameter to Sanitizer::removeHTMLtags, deprecated since
  its introduction in 1.28, has been removed.
* SpecialRecentChanges::filterByCategories(), deprecated in 1.31, was removed.
* The `ArticleContentViewCustom` hook, deprecated in 1.32, was removed.
* AuthManager::callLegacyAuthPlugin, deprecated in 1.33, was removed.
* wfGetMessageCacheStorage was removed without deprecation.
* Title::moveSubpages, deprecated in 1.34, was removed. Use the MovePage class
  and MovePage::moveSubpages instead.
* Article::doEditContent, deprecated in 1.29, was removed. Instead, use
  WikiPage::doEditContent.
* CommentStore::newKey, deprecated in 1.31, was removed.
* EditPage::$hookError was changed from public to private.
* Title::isValidMoveOperation, ::moveTo, and ::isValidMoveTarget, deprecated
  in 1.25, were removed. Use the MovePage class and its methods instead.
* Title::getUserCaseDBKey(), deprecated in 1.33, was removed. Use ::getDBkey().
* StringUtils::explodeMarkup() was removed without deprecation.
* AjaxResponse methods that were unused have been removed without deprecation:
  - checkLastModified
  - loadFromMemcached
  - storeInMemcached
  - setCacheDuration
  - setVary
* ApiDelete::delete and ::deleteFile, both of which were protected methods,
  have been made private to allow a signature change.
* HistoryPager::revLink, ::curLink, ::lastLink, and ::diffButtons, which had
  no visibilities defined, have been made private to allow signature changes.
* SpecialNewpages::revisionFromRcResult, which previously was protected, has
  been made private to allow a signature change.
* DifferenceEngine::$mOldRev and $mNewRev, deprecated for public access in
  1.32, have been removed.
* DifferenceEngine::revisionDeleteLink, which was previosuly protected, has
  been made private to allow a signature change.
* DifferenceEngine::getParserOutput, which is protected, has had a breaking
  signature change: the second parameter must be a RevisionRecord object,
  rather than a Revision object.
* WikiPage::setLastEdit, which was previously protected, has been made
  private to allow a signature change.
* Skin::getSkinNameMessages() deprecated in 1.34, has been removed.
* Skin::escapeSearchLink() deprecated in 1.34, has been removed, use
  Skin::getSearchLink() instead.
* Skin::shouldPreloadLogo() deprecated in  1.32, has been removed.
* Revision::loadFromId and RevisionStore::loadRevisionFromId have been
  removed.
* OutputPage::parserOptions doesn't accept an $options parameter anymore.
* MessageCache::getParserOptions previously did not have a visibility set.
  It has been made private.
* SpecialUndelete::showDiff previously did not have a visibilty set. It
  hav been made private to allow a signature change.
* The Skin no longer loads the "mediawiki.legacy.shared" or
  "mediawiki.legacy.commonPrint" modules. The legacy shared styles must now
  be loaded by the skin explicitly, either inherited via the
  "mediawiki.skinning.*" modules, or by making your skin's main styles
  module use the ResourceLoaderSkinModule class with the "legacy" attribute.
  See Vector and Monobook for examples.
* Passing an ApiMain to the constructor of ApiResult is no longer supported.
  This was deprecated in 1.25.
* ResourceLoaderWikiModule::invalidateModuleCache has been declared to
  be @internal as part of a signature change. No known uses exist outside
  of MediaWiki core.
* The ArticleAfterFetchContentObject hook, deprecated in 1.32, was removed.
  Use ArticleRevisionViewCustom to control output.
* DatabaseBlock::isValid, deprecated in 1.33, was removed.
* HTMLUserTextField and HTMLUsersMultiselectField previously implied
  required=true when exists=true. Form fields that use exists=true should also
  set required=true if they are required.
* In DatabaseUpdater, the following methods are no longer public: dropTable(),
  modifyTable(), modifyField(), runMaintenance(), copyFile(), appendLine().
  In PostgresUpdater, the following methods are no longer public:
  addPgEnumValue(), addPgIndex(), addPgExtIndex(). This change was made without
  deprecation due to immediate danger of data corruption and loss, see T157651.
  Extensions should instead use dropExtensionTable(),
  modifyExtensionExtensionTable(), modifyExtensionField(), addExtensionUpdate().
  The addExtensionUpdate() method can still be used to access any of the
  protected methods on DatabaseUpdater.
* ResourceLoader no longer provides the (always-true) variables for wgEnableAPI
  and wgEnableWriteAPI; they were deprecated in MediaWiki 1.31 and removed from
  the PHP environment in MediaWiki 1.32.
* The wfSetupSession global function, deprecated in 1.27, was removed. Use the
  persist() method of the right MediaWiki\Session\SessionManager object instead.
* The wfIsHHVM global function, deprecated in 1.34, was removed.
* GenderCache::doTitlesArray no longer accepts string values in its $titles
  array parameter. Use Title objects (or other LinkTarget) instead.
* Unused CommentStore::MAX_COMMENT_LENGTH has been removed.
* User::checkTemporaryPassword() and User::checkPassword(), deprecated in 1.27,
  were removed. Use AuthManager instead.
* All constants and class functions now have explicit visibility modifiers. This
  means, per [[mw:Stable interface policy]], that these should now be considered
  stable. This also helps MW align with PSR 2 and PSR 12. This was done based on
  audits of the corpus of skins and extensions hosted in Gerrit. If you find any
  that you need to be less restrictive (i.e. public or protected), please report
  these so that we can re-evaluate or suggest workarounds.
* BaseTemplate::msgWiki(), deprecated in 1.33, was removed. Use ->msg() or
  ->getMsg() instead.
* QuickTemplate::msgWiki(), deprecated in 1.33, was removed. Use ->msg()
  instead.
* WebInstaller::getErrorBox() and ::getWarningBox(), deprecated in 1.34,
  were removed. Use Html::errorBox() or ::warningBox() instead.
* SpecialVersion::getExtensionCredits() and SpecialVersion::getSkinCredits()
  have become private without deprecation.
* As part of the migration to a new hook system (T240307), the following classes
  now require an additional HookContainer constructor parameter:
    - AuthManager
    - BadFileLookup
    - BlockManager
    - ClassicInterwikiLookup
    - ContentHandlerFactory
    - ContentSecurityPolicy
    - DefaultOptionsManager
    - DerivedPageDataUpdater
    - FullSearchResultWidget
    - HtmlCacheUpdater
    - LanguageFactory
    - LanguageNameUtils
    - LinkRenderer
    - LinkRendererFactory
    - LocalisationCache
    - MagicWordFactory
    - MessageCache
    - NamespaceInfo
    - PageEditStash
    - PageHandlerFactory
    - PageUpdater
    - ParserFactory
    - PermissionManager
    - RevisionStore
    - RevisionStoreFactory
    - Router
    - SearchEngineConfig
    - SearchEngineFactory
    - SearchFormWidget
    - SearchNearMatcher
    - SessionBackend
    - SpecialPageFactory
    - UserNameUtils
    - UserOptionsManager
    - WatchedItemQueryService
    - WatchedItemStore
* The following classes now require setHookContainer() to be called after
  construction:
    - AuthenticationProvider
    - ResourceLoaderModule
    - SearchEngine
* The parameters to ChronologyProtector::getTouched() and
  ILBFactory::getChronologyProtectorTouched() were changed without backwards
  compatibility.
* The deprecated $blacklist parameter to wfIsBadImage() has been removed.
* SpecialBlock::checkUnblockSelf no longer accepts an integer representing
  an user ID as part of ongoing refactoring of SpecialBlock class.
* User::setInternalPassword() and User::setPassword(), deprecated in 1.27, have
  been removed. Use User::changeAuthenticationData() instead.
* User::selectFields(), deprecated in 1.31, has been removed. Use
  User::getQueryInfo() instead.
* The "legacy" serialization type in RESTBagOStuff, deprecated in 1.34,
  has been removed.
* The populateContentModel.php maintenance script was removed. It has
  been replaced by the populateContentTables.php script.
* The findHooks.php maintenance script, for the old hooks system, was removed.
* (T257278) Calling MediaWiki\Shell\Command::restrict() will now overwrite
  any previous restrictions rather than adding to them, making it possible to
  disable the default restrictions.

=== Deprecations in 1.35 ===
* The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4, is
  now deprecated. MediaWiki support for PHPUnit 4 ended with the removal of HHVM
  support.
* LockManagerGroup::getDefault() and LockManagerGroup::getAny() are deprecated.
  They seem to be unused. Just use get() directly, and catch any exception.
* AbstractBlock::getPermissionsError and AbstractBlock::getBlockErrorParams are
  deprecated. Use BlockErrorFormatter::getMessage instead.
* The IP class is deprecated. Please instead use the Wikimedia\IPUtils class
  from the new wikimedia/ip-utils library instead. Additionally, the RE_IP_*
  constants are also deprecated. RE_IP_BYTE can be replaced with a class
  constant on the IPUtils class, while the others will eventually be made
  private.
* The following Language methods are deprecated: getFallbackFor,
  getFallbacksFor, getFallbacksIncludingSiteLanguage. Use the corresponding new
  methods on the LanguageFallback class: getFirst, getAll, and
  getAllIncludingSiteLanguage.
* FileJournal::factory is deprecated. Use the constructor directly instead.
* AbstractBlock methods setBlocker(), getBlocker() are deprecated and will
  become internal implementation of DatabaseBlock.
* Title::countRevisionsBetween has been deprecated and moved into RevisionStore.
* FileBackendGroup::singleton() is deprecated. Use MediaWikiServices instead.
* FileBackendGroup::destroySingleton() is deprecated. Test frameworks should
  instead reset MediaWikiServices between test runs.
  (MediaWikiIntegrationTestCase does this automatically.)
* GenderCache::singleton(), deprecated in 1.28, is hard deprecated. Use
  MediaWikiServices::getGenderCache() instead.
* MediaWikiIntegrationTest::setContentLang() has been deprecated. Use
  setMwGlobals( 'wgLanguageCode', 'xxx' ) to set a different site language
  code, or setService( 'ContentLanguage', $myObj ) to set a specific Language
  object. Service resets and $wgContLang will be handled automatically.
* MediaWikiIntegrationTest::assertType() has been deprecated, as part of the
  work to move to PHPUnit 8; PHPUnit's assertInternalType() was deprecated, and
  will be removed in PHPUnit 9. MediaWikiIntegrationTest::assertTypeOrValue(),
  a wrapper for assertType(), has been removed immediately, without deprecation.
* AbstractBlock::getReason is deprecated, since reasons are actually stored as
  CommentStoreComments, and getReason returns a string with no caller control
  over language or formatting. Instead use AbstractBlock::getReasonComment,
  which returns the CommentStoreComment.
* The global function wfGetRusage() is deprecated and will now always call the
  getrusage() function without checking for its existence.
* The properties User::mBlock, User::mBlockedby and User::mHideName are
  deprecated. Instead, use User::getBlock to get the block, then use
  AbstractBlock::getByName or AbstractBlock::getHideName.Use the GetUserBlock
  hook to set, unset or modify a block, including hiding or unhiding a user.
* Directly calling the MergeHistory constructor is deprecated. Instead, use the
  new MergeHistoryFactory class.
* Language::factory() and Language::getParentLanguage() are deprecated, and so
  is directly calling the Language constructor. Use the new LanguageFactory
  class instead.
* Language::classFromCode() is deprecated. There is no reason it should be used
  outside the Language class itself.
* Language::clearCaches() is deprecated. Instead, reset all services and set
  Language::$mLangObjCache = [].
* The following functions from Language class are deprecated in favour of
  respective functions in LanguageConverter:
  - autoConvert
  - autoConvertToAllVariants
  - convert
  - convertTitle
  - convertNamespace
  - hasVariants
  - hasVariant
  - convertHtml
  - convertCategoryKey
  - getVariants
  - getPreferredVariant
  - getURLVariant
  - findVariantLink
  - getExtraHashOptions
  - updateConversionTable
* Language::classFromCode() is hard deprecated and should be removed in 1.36
* Language::getConverter() is deprecated and should be removed in 1.36
* Language::MESSAGES_FALLBACKS, Language::STRICT_FALLBACKS were deprecated.
  Use LanguageFallback::MESSAGES and LanguageFallback::STRICT respectively
* Language::$mLangObjCache is deprecated and should be removed in 1.36. Use
  MediaWikiServices instead to get a LanguageFactory.
* Language::getMessagesFor(), getMessageFor(), and getMessageKeysFor() are
  deprecated. Use LocalisationCache's getItem(), getSubitem(), and
  getSubitemList() methods directly.
* OutputPage::getCSPNonce() is deprecated, use OutputPage::getCSP()->getNonce()
  instead.
* DerivedPageDataUpdater::prepareUpdate accepted as its second parameter an
  optional array of options. Specifying the value of the `oldrevision` key of
  the array to be a Revision object, rather than a RevisionRecord object, is
  hard deprecated. The same applies to the options parameter in
  WikiPage::doEditUpdates.
* Skin::makeI18nUrl() and makeNSUrl() have been deprecated, no longer used.
* Title::countAuthorsBetween and Title::getAuthorsBetween were hard deprecated.
  Use respective methods in RevisionStore instead.
* Remove deprecated SkinCopyrightFooter &$forContent parameter
* The following Language class static variables have been replaced with
  constants and deprecated: $mWeekdayMsgs, $mWeekdayAbbrevMsgs, $mMonthMsgs,
  $mMonthGenMsgs, $mMonthAbbrevMsgs, $mIranianCalendarMonthMsgs,
  $mHebrewCalendarMonthMsgs, $mHebrewCalendarMonthGenMsgs,
  $mHijriCalendarMonthMsgs and $durationIntervals.
* As part of dropping security support for IE 6 and IE 7,
  WebRequest::checkUrlExtension() has been deprecated, and now always returns
  true.
* The following ApiBase::PARAM_* constants have been deprecated in favor of
  equivalent ParamValidator constants: PARAM_DFLT, PARAM_ISMULTI, PARAM_TYPE,
  PARAM_MAX, PARAM_MAX2, PARAM_MIN, PARAM_ALLOW_DUPLICATES, PARAM_DEPRECATED,
  PARAM_REQUIRED, PARAM_SUBMODULE_MAP, PARAM_SUBMODULE_PARAM_PREFIX, PARAM_ALL,
  PARAM_EXTRA_NAMESPACES, PARAM_SENSITIVE, PARAM_DEPRECATED_VALUES,
  PARAM_ISMULTI_LIMIT1, PARAM_ISMULTI_LIMIT2, PARAM_MAX_BYTES, PARAM_MAX_CHARS.
* ApiBase::explodeMultiValue() is deprecated. Use
  ParamValidator::explodeMultiValue() instead.
* ApiBase::parseMultiValue() is deprecated. No replacement is provided;
  generally this sort of thing should be handled by fully validating the
  parameter.
* ApiBase::validateLimit() and ApiBase::validateTimestamp() are deprecated.
  Use ApiParamValidator::validateValue() with an appropriate settings array
  instead.
* ContentHandler (use ContentHandlerFactory):
  - getForTitle
  - getForContent
  - getForModelID
  - getContentModels
  - getAllContentFormats
  - protected $handler (not need anymore)
  - cleanupHandlersCache (not need anymore)
* (T212738) The $wgVersion global is deprecated; instead, use MW_VERSION.
* $wgMemc is deprecated, use MediaWikiServices::getLocalServerObjectCache()
  instead.
* ObjectCache::detectLocalServerCache() is deprecated, instead use
  MediaWikiServices::getLocalServerObjectCache() or
  ObjectCache::makeLocalServerCache().
* ImagePage::getImageLimitsFromOptions() is deprecated. Use static function
  MediaFileTrait::getImageLimitsFromOptions() instead.
* As part of work to replace the Parser, alongside the breaking changes listed
  above, a large number of deprecations changes been made, to simplify the API
  or because they will not be supported in replacement:
  - Parser::doBlockLevels() (and BlockLevelPass class has been marked @internal)
  - Parser::setFunctionTagHook()
  - Parser::attributeStripCallback()
  - Parser::fetchTemplate() - use Parser::fetchTemplateAndTitle() instead.
  - Parser::enableOOUI() - use $parser->getOutput()->enableOOUI() instead.
  - LinkHolderArray has been deprecated for public usage and will be
    internal part of parser.
  - The following parser-related hooks have been deprecated:
    - InternalParseBeforeSanitize
        Use an alternative hook which doesn't expose internal half-parsed state,
        like ParserBeforeInternalParse or ParserAfterTidy
    - ParserFetchTemplate
        Use BeforeParserFetchTemplateAndTitle
    - ParserSectionCreate
        No replacement; <section> tag wrapping will be done by core in future.
    - BeforeParserrenderImageGallery
        No replacement; MediaHandler provides for customizable media rendering
    - ParserBeforeTidy
        Use ParserAfterTidy instead to avoid exposing internal half-parsed state
    - ParserBeforeStrip
        No replacement; stripping is no longer supported.
    - ParserAfterStrip
        No replacement; stripping is no longer supported.
  - The accessor/mutator methods Parser::Options(), Parser::OutputType(), and
    Parser::Title() have been deprecated; use the appropriate Parser::get* or
    Parser::set* methods instead.
  - Parser::firstCallInit() has been deprecated. The parser is initialized
    fully on construction and so ::firstCallInit() no longer has any effect
    when manually invoked.
  - ParserOptions::setAllowExternalImages(), ::setAllowExternalImagesFrom(),
    and ::setEnableImageWhitelist() have been deprecated.  Future parsers
    will not allow per-parser configuration of image filtering; use
    site configuration instead.
  - ParserOptions::getTidy() and ParserOptions::setTidy() have been deprecated.
    These options no longer have any effect.
  - Most methods of MWTidy, except for MWTidy::tidy(), have been deprecated;
    tidiness is always enabled and not configurable.
  - Version 1 of the parserTests file format has been deprecated. You'll need to
    update your parser tests to version 2, which uses Remex tidy on all test
    output by default. Support for parser tests with Remex tidy off will later
    be removed entirely.
  - $wgParser — This global variable, soft deprecated in 1.32, has now been hard
    deprecated. Use MediaWikiServices::getInstance()->getParser() instead.
    (T160811)
* The signature of DefaultPreferencesFactory::__construct has been changed:
  - LanguageConverter $languageConverter has been added.
  and its usage with old arguments is hard deprecated.
* The public usage of the following properties of LanguageConverter have been
  deprecated as there is no reason they should be used outside the
  LanguageConverter class and will be changed from public to private:
  - mLangObj
  - mUcfirst
  - mConvRuleTitle
  - mURLVariant
  - mUserVariant
  - mHeaderVariant
  - mMaxDepth
  - mVarSeparatorPattern
  changed from public to protected:
  - mTables
* The ArticleEditUpdatesDeleteFromRecentchanges hook has been deprecated. Please
  use the RecentChange_save hook or similar instead.
* The ArticleEditUpdates hook has been deprecated. Please
  use the RevisionDataUpdates hook or similar instead.
* The SkinTemplatePreventOtherActiveTabs and SkinTemplateTabAction hooks have
  been hard deprecated. Please use the SkinTemplateNavigation__Universal hook
  instead.
* ResourceLoaderFileModule::compileLessFile() has been deprecated, use
  ResourceLoaderFileModule::compileLessString() instead
* The SquidPurgeClient and SquidPurgeClientPool classes have been deprecated.
  Use MultiHttpClient or HtmlCacheUpdater instead.
* MimeAnalyzer::getExtensionsForType() and ::getTypesForExtensions() were
  deprecated in favor of MimeAnalyzer::getExtensionsFromMimeType() and
  ::getMimeTypesFromExtension(), respectively. The new methods return arrays
  rather than strings.
* Calling Action::factory and Action constructor with WikiPage has been
  hard deprecated. Caller must provide an Article instance.
* ApiTestCase::doLogin, soft deprecated in 1.31, was hard deprecated.
* WebRequest::getLimitOffset is hard deprecated. Instead, use
  ::getLimitOffsetForUser and pass a User object.
* PageArchive::getPreviousRevision is hard deprecated. Instead, use the new
  ::getPreviousRevisionRecord method.
* PageArchive::getArchivedRevision is hard deprecated. Instead, use the new
  ::getArchivedRevisionRecord method.
* PageArchive::undelete is hard deprecated. Instead, use ::undeleteAsUser
  and pass a User object.
* PageArchive::getRevision is hard deprecated.
* EditPage::getBaseRevision was hard deprecated. Instead, use the new
  ::getExpectedParentRevision method.
* The public variable EditPage::$mBaseRevision was hard deprecated.
* FileDeleteForm previously did not accept a user parameter in its constructor,
  instead relying on the global $wgUser. A user parameter has been added,
  and //not// providing a user is deprecated. There are no known callers
  outside of mediawiki core.
* AuthManager::singleton() has been deprecated. Use
  MediaWikiServices::getInstance()->getAuthManager() instead.
* ContribsPager::tryToCreateValidRevision is hard deprecated. Instead, use
  ContribsPager::tryCreatingRevisionRecord.
* The following functions all accept an optional user parameter. Not passing a
  user is hard deprecated, and support for calling them without passing a user
  will be removed in 1.36:
  - Title::getNotificationTimestamp (note however that the method is deprecated
      in its entirely in favor of the new WatchlistNotificationManager service)
  - PatrolLog::record
  - LogEventsList::userCan
  - LogEventsList::userCanBitfield
  - LogEventsList::userCanViewLogType
  - LogPage::addEntry
  - FileDeleteForm::doDelete
  - OldLocalFile::userCan
  - ArchivedFile::userCan
  - File::userCan
* The following functions all accept an optional audience parameter and
  an optional user parameter. If the audience is FOR_THIS_USER and no
  user is passed, they fallback to $wgUser. Not passing a user when
  one is needed is deprecated
  - LogEventsList::getExcludeClause
  - WikiPage::getComment
  - WikiPage::getCreator
  - WikiPage::getUser
  - WikiPage::getUserText
* UploadBase::checkWarnings now accepts a User parameter; not providing a
  user is soft deprecated.
* Article::insertProtectNullRevision and WikiPage::insertProtectNullRevision
  were hard deprecated. Instead, use WikiPage::insertNullProtectionRevision.
* Article::doDeleteArticle, Article::doDeleteArticleReal, and
  WikiPage::doDeleteArticle are all deprecated. Instead, use
  WikiPage::doDeleteArticleReal.
* Article::getComment is deprecated. Instead, use WikiPage::getComment.
* Article::getCreator is deprecated. Instead, use WikiPage::getCreator.
* Article::updateRevisionOn() and ::updateIfNewerOn(), and
  WikiPage::updateIfNewerOn() are deprecated. Instead, use
  WikiPage::updateRevisionOn().
* Article::getUser is deprecated. Instead, use WikiPage::getUser.
* Article::getUserText is deprecated. Instead, use WikiPage::getUserText.
* Article::prepareContentForEdit is hard deprecated. Instead, use
  WikiPage::prepareContentForEdit.
* WikiPage::prepareContentForEdit previously accepted either a Revision or a
  RevisionRecord object as its optional second parameter. Passing a Revision
  is now hard deprecated.
* Article::getUndoContent and WikiPage::getUndoContent are hard deprecated.
  Instead, use ContentHandler::getUndoContent.
* Passing Revision objects to ContentHandler::getUndoContent is hard deprecated.
  Instead, pass the associated Content objects, as well as whether the undo is
  from the current revision.
* Article::doDeleteUpdates and ::doEditUpdates are deprecated. Instead,
  use WikiPage::doDeleteUpdates and ::doEditUpdates.
* WikiPage::doEditUpdates previously accepted a Revision object as its first
  parameter. It now accepts RevisionRecord objects, and passing Revision
  objects is deprecated.
* Article::getRevisionFetched is deprecated. Instead, use the
  fetchRevisionRecord method, which has been converted from protected to
  public.
* LocalFileDeleteBatch was migrated to a new constructor signature with the
  user as the second parameter. Support for the old signature is hard
  deprecated, and once removed the user parameter will be required. At the
  same time, a number of file-deletion related methods were updated
  - File::delete is hard deprecated in favor of the new ::deleteFile
  - LocalFile::delete is hard deprecated in favor of the new ::deleteFile
  - LocalFile::deleteOld is hard deprecated in favor of the new ::deleteOldFile
  - ForeignDBFile::delete is hard deprecated in favor of the new ::deleteFile
* File::recordUpload (along with the respective methods in the LocalFile and
  ForeignDBFile classes) is hard deprecated, and LocalFile::recordUpload2 is
  soft deprecated. Use the new LocalFile::recordUpload3, which has a different
  signature and requires that a User parameter is passed.
* The SpecialPageFactory class was moved from the MediaWiki\Special namespace
  to the MediaWiki\SpecialPage namespace. The old location remains as a
  deprecated alias.
* Title::userCan, ::quickUserCan, and ::getUserPermissionsErrors, which
  were deprecated in 1.33, were hard deprecated. Instead, use
  PermissionManager::userCan, ::quickUserCan, and ::getPermissionErrors.
* All methods of the old SpecialPageFactory, deprecated in 1.32, were hard
  deprecated. Instead, get a SpecialPageFactory from MediaWikiServices and
  use its methods.
* User::updateNewtalk now accepts as its optional third parameter a
  RevisionRecord object; passing a Revision is hard deprecated.
* User::getNewMessageRevisionId and ::getNewMessageLinks were hard deprecated.
* DifferenceEngine::getRevisionHeader now accepts a RevisionRecord as its
  first parameter; passing a Revision is hard deprecated.
* WikiPage::doDeleteUpdates now accepts as its optional third parameter
  a RevisionRecord object; passing a Revision is hard deprecated.
* WikiPage::onArticleEdit now accepts as its optional second parameter
  a RevisionRecord object; passing a Revision is hard deprecated.
* Global $wgUser variable was soft deprecated.
* The Revision class was soft deprecated entirely in 1.31. All methods
  have now been individually hard deprecated:
  - ::__construct - create MutableRevisionRecord objects instead
  - ::newFromId - use RevisionLookup::getRevisionById instead
  - ::newFromTitle - use RevisionLookup::getRevisionByTitle instead
  - ::newFromPageId - use RevisionStore::getRevisionByPageId instead
  - ::newFromArchiveRow - use RevisionFactory::newRevisionFromArchiveRow
  - ::newFromRow - use RevisionStore::newRevisionFromRow instead
  - ::loadFromPageId - use RevisionStore::getRevisionByPageId instead
  - ::loadFromTitle - use RevisionStore::getRevisionByTitle instead
  - ::loadFromTimestamp - use RevisionStore::getRevisionByTimestamp instead
  - ::getQueryInfo - use RevisionStore::getQueryInfo instead
  - ::getArchiveQueryInfo - use RevisionStore::getArchiveQueryInfo instead
  - ::getParentLengths - use RevisionStore::getRevisionSizes instead
  - ::getRevisionRecord - no replacement
  - ::getId - use RevisionRecord::getId instead
  - ::setId - use MutableRevisionRecord::setId instead
  - ::setUserIdAndName - use MutableRevisionRecord::setUser instead
  - ::getTextId - use SlotRecord::getContentAddress for retrieving an actual
      content address, or RevisionRecord::hasSameContent to compare content
  - ::getParentId - use RevisionRecord::getParentId instead
  - ::getSize - use RevisionRecord::getSize instead
  - ::getSha1 - use RevisionRecord::getSha1 instead
  - ::getTitle - use RevisionRecord::getPageAsLinkTarget instead
  - ::setTitle - the method was previously a no-op
  - ::getPage - use RevisionRecord::getPageId instead
  - ::getUser - use RevisionRecord::getUser and then User::getId instead
  - ::getUserText - use RevisionRecord::getUser and then User::getName instead
  - ::getComment - use RevisionRecord::getComment instead
  - ::isMinor - use RevisionRecord::isMinor instead
  - ::isUnpatrolled - use RevisionStore::getRcIdIfUnpatrolled instead
  - ::getRecentChange - use RevisionStore::getRecentChange instead
  - ::isDeleted - use RevisionRecord::isDeleted instead
  - ::getVisibility - use RevisionRecord::getVisibility instead
  - ::getContent - use RevisionRecord::getContent instead
  - ::getSerializedData - use SlotRecord::getContent for retrieving a
      content object, and Content::serialize for the serialized form
  - ::getContentModel - use SlotRecord::getModel instead
  - ::getContentFormat - use SlotRecord::getFormat instead, with a fallback
       to ContentHandler::getDefaultFormat
  - ::getContentHandler - use ContentHandlerFactory::getContentHandler instead
  - ::getTimestamp - use RevisionRecord::getTimestamp instead
  - ::isCurrent - use RevisionRecord::isCurrent instead
  - ::getPrevious - use RevisionLookup::getPreviousRevision instead
  - ::getNext - use RevisionLookup::getNextRevision instead
  - ::getRevisionText - use RevisionRecord::getContent instead
  - ::compressRevisionText - use SqlBlobStore::compressData instead
  - ::decompressRevisionText - use SqlBlobStore::decompressData instead
  - ::insertOn - use RevisionStore::insertRevisionOn instead
  - ::base36Sha1 - use SlotRecord::base36Sha1 instead
  - ::newNullRevision - use RevisionStore::newNullRevision
  - ::userCan - use RevisionRecord::userCanBitfield instead
  - ::userCanBitfield - use RevisionRecord::userCanBitfield instead
  - ::getTimestampFromId - use RevisionStore::getTimestampFromId instead
  - ::countByPageId - use RevisionStore::countRevisionsByPageId instead
  - ::countByTitle - use RevisionStore::countRevisionsByTitle instead
  - ::userWasLastToEdit - use RevisionStore::userWasLastToEdit instead
  - ::newKnownCurrent - use RevisionStore::getKnownCurrentRevision instead
* The Revision method had a few methods that were previously protected and
  have been made private. They were:
  - ::getRevisionStore
  - ::getRevisionLookup
  - ::getRevisionFactory
  - ::getBlobStore
  The $mRecord variable was also changed from protected to private.
* Multiple hooks that include Revision objects were deprecated. The hooks, as
  well as suitable replacements, are noted below:
  - ArticleRevisionUndeleted (hard deprecated, use the RevisionUndeleted hook)
  - ArticleRollbackComplete (hard deprecated, use the RollbackComplete hook)
  - DiffRevisionTools (hard deprecated, use the DiffTools hook)
  - DiffViewHeader (hard deprecated, use the DifferenceEngineViewHeader hook)
  - HistoryRevisionTools (hard deprecated, use the HistoryTools hook)
  - NewRevisionFromEditComplete (hard deprecated, use the
      RevisionFromEditComplete hook).
  - PageContentInsertComplete (hard deprecated, use the PageSaveComplete hook)
  - PageContentSaveComplete (hard deprecated, use the PageSaveComplete hook)
  - RevisionInsertComplete (soft deprecated in 1.31, now hard deprecated)
  - TitleMoveCompleting (hard deprecated, use the PageMoveCompleting hook)
  - TitleMoveComplete (hard deprecated, use the PageMoveComplete hook)
  - UndeleteShowRevision (hard deprecated)
* The following RevisionStore methods were deprecated:
  - ::loadRevisionFromTitle
  - ::loadRevisionFromTimestamp
  - ::loadRevisionFromPageId
  - ::listRevisionSizes
* WikiPage::$mLastRevision was changed from protected to private.
* RecentChange::markPatrolled was deprecated. Use ::doMarkPatrolled instead.
* The JobRunner class has been converted to a service class.
  Direct construction is deprecated, use MediaWikiServices::getJobRunner.
* JobRunner::setLogger has been deprecated, thus using JobRunner as a
  LoggerAwareInterface is deprecated as well. Rely on the logger passed in the
  constructor instead.
* LogEventsList::typeAction accepts an optional right to check against as
  the fourth parameter. Specifying such a right is deprecated.
* SkinTemplate::makeArticleUrlDetails has been deprecated, no longer used.
* Passing a Revision object into CategoryMembershipChange constructor is
  deprecated. Pass a RevisionRecord instead.
* The "mediawiki.legacy.oldshared" module has been deprecated.
  Skins and extensions that are using this should copy its necessary CSS rules
  to their own styles module. CologneBlue and Nostalgia skins serve as examples.
* The "mediawiki.legacy.shared" module has been deprecated.
  Use the "mediawiki.skinning.*" modules, or ResourceLoaderSkinModule instead.
* The following hooks, soft deprecated in 1.24, have been hard deprecated:
  - APIQueryInfoTokens
  - APIQueryRecentChangesTokens
  - APIQueryRevisionsTokens
  - APIQueryUsersTokens
  - ApiTokensGetTokenTypes
* Calling Action::factory and Action constructor with any Page implementations
  other than Article is deprecated.
* Action::page property is deprecated for direct access.
  Use Action::getArticle or Action::getWikiPage instead.
* LESS `.background-image-svg()` mixin from 'mediawiki.mixins.less' is
  deprecated and should be removed in 1.36.
* LESS `.background-image-svg-quick()` mixin from 'mediawiki.mixins.less' is
  deprecated and should be removed in 1.36.
* The following methods were deprecated:
  - Title::getFirstRevision (hard deprecated)
  - Title::getEarliestRevTime
  - WikiPage::getOldestRevision (hard deprecated)
  - Article::getOldestRevision (hard deprecated)
  Use RevisionStore::getFirstRevision instead.
* WikiPage::commitRollback and ::doRollback are declared to be internal
  in preparation for breaking changes. Neither method has any known
  callers outside of MediaWiki core. Both methods modify an array passed
  by reference ($resultDetails) - accessing the Revision objects added to
  that array (using the keys `current` and `target`) is also deprecated.
* The following Linker methods previously accepted Revision objects as
  parameters. They now accept either Revision or RevisionRecord objects.
  Passing a Revision object is hard deprecated.
  - ::revUserLink
  - ::revUserTools
  - ::revComment
  - ::generateRollback
  - ::getRollbackEditCount
  - ::buildRollbackLink
  - ::getRevDeleteLink
* WikiPage::hasDifferencesOutsideMainSlot previously accepted Revision
  objects for its two parameters. It now accepts RevisionRecord objects,
  and passing Revision objects is hard deprecated.
* WikiPage::updateRevisionOn previously accepted Revision objects for its
  second parameter. It now accepts RevisionRecord objects, and passing
  Revision objects is hard deprecated.
* The ParserGetVariableValueVarCache hook has been deprecated.
* When using the ParserGetVariableValueSwitch hook, the following unusual
  uses have been deprecated: modifying the passed $magicWordId or failing to
  cache the returned value in $variableCache.  The related
  MagicWordwgVariableIDs hook has been deprecated and renamed; use
  the GetMagicVariableIDs hook instead.
* The following Parser properties have been deprecated:
  - ::$mTagHooks
  - ::$mFunctionHooks
  - ::$mMarkerIndex
  - ::$mFirstCall
  - ::$mPreprocessor
  - ::$mOutput
  - ::$mStripState
  - ::$mLinkID
  - ::$mIncludeSizes
  - ::$mPPNodeCount
  - ::$mGeneratedPPNodeCount
  - ::$mHighestExpansionDepth
  - ::$mDoubleUnderscores
  - ::$mExpensiveFunctionCount
  - ::$mShowToc
  - ::$mUser
  - ::$mOptions
  - ::$mTitle
  - ::$ot
  - ::$mRevisionObject
  - ::$mRevisionId
  - ::$mRevisionTimestamp
  - ::$mRevisionUser
  - ::$mRevisionSize
  - ::$mInputSize
  - ::$mInParse
* LinksUpdate::getRevision and ::setRevision are hard deprecated in favor
  of the new ::getRevisionRecord and ::setRevisionRecord methods.
* A large number of exposed variables and methods of Article were deprecated as
  part of its planned removal:
  - Article::$mContext is deprecated; use getContext()/setContext() instead.
  - Article::__get(), ::__set() are hard deprecated, use the WikiPage properties
    instead.
  - These Article methods were hard deprecated; use their WikiPage equivalents:
    - ::checkFlags,
    - ::checkTouched,
    - ::clearPreparedEdit,
    - ::commitRollback,
    - ::doDeleteArticleReal,
    - ::doEditContent,
    - ::doPurge,
    - ::doRollback,
    - ::doUpdateRestrictions,
    - ::doViewUpdates,
    - ::exists,
    - ::followRedirect,
    - ::getContentHandler,
    - ::getContentModel,
    - ::getContributors,
    - ::getDeletionUpdates,
    - ::getHiddenCategories,
    - ::getId,
    - ::getLatest,
    - ::getLinksTimestamp,
    - ::getMinorEdit,
    - ::getRedirectTarget,
    - ::getRedirectURL,
    - ::getTimestamp,
    - ::getTouched,
    - ::hasViewableContent,
    - ::insertOn,
    - ::insertRedirect,
    - ::insertRedirectEntry,
    - ::isCountable,
    - ::isRedirect,
    - ::loadFromRow,
    - ::loadPageData,
    - ::lockAndGetLatest,
    - ::makeParserOptions,
    - ::pageDataFromId,
    - ::pageDataFromTitle,
    - ::prepareContentForEdit,
    - ::protectDescription,
    - ::protectDescriptionLog,
    - ::replaceSectionAtRev,
    - ::setTimestamp,
    - ::shouldCheckParserCache,
    - ::supportsSections,
    - ::triggerOpportunisticLinksUpdate,
    - ::updateCategoryCounts, and
    - ::updateRedirectOn.
  - Article::generateReason() was hard deprecated; instead, please use
    WikiPage::getAutoDeleteReason().
  - Article::replaceSectionContent() was hard deprecated, use
    Article::replaceSectionAtRev() instead.
  - Article::getRevision and WikiPage::getRevision were hard deprecated in favor
    of the new WikiPage::getRevisionRecord method.
* A new UserNameUtils service was introduced. The following User methods
  were deprecated in favor of using the new service:
  - isIP
  - isIPRange
  - isValidUserName
  - isUsableName
  - isCreatableName
  - getCanonicalName
* The signature of WikiPage::doDeleteArticleReal was changed to make the user
  the second parameter, and the suppression option the third parameter.
  Previously, the third parameter was unused. Using the old signature is
  hard deprecated.
* ApiQueryRevisions::getRollbackToken, which has been soft deprecated since
  1.24, accepted as its third parameter a Revision object. It now accepts
  a RevisionRecord, and passing a Revision is hard deprecated.
* Passing Article to ParserCache::get() was deprecated
* ParserOptions::newCanonical() with no first parameter, or null as the first
  parameter, which falls back to using global $wgUser, is hard deprecated.
* Parser::fetchCurrentRevisionOfTitle, ::statelessFetchRevision, and
  ::getRevisionObject were hard deprecated in favor of the new
  ::fetchCurrentRevisionRecordOfTitle, ::statelessFetchRevisionRecord,
  and ::getRevisionRecordObject methods respectively.
* ParserOptions::getCurrentRevisionCallback and ::setCurrentRevisionCallback
  were hard deprecated in favor of the new ::getCurrentRevisionRecordCallback
  and ::setCurrentRevisionRecordCallback methods respectively.
* Parser::statelessFetchTemplate returns an array; accessing the Revision
  object returned (via the `revision` key to the array) is deprecated. Instead,
  use `revision-record` to retrieve the equivalent RevisionRecord.
* WikiPage::doEditContent returns an array, and PageUpdater::getStatus returns
  a Status object with an array value. For both of those arrays, accessing the
  Revision object returned (via the `revision` key to the array) is deprecated.
  Instead, use `revision-record` to retrieve the equivalent RevisionRecord.
* Page interface was deprecated. Use Article or WikiPage instead.
* The following DatabaseBlock methods are deprecated because they are no longer
  needed in core: chooseBlock, fromMaster, deleteIfExpired.
* wfGetScriptUrl() was deprecated. The script URL should be configured rather
  than detected. wfScript() can be used to get a configured script URL.
* Action::factory() with null $action argument is hard deprecated
* The following methods of the User class were deprecated: getDefaultOptions,
  getDefaultOption, getOptions, getOption, getBoolOption, getIntOption,
  setOption, listOptionKinds, getOptionKinds, resetOptions. Use corresponding
  methods in UserOptionsLookup or UserOptionsManager service classes instead.
* UserRetrieveNewTalks hook was deprecated without replacement.
* User::getNewtalk and ::setNewtalk were hard deprecated. Use service
  TalkPageNotificationManager instead.
* EditPage::matchSpamRegex and ::matchSummarySpamRegex were hard deprecated in
  favor of the new SpamChecker service.
* Title::getNotificationTimestamp, User::clearNotification, and
  User::clearAllNotifications were deprecated in favor of the new
  WatchlistNotificationManager service.
* SpecialPage::setListed() and SpecialPage::listed() were deprecated. Subclass
  UnlistedSpecialPage to set listed as false, and use SpecialPage::isListed()
  to get the value.
* CategoryPage::getCategoryViewerClass() and ::setCategoryViewerClass() were
  deprecated.
* MWHttpRequest and its subclasses PhpHttpRequest, CurlHttpRequest and
  GuzzleHttpRequest now require the timeout and connectTimeout options to
  always be specified, otherwise a deprecation warning will be raised. Most
  callers should use HttpRequestFactory which always sets these options.
* Linker::normaliseSpecialPage() has been deprecated, instead make use of
  LinkRenderer::normalizeTarget().
* SkinTemplate::getPersonalToolsList() was soft deprecated.
* ChangeTags::truncateTagDescription() has been deprecated.
* The following methods of the User class are deprecated: getGroups,
  getGroupMemberships, getEffectiveGroups, getAutomaticGroups,
  addGroup, removeGroup, getFormerGroups, getAllGroups, getImplicitGroups,
  addAutopromoteOnceGroups. Use the new UserGroupManager service instead.
* The following methods of the UserGroupMembership class were deprecated:
  selectFields, getMembershipsForUser, getMembership, insert, delete,
  newFromRow, initFromRow, purgeExpired.
  Use the new UserGroupManager service instead.
* wfWaitForSlaves() has been hard deprecated. Use LBFactory::waitForReplication
  instead. It was soft deprecated in 1.27.
* BaseTemplate::getAfterPortlet and ::renderAfterPortlet have been deprecated in
  favor of the Skin::getAfterPortlet method. Skin::getAfterPortlet does not wrap
  the result in a div, callers are responsible for that.
  The hook BaseTemplateAfterPortlet, called by both methods has been deprecated
  as well and is replaced by SkinAfterPortlet.
* Autopromote class has been soft deprecated and it's methods moved into
  UserGroupManager.
* SkinTemplateBuildNavUrlsNav_urlsAfterPermalink hook has been deprecated.
  Use SidebarBeforeOutput hook and get the revision id from the OutputPage
  object.
* BaseTemplate::getToolbox() method has been soft deprecated. The toolbox data
  is now available in a sidebar data array which you can get from any class
  that's extending QuickTemplate class. The hook associated with this method,
  BaseTemplateToolbox, has been hard deprecated. To add items to the toolbox,
  use SidebarBeforeOutput hook instead.
* The SkinTemplateOutputPageBeforeExec hook is deprecated.
  The page [[mw:Manual:Hooks/SkinTemplateOutputPageBeforeExec]] and T60137
  for recommendations for alternative approaches based on how developers
  previously used this hook.
* SkinTemplateToolboxEnd hook has been deprecated. Use SidebarBeforeOutput hook
  instead.
* Using Skin::addToBodyAttributes() method to add body attributes has been
  deprecated. Use OutputPageBodyAttributes hook instead.
* Installer::getDBTypes has been hard deprecated in favor of
  InstallerDBSupport::getDatabases
* The hooks BeforeHttpsRedirect, CanIPUseHTTPS and UserRequiresHTTPS were
  deprecated, as part of a long-term plan to remove support for mixed
  HTTP/HTTPS wikis.
* Skin::generateDebugHTML() has been hard deprecated. Call
  MWDebug::getHTMLDebugLog() directly.
* ExternalStoreDB::getSlave(), soft deprecated in 1.34, was hard deprecated.
  Use ExternalStoreDB::getReplica() instead.
* Less variables in mediawiki.ui/variables.less file that don't follow the
  standard variable naming scheme (compare WikimediaUI Base) including
  `@colorGray* variables have been deprecated. New variables are in place and
  aliases have been set. Replace occurrences and use the new variables instead.

=== Other changes in 1.35 ===
* A new maintenance script is added (purgeExpiredWatchlistItems.php) with which
  to delete expired watchlist items. These items will also be deleted during
  wiki editing if $wgWatchlistPurgeRate is > 0. This maintenance script only
  has effect if $wgWatchlistExpiry is true. It is recommended that a cronjob or
  similar be set up to run it at least daily.
* Title::purgeSquid is deprecated. Use MediaWikiServices::getHtmlCacheUpdater.
* SpecialVersion::getExtLicenseFileName() has been deprecated, use
  MediaWiki\ExtensionInfo::getLicenseFileNames() instead.
* SpecialVersion::getExtAuthorsFileName() has been deprecated, use
  MediaWiki\ExtensionInfo::getAuthorsFileName() instead.
* Migration to the new content storage schema is complete, all backwards
  compatibility code and duplication in the database have been removed.
  The old schema was a 1:1 relationship modeled by
  revision.text_id -> text.old_id. The new schema is a n:m relationship,
  revision.rev_id <- slots.slot_revision_id|slots.slot_content_id ->
  content.content_id|content.content_address -> text.old_id. The same applies
  to the archive table.
  The following fields were removed:
  - revision.rev_text_id, replaced by content.content_address
  - revision.rev_content_model, replaced by content.content_model,
    referencing content_models.model_id
  - revision.rev_content_format, replaced by automatic detecting in
    ContentHandler
  - archive.ar_text_id, replaced by content.content_address
  - archive.ar_content_model, replaced by content.content_model,
    referencing content_models.model_id
  - archive.ar_content_format, replaced by automatic detecting in
    ContentHandler
* Migration to normalized storage of edit comments and user names is
  progressing. The following fields were unused and have been removed:
  - revision.rev_comment,
    replaced by rev_comment_id referencing comment.comment_id.
  - revision.rev_user and rev_user_text,
    replaced by rev_actor referencing actor.actor_id.
  Note that archive.ar_user, archive.ar_user_text, and archive.ar_comment
  had already been removed in previous releases.
* The printableversion has been marked as deprecated per T167956.
* (T30162, T245387) The installer supports using a Postgres server running
  on a custom port other than 5432.

== Compatibility ==
MediaWiki 1.35 requires PHP 7.3.19 or later, and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* json
* mbstring
* xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
but support for them is somewhat less mature.

The supported versions are:

* MySQL 5.5.8 or later
* PostgreSQL 9.2 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.

= MediaWiki 1.34 =

== MediaWiki 1.34.4 ==

This is a maintenance release of the Mediawiki 1.34 branch.

=== Changes since MediaWiki 1.34.3 ===
* Fixed issue relating to backporting of changes for T260485.

== MediaWiki 1.34.3 ==

This is a security and maintenance release of the MediaWiki 1.34 branch.

=== Changes since MediaWiki 1.34.2 ===
* In the web installer, use secure session cookies.
* Make UsersPager::requestedGroup public.
* (T257407) Split patch-drop-user-fields.sql into patch per table.
* (T257356) Split patch-drop-comment-fields.sql into patch per table.
* (T257997) Undeprecate WebInstaller::getInfoBox().
* Added $wgForceHTTPS, which makes the HTTP to HTTPS redirect be unconditional
  and suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
  recommend this be set to true on pure HTTPS wikis.
* Added $wgCookieSameSite, which allows login cookies to be sent with
  SameSite=None. This is required for cross-site CentralAuth autologin after
  Chrome 84.
* Added $wgUseSameSiteLegacyCookies, which adds a compatibility hack to
  SameSite=None cookies for browsers which implemented an incompatible draft
  version of the specification.
* (T257207) shell: Expand documentation in firejail.profile.
* (T246135) Give the "remember me" checkbox a specific CSS class so skins
  like Minerva can only hide that checkbox.
* (T256287) rdbms: improve DBConnRef domain selection exception message.
* (T248191, T259123) phpunit: Acknowledge known dberror from
  SpecialPageFatalTest.
* (T256394, T259123) Cleanup up excess commit() call in LocalRepoTest.
* Fix runBatchedQuery.php for no result from select.
* (T130906) Add Edge to MediaWiki:Clearyourcache.
* (T249521) reassignEdits: Update script to use User::newFromName for anon
  users.
* (T172060) GlobalFunctions: Use php_uname instead of posix_uname.
* Use IPset in MWRestrictions::checkIP.
* (T260031) Add application/font-sfnt to MimeMap for ttf files.
* shell: Make ->restrict( RESTRICT_NONE ) actually work.
* (T183759) Fixes shell edge-cases in Windows.
* (T258390) Add CentralIdLookup::factoryNonLocal().
* (T246991) User: Fix pingLimiter() to use makeGlobalKey() for global rate
  limits.
* (T232568, CVE-2020-25813) SECURITY: Special:UserRights exposes the existence
  of hidden users.
* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global rate
  limit type.
* (T246991) User: enforce pingLimiter() expiry time.
* (T260232) don't include null page ids in query list for category dumps.
* (T251506) Sanitizer: Truncate IDs to a reasonable length.
* (T262900) Fix failure of rebuildLocalisationCache.php due to RL hook.
* Explicitly wrap some XML calls in libxml_disable_entity_loader().
* (T263455 T247285) Set EnableJavaScriptTest to true in
  includes/DevelopmentSettings.php.
* (T232568, CVE-2020-25813) SECURITY: SpecialUserrights: If a viewer lacks
  `hideuser`, ignore hidden users.
* (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on
  Special:Contributions.
* (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within
  LogEventsList.
* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
  firejail's --output functionality.
* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
  'style' attribute.
* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
  mw.message( ... ).parse().
* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
  database.
* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.

== MediaWiki 1.34.2 ==

This is a security and maintenance release of the MediaWiki 1.34 branch.

=== Changes since MediaWiki 1.34.1 ===
* (T247017) PasswordReset performance improvements.
* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
* (T250568) Work around change in SimpleXMLElement behavior introduced in PHP
  7.3.17.
* (T251789) Let $wgResourceLoaderMaxQueryLength=-1 fallback to default.
* Remove some rotten and out of date documentation.
* (T252311) Improvements to some older SQLite update patches.
* (T240307) Minor fixes to extension.schema.v2.json and
  extension.schema.v1.json.
* (T238043) cleanupUsersWithNoId.php: Handle missing fields.
* (T199474) Set rc_patrolled to 2 for autopatrolled changes in
  rebuildrecentchanges.php.
* (T229461) Update the change_tag table in rebuildrecentchanges.php.
* (T249730) Password Reset Updates.
* (T234450) Per-user concurrency in SpecialContributions can now be limited by
  setting $wgPoolCounterConf['SpecialContributions'] appropriately.
* (T248947) SECURITY: img_auth.php may leak private extension images into the
  public cache.

== MediaWiki 1.34.1 ==

This is a security and maintenance release of the MediaWiki 1.34 branch.

=== Changes since MediaWiki 1.34.0 ===
* (T211450) User: better error message when getActorId fails.
* (T241340) Don't redefine MW_ENTRY_POINT in thumb.php if already defined.
* (T236444) User: Allow newSystemUser() to create over anonymous actors.
* (T238483) Fix NewPagesPager "hide registered users" option.
* (T245072) mediawiki.language: Rename languageData back to languageNames.
* Use proper SemVer comparison in CheckComposerLockUpToDate.
* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated.
* (T246127) Fix error when initialising updateCollation.php.
* Update comment about PHP versions supported by The PHP Group.
* (T247215) Fix output of RecountCategories::doWork().
* Add check for page existence to view.php maintenance script.
* (T245149) Fix fetching login token from action=query&meta=tokens on private
  wikis.
* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink().
* (T232932) SECURITY: User content can redirect the logout button to different
  URL.
* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to
  any CSS selector.

== MediaWiki 1.34.0 ==

=== Changes since MediaWiki 1.34.0-rc.1 ===
* $wgDiffEngine (T237049) – This configuration can be used to specify which
  difference engine to use. MediaWiki continues to default to automatically
  choosing the first of $wgExternalDiffEngine, wikidiff2, or php that is
  usable.
* (T231866) SqlBlobStore no longer needs Language object.
* (T236735) WikiExporter: Remove unnecessary check for SCHEMA_COMPAT_WRITE_OLD
  flag.
* (T231673) Set MCR migration stage to SCHEMA_COMPAT_NEW.
* (T229601) Make sure DBLoadBalancerFactory service is not disabled.
* (T232866) Fix support for HTTP/2 in MultiHttpClient.
* (T231866) LocalisationCache: Don't instantiate ResourceLoader.
* (T227461) Stop calling deprecated Redis delete functions.
* (T239561) Mark options as requiring parameters in addSite.php.
* (T232866) Mimic CURLOPT_POST in GuzzleHttpRequest.
* (T239734) Replace deprecated lSize with lLen in Redis code.
* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
* (T239428) ApiEditPage: Test for bad redirect targets.
* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
  'trace'.
* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
* (T240924) NewPagesPager: Fix namespace query conditions.
* (T212067) Tests for an old PHP bug in parse_url.

== MediaWiki 1.34.0-rc.1 ==

=== Changes since MediaWiki 1.34.0-rc.0 ===
* (T231742) rdbms: Restore debug toolbar "Queries" feature.
* (T231366) The ProfilerOutputDb class, 'profiling' table, and profileinfo.php
  entry point had been deprecated.
* (T234361) localisation: Add debug message for backend of MessageCache.
* (T234361) session: Add debug message for the used store class.
* (T235559) Fix example Kask configuration in RESTBagOStuff class comment.
* (T235137) Don't apply styling for Special:Contributions on other pages.
* Upgrade mediawiki-codesniffer from 26.0.0 to 28.0.0 (dev-only).
* (T219604) The "jquery.ui.*" and "jquery.effects.*" modules are now
  deprecated as aliases for the "jquery.ui" module.
* (T235392) Deprecate setting Parser::mTitle to null.
* Supporting commits for T235392 were also backported to prevent divergence
  from master (MediaWiki 1.35).
* (T234581) The 'jquery.tabIndex' module is deprecated.
* Fix docs for GetUserBlock hooks.
* Parser: Hard deprecate getConverterLanguage.
* (T236810) A number of public methods of Parser were exposed only for
  historical reasons and have been deprecated: doMagicLinks,
  doDoubleUnderscore, doHeadings, doAllQuotes, replaceExternalLinks,
  replaceInternalLinks, replaceInternalLinks2, getVariableValue,
  initialiseVariables, formatHeadings, testPst, testPreprocess, testSrvus,
  areSubpagesAllowed, maybeDoSubpageLink, splitWhitespace, createAssocArgs,
  armorLinks, makeKnownLinkHolder, getImageParams, parseLinkParameter,
  stripAltText, replaceLinkHolders, replaceLinkHoldersText, armorLinks,
  makeKnownLinkHolder, getImageParams, parseLinkParameter, stripAltText.
* (T30798) $wgServer must now always be set in LocalSettings.php. This is most
  likely the case already for any wiki installed after 1.18. The autodetection
  system was informally deprecated since 1.18 and vulnerable to cache poisoning
  attacks. Older wikis may need to update their LocalSettings.php file.
* (T232169) Hard deprecate $wgSysopEmailBans.
* (T236628) Fix for ArticleRevisionViewCustom hook in DifferenceEngine.php.
* (T181658) Do not insert page titles into querycache.qc_value.
* ParamValidator has been flagged as unstable.
* Hard deprecate Parser::disableCache().

== MediaWiki 1.34.0-rc.0 ==

== Upgrading notes for 1.34 ==
1.34 has several database changes since 1.33, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed upgrade instructions, including
important information when upgrading from versions prior to 1.11.

Some specific notes for MediaWiki 1.34 upgrades are below:

* MediaWiki now requires PHP 7.2.9 or above.
* MediaWiki no longer supports HHVM.

For notes on 1.33.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.34 ===

In an effort to enforce best practices for passwords, MediaWiki will now warn
users, and suggest that they change their password, if it is in the list of
100,000 commonly used passwords that are considered bad passwords. If you want
to disable this for your users, please add the following to your local settings:

$wgPasswordPolicy['policies']['default']['PasswordNotInLargeBlacklist'] = false;

==== New configuration ====
* $wgAllowExternalReqID (T201409) - This configuration setting controls whether
  Mediawiki accepts the request ID set by the incoming request via the
  `X-Request-Id` header. If set to `true`, that value will be used throughout
  the code as the request identificator. Otherwise, the sent header will be
  ignored and the request ID will either be taken from Apache's mod_unique
  module or will be generated by Mediawiki itself (depending on the set-up).
* $wgEnableSpecialMute (T218265) - This configuration controls whether
  Special:Mute is available and whether to include a link to it on emails
  originating from Special:Email.
* editmyuserjsredirect user right – users without this right now cannot edit JS
  redirects in their userspace unless the target of the redirect is also in
  their userspace. By default, this right is given to everyone.
* (T226733) Add rate limiter to Special:ConfirmEmail.
* $wgDiffEngine (T237049) – This configuration can be used to specify which
  difference engine to use. MediaWiki continues to default to automatically
  choosing the first of $wgExternalDiffEngine, wikidiff2, or php that is
  usable.

==== Changed configuration ====
* $wgUseCdn, $wgCdnServers, $wgCdnServersNoPurge, and $wgCdnMaxAge – These four
  CDN-related config variables have been renamed from being specific to Squid –
  they were previously $wgUseSquid, $wgSquidServers, $wgSquidServersNoPurge, and
  $wgSquidMaxage respectively. This aligns them with the related existing
  variable $wgCdnMaxageLagged. The previous configuration variable names are
  deprecated, but will be used as the fall back if they are still set.
  Note that wgSquidPurgeUseHostHeader has not been renamed, as it is deprecated.
* (T27707) File type checks for image uploads have been relaxed to allow files
  containing some HTML markup in metadata. As a result, the $wgAllowTitlesInSVG
  setting is no longer applied and is now always true. Note that MSIE 7 may
  still be able to misinterpret certain malformed PNG files as HTML.
* (T30798) $wgServer must now always be set in LocalSettings.php. This is most
  likely the case already for any wiki installed after 1.18. The autodetection
  system was informally deprecated since 1.18 and vulnerable to cache poisoning
  attacks. Older wikis may need to update their LocalSettings.php file.
* Introduced $wgVerifyMimeTypeIE to allow disabling the MSIE 6/7 file type
  detection heuristic on upload, which is more conservative than the checks
  that were changed above.
* $wgExternalDiffEngine — Setting this to a string value of 'wikidiff',
  'wikidiff2', or 'wikidiff3' will no longer work. This legacy behaviour was
  deprecated in MediaWiki 1.27, 1.32, and 1.27, respectively.
* $wgSkipSkin — Setting this instead of $wgSkipSkins, deprecated in 1.23, is now
  hard-deprecated.
* $wgLocalInterwiki — Setting this instead of $wgLocalInterwikis, deprecated in
  1.23, is now hard-deprecated.
* $wgProfileOnly — Setting this, deprecated in 1.23, is now hard-deprecated.
  Instead, set the log file in $wgDebugLogGroups['profileoutput'].
* $wgProxyList — Setting this to an array with IP addresses in the array keys,
  which was deprecated in 1.30, no longer works. Instead, $wgProxyList should be
  an array with IP addresses as the values, or a string path to a file
  containing one IP address per line.
* $wgCookieSetOnAutoblock and $wgCookieSetOnIpBlock are now enabled by default.

==== Removed configuration ====
* $wgWikiDiff2MovedParagraphDetectionCutoff — If you still want a custom change
  size threshold, please specify in php.ini, using the configuration variable
  wikidiff2.moved_paragraph_detection_cutoff.
* $wgUseESI - This experimental setting, deprecated in 1.33, is now removed.
* $wgDebugPrintHttpHeaders - The default of including HTTP headers in the
  debug log channel is no longer configurable. The debug log itself remains
  configurable via $wgDebugLogFile.
* $wgMsgCacheExpiry - The MessageCache uses 24 hours as the expiry for values
  stored in WANObjectCache. This is no longer configurable.
* $wgPasswordSalt – This setting, used for migrating exceptionally old, insecure
  password setups and deprecated since 1.24, is now removed.
* $wgDBOracleDRCP - If you must use persistent connections, set DBO_PERSISTENT
  in the 'flags' field for servers in $wgDBServers (or $wgLBFactoryConf).
* $wgMemCachedDebug - Set the cache "debug" field in $wgObjectCaches instead.
* $wgActorTableSchemaMigrationStage has been removed. Extension code for
  MediaWiki 1.31+ finding it unset should treat it as being SCHEMA_COMPAT_NEW.

=== New user-facing features in 1.34 ===
* Special:Mute has been added as a quick way for users to block unwanted emails
  from other users originating from Special:EmailUser.
* (T207577) Special:NewSection has been created as a shortcut to creating a new
  section on a page. When linked to, its subpage is used as the target
  ([[Special:NewSection/Test]] redirects to creating a new section in "Test").
  Otherwise, it displays a basic interface to allow the end user to specify
  the target manually.
* (T220447) Special:Contributions/newbies has been removed for performance and
  usefulness reasons. Use Special:RecentChanges?userExpLevel=newcomer instead.
* Special:NewFiles/newbies has been removed for performance and usefulness
  reasons. Use Special:RecentChanges?userExpLevel=newcomer&namespace=6 instead.

=== New developer features in 1.34 ===
* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
  of headers in private wikis.
* Language::formatTimePeriod now supports the new 'avoidhours' option to output
  strings like "5 days ago" instead of "5 days 13 hours ago".
* (T220163) Added SpecialMuteModifyFormFields hook to allow extensions
  to add fields to Special:Mute.
* (T100896) Skin authors can define custom OOUI themes using OOUIThemePaths.
  See <https://www.mediawiki.org/wiki/OOUI/Themes> for details.
* (T229035) The GetUserBlock hook was added. Use this instead of
  GetBlockedStatus.
* ObjectFactory is available as a service. When used as a service, the object
  specs can now specify needed DI services.
* (T222388) Special pages can now be specified as an ObjectFactory spec,
  allowing the construction of special pages that require services to be
  injected in their constructor.
* (T222388) API modules can now be specified as an ObjectFactory spec,
  allowing the construction of modules that require services to be injected
  in their constructor.
* (T117736) The function signature of SpecialContributions::getForm::filters
  has changed. It now expects definitions of additional filter fields as array
  rather than string.

=== External library changes in 1.34 ===

==== Changed external libraries ====
* Updated Mustache from 1.0.0 to v3.0.1.
* Updated OOUI from v0.31.3 to v0.34.0.
* Updated OOjs from v2.2.2 to v3.0.0.
* Updated composer/semver from 1.4.2 to 1.5.0.
* Updated composer/spdx-licenses from 1.4.0 to 1.5.1 (dev-only).
* Updated mediawiki/codesniffer from 25.0.0 to 28.0.0 (dev-only).
* Updated cssjanus/cssjanus from 1.2.1 to 1.3.0.
* Updated wikimedia/at-ease from 1.2.0 to 2.0.0.
* Updated wikimedia/remex-html from 2.0.1 to 2.1.0.
* Updated monolog/monolog from 1.22.1 to 1.24.0 (dev-only).
* Updated wikimedia/object-factory from 1.0.0 to 2.1.0.
* Updated wikimedia/timestamp from 2.2.0 to 3.0.0.
* Updated wikimedia/xmp-reader from 0.6.2 to 0.6.3.
* Updated mediawiki/mediawiki-phan-config from 0.6.0 to 0.6.1 (dev-only).
* Updated wikimedia/avro from 1.8.0 to 1.9.0 (dev-only).

==== Removed external libraries ====
* The jquery.async module, deprecated in 1.33, was removed.

=== Bug fixes in 1.34 ===
* (T222529) If a log entry or page revision is recorded in the database with an
  empty username, attempting to display it will log an error and return a "no
  username available" to the user instead of silently displaying nothing or
  invalid links.

=== Action API changes in 1.34 ===
* The 'recenteditcount' response property from action=query list=allusers,
  deprecated in 1.25, has been removed.
* (T60993) action=query list=filearchive, list=alldeletedrevisions and
  prop=deletedrevisions no longer require the 'deletedhistory' user right.
* In the response to queries that use 'prop=imageinfo', entries for
  non-existing files (indicated by the 'filemissing' field) now omit the
  following fields, since they are meaningless in this context:
  'timestamp', 'userhidden', 'user', 'userid', 'anon', 'size', 'width',
  'height', 'pagecount', 'duration', 'commenthidden', 'parsedcomment',
  'comment', 'thumburl', 'thumbwidth', 'thumbheight', 'thumbmime',
  'thumberror', 'url', 'sha1', 'metadata', 'extmetadata', 'commonmetadata',
  'mime', 'mediadtype', 'bitdepth'.
  Clients that process these fields should first check if 'filemissing' is
  set. Fields that are supported even if the file is missing include:
  'canonicaltitle', 'archivename' (deleted files only), 'descriptionurl',
  'descriptionshorturl'.
* The 'blockexpiry' result property in list=users and list=allusers will now be
  returned in the same format used by the rest of the API: ISO 8601 for
  expiring blocks, and "infinite" for non-expiring blocks.

=== Action API internal changes in 1.34 ===
* The exception thrown in ApiModuleManager::getModule has been changed
  from an MWException to an UnexpectedValueException, thrown by ObjectFactory.
  ApiModuleManager::getModule now also throws InvalidArgumentExceptions when
  ObjectFactory is presented with an invalid spec or incorrectly constructed
  objects.
* Added ApiQueryBlockInfoTrait.

=== Languages updated in 1.34 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T152908) Added language support for N'Ko (nqo).

=== Breaking changes in 1.34 ===
* The global functions wfSuppressWarnings and wfRestoreWarnings, deprecated in
  1.26, have been removed. Use Wikimedia\AtEase\AtEase::suppressWarnings() and
  Wikimedia\AtEase\AtEase::restoreWarnings() directly.
* Preferences class, deprecated in 1.31, has been removed.
* The following parts of code, deprecated in 1.32, were removed in favor of
  built-in PHP functions:
  * CryptRand class
  * CryptRand service
  * Functions of the MWCryptRand class: singleton(), wasStrong() and generate().
* Various Special Page PHP Classes were renamed (mostly casing changes):
  * SpecialAncientpages => SpecialAncientPages
  * SpecialConfirmemail => SpecialConfirmEmail
  * SpecialDeadendpages => SpecialDeadendPages
  * SpecialFewestrevisions => SpecialFewestRevisions
  * SpecialListredirects => SpecialListRedirects
  * SpecialLonelypages => SpecialLonelyPages
  * SpecialLongpages => SpecialLongPages
  * SpecialMIMEsearch => SpecialMIMESearch
  * SpecialMostcategories => SpecialMostCategories
  * SpecialMostinterwikis => SpecialMostInterwikis
  * SpecialMostlinked => SpecialMostLinked
  * SpecialMostlinkedcategories => SpecialMostLinkedCategories
  * SpecialMostlinkedtemplates => SpecialMostLinkedTemplates
  * SpecialMostrevisions => SpecialMostRevisions
  * SpecialNewimages => SpecialNewFiles
  * SpecialShortpages => SpecialShortPages
  * SpecialUncategorizedcategories => SpecialUncategorizedCategories
  * SpecialUncategorizedimages => SpecialUncategorizedImages
  * SpecialUncategorizedpages => SpecialUncategorizedPages
  * SpecialUncategorizedtemplates => SpecialUncategorizedTemplates
  * SpecialUnusedcategories => SpecialUnusedCategories
  * SpecialUnusedimages => SpecialUnusedImages
  * SpecialUnusedtemplates => SpecialUnusedTemplates
  * SpecialUnwatchedpages => SpecialUnwatchedPages
  * SpecialWantedcategories => SpecialWantedCategories
  * SpecialWantedtemplates => SpecialWantedTemplates
  * SpecialWithoutinterwiki => SpecialWithoutInterwiki
* Language::setCode, deprecated in 1.32, was removed. Use Language::factory to
  create a new Language object with a different language code.
* MWNamespace::clearCaches() has been removed.  So has the $rebuild parameter
  to MWNamespace::getCanonicalNamespaces(), which was deprecated since 1.31.
  Instead, reset services, such as by calling $this->overrideMwServices() (if
  your test extends MediaWikiTestCase). Services will generally not pick up
  configuration changes from after they were created, so you must reset
  services after any configuration change. Even if your code works now, it is
  likely to break in future versions as more code is moved to services.
* The ill-defined "DatabaseOraclePostInit" hook has been removed.
* PreferencesFormLegacy and PreferencesForm classes, deprecated in 1.32, have
  been removed.
* ObjectFactory class, deprecated in 1.31, has been removed.
* HWLDFWordAccumudlator class, deprecated in 1.28, has been removed.
* XMPInfo, XMPReader and XMPValidate, deprecated in 1.32, have been removed.
* The RedirectSpecialPage::execute method could sometimes return a Title object.
  This behavior was removed, and the method now matches the parent signature
  (SpecialPage::execute) which is to return HTML string or void.
  To obtain the destination title, use RedirectSpecialPage::getRedirect.
* The 'recenteditcount' response property from action API action=query
  list=allusers, deprecated in 1.25, has been removed.
* SearchEngine::userNamespaces(), SearchEngine::namespacesAsText(),
  SearchEngine::create(), SearchEngine::getSearchTypes() and
  SearchEngine::getNearMatch(), methods deprecated in 1.27, have been removed.
* FileRepo::streamFile(), deprecated in 1.26, has been removed.
* User::randomPassword() method, deprecated in 1.27, have been removed.
* MWNamespace::canTalk(), deprecated in 1.30, have been removed.
* Parser class property $mUniqPrefix, deprecated in 1.26, has been removed.
* wfArrayFilter() and wfArrayFilterByKey(), deprecated in 1.32, have been
  removed.
* wfMakeUrlIndexes() function, deprecated in 1.33, have been removed.
* Method signatures in WatchedItemQueryServiceExtension have changed from taking
  User objects to taking UserIdentity objects. Extensions implementing this
  interface need to be changed accordingly.
* User::getGroupPage() and ::makeGroupLinkHTML(), deprecated in 1.29, have been
  removed. Use UserGroupMembership::getGroupPage and ::getLink instead.
* User::makeGroupLinkWiki(), deprecated in 1.29, has been removed. Use
  UserGroupMembership::getLink() instead.
* SavepointPostgres, deprecated in 1.31, has been removed.
* OutputPage::enableSectionEditLinks(), OutputPage::sectionEditLinksEnabled(),
  ParserOptions::getEditSection(), ParserOptions::setEditSection(), and
  ParserOutput::getEditSectionTokens, ::getTOCEnabled, ::setEditSectionTokens,
  and ::setTOCEnabled, deprecated in 1.31, have been removed.
* EditPage::safeUnicodeInput() and ::safeUnicodeOutput(), deprecated in 1.30,
  have been removed.
* Four methods in OutputPage, deprecated in 1.32, have been removed. You should
  use OutputPage::showFatalError or throw a FatalError instead. The methods are
  ::showFileCopyError(), ::showFileRenameError(), ::showFileDeleteError(), and
  ::showFileNotFoundError().
* ApiBase::truncateArray(), deprecated in 1.32, has been removed.
* IcuCollation::getICUVersion(), deprecated in 1.32, has been removed. Use PHP's
  INTL_ICU_VERSION constant directly.
* HTMLForm::setSubmitProgressive(), deprecated in 1.32, has been removed.
* ResourceLoaderStartUpModules::getStartupModules() and ::getLegacyModules(),
  both deprecated in 1.32, have been removed.
* BaseTemplate::msgHtml() and QuickTemplate::msgHtml(), deprecated in 1.32, have
  been removed. Use ->msg() or ->getMsg() instead.
* WatchAction::getUnwatchToken(), deprecated in 1.32, has been removed. Instead,
  use WatchAction::getWatchToken() with action 'unwatch' directly.
* Language::initEncoding(), ::recodeForEdit(), and recodeInput(), deprecated in
  1.28, have been removed.
* PageArchive::getTextFromRow(), ::listAllPages(), and ::getLastRevisionText(),
  deprecated in 1.32, have been removed.
* OutputPage::getModuleScripts(), ParserOutput::getModuleScripts(), deprecated
  in 1.33, have been removed.
* User::getPasswordValidity(), deprecated in 1.33, has been removed.
* ApiQueryBase::prepareUrlQuerySearchString(), deprecated in 1.33, has been
  removed.
* ChangeTags::purgeTagUsageCache(), deprecated in 1.33, has been removed.
* JobQueueGroup::pushLazyJobs(), deprecated in 1.33, has been removed.
* MediaWikiTestCase::stashMwGlobals(), deprecated in 1.32, has been removed.
* SearchEngine::transformSearchTerm(), deprecated in 1.32, has been removed.
* The Block typehint only refers to blocks stored in the database. It should be
  updated to AbstractBlock in cases where any type of block could be expected.
* FileRepoStatus, deprecated in 1.25, has been removed.
* The LegacyHookPreAuthenticationProvider class, deprecated since its creation
  in 1.27, has been removed.
* IP::isValidBlock(), deprecated in 1.30, has been removed.
* WikiPage::prepareContentForEdit now doesn't accept an integer for $revision,
  was deprecated in 1.25.
* The jquery.byteLength module, deprecated in 1.31, was removed.
  Use the mediawiki.String module instead.
* mw.language.specialCharacters, deprecated in 1.33, has been removed.
  Use require( 'mediawiki.language.specialCharacters' ) instead.
* The jquery.colorUtil module was removed. Use jquery.color instead.
* The jquery.checkboxShiftClick module was removed. The functionality
  is provided by mediawiki.page.ready instead (T232688).
* The 'jquery.accessKeyLabel' module has been removed. This jQuery
  plugin now ships as part of the 'mediawiki.util' module bundle.
* EditPage::submit(), deprecated in 1.29, has been removed. Use $this->edit()
  directly.
* HTMLForm::getErrors(), deprecated in 1.28, has been removed. Use
  getErrorsOrWarnings() instead.
* SpecialPage::getTitle(), deprecated in 1.23, has been removed. Use
  SpecialPage::getPageTitle() instead.
* jquery.ui.effect-bounce, jquery.ui.effect-explode, jquery.ui.effect-fold
  jquery.ui.effect-pulsate, jquery.ui.effect-slide, jquery.ui.effect-transfer,
  which are no longer used, have now been removed.
* SpecialEmailUser::validateTarget(), ::getTarget() without a sender/user
  specified, deprecated in 1.30, have been removed.
* BufferingStatsdDataFactory::getBuffer(), deprecated in 1.30, has been removed.
* The constant DB_SLAVE, deprecated in 1.28, has been removed. Use DB_REPLICA.
* The constants NS_IMAGE and NS_IMAGE_TALK, deprecated in 1.14, have been
  removed. Use NS_FILE and NS_FILE_TALK respectively.
* Replacer, DoubleReplacer, HashtableReplacer and RegexlikeReplacer
  (deprecated in 1.32) have been removed. Closures should be used instead.
* OutputPage::addWikiText(), ::addWikiTextWithTitle(), ::addWikiTextTitleTidy(),
  ::addWikiTextTidy(), ::addWikiTextTitle(), deprecated in 1.32, have been
  removed.
* The $wgUseKeyHeader configuration option and the OutputPage::getKeyHeader()
  method, deprecated in 1.32, have been removed.
* WebInstallerOutput::addWikiText(), deprecated in 1.32, has been removed.
* Parser::fetchFile(), deprecated in 1.32, has been removed. Use the method
  Parser::fetchFileAndTitle() instead.
* The global function wfBCP47, deprecated in 1.31, has been removed.
* wfCountDown() function, deprecated in 1.31, has been removed. Use
  \Maintenance::countDown() method instead.
* OutputPage::wrapWikiMsg() no longer accepts an options parameter. This was
  deprecated since 1.20.
* Skin::outputPage() no longer accepts a context. This was deprecated in 1.20.
* Linker::link() no longer accepts a string for the query array, as was
  deprecated in 1.20.
* PrefixSearch::titleSearch(), deprecated in 1.23, has been removed. Use the
  SearchEngine::defaultPrefixSearch or ::completionSearch() methods instead.
* The UserRights hook, deprecated in 1.26, has been removed. Instead, use the
  UserGroupsChanged hook.
* Skin::getDefaultInstance(), deprecated in 1.27, has been removed. Get the
  instance from MediaWikiServices instead.
* The UserLoadFromSession hook, deprecated in 1.27, has been removed.
* The wfResetSessionID global function, deprecated in 1.27, has been removed.
  Use MediaWiki\Session\SessionManager instead.
* The wfGetLBFactory global function, deprecated in 1.27, has been removed.
  Use MediaWikiServices::getInstance()->getDBLoadBalancerFactory().
* The internal method OutputPage->addScriptFile() will no longer silently drop
  calls that use an invalid path (i.e., something other than an absolute path,
  protocol-relative URL, or full scheme URL), and will instead pass them to the
  client where they will likely 404. This usage was deprecated in 1.24.
* Database::reportConnectionError, deprecated in 1.32, has been removed.
* APIEditBeforeSave hook, deprecated in 1.28, has been removed. Please see
  EditFilterMergedContent hook for an alternative way to use this feature.
* API module methods getDescription(), getParamDescription(), & getExamples(),
  all deprecated in 1.25 and ignored, have been removed.
* The API module method getDescriptionMessage(), deprecated in 1.30, has been
  removed.
* The JavaScript global variable wgLoadScript has been removed. Use
  mw.util.wikiScript( 'load' ) instead.
* ResourceLoader no longer creates the 'mw.legacy' placeholder object. It has
  been unused since 1.16 and was deprecated in 1.22. To deprecate a property
  in JavaScript, use mw.log.deprecate() instead.
* The 'user.groups' module, deprecated in 1.28, was removed.
  Use the 'user' module instead.
* The ResourceLoaderContext::expandModuleNames method, deprecated in 1.33, was
  removed. Use ResourceLoader::expandModuleNames instead.
* The ability to override User::$mRights has been removed. Use
  PermissionManager::addTemporaryUserRights() instead.
* Previously, when iterating ResultWrapper with foreach() or a similar
  construct, the range of the index was 1..numRows. This has been fixed to be
  0..(numRows-1).
* The ChangePasswordForm hook, deprecated in 1.27, has been removed. Use the
  AuthChangeFormFields hook or security levels instead.
* WikiMap::getWikiIdFromDomain(), deprecated in 1.33, has been removed.
  Use WikiMap::getWikiIdFromDbDomain() instead.
* The config variables $wgHtml5, $wgJsMimeType, and $wgXhtmlDefaultNamespace,
  which were deprecated and ignored by core since 1.22, are no longer set to any
  value, and SkinTemplate no longer emits a 'jsmimetype' key. Any extensions not
  updated since 2013 to cope with this deprecation may now break.
* (T222637) Passing ResourceLoaderModule objects to ResourceLoader::register()
  or $wgResourceModules is no longer supported.
  Use the 'class' or 'factory' option of the array format instead.
* The parameter $lang of the functions generateTOC and tocList in Linker and
  DummyLinker must be in type Language when present. Other types are
  deprecated since 1.33.
* The static properties mw.Api.errors and mw.Api.warnings, deprecated in 1.29,
  have been removed.
* ParserOption::getSpeculativeRevIdCallback(), deprecated in 1.28, has been
  removed.
* The UploadVerification hook, deprecated in 1.28, has been removed. Instead,
  use the UploadVerifyFile hook.
* UploadBase:: and UploadFromChunks::stashFileGetKey() and stashSession(),
  deprecated in 1.28, have been removed. Instead, please use the getFileKey()
  method on the response from doStashFile().
* LBFactory::setDomainPrefix() and LoadBalancer::setDomainPrefix(), deprecated
  in 1.33, have been removed. Use setLocalDomainPrefix() instead.
* IDatabase::implicitGroupby(), deprecated in 1.30, has been removed.
* IDatabase::doneWrites(), deprecated in 1.31, has been removed.
  Use IDatabase::lastDoneWrites() instead.
* Database::reportConnectionError(), deprecated in 1.32, has been removed.
* LoadBalancer::laggedSlaveUsed(), deprecated in 1.28, has been removed.
  Use LoadBalancer::laggedReplicaUsed() instead.
* Database::getProperty(), deprecated in 1.28, has been removed.
* IDatabase::getWikiId(), deprecated in 1.30, has been removed.
  Use IDatabase::getDomainID() instead.
* (T191231) Support for using Oracle or MSSQL as database backends has been
  dropped.
* MessageCache::destroyInstance() has been removed. Instead, call
  MediaWikiTestCase::resetServices().
* SearchResult protected field $searchEngine is removed and no longer
  initialized after calling SearchResult::initFromTitle().
* The UserIsBlockedFrom hook is only called if a block is found first, and
  should only be used to unblock a blocked user.
* Parameters for index.php from PATH_INFO, such as the title, are no longer
  written to $_GET.
* The selectFields() methods on classes LocalFile, ArchivedFile, OldLocalFile,
  DatabaseBlock, and RecentChange, deprecated in 1.31, have been removed. Use
  the corresponding getQueryInfo() methods instead.
* The following methods on Revision, deprecated since 1.31, have been removed.
  Use RevisionStore::getQueryInfo() or RevisionStore::getArchiveQueryInfo()
  instead.
  * Revision::userJoinCond()
  * Revision::pageJoinCond()
  * Revision::selectFields()
  * Revision::selectArchiveFields()
  * Revision::selectTextFields()
  * Revision::selectPageFields()
  * Revision::selectUserFields()
* User::setNewpassword(), deprecated in 1.27 has been removed.
* The ObjectCache::getMainWANInstance and ObjectCache::getMainStashInstance
  functions, deprecated since 1.28, have been removed.
* Language::$dataCache has been removed (without prior deprecation, for
  practical reasons). Use MediaWikiServices instead to get a LocalisationCache.

=== Deprecations in 1.34 ===
* The MWNamespace class is deprecated. Use NamespaceInfo.
* ExtensionRegistry->load() is deprecated, as it breaks dependency checking.
  Instead, use ->queue().
* User::isBlocked() is deprecated since it does not tell you if the user is
  blocked from editing a particular page. Use User::getBlock() or
  PermissionManager::isBlockedFrom() or PermissionManager::userCan() instead.
* User::isLocallyBlockedProxy and User::inDnsBlacklist are deprecated and moved
  to the BlockManager as private helper methods.
* User::isDnsBlacklisted is deprecated. Use BlockManager::isDnsBlacklisted
  instead.
* The Config argument to ChangesListSpecialPage::checkStructuredFilterUiEnabled
  is deprecated. Pass only the User argument.
* WatchedItem::getUser is deprecated. Use getUserIdentity.
* Passing a Title as the first parameter to the getTimestampById method of
  RevisionStore is deprecated. Omit it, passing only the remaining parameters.
* Title::getPreviousRevisionId and Title::getNextRevisionId are deprecated. Use
  RevisionLookup::getPreviousRevision and RevisionLookup::getNextRevision.
* The Title parameter to RevisionLookup::getPreviousRevision and
  RevisionLookup::getNextRevision is deprecated and should be omitted.
* MWHttpRequest::factory is deprecated. Use HttpRequestFactory.
* The Http class is deprecated. For the request, get, and post methods, use
  HttpRequestFactory. For isValidURI, use MWHttpRequest::isValidURI.  For
  getProxy, use (string)$wgHTTPProxy. For createMultiClient, construct a
  MultiHttpClient directly.
* Http::$httpEngine is deprecated and has no replacement. The default 'guzzle'
  engine will eventually be made the only engine for HTTP requests.
* RepoGroup::singleton(), RepoGroup::destroySingleton(),
  RepoGroup::setSingleton(), wfFindFile(), and wfLocalFile() are all
  deprecated. Use MediaWikiServices instead.
* The getSubjectPage, getTalkPage, and getOtherPage of Title are deprecated.
  Use NamespaceInfo's getSubjectPage, getTalkPage, and getAssociatedPage.
* MWMessagePack class, no longer used, has been deprecated in 1.34.
* The Block class is separated into DatabaseBlock (for blocks stored in the
  database), and SystemBlock (for temporary blocks created by the system).
  SystemBlock should be used when creating any temporary blocks. Block is
  a deprecated alias for DatabaseBlock.
* Parser::$mConf is deprecated. It will be removed entirely in a later version.
  Some context can be found at T224165.
* Constructing Parser directly is deprecated. Obtain one from ParserFactory.
* Title::moveSubpages is deprecated. Use MovePage::moveSubpages or
  MovePage::moveSubpagesIfAllowed.
* The MWNamespace class is deprecated. Use MediaWikiServices::getNamespaceInfo.
* (T62260) Hard deprecate Language::getExtraUserToggles() method.
* Language::viewPrevNext function is deprecated, use
  PrevNextNavigationRenderer::buildPrevNextNavigation instead
* User::trackBlockWithCookie and DatabaseBlock::clearCookie are deprecated. Use
  BlockManager::trackBlockWithCookie and BlockManager::clearCookie instead.
* DatabaseBlock::setCookie, DatabaseBlock::getCookieValue,
  DatabaseBlock::getIdFromCookieValue and AbstractBlock::shouldTrackWithCookie
  are moved to internal helper methods for BlockManager::trackBlockWithCookie.
* ResourceLoaderContext::getConfig and ResourceLoaderContext::getLogger have
  been deprecated. Inside ResourceLoaderModule subclasses, use the local methods
  instead. Elsewhere, use the methods from the ResourceLoader class.
* The Profiler::setTemplated and Profiler::getTemplated methods have been
  deprecated. Use Profiler::setAllowOutput and Profiler::getAllowOutput
  instead.
* The ProfilerOutputDb class, 'profiling' table, and profileinfo.php entry
  point had been deprecated (T231366).
* The Preprocessor_DOM implementation has been deprecated.  It will be
  removed in a future release.  Use the Preprocessor_Hash implementation
  instead.
* Sanitizer::attributeWhitelist() and Sanitizer::setupAttributeWhitelist()
  have been deprecated; they will be made private in the future.
* SearchResult::termMatches() method is deprecated. It was unreliable because
  only populated by few search engine implementations. Use
  SqlSearchResult::getTermMatches() if really needed.
* SearchResult::getTextSnippet( $terms ) the $terms param is being deprecated
  and should no longer be passed. Search engine implemenations should be
  responsible for carrying relevant information needed for highlighting with
  their own SearchResultSet/SearchResult sub-classes.
* SearchResultSet::free() method is deprecated.
* SearchEngine::$searchTerms protected field is deprecated. Moved to
  SearchDatabase.
* The use of the $terms param in the ShowSearchHit and ShowSearchHitTitle
  hooks is highly discouraged as it's only populated by SearchDatabase search
  engines.
* Skin::escapeSearchLink() is deprecated. Use Skin::getSearchLink() or the skin
  template option 'searchaction' instead.
* Skin::getRevisionId() and Skin::isRevisionCurrent() have been deprecated.
  Use OutputPage::getRevisionId() and OutputPage::isRevisionCurrent() instead.
* LoadBalancer::haveIndex() and LoadBalancer::isNonZeroLoad() have
  been deprecated.
* FileBackend::getWikiId() has been deprecated.
  Use FileBackend::getDomainId() instead.
* User::getRights() and User::$mRights have been deprecated. Use
  PermissionManager::getUserPermissions() instead.
* The LocalisationCacheRecache hook no longer allows purging of message blobs
  to be prevented. Modifying the $purgeBlobs parameter now has no effect.
* SVGMetadataExtractor::getMetadata has been deprecated. Instead, you should
  use SVGReader->getMetadata() directly.
* The following public properties on AbstractBlock are deprecated: $mReason,
  $mTimestamp, $mExpiry, $mHideName. Use the getters/setters instead.
* The following public properties on DatabaseBlock are deprecated: $mAuto,
  $mParentBlockId. To check for an autoblock use DatabaseBlock::getType; to
  check for the parent ID, use DatabaseBlock::getParentBlockId.
* SearchEngine::userHighlightPrefs() is deprecated, simply stop passing
  $contextlines and $contextchars to the SearchHighlighter methods, they will
  use proper defaults defined in SearchHighlighter::DEFAULT_CONTEXT_LINES and
  DEFAULT_CONTEXT_CHARS.
* SearchUpdate constructor: passing a string as the title param and or a boolean
  or a string as the content will produce a deprecation warning.
* SearchEngine::getTextFromContent() is deprecated, use getTextForSearchIndex()
  directly from the Content object.
* SearchEngine::textAlreadyUpdatedForIndex() is deprecated, given the
  deprecation above this method is no longer needed/called and should not be
  implemented by SearchEngine implementation.
* IDatabase::bufferResults() has been deprecated. Use query batching instead.
* MessageCache::singleton() is deprecated. Use
  MediaWikiServices::getMessageCache().
* ObjectCache::getWANInstance() is deprecated. Use
  MediaWikiServices::getMainWANObjectCache() instead.
* ObjectCache::newWANCacheFromParams() is deprecated. Use
  MediaWikiServices::getMainWANObjectCache() instead.
* Constructing MovePage directly is deprecated. Use MovePageFactory.
* TempFSFile::factory() has been deprecated. Use TempFSFileFactory instead.
* wfIsBadImage() is deprecated. Use the BadFileLookup service instead.
* Building a new SearchResult is hard-deprecated, always call
  SearchResult::newFromTitle(). This class is being refactored into an abstract
  class. If you extend this class please be sure to override all its methods
  or extend RevisionSearchResult.
* Skin::getSkinNameMessages() is deprecated and no longer used.
* The mediawiki.RegExp module is deprecated; use mw.util.escapeRegExp() instead.
* Specifying a SpecialPage object for the list of special pages (either through
  the SpecialPage_initList hook or by adding to $wgSpecialPages) is now
  deprecated.
* The 'jquery.tabIndex' module is deprecated.
* WebInstaller::getWarningBox() and getErrorBox() are deprecated.
  Use Html::errorBox() or Html::warningBox() instead.
* Use of ActorMigration with 'ar_user', 'img_user', 'oi_user', 'fa_user',
  'rc_user', 'log_user', and 'ipb_by' is deprecated. Queries should be adjusted
  to use the corresponding actor fields directly. Note that use with
  'rev_user' is *not* deprecated at this time.
* Specifying both the class and factory parameters for
  ApiModuleManager::addModule is now deprecated. The ObjectFactory spec should
  be used instead.
* The UserIsHidden hook is deprecated. Use GetUserBlock instead, and add a
  system block that hides the user.
* The GetBlockedStatus hook is deprecated. Use GetUserBlock instead, to add or
  remove a block.
* $wgContentHandlerUseDB is deprecated and should always be true.
* StreamFile::send404Message() and StreamFile::parseRange() are now deprecated.
  Use HTTPFileStreamer::send404Message() and HTTPFileStreamer::parseRange()
  respectively instead.
* Global variable $wgSysopEmailBans is deprecated; to allow sysops to ban
  users from sending emails, use
  $wgGroupPermissions['sysop']['blockemail'] = true;
* ApiQueryBase::showHiddenUsersAddBlockInfo() is deprecated. Use
  ApiQueryBlockInfoTrait instead.
* PasswordReset is now a service, its direct instantiation is deprecated.
* RESTBagOStuff users should specify either "JSON" or "PHP" serialization type.
* The global function wfIsHHVM() is deprecated and will now always return false
  regardless of the runtime environment. This is part of the continuing work to
  remove HHVM support from MediaWiki, which started in MediaWiki 1.31.
* Language::getLocalisationCache() is deprecated. Use MediaWikiServices
  instead.
* The following Language methods are deprecated: isSupportedLanguage,
  isValidCode, isValidBuiltInCode, isKnownLanguageTag, fetchLanguageNames,
  fetchLanguageName, getFileName, getMessagesFileName, getJsonMessagesFileName.
  Use the new LanguageNameUtils class instead. (Note that fetchLanguageName(s)
  are called getLanguageName(s) in the new class.)
* Using the Parser without initializing its $mTitle property to non-null has
  been deprecated.  In a future release Parser::getTitle() will throw a
  TypeError if $mTitle is uninitialized.
* A number of public methods of Parser were exposed only for historical
  reasons and have been deprecated: doMagicLinks, doDoubleUnderscore,
  doHeadings, doAllQuotes, replaceExternalLinks, replaceInternalLinks,
  replaceInternalLinks2, getVariableValue, initialiseVariables, formatHeadings,
  testPst, testPreprocess, testSrvus, areSubpagesAllowed, maybeDoSubpageLink,
  splitWhitespace, createAssocArgs, armorLinks, makeKnownLinkHolder,
  getImageParams, parseLinkParameter, stripAltText, replaceLinkHolders,
  replaceLinkHoldersText, armorLinks, makeKnownLinkHolder, getImageParams,
  parseLinkParameter, stripAltText.

=== Other changes in 1.34 ===
* Added option to specify "Various authors" as author in extension credits using
  "..." as the only author name. If the "author" array contains more than one
  entry and "..." is one of the entries in the array, "..." will be parsed as
  "others" (version-poweredby-others i18n message) like previously.
* (T232563) Browser support ("Grade C") for Internet Explorer 6 and 7
  was discontinued. Basic content and security features may no longer
  work correctly in these browsers.

= MediaWiki 1.33 =

== MediaWiki 1.33.4 ==

This is a security and maintenance release of the MediaWiki 1.33 branch.

=== Changes since MediaWiki 1.33.3 ===
* (T247017) PasswordReset performance improvements.
* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
* (T250568) Work around change in SimpleXMLElement behavior introduced in PHP
  7.3.17.
* Remove some rotten and out of date documentation.
* (T252311) Improvements to some older SQLite update patches.
* (T240307) Minor fixes to extension.schema.v2.json and
  extension.schema.v1.json.
* rdbms: Add callback for atomic section cancellation.
* (T191668) NameTableStoreTest::getCallCheckingDb simplification.
* Make NameTableStore use LoadBalancer::getConnectionRef().
* (T224949) NameTableStore: ensure consistency upon rollback.
* (T199474) Set rc_patrolled to 2 for autopatrolled changes in
  rebuildrecentchanges.php.
* (T229461) Update the change_tag table in rebuildrecentchanges.php.
* (T234450) Per-user concurrency in SpecialContributions can now be limited by
  setting $wgPoolCounterConf['SpecialContributions'] appropriately.
* (T248947) SECURITY: img_auth.php may leak private extension images into the
  public cache.

== MediaWiki 1.33.3 ==

This is a security and maintenance release of the MediaWiki 1.33 branch.

=== Changes since MediaWiki 1.33.2 ===
* (T245072) mediawiki.language: Rename languageData back to languageNames.
* Use proper SemVer comparison in CheckComposerLockUpToDate.
* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated.
* Update comment about PHP versions supported by The PHP Group.
* (T247215) Fix output of RecountCategories::doWork().
* Add check for page existence to view.php maintenance script.
* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink().
* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to
  any CSS selector.

== MediaWiki 1.33.2 ==

This is a security and maintenance release of the MediaWiki 1.33 branch.

=== Changes since MediaWiki 1.33.1 ===
* (T217831) (T200653) PopulateContentTables: compute sha1 and length if needed.
* Fix extra newlines in the installer.
* (T236628) Fix for ArticleRevisionViewCustom hook in DifferenceEngine.php.
* (T181658) Do not insert page titles into querycache.qc_value.
* (T206013) Suppress errors when reading invalid XML file properties.
* (T237931) Remove references to pg_attrdef.adsrc in Postgres code.
* Use correct value for 'sslmode' in DatabasePostgres.
* (T232866) Fix support for HTTP/2 in MultiHttpClient.
* (T227461) Stop calling deprecated Redis delete functions.
* (T239561) Mark options as requiring parameters in addSite.php.
* (T219440) Skip flaky rollback test.
* (T232866) Mimic CURLOPT_POST in GuzzleHttpRequest.
* (T239734) Replace deprecated lSize with lLen in Redis code.
* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
* (T239428) ApiEditPage: Test for bad redirect targets.
* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
  'trace'.
* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
* (T212067) SECURITY: Work around PHP bug in parse_url.

== MediaWiki 1.33.1 ==

This is a security and maintenance release of the MediaWiki 1.33 branch.

=== Changes since MediaWiki 1.33.0 ===
* A change that kept people with a database table prefix that didn't
  end with an underscore from updating was reverted.
* (T207100) Updated LanguageTr for dotted and dotless I in PHP 7.3.
* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
  of headers in private wikis.
* (T230317) Allow upgrading from MediaWiki before 1.15 where the valid_tag table
  doesn't yet exist.
* (T208897) MessageCache: Restore 'loadedLanguages' tracking for load().
* (T228555) MessageCache: Fix isMainCacheable() logic for non-content languages.
* (T200088) Remove title protection correctly for undeletions and imports.
* (T230402) SECURITY: Add permission check for suppressed account to
  Special:Redirect.
* Add helper for HTTPFileStreamer header syntax.
* (T227461) ObjectCache: avoid using deprecated phpredis::delete() alias.
* (T231386) SpecialRedirect::dispatchUser() should use a 302 http status code.
* (T118799) Fix XMP parser errors due to trailing nullchar.
* (T230618) Fix GROUP BY in ActiveUsersPager and RecentChangesUpdateJob for
  PostgreSQL.
* (T230487) Handle changed defaults in Argon2PasswordTest::testPartialConfig().
* (T233119) Improve documentation for the MinimumPasswordLengthToLogin policy.
* (T227662) Split down patch-comment-table.sql and patch-actor-table.sql into
  separate files to help allieviate potential migration problems.

=== Upgrading notes for 1.33 ===
1.33 has several database changes since 1.32, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed upgrade instructions, including
important information when upgrading from versions prior to 1.11.

Some specific notes for MediaWiki 1.33 upgrades are below:

* Some external link searches will not work correctly until update.php (or
  refreshExternallinksIndex.php) is run. These include searches for links using
  IP addresses, internationalized domain names, and possibly mailto links.
* If you ran migrateActors.php using an older version of MediaWiki and want to
  run your wiki with $wgActorTableSchemaMigrationStage SCHEMA_COMPAT_READ_OLD,
  note that log_search rows needed to find revision deletions by target user
  were incorrectly deleted. See T215464 for details.
* If revision deletions were performed when the wiki was configured with
  $wgActorTableSchemaMigrationStage SCHEMA_COMPAT_WRITE_BOTH and without
  migrateActors.php having been run, the log_search table may contain rows with
  empty values for "target_author_actor" which will prevent log searches for
  revision deletions by target user from finding those log entries. These rows
  may be corrected by (re-)running migrateActors.php.

For notes on 1.32.x and older releases, see HISTORY.

== MediaWiki 1.33.0 ==

=== Changes since MediaWiki 1.33.0-rc.0 ===
* (T225558) Update installer link to PHP intl.
* (T225901) Only attempt to deduplicate if there is data in archive and revision
  tables.
* (T225564) Fetch tag ID before calling undefineTag().
* (T225496) Detect APC for MainCacheType in CLI installer.
* Call unpack() with correct parameters in MimeAnalyzer.php for PHP 7.0 support.
* (T212613) Style change tags correctly on Special:Newpages.
* (T202211) Fix SQLite patch-(page|template)links-fix-pk.sql column order.

== MediaWiki 1.33.0-rc.0 ==

=== Configuration changes for system administrators in 1.33 ===
==== New configuration ====
* $wgEnablePartialBlocks – This enables the Partial Blocks feature, which gives
  accounts with block permissions the ability to block users, IPs, and IP ranges
  from editing specific pages, while allowing them to edit the rest of the wiki.
  It is a temporary setting for gradual enablement, current default to `false`,
  and will be set to `true` and then removed once initial development completes.

==== Changed configuration ====
* $wgChangeTagsSchemaMigrationStage (T193868) — This temporary setting, added in
  MediaWiki 1.32, now defaults to MIGRATION_NEW instead of MIGRATION_WRITE_BOTH.
* $wgPasswordPolicy – There is a new password policy to check that the account's
  password is not in the large blacklist. This is enabled by default for the
  built-in user groups bureaucrat, sysop, interface-admin, and bot. To configure
  this for other user groups, set the `PasswordNotInLargeBlacklist` flag `true`.
* $wgPasswordDefault – There is a new password type configuration using Argon2
  password hashing (which requires PHP 7.2 and above). It's designed to resist
  timing attacks, and (on systems with PHP 7.3+) GPU hacking; if you configure
  argon2 to be used, by default, it will automatically choose the best available
  algorithm depending on which version of PHP you have available. To use this,
  you can set `$wgPasswordDefault = 'argon2';`.
* $wgActorTableSchemaMigrationStage now defaults to reading the new schema.
  update.php will back-populate the new database fields due to the changed
  setting, which may take some time on large wikis. You can avoid downtime by
  following a process like that described in T188327.

==== Removed configuration ====
* $wgTagStatisticsNewTable (T199334) — This temporary setting, added in
  MediaWiki 1.32, has now been removed. When loading Special:Tags, MediaWiki
  will now always use the `change_tag_def` instead of the `change_tag` table.
* $wgUseTidy, $wgTidyBin, $wgTidyConf, $wgTidyOpts, $wgTidyInternal, and
  $wgDebugTidy – These options, all deprecated since 1.26, have now all been
  removed, as MediaWiki now always tidies user output. The $wgTidyConfig setting
  remains only for experimental features and debugging, and should not be used.
* $wgEnableParserCache – This setting has been deprecated since 1.26, has now
  been removed. If you still desire to disable the parser cache, instead you can
  set `$wgParserCacheType = CACHE_NONE;`.
* $wgCommentTableSchemaMigrationStage – This temporary migration setting has now
  been removed. Code finding it unset should treat it as being MIGRATION_NEW.
* $wgAuth – This old setting, deprecated in 1.27, has been removed as part of
  the removal of AuthPlugin.
* $wgSitesCacheFile – This configuration was introduced in 1.25 with the intent
  to allow sites to configure a file in which to cache the SiteStore database
  table, but it was never used. SiteStore already caches its information by
  default using BagOStuff (e.g. Memcached or APC).
* $wgClockSkewFudge – This setting was used by User.php to let sites adjust by
  how much MediaWiki would fudge when trying to minimize the chances of a
  user.user_touched database update to the "current" timestamp being before the
  value already there (e.g. due to clock skew between different servers). This
  is no longer a problem, because the code now ensures the timestamp is always
  higher than the previous one. The writes are guarded with CAS logic (check
  and set), which prevents updates that would overlap.
* $wgDBmysql5 (T196185) - This experimental setting, deprecated in 1.31, has
  been removed.

=== New user-facing features in 1.33 ===
* (T96041) __EXPECTUNUSEDCATEGORY__ on a category page causes the category
  to be hidden on Special:UnusedCategories.
* (T210814) SVGs are now by default displayed in wiki language on image
  pages.
* Special:CreateAccount now warns the user if their chosen username has to be
  normalized.
* (T205040) Multilingual images are now be displayed in the current parse
  language where available.
* Special:ActiveUsers will no longer filter out users who became inactive since
  the last time the active users query cache was updated.
* (T215675) RecentChange and ManualLogEntry implement new Taggable interface.
* (T215675) Added a hook, ManualLogEntryBeforePublish, to allow extensions
  to modify (example: add tags) log entries.

=== New developer features in 1.33 ===
* The AuthManagerLoginAuthenticateAudit hook has a new parameter for
  additional information about the authentication event.
* TextContent::getText() was introduced as a replacement for
  Content::getNativeData() for text-based content models.
* (T214706) LinksUpdate::getAddedExternalLinks() and
  LinksUpdate::getRemovedExternalLinks() were introduced.
* (T213893) Added 'MaintenanceUpdateAddParams' hook
* (T219655) The MarkPatrolled hook has a new parameter for the tags
  associated with this entry in the patrol log.
* (T212472) Extensions can now specify platform abilities they require to work,
  limited to shell access for now.


=== External library changes in 1.33 ===
==== New external libraries ====
* Added wikimedia/password-blacklist 0.1.4.
* Added guzzlehttp/guzzle 6.3.3.

==== Changed external libraries ====
* Updated OOUI from v0.29.2 to v0.31.3.
* Updated OOjs Router from pre-release to v0.2.0.
* Updated moment from v2.19.3 to v2.24.0.
* Updated wikimedia/xmp-reader from 0.6.0 to 0.6.2.
* Updated wikimedia/scoped-callback from 2.0.0 to 3.0.0.
* Updated jquery-client from 2.0.1 to 2.0.2.
* Updated pear/net_smtp from 1.8.0 to 1.8.1.
* Updated cssjanus/cssjanus from 1.2.0 to 1.3.0.
* Updated wikimedia/php-session-serializer from 1.0.6 to 1.0.7.

==== Removed external libraries ====
* (T219403) jquery.ui.spinner, deprecated since 1.31, was removed.


=== Developer library changes in 1.33 ===
==== New developer libraries ====
* Added jakub-onderka/php-console-highlighter 0.3.2 explicitly (dev-only).
* Added mediawiki/mediawiki-phan-config 0.5.0 (dev-only).

==== Changed developer libraries ====
* Updated wikimedia/ip-set from 1.3.0 to 2.0.1.
  * The deprecated IPSet\IPSet alias was removed, Wikimedia\IPSet must be
    used instead.
* Updated psy/psysh from 0.9.6 to 0.9.9 (dev-only).
* Updated nikic/php-parser from 3.1.3 to 3.1.5 (dev-only).
* Updated mediawiki/mediawiki-codesniffer from 22.0.0 to 25.0.0 (dev-only).
* Updated qunitjs from 2.6.2 to 2.9.1.

==== Removed developer libraries ====
* The jetbrains/phpstorm-stubs repository was removed in favour of the minimal
  stubs we need, which are kept in the new `.phan/internal_stubs` directory
  (dev-only).


=== Bug fixes in 1.33 ===
* (T164211) Special:UserRights could sometimes fail with a
  "conflict detected" error when there weren't any conflicts.
* (T216029) Chrome redirects to Special:BadTitle after editing a section with
  a non-Latin name on a page with non-Latin characters in title.
* (T222385) resourceloader: Use AND instead of OR for upsert conds in
  saveFileDependencies().

=== Action API changes in 1.33 ===
* (T198913) Added 'ApiOptions' hook.
* The JSON formatversion=2 is no longer experimental.
* Internal API errors (those with code beginning "internal_api_error") will
  include the exception class name in a data field named "errorclass".
  * Class names are not guaranteed to remain stable, and in particular database
    exceptions will now include the "Wikimedia\Rdbms\" prefix in the class name.
  * The code including an exception class name is deprecated. In the future,
    all internal errors will use code "internal_api_error".
* (T212356) When using action=delete on pages with many revisions, the module
  may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
  deletion will be processed via the job queue.
* action=setnotificationtimestamp will now update the watchlist asynchronously
  if entirewatchlist is set, so updates may not be visible immediately
* Block info will be added to "blocked" errors from more modules.
* (T216245) Autoblocks will now be spread by action=edit and action=move.
* action=query&meta=userinfo has a new uiprop, 'latestcontrib', that returns
  the date of user's latest contribution.
* (T25227) action=logout now requires to be posted and have a csrf token.

=== Action API internal changes in 1.33 ===
* A number of deprecated methods for API documentation, intended for overriding
  by extensions, are no longer called by MediaWiki, and will emit deprecation
  notices if your extension attempts to use them:
  * ApiBase::getDescription() (deprecated in 1.25)
  * ApiBase::getParamDescription() (deprecated in 1.25)
  * ApiBase::getExamples() (deprecated in 1.25)
  * ApiBase::getDescriptionMessage() (deprecated in 1.30)
  Additionally, the  'APIGetDescription' and 'APIGetParamDescription' hooks have
  been removed, as their only use was to let extensions override values returned
  by getDescription() and getParamDescription(), respectively.
* API error codes may only contain ASCII letters, numbers, underscore, and
  hyphen. Methods such as ApiBase::dieWithError() and
  ApiMessageTrait::setApiCode() will throw an InvalidArgumentException if
  passed a bad code.
* ApiBase::checkTitleUserPermissions() now takes an options array as its third
  parameter. Passing a User object or null is deprecated.
* The api-feature-usage log channel now has log context. The text message is
  deprecated and will be removed in the future.

=== Languages updated in 1.33 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T203908) Added language support for Eastern Pwo (kjp).
* (T213717) Fixed a translation error on Goan Konkani (gom-deva) translations
  for NS_TEMPLATE.
* (T212221) Added $digitTransformTable for Santali (sat).
* (T216479) Added language support for Saisiyat (xsy).
* (T219728) Added support for new Japanese era name "Reiwa"

=== Breaking changes in 1.33 ===
* The parameteter $lang in DifferenceEngine::setTextLanguage must be of type
  Language. Other types are deprecated since 1.32.
* Skin::doEditSectionLink requires type Language for the parameter $lang.
  The parameters $tooltip and $lang are mandatory. Omitting the parameters is
  deprecated since 1.32.
* Language::truncate(), deprecated in 1.31, has been removed.
* UtfNormal, deprecated in 1.25, was removed. Use UtfNormal\Validator directly
  instead.
* (T197179) In OOUI HTMLForm fields, the parameters 'notice', 'notice-messages',
  and 'notice-message', which were deprecated in 1.32, were removed. Instead,
  use 'help', 'help-message', and 'help-messages'.
* (T197179) HTMLFormField::getNotices(), deprecated in 1.32, was removed.
* The "Parsoid v1" compatibility mappings in ParsoidVirtualRESTService and
  RestbaseVirtualRESTService, deprecated since 1.26, have been removed.
  Use the RESTBase v1 or Parsoid v3 API instead.
* ParserOptions defaults 'tidy' to true now, since the untidy modes of the
  parser are being deprecated and ParserOptions::getCanonicalOverrides()
  has always been true at any rate.
* Support for disabling tidy and external tidy implementations has been removed.
  This was deprecated in 1.32. The pure PHP Remex tidy implementation is now
  used and no configuration is necessary.
* A number of deprecated methods for API documentation, intended for overriding
  by extensions, are no longer called by MediaWiki, and will emit deprecation
  notices if your extension attempts to use them:
  * ApiBase::getDescription() (deprecated in 1.25)
  * ApiBase::getParamDescription() (deprecated in 1.25)
  * ApiBase::getExamples() (deprecated in 1.25)
  * ApiBase::getDescriptionMessage() (deprecated in 1.30)
  Additionally, the  'APIGetDescription' and 'APIGetParamDescription' hooks have
  been removed, as their only use was to let extensions override values returned
  by getDescription() and getParamDescription(), respectively.
* The authentication hooks 'AbortAutoAccount' 'AbortNewAccount', 'AbortLogin',
  'LoginUserMigrated', 'UserCreateForm', and 'UserLoginForm', all deprecated by
  the creation of AuthManager in 1.27, have been removed. This also means that
  the FakeAuthTemplate and LoginForm classes are removed, that FakeAuthTemplate
  is no longer passed into LoginSignupSpecialPage->getFieldDefinitions(), and
  that LoginSignupSpecialPage->getBCFieldDefinitions() is removed.
* The 'jquery.localize' module, deprecated in 1.32, has been removed. Instead,
  use 'jquery.i18n'.
* The hooks LanguageGetSpecialPageAliases and LanguageGetMagic, deprecated since
  1.16, have now been removed. Instead, use $specialPageAliases or $magicWords
  respectively in a $wgExtensionMessagesFiles file.
* The following methods of the Preferences class, deprecated in 1.31, have been
  removed:
  * getSaveBlacklist()
  * loadPreferenceValues()
  * getOptionFromUser()
  * profilePreferences()
  * skinPreferences()
  * filesPreferences()
  * datetimePreferences()
  * renderingPreferences()
  * editingPreferences()
  * rcPreferences()
  * watchlistPreferences()
  * searchPreferences()
  * miscPreferences()
  * generateSkinOptions()
  * getDateOptions()
  * getImageSizes()
  * getThumbSizes()
  * validateSignature()
  * cleanSignature()
  * getTimezoneOptions()
  * filterIntval()
  * filterTimezoneInput()
  * getTimeZoneList()
* mw.util.jsMessage(), deprecated in 1.20, was removed. Use mw.notify instead.
* (T61113) User::EDIT_TOKEN_SUFFIX was removed. It was deprecated since 1.27.
* The 'mediawiki.api' module aliases, deprecated in 1.32, have been removed.
  Specifically: mediawiki.api.category, mediawiki.api.edit,
  mediawiki.api.login, mediawiki.api.options, mediawiki.api.parse,
  mediawiki.api.upload, mediawiki.api.user, mediawiki.api.watch,
  mediawiki.api.messages, and mediawiki.api.rollback.
* The 'jquery.byteLimit' module alias for 'jquery.lengthLimit',
  deprecated in 1.31, was removed.
* Revision::fetchRevision(), deprecated in 1.28, was removed.
* Class SquidUpdate, deprecated in 1.27, was removed.
* Title->getSquidURLs(), deprecated in 1.27, was removed. Instead, use
  Title->getCdnUrls().
* Title::escapeFragmentForURL(), deprecated in 1.30, was removed. Use
  Sanitizer::escapeIdForLink() or escapeIdForExternalInterwiki() instead.
* Title->canTalk(), deprecated in 1.30, was removed. Instead, use
  Title->canHaveTalkPage().
* Title's methods for site and user page related to CSS and JS, deprecated in
  1.31, were removed:
  * Title->isCssOrJsPage() — Use Title->isSiteConfigPage()
  * Title->isCssJsSubpage() – Use Title->isUserConfigPage()
  * Title->getSkinFromCssJsSubpage() – Use Title->getSkinFromConfigSubpage()
  * Title->isCssSubpage() – Use Title->isUserCssConfigPage()
  * Title->isJsSubpage() – Use Title->isUserJsConfigPage()
* SiteSQLStore, deprecated in 1.27 and whose only method, ::newInstance(),
  would return the global SiteStore instance, has been removed. You can get to
  this via MediaWiki\MediaWikiServices::getInstance()->getSiteStore() directly.
* Linker::formatSize, deprecated in 1.28, has been removed (with DummyLinker's).
  Instead, use Language->formatSize() with the relevant Language object.
* Linker::formatTemplates, deprecated in 1.28, has been removed (along with the
  version in DummyLinker). You can use TemplatesOnThisPageFormatter directly.
* EventRelayerGroup::singleton(), deprecated in 1.27, has been removed. You can
  use MediaWikiServices::getInstance()->getEventRelayerGroup() directly.
* LinkCache->addLink(), deprecated in 1.27, has been removed. It is thought to
  be unused, and is distinct from OutputPage->addLink(), which remains.
* JsonContent->getJsonData(), deprecated in 1.25, has been removed. Instead, use
  JsonContent->getData().
* MWExceptionHandler::getLogId(), deprecated in 1.27, has been removed, as the
  exception ID is the same as the request ID, from WebRequest::getRequestId().
* SearchEngine::getNearMatchResultSet(), deprecated in 1.27, has been removed.
  You can use SearchEngine::getNearMatcher() instead.
* EmailNotification::updateWatchlistTimestamp, deprecated in 1.27, has been
  removed. Instead, use WatchedItemStore::updateNotificationTimestamp directly.
* User::getGroupName() and ::getGroupMember(), both deprecated in 1.29, have
  been removed. Instead, please use UserGroupMembership::getGroupName() and
  UserGroupMembership::getGroupMemberName().
* Backwards compatibility for setting wgSessionsInObjectCache to false or using
  wgSessionHandler, both of which were deprecated in 1.27 with the introduction
  of SessionManager, has been removed.
* SessionManager::autoCreateUser, deprecated in 1.27, has been removed. Use
  MediaWiki\Auth\AuthManager::autoCreateUser instead.
* The mw.libs.jpegmeta property, deprecated in 1.31, was removed.
  Use require( 'mediawiki.libs.jpegmeta' ) instead.
* The mw.user.stickyRandomId() method, deprecated in 1.32, was removed.
  Use mw.user.getPageviewToken() instead.
* Removed deprecated class property WikiRevision::$importer.
* ResourceLoaderFileModule::readStyleFiles() now requires its $context
  parameter.
* The ChangeList::insertArticleLink() method, that was deprecated in 1.27, has
  been removed.
* MessageBlobStore::__construct() now requires its $rl parameter.
* Second parameter to Sanitizer::escapeIdReferenceList() (deprecated in 1.31)
  has been removed.
* The 'jquery.xmldom' module has been removed.
* The 'jquery.mockjax' module has been removed.
* The 'jquery.hidpi' module, deprecated in 1.32, has been removed.
* AuthPlugin and related code, deprecated in 1.27, has been removed. Extensions
  should instead use AuthManager. The following no longer exist:
  * The AuthPlugin class itself and the related AuthPluginUser class and i18n
  * The AuthPluginSetup and AuthPluginAutoCreate hooks
  * The transitional wrapper classes AuthPluginPrimaryAuthenticationProvider,
    AuthManagerAuthPlugin, and AuthManagerAuthPluginUser.
  * The $wgAuth configuration setting and its use in Setup.php and unit tests
* (T217772) The 'wgAvailableSkins' mw.config key in JavaScript, was removed.
* Language::markNoConversion, deprecated in 1.32, has been removed. Use
  LanguageConverter::markNoConversion instead.
* BagOStuff::modifySimpleRelayEvent() method has been removed.
* ParserOutput::getLegacyOptions, deprecated in 1.30, has been removed.
  Use ParserOutput::allCacheVaryingOptions instead.
* CdnCacheUpdate::newSimplePurge, deprecated in 1.27, has been removed.
  Use CdnCacheUpdate::newFromTitles() instead.
* Handling of multiple arguments by the Block constructor, deprecated in 1.26,
  has been removed.
* The translation of main page in Sardinian (sc) was changed from "Pàgina Base"
  to "Pàgina printzipale". Existing wikis using this content language need to
  move the main page or change the name through MediaWiki:Mainpage page.
* wfSplitWikiID(), deprecated in 1.32, has been removed.
* MessageBlobStore::getBlob(), deprecated in 1.27, has been removed.
  Use ::getBlobs() instead.
* The .background-size() LESS mixin, deprecated in 1.27, has been removed.
* ReadOnlyMode::clearCache() and ConfiguredReadOnlyMode::clearCache() have been
  removed. Use MediaWikiTestCase::overrideMwServices() instead.
* Support for the 'aggregator' option of JobQueue (and thus $wgJobTypeConf) was
  removed. The JobQueueAggregator interface and JobQueueAggregatorRedis class
  have also been removed. They were experimentally developed for use by the
  Wikimedia Foundation, but were never used, with no known use cases. (Note that
  this does not affect JobQueueRedis which is still supported.)

=== Deprecations in 1.33 ===
* The configuration option $wgUseESI has been deprecated, and is expected
  to be removed in a future release.
* The configuration option $wgSquidPurgeUseHostHeader has been deprecated,
  and is expected to be removed in a future release.
* The configuration options $wgFixArabicUnicode and $wgFixMalayalamUnicode,
  introduced in MW 1.17, have been deprecated.  These fixes will always be
  applied for Arabic and Malayalam in the future.  Please enable these on
  your local wiki (if you have them explicitly set to false) and run
  maintenance/cleanupTitles.php to fix any existing page titles.
* The LegacyHookPreAuthenticationProvider class, deprecated since its creation
  in 1.27 as part of the AuthManager re-write, now emits deprecation warnings.
  This will help identify the issue if you added it to $wgAuthManagerConfig.
* wfSplitWikiId() is now deprecated. Cache key generation should have the wiki
  domain ID as a key component and use makeGlobalKey().
* (T202094) Title::getUserCaseDBKey() is deprecated; instead, please use
  Title::getDBkey(), which doesn't vary case.
* User::getPasswordValidity() is now deprecated. User::checkPasswordValidity()
  returns the same information in a more useful format.
* For Linker::generateTOC() and Linker::tocList(), passing strings or booleans
  as the $lang parameter was deprecated. The same applies to DummyLinker.
* The PasswordPolicy 'PasswordCannotBePopular' has been deprecated. To
  follow best practices, it is reccommended to use 'PasswordNotInLargeBlacklist'
  instead which blacklists 100,000 commonly used passwords.
* (T208862) Action::requiresUnblock() is now called from
  Title::getUserPermissionsErrors() and Title::userCan(). Previously, the method
  was only called in Action::checkCanExecute(). Actions should ensure that their
  requiresUnblock() returns the proper result (the default is `true`).
* (T211608) The MediaWiki\Services namespace has been renamed to
  Wikimedia\Services. The old name is still supported, but deprecated.
* (T155582) Content::getNativeData has been deprecated. Please use model-
  specific getters, such as TextContent::getText().
* The class WebInstallerOutput is now marked as @private.
* (T209699) The jquery.async module has been deprecated. JavaScript code that
  needs asynchronous behaviour should use Promises.
* Password::equals() is deprecated, use verify().
* BaseTemplate::msgWiki() and QuickTemplate::msgWiki() will be removed. Use
  other means to fetch a properly escaped message string or Message object.
* (T126091) The 'ResourceLoaderTestModules' hook, which lets you declare QUnit
  testing code for your JavaScript modules, is deprecated. Instead, you can now
  use the new extension registration key 'QUnitTestModule'.
* (T213426) The jquery.throttle-debounce module has been deprecated. JavaScript
  code that needs this behaviour should use OO.ui.debounce/throttle.
* The mw.language.specialCharacters property from the
  'mediawiki.language.specialCharacters' module has been deprecated.
  Use require( 'mediawiki.language.specialCharacters' ) instead.
* ChangeTags::purgeTagUsageCache() has been deprecated, and is expected to be
  removed in a future release.
* Passing a User object or null as the third parameter to
  ApiBase::checkTitleUserPermissions() has been deprecated. Pass an array
  [ 'user' => $user ] instead.
* (T211578) Block::prevents is deprecated. Use Block::isEmailBlocked,
  Block::isCreateAccountBlocked and Block::isUsertalkEditAllowed to get and set
  block properties; use Block::appliesToRight and Block::appliesToUsertalk to
  check block behaviour.
* The api-feature-usage log channel now has log context. The text message is
  deprecated and will be removed in the future.
* The FileBasedSiteLookup class has been deprecated. For a cacheable SiteLookup
  implementation, use CachingSiteStore instead.
* Language::viewPrevNext function is deprecated, use
  SpecialPage::buildPrevNextNavigation instead
* ManualLogEntry::setTags() is deprecated, use ManualLogEntry::addTags()
  instead. The setTags() method was overriding the tags, addTags() doesn't
  override, only adds new tags.
* Block::isValid is deprecated, since it is no longer needed in core.
* Calling Maintenance::hasArg() as well as Maintenance::getArg() with no
  parameter has been deprecated. Please pass the argument number 0.
* ResourceLoaderContext::expandModuleNames has been deprecated.
  Use ResourceLoader::expandModuleNames instead.

=== Other changes in 1.33 ===
* (T201747) Html::openElement() warns if given an element name with a space
  in it.
* The implementation of buildStringCast() in Wikimedia\Rdbms\Database has
  changed to explicitly cast. Subclasses relying on the base-class
  implementation should check whether they need to override it now.
* BagOStuff::add is now abstract and must explicitly be defined in subclasses.
* LinksDeletionUpdate is now a subclass of LinksUpdate. As a consequence,
  the following hooks will now be triggered upon page deletion in addition
  to page updates: LinksUpdateConstructed, LinksUpdate, LinksUpdateComplete.
  LinksUpdateAfterInsert is not triggered since deletions do not cause
  insertions into links tables.
* Category::newFromID( $id )->getID() will now return $id without any
  validation, to avoid a mostly unnecessary DB query.
* On Special:Version, the name for an extension can no longer be arbitrary
  html when no link is specified.

= MediaWiki 1.32 =

== MediaWiki 1.32.6 ==

This is a security and maintenance release of the MediaWiki 1.32 branch.

=== Changes since MediaWiki 1.32.5 ===
* (T236628) Fix for ArticleRevisionViewCustom hook in DifferenceEngine.php.
* (T181658) Do not insert page titles into querycache.qc_value.
* (T206013) Suppress errors when reading invalid XML file properties.
* (T237931) Remove references to pg_attrdef.adsrc in Postgres code.
* Use correct value for 'sslmode' in DatabasePostgres.
* (T232866) Fix support for HTTP/2 in MultiHttpClient.
* (T227461) Stop calling deprecated Redis delete functions.
* (T239561) Mark options as requiring parameters in addSite.php.
* (T239734) Replace deprecated lSize with lLen in Redis code.
* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
* (T239428) ApiEditPage: Test for bad redirect targets.
* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
  'trace'.
* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
* (T212067) SECURITY: Work around PHP bug in parse_url.

== MediaWiki 1.32.5 ==

This is a maintenance release of the MediaWiki 1.32 branch.

=== Changes since MediaWiki 1.32.4 ===
* Compute sha1 and length if needed in maintenance/populateContentTables.php.
* Fix extra newlines in the installer.
* Followup T230402, PermissionManager doesn't exist until 1.33, so fix the
  backported patches to use User::isAllowed() instead.

== MediaWiki 1.32.4 ==

This is a security and maintenance release of the MediaWiki 1.32 branch.

=== Changes since MediaWiki 1.32.3 ===
* (T207100) Updated LanguageTr for dotted and dotless I in PHP 7.3.
* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
  of headers in private wikis.
* (T230402) SECURITY: Add permission check for suppressed account to
  Special:Redirect.
* (T208897) MessageCache: Restore 'loadedLanguages' tracking for load().
* (T200088) Remove title protection correctly for undeletions and imports.
* Add helper for HTTPFileStreamer header syntax.
* (T118799) Fix XMP parser errors due to trailing nullchar.
* (T233119) Improve documentation for the MinimumPasswordLengthToLogin policy.
* Cache redirects from Special:Redirect.
* (T231386) dispatchUser() should use a 302 http status code.
* (T227662) Split down patch-comment-table.sql and patch-actor-table.sql into
  separate files to help allieviate potential migration problems.
* Make SQLite's patch-add-3d.sql a no-op to prevent clobbering other database
  updates.

== MediaWiki 1.32.3 ==

This is a maintenance release of the MediaWiki 1.32 branch.

=== Changes since MediaWiki 1.32.2 ===
* (T225558) Update installer link to PHP intl.
* (T225496) Detect APC for MainCacheType in CLI installer.
* (T226766) Remove jetbrains/phpstorm-stubs from composer dev dependencies.
* (T202211) Fix SQLite patch-(image|page|template)links-fix-pk.sql column order.

== MediaWiki 1.32.2 ==

This is a security and maintenance release of the MediaWiki 1.32 branch.

=== Changes since MediaWiki 1.32.1 ===
* (T204423) Backport support for hyphenated DB names in JobQueueGroup.
* (T216968) Return pageid as int in both list=iwbacklinks and
  list=langbacklinks.
* (T215169) Fix for Database::update() with IGNORE option fails on PostgreSQL.
* (T199474) Fix typo in rebuildrecentchanges.php resulting in rogue flags.
* (T218608) SECURITY: Fix an issue that prevents Extension:OAuth working when
  $wgBlockDisablesLogin is true.
* (T216029) Chrome redirects to Special:BadTitle after editing a section with
  a non-Latin name on a page with non-Latin characters in title.
* Unbreak language related maintenance scripts that use StaticArrayWriter.
* (T219728) Added support for new Japanese era name "Reiwa".
* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
  token.
* Updated cssjanus/cssjanus from 1.2.0 to 1.3.0.
* (T221045) Remove orphaned code from ConfigRepository.
* (T222385) resourceloader: Use AND instead of OR for upsert conds in
  saveFileDependencies().
* (T224374) Fix message parameters so that the message that says SQLite is
  out of date makes sense.
* (T200471) Prevent LBFactorySimple breaking ExternalStorage, when trying to
  connect to external server with local database name.
* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
* (T208881) SECURITY: blacklist CSS var().
* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
* (T222036, T222038) SECURITY: Add permission check for user is permitted to
  view the log type.
* (T221739) SECURITY: resources: Patch jQuery 3.3.1 for CVE-2019-11358.

== MediaWiki 1.32.1 ==

=== Changes since MediaWiki 1.32.0 ===
* (T213577) rdbms: avoid transaction status errors from ping() in rollback().
* rdbms: Pass required parameter.
* rdbms: do not treat SAVEPOINT and RELEASE SAVEPOINT as write queries.
* (T204531) rdbms: reduce LoadBalancer replication log spam.
* (T213489) Avoid session double-start in Setup.php.
* (T213717) Correct namespace 'Template' for gom-deva
* (T198054) Fix login page crash caused by unknown language via ?uselang
* (T215324) (T210937) list=users mistakenly reports user as missing.
* (T209483) Add ILBFactory::redefineLocalDomain method. This is intended for
use with scripts like addWiki.php to avoid mismatched domain errors.
* (T208871) The hard-coded Google search form on the database error page was
removed.
* (T204800) Fix Title::getFragmentForURL for bad interwiki prefix
* (T215566) Fix installer being unable to determine if the database exists
during a fresh installation.

== MediaWiki 1.32.0 ==

=== Changes since MediaWiki 1.32.0-rc.2 ===
* (T188327) Fix slow queries in migrateActors.php.
* (T102320) Fix $magicWords for the Sanskrit language.

=== Changes since MediaWiki 1.32.0-rc.1 ===
* Fix addition of ug_expiry column to user_groups table on MSSQL.
* (T210307) Fix the cache timestamp for forced updates.
* (T210621) User: Bypass repeatable-read when creating an actor_id.
* (T197535) Extensions can now specify PHP versions and PHP extensions they
  depend on.
* Updated wikimedia/ip-set from v1.2.0 to v1.3.0.
* (T212356) When using action=delete on pages with many revisions, the module
  may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
  deletion will be processed via the job queue.
* (T64103) Dropped columns category.cat_hidden, site_stats.ss_admins, and
  recentchanges.rc_cur_time from the PostgreSQL schema.

=== Changes since MediaWiki 1.32.0-rc.0 ===
* (T209885) Prevent populateSearchIndex.php from breaking once actor migration
  has been started.
* (T210998) Properly set $wgLanguageCode in the generated LocalSettings.php
  if --lang is used with the command-line installer (install.php).

=== Configuration changes in 1.32 ===

==== New configuration ====
* $wgJpegQuality – The quality of JPEG thumbnails is now configurable through
  this setting. The default is 80, which matches the quality of JPEG thumbnails
  previously generated by ImageMagick. The quality of JPEG thumbnails generated
  by GD was previously 95, but now uses the $wgJpegQuality setting as well.
* $wgCookieSetOnIpBlock - This determines whether to set a cookie when an IP
  user is blocked. Doing so means that a blocked user, even after moving to a
  new IP address, will still be blocked.
* $wgRawHtmlMessages – This new configuration setting is added for listing
  messages which are displayed as raw HTML.
* $wgCSPHeader and $wgCSPReportOnlyHeader – You can now define a
  "Content Security Policy" for your wiki. This adds a defense-in-depth feature
  to stop an attacker who has found a bug in the parser allowing them to insert
  malicious attributes. Disabled by default. (T135963)
* $wgGroupPermissions – A new user group, 'interface-admin', is added for
  controlling access to sitewide CSS/JS (and editing other users' CSS/JS). No
  other group has 'editsitecss', 'editusercss', 'editsitejs' or 'edituserjs'
  by default.
* $wgGrantPermissions – A new grant group, 'editsiteconfig', is added for
  granting the above rights.
* $wgDBDefaultGroup – A default database group for use by maintenance scripts.
* $wgResourceLoaderEnableJSProfiler – This new configuration setting lets you
  enable client-side profiling of JavaScript modules; it is off by default.
* (T193868) $wgChangeTagsSchemaMigrationStage — This temporary configuration
  setting allows sysadmins to gradually migrate the database table schema for
  how change tags are stored.
* (T199334) $wgTagStatisticsNewTable — This temporary configuration setting
  allows sysadmins to enable the caching of Special:Tags via the new
  change_tag_def table.

==== Changed configuration ====
* $wgUseAjax – This setting, deprecated in 1.31, is now ignored.
* $wgDefaultUserOptions – The default watchlist view time (watchlistdays) has
  been increased from 3 to 7 days. (T194414)
* $wgGroupPermissions – The right to edit sitewide Javascript
  (e.g. MediaWiki:Common.js), CSS or JSON was separated from 'editinterface'
  and is available under 'editsitejs'/'editsitecss'/'editsitejson'. Having
  'editinterface' is still necessary to edit such pages.
* $wgMultiContentRevisionSchemaMigrationStage now defaults to writing both the
  old and the new schema, but reading the new schema, so Multi-Content Revisions
  (MCR) are now functional per default. The new default value of the setting is
  SCHEMA_COMPAT_WRITE_BOTH | SCHEMA_COMPAT_READ_NEW.
* $wgActorTableSchemaMigrationStage no longer accepts MIGRATION_WRITE_BOTH or
  MIGRATION_WRITE_NEW. It instead uses SCHEMA_COMPAT_WRITE_BOTH |
  SCHEMA_COMPAT_READ_OLD and SCHEMA_COMPAT_WRITE_BOTH | SCHEMA_COMPAT_READ_NEW
  for intermediate stages of migration.
* $wgDBTableOptions – The default table options now use the binary charset. The
  default was already overridden in the installer-generated LocalSettings.php,
  and so is always set to binary after the installer UI option was removed. The
  default value is only used when the installer installs an extension.
* $wgPopularPasswordFile — The location of the default popular passwords file
  has been moved to be in line with other non-PHP files used by libraries and
  classes.
* $wgEnableImageWhitelist is now disabled by default, as it opens up a hole for
  potential privacy leaks by administrators. You can check
  "MediaWiki:External image whitelist" on your wiki to see whether the feature
  was ever used, and whether it needs to be re-enabled.

==== Removed configuration ====
* $wgEnableAPI and $wgEnableWriteAPI – These settings, deprecated in 1.31,
  have been removed. (T115414)
* $wgSiteSupportPage – This setting, unused since 1.5, was removed.
* $wgBrowserBlacklist – This setting, deprecated in 1.30, was removed.
* $wgExperimentalHtmlIds – This setting, deprecated since 1.30, was removed.
  The 'html5-legacy' value for $wgFragmentMode is no longer accepted.
* $wgPasswordSenderName - This setting, ignored since 1.23 by MediaWiki and
  most extensions, is no longer set. Instead, you can modify the system
  message `emailsender`.
* $wgTidyConfig – The experimental Html5Internal and Html5Depurate tidy drivers
  were removed. RemexHtml, which is the default, should be used instead.
* (T181318) The $wgStyleVersion setting and its appendage to various script and
  style URLs in OutputPage, deprecated in 1.31, was removed.
* (T140807) The wgResourceLoaderLESSImportPaths configuration option was removed
  from ResourceLoader. Instead, use `@import` statements in LESS to import
  files directly from nearby directories within the same project.
* (T140804) The wgResourceLoaderLESSVars configuration option, deprecated
  since 1.30, was removed. Instead, to expose variables from PHP to LESS, use
  the ResourceLoaderModule::getLessVars() method.
* $wgResourceLoaderValidateStaticJS – This setting, unused since MediaWiki 1.18,
  was removed.
* Two temporary variables for deploying the feature of filters on change lists,
  $wgStructuredChangeFiltersShowPreference introduced in MediaWiki 1.30 and
  $wgStructuredChangeFiltersOnWatchlist in 1.31, were removed.

=== New features in 1.32 ===
* (T112474) Generalized the ResourceLoader mechanism for overriding modules
  using a particular page during edit previews.
* (T12331) You can now log page creation events by setting $wgPageCreationLog
  to true.
* Added 'ApiParseMakeOutputPage' hook.
* (T174313) Added checkbox on Special:ListUsers to display only users in
  temporary user groups.
* (T152462) A cookie can now be set when an IP user is blocked to track that
  user if they move to a new IP address. This is disabled by default.
* (T194950) Added 'ApiMaxLagInfo' hook.
* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
  reauthenticating.
* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
  getLoginSecurityLevel() returns non-false.
* The 'ImageBeforeProduceHTML' hook is now passed three new parameters, $parser,
  &$query and &$widthOption, allowing extensions even finer control over the
  resulting HTML code.
* Added new 'ArticleShowPatrolFooter' hook, which allows extensions to determine
  if the [mark as patrolled] link should be shown at the footer of patrollable
  pages.
* The array of hidden options ($opts) passed to the 'SpecialSearchPowerBox' hook
  is now passed by reference, allowing extensions to modify or even unset it.
* Added new 'OutputPageAfterGetHeadLinksArray' hook, allowing extensions to
  modify the return value of OutputPage#getHeadLinksArray in order to add,
  remove or otherwise alter the elements to be output in the page <head>.
* (T28934) The 'HistoryPageToolLinks' hook allows extensions to append
  additional links to the subtitle of a history page.
* The 'GetLinkColours' hook now receives an additional $title parameter,
  the Title object of the page being parsed, on which the links will be shown.
* (T194731) DifferenceEngine supports multiple slots. Added SlotDiffRenderer to
  render diffs between two Content objects, and DifferenceEngine::setRevisions()
  to render diffs between two custom (potentially multi-content) revisions.
  Added GetSlotDiffRenderer hook which works like GetDifferenceEngine for slots.
* Added a temporary action=mcrundo to the web UI, as the normal undo logic
  can't yet handle MCR and deadlines are forcing is to put off fixing that.
  This action should be considered deprecated and should not be used directly.
* Extensions overriding ContentHandler::getUndoContent() will need to be
  updated for the changed method signature.
* Added a new hook, 'UserGetRightsRemove', which can be used to remove rights
  from user. Unlike the 'UserGetRights' it will ensure that removed rights
  will not be reinserted.
* (T197535) Extensions can now specify PHP versions and PHP extensions they
  depend on.

=== External library changes in 1.32 ===

==== New external libraries ====
* Added pear/Net_SMTP v1.8.0.
* Added wikimedia/xmp-reader v0.6.0.

* Added cache/integration-tests v0.16.0 (dev-only).
* Added giorgiosironi/eris v0.10.0 (dev-only).
* Added seld/jsonlint v1.7.1 (dev-only).

* Added EasyDeflate (unversioned).

==== Changed external libraries ====
* Updated OOUI from v0.26.3 to v0.29.2.
* Updated wikimedia/base-convert from v1.0.1 to v2.0.0.
* Updated wikimedia/remex-html from v1.0.3 to v2.0.1.
* Updated wikimedia/scoped-callback from v1.0.0 to v2.0.0.
** ScopedCallback objects can no longer be serialized.
* Updated wikimedia/timestamp from v1.0.0 to v2.2.0.
* Updated wikimedia/wrappedstring from v2.3.0 to v3.0.1.
* oyejorge/less.php replaced with our fork wikimedia/less.php
* Updated wikimedia/ip-set from v1.2.0 to v1.3.0.

* Updated composer/spdx-licenses from v1.3.0 to v1.4.0 (dev-only).
* Updated mediawiki/mediawiki-codesniffer from v18.0.0 to v22.0.0 (dev-only).
* Updated psy/psysh from v0.8.11 to v0.9.6 (dev-only).

* Updated CLDRPluralRuleParser from v0.1.0 to v1.3.2-pre.
* Updated jquery from v3.2.1 to v3.3.1.
* Updated jquery.client from v2.0.0 to v2.0.1.
* Updated jquery.i18n from v1.0.4 to v1.0.5.
* Updated mustache.js from v0.8.2-d9aa703 to v1.0.0.
* Updated OOjs from v2.2.0 to v2.2.2.
* Updated qunitjs from v2.4.0 to v2.6.2.
* Updated sinonjs from v1.17.3 to v1.17.7.

==== Removed external libraries ====
* pear/mail_mime-decode was removed.

=== Bug fixes in 1.32 ===
* SpecialPage::execute() will now only call checkLoginSecurityLevel() if
  getLoginSecurityLevel() returns non-false.
* (T43720, T46197) Improved page display title handling for category pages
* (T65080) Fixed resetting options of some types via API action=options.

=== Action API changes in 1.32 ===
* Added templated parameters.
  * A module can define a templated parameter like "{fruit}-quantity", where
    the actual parameters recognized correspond to the values of a multi-valued
    parameter. Then clients can make requests like
    "fruits=apples|bananas&apples-quantity=1&bananas-quantity=5".
  * action=paraminfo will return templated parameter definitions separately
    from normal parameters. All parameter definitions now include an "index"
    key to allow clients to maintain parameter ordering when merging normal and
    templated parameters.
* It is now an error to submit too many values for a multi-valued parameter.
  This has generated a warning since MediaWiki 1.14.
* Assertion failures from the 'assert' and 'assertuser' parameters will no
  longer use the action module's custom response format, for the few modules
  that use custom formatters that handle errors.
* (T198935) User list preferences such as `email-blacklist` and similar
  extension preferences are no longer represented as arrays when returned by
  action=query&meta=userinfo&uiprop=options.
* 'missingparam' errors will now use the prefixed parameter name in the code
  and error text, e.g. "noxxfoo" and "The 'xxfoo' parameter must be set" rather
  than "nofoo" and "The 'foo' parameter must be set".
* action=query&prop=revisions now takes a 'rvslots' parameter to indicate the
  multi-content revision slots for which content should be returned. It also
  has a new rvprop, 'roles', to indicate which roles have slots. A deprecation
  warning will be issued if rvprop=content or rvprop=contentmodel are used
  without rvslots.
* The rvcontentformat parameter to action=query&prop=revisions has been
  deprecated. Clients should be prepared to deal with the default format for
  relevant models.
* Use of the deprecated parameters rvexpandtemplates, rvgeneratexml, rvparse,
  rvdiffto, rvdifftotext, rvdifftotextpst, rvcontentformat, or the deprecated
  rvprop=parsetree is forbidden with the new 'rvslots' parameter.
* action=query&prop=deletedrevisions, action=query&list=allrevisions, and
  action=query&list=alldeletedrevisions are changed similarly to
  &prop=revisions (see the three previous items).
* (T174032) action=compare now supports multi-content revisions.
  * It has a 'slots' parameter to select diffing of individual slots. The
    default behavior is to return one combined diff.
  * The 'fromtext', 'fromsection', 'fromcontentmodel', 'fromcontentformat',
    'totext', 'tosection', 'tocontentmodel', and 'tocontentformat' parameters
    are deprecated. Specify the new 'fromslots' and 'toslots' to identify which
    slots have text supplied and the corresponding templated parameters for
    each slot.
  * The behavior of 'fromsection' and 'tosection' of extracting one section's
    content is not being preserved. 'fromsection-{slot}' and 'tosection-{slot}'
    instead expand the given text as if for a section edit. This effectively
    declines T183823 in favor of T185723.
* (T198214) The 'disabletidy' parameter to action=parse has been
  deprecated; untidy output will not be supported by future wikitext
  parsers.
* Added intestactionsdetail to action=query&prop=info to allow retrieving the
  reasons an action is not allowed.
* Deprecated action=query&prop=info inprop=readable in favor of
  intestactions=read.
* (T212356) When using action=delete on pages with many revisions, the module
  may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
  deletion will be processed via the job queue.

=== Action API internal changes in 1.32 ===
* Added 'ApiParseMakeOutputPage' hook.
* Parameter names may no longer contain '{' or '}', as these are now used for
  templated parameters.
* (T194950) Added 'ApiMaxLagInfo' hook.
* The following methods now take a RevisionRecord rather than a Revision. No
  external callers are known.
  * ApiFeedContributions::feedItemAuthor()
  * ApiFeedContributions::feedItemDesc()
  * ApiQueryRevisionsBase::extractRevisionInfo()
* The following deprecated methods have been removed:
  * ApiBase::profileIn() (deprecated in 1.25)
  * ApiBase::profileOut() (deprecated in 1.25)
  * ApiBase::safeProfileOut() (deprecated in 1.25)
  * ApiBase::profileDBIn() (deprecated in 1.25)
  * ApiBase::profileDBOut() (deprecated in 1.25)
  * ApiBase::dieUsage() (deprecated in 1.29)
  * ApiBase::dieUsageMsg() (deprecated in 1.29)
  * ApiBase::dieUsageMsgOrDebug() (deprecated in 1.29)
  * ApiBase::getErrorFromStatus() (deprecated in 1.29)
  * ApiBase::parseMsg() (deprecated in 1.29)
  * ApiBase::setWarning() (deprecated in 1.29)
  * ApiPageSet::getInvalidTitles() (deprecated in 1.26)
  * ApiQueryLogEvents::addLogParams() (deprecated in 1.25)
  * ApiUsageException::getCodeString() (deprecated in 1.29)
  * ApiUsageException::getMessageArray() (deprecated in 1.29)
* Class UsageException, deprecated in 1.29, has been removed.
* ApiErrorFormatter: Added getFormat() and newWithFormat(). In particular, you
  can now easily test $formatter->getFormat() === 'bc', and then call
  $formatter->newWithFormat( 'plaintext' ) to get a non-BC formatter.

=== Languages updated in 1.32 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T193566) Added language support for Ambonese Malay (abs).
* (T194047) Added language support for Shawiya, Latin script (shy-latn).
* (T195940) Added language support for Batak Mandailing (btm).
* (T137491) Added language support for Standard Moroccan Amazigh (zgh).
* (T198132) Added language support for Manipuri (mni).
* (T201276) Added language support for Western Armenian (hyw).
* (T201583) Added language support for Mon (mnw).

=== Breaking changes in 1.32 ===
* $wgRequestTime, deprecated in 1.25, was removed. Use
  $_SERVER['REQUEST_TIME_FLOAT'] or WebRequest::getElapsedTime() instead.
* The MediaWikiI18N class, deprecated in 1.31, was removed.
* QuickTemplate::setTranslator(), deprecated in 1.31, was removed. Use
  Skin::msg() instead.
* wfInitShellLocale(), deprecated in 1.30, was removed.
* wfShellExecDisabled(), deprecated in 1.30, was removed.
* The type string for the parameter $lang of DateFormatter::getInstance,
  deprecated in 1.31, was removed.
* The EDIT_TOKEN_SUFFIX constant deprecated in 1.27, was removed. Use
  MediaWiki\Session\Token::SUFFIX instead.
* EditPage::isOouiEnabled() deprecated in 1.30, was removed.
* mw.util.wikiGetlink(), deprecated in 1.23, was removed. Use mw.util.getUrl()
  instead.
* (T61113) The following methods and constants from the Revision class, which
  were deprecated in 1.25, have now been removed:
  * Revision::getRawUser()
  * Revision::getRawUserText()
  * Revision::getRawComment()
* window.gM() from mediawiki.jqueryMsg, deprecated in 1.23, was removed. Use
  mw.msg() or mw.message() instead.
* mw.util.escapeId(), deprecated in 1.30, was removed. Use
  mw.util.escapeIdForAttribute or mw.util.escapeIdForLink instead.
* mw.util.updateTooltipAccessKeys(), deprecated in 1.24, was removed. Use
  jquery.accessKeyLabel instead.
* The SqlDataUpdate class, deprecated in 1.28, has been removed.
* The Html5Internal and Html5Depurate tidy driver classes were removed, along
  with the Balancer tidy implementation. Both implementations were experimental,
  and were replaced by RemexHtml.
* (T179624) Job::insert() and ::batchInsert(), deprecated in 1.21, were both
  removed. Use JobQueueGroup::singleton()->push() instead.
* The jquery.footHovzer module, for mediawiki.debug, was removed.
* The es5-shim module, empty and deprecated since 1.29, was removed.
* the dom-level2-shim module, empty and deprecated since 1.29, was removed.
* the json module, empty and deprecated since 1.29, was removed.
* The mediawiki.widgets.visibleByteLimit module alias, deprecated in 1.32, was
  removed. Use mediawiki.widgets.visibleLengthLimit instead.
* The jquery.farbtastic module, unused since 1.18, was removed.
* The 'jquery.expandableField' module, unused since 1.22, was removed.
* The hooks 'PreferencesFormPreSave' and 'PreferencesGetLegend' may provide
  any HTMLForm object rather than PreferencesForm.
* The non namespaced TimestampException class, deprecated in 1.29, was removed.
  Use Wikimedia\Timestamp\TimestampException instead.
* The global functions codepointToUtf8, hexSequenceToUtf8, utf8ToHexSequence,
  utf8ToCodepoint, and escapeSingleString (deprecated in 1.25) were removed.
  The UtfNormal\Utils class from the utfnormal library should be used instead.
* The deprecated UTF8_ and UNICODE_ constants were removed. The class constants
  from the UtfNormal\Constants class from the utfnormal library should be used
* The protected methods PHPSessionHandler::returnSuccess() and returnFailure(),
  only needed for PHP5 compatibility, have been removed. It now uses the boolean
  values `true` and `false` respectively.
* The $parserMemc global and wfGetParserCacheStorage(), deprecated since 1.30,
  were removed. Use the ParserCache class instead.
* ScopedCallback (deprecated in 1.28) was removed. Use Wikimedia\ScopedCallback
  instead.
* Support for ResourceLoaderModule::getModifiedTime() and getModifiedHash(),
  deprecated since 1.26, was removed. Use getDefinitionSummary() instead.
* (T195256) Skins are recommended not to rely on JavaScript for the "mw-jump"
  and "jump-to-nav" accessibility links. To this end, the "jquery.mw-jump"
  is no longer loaded by default. The Vector and MonoBook skins have made a
  minor change to implement the toggle feature with CSS instead. To restore
  prior functionality, either explicitly load "jquery.mw-jump" in your skin
  or refer to T195256 for details on how to make the same change.
* Hook 'EditPageBeforeEditChecks' was removed;
  use 'EditPageGetCheckboxesDefinition' instead.
* Linker::getLinkColour() and DummyLinker::getLinkColour(), deprecated since
  1.28, were removed. LinkRenderer::getLinkClasses() should be used instead.
* Wikimedia\Rdbms\LoadBalancer::getLaggedSlaveMode(), deprecated in 1.28, has
  been removed. Use Wikimedia\Rdbms\LoadBalancer::getLaggedReplicaMode()
  instead.
* mw.widgets.CategoryMultiselectWidget now uses TagMultiselectWidget instead of
  CapsuleMultiselectWidget. The following methods may no longer be used:
  * setItemsFromData: Use setValue instead
  * getItemsData: Use getItems instead and get the data property
* Two OutputPage methods, addMetadataLink() and getMetadataAttribute(), were
  removed.  Use addLink() instead.
* Another two OutputPage methods, setPageTitleActionText() and
  getPageTitleActionText(), were removed.  They did nothing since 1.15 (almost
  ten years).  Use setHTMLTitle() directly.
* The return value of OutputPage::adaptCdnTTL() has been removed. The
  value returned was misleading and probably not what any caller would
  have wanted.
* All MagicWord static member variables have been removed.  Use appropriate
  hooks or MagicWordFactory methods instead.
* MagicWord::clearCache() has been removed.  Instead, create a new
  MagicWordFactory, such as by calling
  resetServiceForTesting( 'MagicWordFactory' ) on a MediaWikiServices.
* mw.util.init() has been removed. This function is not needed anymore and was
  a no-op function since 1.30.
* SpecialPageFactory::resetList() is a no-op.  Call overrideMwServices()
  instead.
* MediaWiki no longer supports a StartProfiler.php file. Instead, you can set
  $wgProfiler and $wgEnableProfileInfo.
* The mw.loader.addSource() is now considered a private method, and no longer
  supports the `id, url` signature. Use the `Object` parameter instead.
* The backwards-compatibility code in HTMLForm to add a drop-down control to an
  option that is not set to be a drop-down if the "mw-chosen" class is present,
  is now removed.
* Several collations were removed. They were workarounds for bugs in the ICU
  library and they are no longer needed (as of ICU 57.1):
  * 'uppercase-se' (NorthernSamiUppercaseCollation) - use 'uca-se' instead
  * 'xx-uca-et' (CollationEt) - use 'uca-et' instead
  * 'xx-uca-fa' (CollationFa) - use 'uca-fa' instead
* LanguageCode::bcp47() now always returns a valid BCP 47 code.  This means
  that some MediaWiki-specific language codes, such as `simple`, are mapped
  into valid BCP 47 codes (eg `en-simple`).
* The hooks 'SpecialRecentChangesFilters' & 'SpecialWatchlistFilters' deprecated
  in 1.23 were removed. Instead, use 'ChangesListSpecialPageStructuredFilters'.
  The ChangesListSpecialPage code for these legacy hooks, and their use in
  SpecialRecentchanges.php and SpecialWatchlist, was also removed:
  * ChangesListSpecialPage->getCustomFilters()
  * ChangesListSpecialPage->getFilterGroupDefinitionFromLegacyCustomFilters()
  * ChangesListSpecialPage::customFilters
* The global function wfUseMW, deprecated since 1.26, has now been removed. Use
  the "requires" property of static extension registration instead.
* $wgSpecialPages no longer accepts array syntax, deprecated since 1.18.
* The MailAddress constructor can no longer be called with a User object,
  behaviour which has been deprecated since 1.24.
* LBFactory, deprecated since 1.28, has been removed. Instead, use
  Wikimedia\Rdbms\LBFactory.
* The MimeMagic class, deprecated since 1.28 has been removed. Get a
  MimeAnalyzer instance from MediaWikiServices instead.
* The '--tidy' option to maintenance/parse.php has been removed.  Tidying
  the output is now the default.  Use '--no-tidy' to bypass the tidy
  phase.
* The global function wfErrorLog, deprecated since 1.25, has now been removed.
  Use MWLoggerLegacyLogger::emit or UDPTransport.
* The hooks 'SpecialRecentChangesQuery' & 'SpecialWatchlistQuery', deprecated in
  1.23, were removed. Instead, use ChangesListSpecialPageStructuredFilters or
  ChangesListSpecialPageQuery.
* The global function wfUsePHP, deprecated since 1.30, has now been removed. To
  assert a newer version of PHP than MediaWiki does, use extension registration.
* The hook 'ChangesListSpecialPageFilters', deprecated in 1.29, has now been
  removed. Use the 'ChangesListSpecialPageStructuredFilters' hook instead.
* DeferredUpdates::setImmediateMode(), deprecated since 1.29, has been removed.
* File / MediaHandler::getStreamHeaders(), deprecated since 1.30, was removed.
* The hook 'DoEditSectionLink', deprecated since 1.25, has been removed. Use
  the hook 'SkinEditSectionLinks' instead.
* The hook 'UserGetImplicitGroups', deprecated since 1.25, has been removed.
* The global function wfRunHooks, deprecated since 1.25, has now been removed.
  Use Hooks::run().
* The hook 'UnknownAction', deprecated since 1.19, has now been removed.
* The hook 'ParserLimitReport', deprecated since 1.22, has been removed. Use
  the hooks 'ParserLimitReportPrepare' and 'ParserLimitReportFormat' instead.
* The following deprecated API methods have been removed:
  * ApiBase::profileIn() (deprecated in 1.25)
  * ApiBase::profileOut() (deprecated in 1.25)
  * ApiBase::safeProfileOut() (deprecated in 1.25)
  * ApiBase::profileDBIn() (deprecated in 1.25)
  * ApiBase::profileDBOut() (deprecated in 1.25)
  * ApiBase::dieUsage() (deprecated in 1.29)
  * ApiBase::dieUsageMsg() (deprecated in 1.29)
  * ApiBase::dieUsageMsgOrDebug() (deprecated in 1.29)
  * ApiBase::getErrorFromStatus() (deprecated in 1.29)
  * ApiBase::parseMsg() (deprecated in 1.29)
  * ApiBase::setWarning() (deprecated in 1.29)
  * ApiPageSet::getInvalidTitles() (deprecated in 1.26)
  * ApiQueryLogEvents::addLogParams() (deprecated in 1.25)
  * ApiUsageException::getCodeString() (deprecated in 1.29)
  * ApiUsageException::getMessageArray() (deprecated in 1.29)
* Class UsageException, deprecated in 1.29, has been removed.
* MediaWiki no longer has a 'JavaScript-powered' wikitext toolbar built in. The
  old "bulletin board style toolbar", known as "the 2006 wikitext editor", has
  been removed, and instead sysadmins will be required to choose one (or more)
  of the several extensions available for this purpose if they need the
  functionality. The MediaWiki "tarball" releases have included the replacement
  extension for this, the WikiEditor extension aka "the 2010 wikitext editor",
  for many years now. As part of this, several parts of MediaWiki have been
  removed or simplified:
  * The user option 'showtoolbar' (shown as "Show edit toolbar") is no longer
    available; if an extension adds a toolbar via the EditPageBeforeEditToolbar
    hook, it will be shown; extensions should provide a specific user preference
    to disable themselves as needed.
  * The public methods Language::getImageFile() and ::getImageFiles(), and the
    related specification of $imageFiles within individual languages' code file,
    as well as the referenced static media assets, all of which were only used
    inside MediaWiki itself for providing the icons for the old toolbar, have
    been removed without explicit deprecation.
  * The internal ResourceLoader module "mediawiki.toolbar", which is unused
    except by MediaWiki itself and back-compatibility code, has been removed.
  * The internal ResourceLoaderEditToolbarModule class has been removed.

=== Deprecations in 1.32 ===
* HTMLForm::setSubmitProgressive() is deprecated. No need to call it. Submit
  button is already marked as progressive.
* Skin::setupSkinUserCss() is deprecated. Adding of modules to load
  has been centralised to Skin::getDefaultModules(), which is now capable
  of queueing style modules as well.
* OutputPage::addModuleScripts() and ParserOutput::addModuleScripts are
  deprecated. Use addModules() instead.
* Overriding SearchEngine::{searchText,searchTitle,searchArchiveTitle}
  in extending classes is deprecated.  Extend related doSearch* methods
  instead.
* The following 'mediawiki.api' plugin modules were merged into mediawiki.api
  and deprecated: mediawiki.api.category, mediawiki.api.edit,
  mediawiki.api.login, mediawiki.api.options, mediawiki.api.parse,
  mediawiki.api.upload, mediawiki.api.user, mediawiki.api.watch,
  mediawiki.api.messages, and mediawiki.api.rollback.
* ApiBase::truncateArray() is deprecated. No replacement, as nothing is known
  to use it.
* WatchAction::getUnwatchToken is deprecated. Use WatchAction::getWatchToken
  with the 'unwatch' action parameter instead.
* IcuCollation::getICUVersion() is deprecated, as you can just use the PHP
  constant INTL_ICU_VERSION directly in all versions that MediaWiki supports.
* Parser::fetchFile() is deprecated. Use ::fetchFileAndTitle() instead.
* The ApiQueryContributions class has been renamed to ApiQueryUserContribs.
* The XMPInfo, XMPReader, and XMPValidate classes have been deprecated in favor
  of the namespaced classes provided by the wikimedia/xmp-reader library.
* SearchResultSet::{next,rewind} are deprecated. Calling code should
  use foreach on the SearchResultSet, or the extractResults method. Extending
  code should override extractResults.
* Instantiating SearchResultSet directly is deprecated. SearchEngine
  implementations must subclass SearchResultSet for their purposes.
* SearchResult::setExtensionData argument has been changed from accepting an
  array to accepting a Closure that returns the array when called.
* Class CryptRand, everything in MWCryptRand except generateHex() and function
  MediaWikiServices::getInstance()->getCryptRand() are deprecated, use
  random_bytes() to generate cryptographically secure random byte sequences.
* Parser::getConverterLanguage() is deprecated.  Use ::getTargetLanguage()
  instead.
* Language::markNoConversion() is deprecated.  It confused readers because
  it had unexpected behavior (only marking text if it looked like a URL)
  and was only used in a single place in the code.  Use
  LanguageConverter::markNoConversion() instead.
* (T197492) Language::truncate() was soft deprecated in 1.31 and is
  hard deprecated in this release.  It has been split into two similar
  methods, Language::truncateForVisual() and Language::truncateForDatabase(),
  which measure length in characters and bytes, respectively.  Use
  Language::truncateForVisual() when possible to provide equity to users
  of multibyte scripts.
* (T176526) EditPage::getContextTitle() falling back to $wgTitle when the
  context title is unset is now deprecated; anything creating an EditPage
  instance should set the context title via ::setContextTitle().
* The 'jquery.hidpi' module (polyfill for IMG srcset) is deprecated.
* ResourceLoaderStartUpModule::getStartupModules() and ::getLegacyModules()
  are deprecated. These concepts are obsolete and have no replacement.
* String type for $lang of DifferenceEngine::setTextLanguage is deprecated.
* The following methods of OutputPage are now deprecated in favour
  of using showFatalError directly: OutputPage::showFileDeleteError()
  OutputPage::showFileNotFoundError(), OutputPage::showFileRenameError()
  OutputPage::showFileCopyError() and OutputPage::showUnexpectedValueError().
* The Replacer, DoubleReplacer, HashtableReplacer, and RegexlikeReplacer
  classes are now deprecated. Use a Closure instead.
* (T194263) ContentHandler::makeParserOptions() is deprecated. Use
  WikiPage::makeParserOptions() or ParserOptions::newCanonical() instead.
* (T100681) Use of the Parsoid v1 API with the VirtualRESTService, deprecated in
  MediaWiki 1.26,  is now hard-deprecated. All known clients were converted to
  the Parsoid v3 API in May 2015.
* $input is deprecated in hook 'LogEventsListGetExtraInputs'. Use
  $formDescriptor instead.
* SearchEngine::transformSearchTerm( $term ) should no longer be called prior
  to running searchText. This method was mainly implemented to support the
  'prefix' URI param in SpecialSearch, but there are no reasons to expose this
  logic as it should be handled internally by SearchEngine implementations
  supporting this feature. SearchEngine implementations should no longer
  override this methods.
* SearchEngine::replacePrefixes( $query ) should no longer be called prior
  to running searchText/searchTitle.
* (T199657) Messages for $wgFilterLogTypes labels should be no longer be in the
  'log-show-hide-[type]' format. Instead use 'logeventslist-[type]-log'.
* Global functions  wfArrayFilter() and wfArrayFilterByKey() are deprecated.
  use array_filter() directly.
* The $wgShowSQLErrors global is deprecated and nonfunctional.
  Set $wgShowExceptionDetails and/or $wgShowHostnames instead.
* The $wgShowDBErrorBacktrace global is deprecated and nonfunctional.
  Set $wgShowExceptionDetails instead.
* Public access to the DifferenceEngine properties mOldid, mNewid, mOldRev,
  mNewRev, mOldPage, mNewPage, mOldContent, mNewContent, mRevisionsLoaded,
  mTextLoaded and mCacheHit is deprecated. Use getOldid() / getNewid() /
  getOldRevision() / getNewRevision() for the first four (note that the
  revision ones return a RevisionRecord, not a Revision), do your own lookup
  for page/content.
* The $wgExternalDiffEngine value 'wikidiff2' is deprecated. To use wikidiff2
  just enable the PHP extension, and it will be autodetected.
* (T194731) DifferenceEngine properties mOldContent and mNewContent and methods
  setContent(), generateContentDiffBody(), generateTextDiffBody() and textDiff()
  are deprecated. To interact with a single slot, use a SlotDiffRenderer (and
  subclass it to customize diff rendering); to diff custom (e.g. unsaved)
  content, use setRevisions(). Subclassing DifferenceEngine should only be done
  to customize page-level diff properties (such as the navigation header).
* The wfUseMW function, soft-deprecated in 1.26, is now hard deprecated.
* All MagicWord static methods are now deprecated.  Use the MagicWordFactory
  methods instead.
* PasswordFactory::init is deprecated. To get a password factory with the
  standard configuration, use
  MediaWikiServices::getInstance()->getPasswordFactory.
* $wgContLang is deprecated, use
  MediaWikiServices::getInstance()->getContentLanguage() instead.
* $wgParser is deprecated, use MediaWikiServices::getInstance()->getParser()
  instead.
* wfGetMainCache() is deprecated, use ObjectCache::getLocalClusterInstance()
  instead.
* wfGetCache() is deprecated, use ObjectCache::getInstance() instead.
* All SpecialPageFactory static methods are deprecated. Instead, call the
  methods on a SpecialPageFactory instance, which may be obtained from
  MediaWikiServices.
* mw.user.stickyRandomId was renamed to the more explicit
  mw.user.getPageviewToken to better capture its function.
* Passing Revision objects to ContentHandler::getUndoContent() is deprecated,
  Content object should be passed instead.
* (T197179) Parameters 'notice', 'notice-messages', 'notice-message',
  previously used by OOUI HTMLForm fields, are now deprecated. Use
  'help', 'help-message', 'help-messages' instead.
* (T197179) HTMLFormField::getNotices() is now deprecated.
* The jquery.localize module is now deprecated. Use jquery.i18n instead.
* The SecondaryDataUpdates hook was deprecated in favor of RevisionDataUpdates,
  or overriding ContentHandler::getSecondaryDataUpdates (T194038).
* The WikiPageDeletionUpdates hook was deprecated in favor of
  PageDeletionDataUpdates, or overriding ContentHandler::getDeletionDataUpdates
  (T194038).
* Content::getSecondaryDataUpdates has been deprecated in favor of
  ContentHandler::getSecondaryDataUpdates() for overriding by extensions
  (T194038).
  Application logic should call WikiPage::doSecondaryDataUpdates() (T194037).
* Content::getDeletionUpdates has been deprecated in favor of
  ContentHandler::getDeletionUpdates() for overriding by extensions (T194038).
  Application logic should call WikiPage::doSecondaryDataUpdates() (T194037).
* (T198214) Old Tidy-related configuration settings, which were soft-deprecated
  in MediaWiki 1.26, have now been hard deprecated. This affects $wgUseTidy,
  $wgTidyBin, $wgTidyConf, $wgTidyOpts, $wgTidyInternal, and $wgDebugTidy. Use
  $wgTidyConfig instead.
* All Tidy configurations other than Remex have been hard deprecated;
  future parsers will not emit compatible output for these configurations.
  In particular, running MediaWiki with tidy disabled has been deprecated.
* (T198214) OutputPage::addWikiText(), OutputPage::addWikiTextWithTitle(),
  and OutputPage::addWikiTextTitle() have been deprecated, since they
  can result in untidy output.  In addition OutputPage::addWikiTextTidy()
  and OutputPage::addWikiTextTitleTidy() was deprecated to make naming new
  methods consistent.  Use OutputPage::addWikiTextAsInterface() or
  OutputPage::addWikiTextAsContent() instead, which ensures the output is
  tidy and clarifies whether content-language specific postprocessing should
  be done on the text.
* OutputPage::parse() and OutputPage::parseInline() have been deprecated
  due to untidy output and inconsistent handling of wrapper divs and
  interface/content language defaults.  Use OutputPage::parseAsContent(),
  OutputPage::parseAsInterface(), or OutputPage::parseInlineAsInterface()
  as appropriate.
* QuickTemplate::msgHtml() and BaseTemplate::msgHtml() have been deprecated
  as they promote bad practises. I18n messages should always be properly
  escaped.
* Skin::getDynamicStylesheetQuery() has been deprecated. It always
  returns action=raw&ctype=text/css which callers should use directly.
* Class LegacyFormatter is deprecated.
* Use of CommentStore::insertWithTempTable() with 'img_description' is
  deprecated. Use CommentStore::insert() instead.
* Language::setCode is deprecated as public function. Use Language::factory
  to create a new Language object with a different language code.
* Several classes have been moved from the MediaWiki\Storage\ namespace to the
  MediaWiki\Revision\ namespace. The old class names are aliased for
  compatibility, but are deprecated. Classes are IncompleteRevisionException,
  MutableRevisionRecord, MutableRevisionSlots, RevisionAccessException,
  RevisionArchiveRecord, RevisionFactory, RevisionLookup, RevisionRecord,
  RevisionSlots, RevisionStore, RevisionStoreRecord, SlotRecord, and
  SuppressedDataException.
* When using OOUI HTMLForm containing an 'info' field which uses the 'rawrow'
  option, it is now deprecated to give its contents (the 'default' option)
  as a string. They should be given as a OOUI\FieldLayout object instead.
  Notably, this affects fields defined in the 'GetPreferences' hook, because
  Special:Preferences uses an OOUI form now. (If possible, don't use 'rawrow'.)
* In Skin::doEditSectionLink omitting the parameters $tooltip and $lang is
  deprecated. For the $lang parameter, types other than Language are
  deprecated.
* The $wgUseKeyHeader configuration option and the
  OutputPage::getKeyHeader() method have been deprecated; the relevant
  draft IETF spec expired without becoming a standard.
* Deprecated API action=query&prop=info inprop=readable in favor of
  intestactions=read.

=== Other changes in 1.32 ===
* (T198811) The following tables have had their UNIQUE indexes turned into
  proper PRIMARY KEYs for increased maintainability: interwiki, page_props,
  protected_titles and site_identifiers.
* OOUI HTMLForm will now display help text inline after the input field,
  rather than in a popup. Previous behavior can be restored by using
  `'help-inline' => false`.
* The archive table's ar_rev_id field is now unique.
* Special:BotPasswords now requires reauthentication.
* (T174023) Multi-Content Revision (MCR) capabilities were introduced into the
  storage layer and have basic support for display. No user interface exists
  yet for creating or managing content in slots beides the main slot. See
  <https://www.mediawiki.org/wiki/Multi-Content_Revisions> for more
  information.
* The image_comment_temp database table has been removed. Since all access
  should be mediated by the CommentStore class, this change shouldn't affect
  external code.
* (T206147) Database::close() will no longer commit any open transactions.
* (T64103) Dropped columns category.cat_hidden, site_stats.ss_admins, and
  recentchanges.rc_cur_time from the PostgreSQL schema.

= MediaWiki 1.31 =

== MediaWiki 1.31.16 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

This is intended to be the final release of the MediaWiki 1.31 branch,
and as such, 1.31 is now considered End of Life.

=== Changes since MediaWiki 1.31.15 ===
* (T283273) Make postgres IRC channel point to libera.chat.
* (T289108) ExtensionProcessor: Remove loaderScripts from
  extension.json schemas.
* (T285515, CVE-2021-41798) SECURITY: XSS vulnerability in
  Special:Search.
* (T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
  table scan.
* (T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
  Special:Contributions.

== MediaWiki 1.31.15 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.14 ===
* (T270988) Fixup issues in SpecialChangeContentModel.php.
* (T278026) rdbms: Add DB_PRIMARY to replace DB_MASTER.
* (T276945) Define a batch size in maintenance/manageJobs.php.
* (T276945) Implement JobQueueDB::getAllAbandonedJobs.
* (T281549) WebInstaller: Don't show the announce-l subscribe
  checkbox temporarily.
* (T283247) Freenode -> Libera per wikimedia moving from
  freenode to libera.
* (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from
  purging pages.

== MediaWiki 1.31.14 ==

This is a maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.13 ===
* Make Title implement IDBAccessObject.

== MediaWiki 1.31.13 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.12 ===
* (T115436) resourceloader: CSSMin::getLocalFileReferences now strips
  anchors.
* Updating php-parallel-lint/php-parallel-lint (0.9.2 => 1.0.0).
* Updating mediawiki/codesniffer (19.1.0 => 19.4.0).
* DefaultSettings.php: Update $wgPingback documentation.
* PHPVersionCheck: The PHP Group only supports PHP >= 7.3.0.
* (T275261) Escape wikitext in the title in invalid title error messages.
* (T277009, CVE-2021-30158) SECURITY: Allow blocked users to access
  Special:ResetTokens.
* pageExist.php: Output trailing newlines.
* (T278058, CVE-2021-30157) SECURITY: Escape rcfilters-filter-* messages
  on ChangesList pages.
* (T277414) HTMLFormField: Use non namespaced class name rather than
  static::class.
* (T268230) Switch to new MediaWiki logo by Serhio Magpie.
* (T271735) Expand config-pingback-help, link to privacy policy in
  config-pingback.
* Fix documentation of user-global in $wgRateLimits.
* BackupDumper: Add -o as shortcode for --output.
* (T278014, CVE-2021-30154) SECURITY: Escape mediastatistics-header-*
  messages on Special:NewFiles.
* (T270713, CVE-2021-30152) SECURITY: Allow user to only apply protection
  they have right to do so via action=protect.
* (T272386, CVE-2021-30159) SECURITY: Non-admin deleted enwiki page in
  fast double move.
* (T270988, CVE-2021-30155) SECURITY: ContentModelChange: Check that user
  can create pages.
* (T276843, CVE-2021-20270, CVE-2021-27291) SECURITY:
  SyntaxHighlight_GeSHi: Various lexers have been disabled due to DoS
  vectors.

== MediaWiki 1.31.12 ==

This is a maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.11 ===
* Fixed issues relating to User::isRegistered() not existing in 1.31.

== MediaWiki 1.31.11 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.10 ===
* Fix undefined $wgRedirectOnLogin.
* (T251661, T265313) CentralIdLookup::factoryNonLocal can return null.
* (T263592) media: Fix case of FlashPixVersion in
  FormatMetadata::makeFormattedData().
* (T265223) BaseTemplate: Guard against passing zero arg to array_merge().
* (T266418) composer.json: add requirement for composer-plugin-api ^1.1.
* (T260631, T260633), BotPassword::save() now returns a Status object for the
  result rather than a bool. The length of the bot password grants and
  restriction fields are now validated, and an error will be thrown if it
  would be truncated by the database.
* (T264536, T233012) SectionProfiler: Do not attempt to use null values as
  arrays.
* (T269178) MemcachedClient: Cast Resource to integer.
* (T268917, CVE-2020-35475) SECURITY: Use Xml::element in SpecialUserrights for
  sanity.
* (T268938, CVE-2020-35479) SECURITY: BlockLogFormatter can output raw html.
* (T205908, CVE-2020-35477) SECURITY: Unable to change visibility of log entries
  when MediaWiki:Mainpage uses Special:MyLanguage.
* (T120883, CVE-2020-35480) SECURITY: Divergent behavior for contributions and
  user pages of hidden users and missing users.

== MediaWiki 1.31.10 ==

This is a maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.9 ===
* Fixed issues relating to backporting of changes for T260485.

== MediaWiki 1.31.9 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.8 ===
* In the web installer, use secure session cookies.
* (T257207) shell: Expand documentation in firejail.profile.
* Added $wgForceHTTPS, which makes the HTTP to HTTPS redirect be unconditional
  and suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
  recommend this be set to true on pure HTTPS wikis.
* Added $wgCookieSameSite, which allows login cookies to be sent with
  SameSite=None. This is required for cross-site CentralAuth autologin after
  Chrome 84.
* Added $wgUseSameSiteLegacyCookies, which adds a compatibility hack to
  SameSite=None cookies for browsers which implemented an incompatible draft
  version of the specification.
* (T191537) Disable WebResponse setters for post-send processing.
* (T198525) WebReponse: Use values altered in 'WebResponseSetCookie' hook.
* Fix runBatchedQuery.php for no result from select.
* (T130906) Add Edge to MediaWiki:Clearyourcache.
* Use IPset in MWRestrictions::checkIP.
* (T260031) Add application/font-sfnt to MimeMap for ttf files.
* shell: Make ->restrict( RESTRICT_NONE ) actually work.
* (T183759) Fixes shell edge-cases in Windows.
* (T258390) Add CentralIdLookup::factoryNonLocal().
* (T246991) User: Fix pingLimiter() to use makeGlobalKey() for global rate
  limits.
* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global rate
  limit type.
* (T246991) User: enforce pingLimiter() expiry time.
* (T260232) don't include null page ids in query list for category dumps.
* (T251506) Sanitizer: Truncate IDs to a reasonable length.
* Explicitly wrap some XML calls in libxml_disable_entity_loader().
* (T263455 T247285) Set EnableJavaScriptTest to true in
  includes/DevelopmentSettings.php.
* (T232568, CVE-2020-25813) SECURITY: Special:UserRights exposes the existence
  of hidden users.
* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
  firejail's --output functionality.
* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
  'style' attribute.
* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
  mw.message( ... ).parse().
* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
  database.
* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.

== MediaWiki 1.31.8 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.7 ===
* (T199809) Don't invalidate BotPasswords if a password reset email is sent.
* (T247017) PasswordReset performance improvements.
* (T250568) Work around change in SimpleXMLElement behavior introduced in PHP
  7.3.17.
* Remove some rotten and out of date documentation.
* (T252311) Improvements to some older SQLite update patches.
* (T240307) Minor fixes to extension.schema.v2.json and
  extension.schema.v1.json.
* (T199474) Set rc_patrolled to 2 for autopatrolled changes in
  rebuildrecentchanges.php.
* (T229461) Update the change_tag table in rebuildrecentchanges.php.
* (T206476) Call ob_start() before running tests.
* (T234450) Per-user concurrency in SpecialContributions can now be limited by
  setting $wgPoolCounterConf['SpecialContributions'] appropriately.
* (T248947) SECURITY: img_auth.php may leak private extension images into the
  public cache.

== MediaWiki 1.31.7 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.6 ===
* (T193565, T234022) Re-add DB domain sanity checks to LoadBalancer.
* Use proper SemVer comparison in CheckComposerLockUpToDate.
* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated.
* Update comment about PHP versions supported by The PHP Group.
* (T247215) Fix output of RecountCategories::doWork().
* Add check for page existence to view.php maintenance script.
* (T247580) Disable some broken Selenium tests.
* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink().
* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to
  any CSS selector.

== MediaWiki 1.31.6 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.5 ===
* (T181658) Do not insert page titles into querycache.qc_value.
* (T206013) Suppress errors when reading invalid XML file properties.
* (T237931) Remove references to pg_attrdef.adsrc in Postgres code.
* Use correct value for 'sslmode' in DatabasePostgres.
* (T232866) Fix support for HTTP/2 in MultiHttpClient.
* (T227461) Stop calling deprecated Redis delete functions.
* (T239561) Mark options as requiring parameters in addSite.php.
* (T239734) Replace deprecated lSize with lLen in Redis code.
* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
* (T239428) ApiEditPage: Test for bad redirect targets.
* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
  'trace'.
* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
* (T212067) Work around PHP bug in parse_url.

== MediaWiki 1.31.5 ==

This is a maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.4 ===
* Fix extra newlines in installer.
* Followup T230402, PermissionManager doesn't exist until 1.33, so fix the
  backported patches to use User::isAllowed() instead.

== MediaWiki 1.31.4 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.3 ===
* (T207100) Updated LanguageTr for dotted and dotless I in PHP 7.3.
* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
  of headers in private wikis.
* (T230402) SECURITY: Add permission check for suppressed account to
  Special:Redirect.
* Add helper for HTTPFileStreamer header syntax.
* (T118799) Fix XMP parser errors due to trailing nullchar.
* (T233119) Improve documentation for the MinimumPasswordLengthToLogin policy.
* (T202183) Give more specific error messages on Special:Redirect.
* Cache redirects from Special:Redirect.
* (T231386) dispatchUser() should use a 302 http status code.
* (T227662) Split down patch-comment-table.sql and patch-actor-table.sql into
  separate files to help allieviate potential migration problems.
* Make SQLite's patch-add-3d.sql a no-op to prevent clobbering other database
  updates.

== MediaWiki 1.31.3 ==

This is a maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.2 ===
* (T225558) Update installer link to PHP intl.
* (T225496) Detect APC for MainCacheType in CLI installer.
* (T226766) Remove jetbrains/phpstorm-stubs from composer dev dependencies.
* (T202211) Fix SQLite patch-(image|page|template)links-fix-pk.sql column order.

== MediaWiki 1.31.2 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

Required PHP version has been increased from 7.0.0 to 7.0.13.

=== Changes since MediaWiki 1.31.1 ===
* (T204729) WatchedItemStore::countVisitingWatchersMultiple() shouldn't query
  all titles when asked for none.
* (T205967) Fix syntax error typo in postgres database upgrade file.
* (T200254) Add pear/Net_SMTP 1.7.3 to composer dependencies.
* (T206765) Load installer i18n when running update.php.
* (T109121) Remove deprecated pear/mail_mime-decode from composer suggested
  libraries.
  [Also in the bundled composer /vendor directory.]
* Various PHP 7.2 and 7.3 compatibility fixes:
  * (T200595, T206974) Fix PHP 7.3 warnings of using "continue" in some
    scenarios instead of "break".
    * (T206976, T206977) Also in the bundled LocalisationUpdate and
      ParserFunctions extensions.
  * (T206979) Fix PHP 7.3 warnings of using "compact()" when some variables may
    not be set.
  * (T215632) FormatMetadata and UploadStash regexes fixed to be PHP
    7.3-compatible.
  * Fix PHP warnings "preg_replace(): [...] invalid range in character class.
  * Avoid PHP 7.2 warnings in DBConRefTest about count() on non-Countable.
  * Suppress "Headers already sent" in PHP 7.2 too.
  * (T206476) Output only to stderr in unit tests.
  * (T207112) Add session_write_close() calls to SessionManager tests.
  * oyejorge/less.php replaced with our fork wikimedia/less.php
  * (T209756) Updated wikimedia/ip-set from 1.2.0 to 1.3.0.
  * (T213489) Avoid session double-start in Setup.php.
  * (T206975) Switch to our fork of less.php.
* (T207540) Include IP address in "Login for $1 succeeded" log entry.
* (T201781) Database: Allow selectFieldValues() to accept SQL fragments.
* (T205765) installer: Don't link to the obsolete "Extension Matrix" page.
* (T206013) Update ImportableUploadRevisionImporter for interwiki usernames.
* (T207541) Pass an email address, not a MailAddress, to mail().
* (T207603) SECURITY: User JS may no longer be loaded with mime type
  text/javascript if there is no account associated with the username.
* (T112937, T113042) SECURITY: Do not allow loading pages raw with a
  text/javascript MIME
  type if non-admins can edit the page.
* (T17491) <ins>/<del> elements can be phrasing or flow.
* (T200827) RemexCompatMunger: Don't call endTag() in case B/b
* (T207088) Upgrade wikimedia/remex-html to 2.0.1.
  [Also in the bundled composer /vendor directory.]
* (T194052) Updated wikimedia/base-convert from 1.0.1 to 2.0.0.
  [Also in the bundled composer /vendor directory.]
* (T199494) Fix notices in maintenance/removeUnusuedAccounts.php.
* Require ext-fileinfo in composer.json, per PHPVersionCheck.
* (T176390) Bundled LocalisationUpdate extension: Handle exceptions from
  GitHubFetcher.
* (T208255) Completion search should not change the search query.
* (T209870) Fix SQL syntax error in MS-SQL initialisation file for new wikis.
* (T185049) LogFormatter: Fail softer when trying to link an invalid titles.
* (T210998) Properly set $wgLanguageCode in the generated LocalSettings.php
  if --lang is used with the command-line installer (install.php).
* (T211061) ImageListPager: Actor migration for buildQueryConds().
* (T209335) Clarify the default sidebar 'Help' link is about MediaWiki itself.
* Fix addition of ug_expiry column to user_groups table on MSSQL.
* (T204767) Add join conditions to ActiveUsersPager.
* (T210621) User: Bypass repeatable-read when creating an actor_id.
* (T204531) rdbms: reduce LoadBalancer replication log spam.
* (T195525) Fix db error outage page.
* (T208871) The hard-coded Google search form on the database error page was
  removed.
* (T176097) Fix flaky MessageBlobStoreTest assertion failures.
* (T209423) Update required PHP version to 7.0.13.
* (T209885) Prevent populateSearchIndex.php from breaking once actor migration
  has been started.
* (T216968) Return pageid as int in both list=iwbacklinks and
  list=langbacklinks.
* (T215169) Fix for Database::update() with IGNORE option fails on PostgreSQL.
* (T204423) Backport support for hyphenated DB names in JobQueueGroup.
* (T199474) Fix typo in rebuildrecentchanges.php resulting in rogue flags.
* (T218608) SECURITY: Fix an issue that prevents Extension:OAuth working when
  $wgBlockDisablesLogin is true.
* (T216029) Chrome redirects to Special:BadTitle after editing a section with
  a non-Latin name on a page with non-Latin characters in title.
* (T219728) Added support for new Japanese era name "Reiwa".
* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
  token.
* Updated cssjanus/cssjanus from 1.2.0 to 1.3.0.
* (T222385) resourceloader: Use AND instead of OR for upsert conds in
  saveFileDependencies().
* (T224374) Fix message parameters so that the message that says SQLite is out
  of date makes sense.
* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
  reauthenticating.
* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
  getLoginSecurityLevel() returns non-false.
* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
* (T208881) SECURITY: blacklist CSS var().
* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
* (T222036, T222038) SECURITY: Add permission check for user is permitted to
  view the log type.
* (T221739) SECURITY: resources: Patch jQuery 3.2.1 for CVE-2019-11358.

== MediaWiki 1.31.1 ==

This is a security and maintenance release of the MediaWiki 1.31 branch.

=== Changes since MediaWiki 1.31.0 ===
* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
  'newbie'.
* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
  account lock.
* (T199029, CVE-2018-13258) SECURITY: Tarball was missing .htaccess files.
* (T197229) Bundle Nuke extension, it was accidentally omitted.
* (T193995) Fix undefined patchPath() method call in parser tests.
* (T198687) Fix various selectFields methods to use the string 'NULL', not null.
* Special:BotPasswords now requires reauthentication.
* (T191608, T187638) Add 'logid' parameter to Special:Log.
* (T193829) Indicate when a Bot Password needs reset.
* (T198037) GitInfo: Don't try shelling out if it's disabled.
* (T151415) Log email changes.
* (T197206) Fix performance regression when multiple DB used without caching.
* (T197030) PHPSessionHandler: Suppress headers warnings in initialize().
* (T182377, T196793) Exif: Guard against uncountable tag values.
* (T200861) Fix total breakage of SQLite web upgrade.
* (T200864) Fix pingback over-reporting on non-MySQL databases
* (T202550) Unbreak SpecialListusersHeaderForm and SpecialListusersHeader
  hooks.

== MediaWiki 1.31.0 ==

=== Changes since MediaWiki 1.31.0-rc.2 ===
* (T195783) Initialize PSR-4 namespaces at same stage as normal autoloader.
* (T196092) Hide MySQL binary/utf-8 charset option in the installer.
* (T196185) Don't allow setting $wgDBmysql5 in the installer.
* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
* (T182366) UploadBase::checkXMLEncodingMissmatch() now works on PHP 7.1+
* (T118683) Fix exception from &$user deref on HHVM in the TitleMoveComplete
  hook.
* (T196672) The mtime of extension.json files is now able to be zero
* (T180403) Validate $length in padleft/padright parser functions.
* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.

=== Changes since MediaWiki 1.31.0-rc.0 ===
* (T33223) Drop archive.ar_text and ar_flags.
* Add default edit rate limit of 90 edits/minute for all users.
* (T187645) Use codepoint as tiebreaker when getting first-letters in
  IcuCollation.
* (T191947) Don't shell during the installer if shelling out is disabled.
* (T194319) Improve duplicate config setting exception as part of extension
  registration.
* (T195211) Don't require trailing slash in PSR-4 autoloader directory.
* (T186565) Fix PHP Notice from `ob_end_flush()` in `FileRepo::streamFile()`.
* Do not incorrectly hide namespace input field in the installer.
* (T186456) Refactor checks looking for PEAR maik libraries to be clearer.

=== Important pre-upgrade notes for 1.31 ===
* If you're using MySQL, SQLite, or MSSQL, are not using update.php to apply
  schema changes, and cannot have downtime to run migrateArchiveText.php and
  apply patch-drop-ar_text.sql manually, you'll have to apply a default value
  to the ar_text and ar_flags columns of the archive table or make those
  columns nullable before upgrading to MediaWiki 1.31.
  maintenance/archives/patch-nullable-ar_text.sql shows how to do this for
  MySQL.

=== Configuration changes in 1.31 ===
* $wgEnableAPI and $wgEnableWriteAPI are now deprecated and will be removed in
  a future version. The API is now considered to be stable, secure and
  essential.
* $wgUsejQueryThree was removed, as it is now the default. This was documented
  as a temporary variable during the migration period, deprecated since 1.29.
* $wgLogoHD has been updated to support svg images and uses $wgLogo where
  possible for fallback images such as png.
* (T44246) $wgFilterLogTypes will no longer ignore 'patrol' when user does not
  have the right to mark things patrolled.
* Wikis that contain imported revisions or CentralAuth global blocks should run
  maintenance/cleanupUsersWithNoId.php.
* The configuration settings $wgResourceLoaderMinifierStatementsOnOwnLine and
  $wgResourceLoaderMinifierMaxLineLength, deprecated since 1.27, were removed.
* (T180921) $wgReferrerPolicy now supports having fallbacks for browsers that
  are not using the latest version of the Referrer Policy specification.
* $wgFragmentMode is now set to [ 'legacy', 'html5' ] by default. This is a
  first step of migration to human-readable section IDs that will later result
  in 'html5' being the default mode.
* CACHE_ACCEL now only supports APC(u) or WinCache. XCache support was removed
  as upstream is inactive and has no plans to move to PHP 7.
* The old CategorizedRecentChanges feature, including its related configuration
  option $wgAllowCategorizedRecentChanges, has been removed.
* (T188472) The 'comma' value for $wgArticleCountMethod is no longer supported
  for performance reasons, and installations with this setting will now work as
  if it was configured with 'any'.
* (T185753) MediaWiki now defaults to using RemexHtml to tidy up user input,
  rather than being off by default. If you wish to disable HTML tidying
  entirely, set $wgTidyConfig to null; if you wish to use the old, deprecated
  Tidy external binary, both set $wgTidyConfig to null and $wgUseTidy to true.
* $wgLogAutopatrol now defaults to false instead of true.
* $wgValidateAllHtml was removed and will be ignored.
* $wgScriptExtension, deprecated and ignored since 1.25, was removed. See the
  1.25 release notes for more information.
* $wgUseAjax is now marked as deprecated, just like the deprecated AJAX
  framework that it enables. Some extensions mistakenly used this to check
  whether any AJAX functionality at all should be enabled, further making this
  problematic to retain.
* $wgDBmysql5 is now deprecated, and will be removed in a future version. It
  has been marked as experimental ever since it was introduced.

=== New features in 1.31 ===
* (T76554) User sub-pages named ….json are now protected in the same way that
  ….js and ….css pages are, so that configuration options can safely be placed
  there.
* Wikimedia\Rdbms\IDatabase->select() and similar methods now support joins
  with parentheses for grouping.
* As a first pass in standardizing dialog boxes across the MediaWiki product,
  Html class now provides helper methods for messageBox, successBox, errorBox
  and warningBox generation.
* (T9240) Imports will now record unknown (and, optionally, known) usernames in
  a format like "iw>Example".
* (T20209) Linker (used on history pages, log pages, and so on) will display
  usernames formed like "iw>Example" as interwiki links, as if by wikitext like
  [[iw:User:Example|iw>Example]].
* (T111605) The 'ImportHandleUnknownUser' hook allows extensions to auto-create
  users during an import.
* Added a hook, ParserOutputPostCacheTransform, to allow extensions to affect
  the ParserOutput::getText() post-cache transformations.
* Added a hook, UploadForm:getInitialPageText, to allow extensions to alter the
  initial page text for file uploads.
* (T181651) The info page for File pages now displays the file's base-16 SHA1
  hash value in the table of basic information.
* Style tags with a 'data-mw-deduplicate' attribute will be deduplicated as a
  ParserOutput::getText() post-cache transformation. This may be disabled by
  passing 'deduplicateStyles' => false to that method.
* The identity of the logged-in or IP "actor" for logged actions is being moved
  into a new actor table, with the rows in tables such as revision and logging
  referring to the actor ID instead of storing the user ID and name/IP in
  every row.
  * This is currently gated by $wgActorTableSchemaMigrationStage. Most wikis
    can set this to MIGRATION_NEW and run maintenance/migrateActors.php as
    soon as any necessary extensions are updated.
  * Most code accessing rows for logged actions from the database should use
    the relevant getQueryInfo() methods to get the information needed to build
    the SQL query. The ActorMigration class may also be used to get feature
    -flagged information needed to access actor-related fields during the
    migration period.
* Added Wikimedia\Rdbms\IDatabase::cancelAtomic(), to roll back an atomic
  section without having to roll back the whole transaction.
* Wikimedia\Rdbms\IDatabase::doAtomicSection(), non-native ::insertSelect(),
  and non-MySQL ::replace() and ::upsert() no longer roll back the whole
  transaction on failure.
* (T189785) Added a monthly heartbeat ping to the pingback feature.
* The CLI installer (maintenance/install.php) learned to detect and include
  extensions. Pass --with-extensions to enable that feature.
* (T184791) rc_patrolled now has three states: "0" for unpatrolled,
  "1" for manually patrolled and "2" for autopatrolled actions.
* Extensions can now set their type to "editor" if they provide an editor or
  enhance the editing experience.
* Extensions can use a PSR-4 autoloader by setting an "AutoloadNamespaces"
  property in extension.json. See the documentation at
  <https://mediawiki.org/wiki/Manual:Extension.json/Schema#AutoloadNamespaces>
  for more details and an example.
* (T19099) Tabs which link to pages that don't exist (like those to uncreated
  discussion pages) now have a tooltip to indicate state, not just colour.

=== External library changes in 1.31 ===
* pear/mail, pear/mail_mime and pear/mail_mime-decode have been moved from
  suggested to required. These packages now must be installed via composer
  and not via PEAR itself.

==== Upgraded external libraries ====
* Updated jquery.chosen from v0.9.14 to v1.8.2.
* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).
* Updated nikic/php-parser from 2.1.0 to 3.1.3 (development dependency).
* Updated wikimedia/ip-set from 1.1.0 to 1.2.0.
* Updated wikimedia/relpath from 2.0.0 to 2.1.1.
* Updated wikimedia/running-stat from 1.1.0 to 1.2.0.
* Updated wikimedia/wrappedstring from 2.2.0 to 2.3.0.
* Updated mediawiki/at-ease from 1.1.0 to 1.2.0.
* Updated wikimedia/php-session-serializer from 1.0.4 to 1.0.6.
* Updated wikimedia/remex-html from 1.0.2 to 1.0.3.
* Updated wikimedia/html-formatter from 1.0.1 to 1.0.2.

==== New external libraries ====
* Added wikimedia/object-factory 1.0.0

==== Removed and replaced external libraries ====
* (T17845) The deprecated 'jquery.badge' module was removed.
* The deprecated 'jquery.autoEllipsis' module was removed. Use the CSS
  text-overflow property instead.
* The deprecated 'jquery.placeholder' module was removed.
* The deprecated 'jquery.appear' module was removed. Use the
  'mediawiki.viewport' module instead.
* mediawiki/at-ease was replaced with wikimedia/at-ease.

=== Bug fixes in 1.31 ===
* (T90902) Non-breaking space in header ID breaks anchor.
* (T189375) CSSMin now allows quoted urls in `url()` syntax to start with a
  space.
* (T2087, T10897, T87753, T174639) Whitespace created by category and language
  links is now stripped rather than leaving blank lines in odd places.
* (T3780) Uploads with UTF-8 names now work on PHP7.1+ on Windows servers.
* (T182366) UploadBase::checkXMLEncodingMissmatch() now works on PHP 7.1+

=== Action API changes in 1.31 ===
* (T185058) The 'name' value to tgprop for action=query&list=tags has been
  removed. It has never made a difference in the output, the name was always
  returned regardless.
* The 'watch' and 'unwatch' parameters for action=move have been removed. They
  were deprecated and also accidentally nonfunctional since 1.17 in 2010. Use
  'watchlist' instead.

=== Action API internal changes in 1.31 ===
* ApiBase::getProfileDBTime, deprecated since 1.25, was removed.
* ApiBase::getModuleProfileName, deprecated since 1.25, was removed.
* ApiBase::getProfileTime, deprecated since 1.25, was removed.

=== Languages updated in 1.31 ===
MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.

* (T180052) Mirandese (mwl) now supports gendered NS_USER/NS_USER_TALK.
* (T182305) New language support: Nyungar (nys).
* (T186359) New language support: Siberian Tatar [себертатар] (sty).
* (T186635) New language support: Guianan Creole (gcr).
* (T186647) New language support: Kumyk [къумукъ] (kum).
* (T187750) New language support: Spanish formal address (es-formal).
* (T187824) New language support: Hungarian formal address (hu-formal).
* (T189127) New language support: Gorontalo (gor).

=== Breaking changes in 1.31 ===
* MessageBlobStore::insertMessageBlob(), deprecated in 1.27, was removed.
* The OutputPage class constructor now requires a context parameter.
  Instantiating without context was deprecated in 1.18.
* The mw.page JavaScript singleton, deprecated in 1.30, was removed.
* Article::getLastPurgeTimestamp(), WikiPage::getLastPurgeTimestamp(), and the
  related WikiPage::PURGE_* constants, deprecated in 1.29, were removed.
* The Article::selectFields(), ::onArticleCreate(), ::onArticleDelete(), and
  ::onArticleEdit() methods, deprecated in 1.24, were removed.
* Installer::locateExecutable() and ::locateExecutableInDefaultPaths() were
  removed. Use ExecutableFinder::findInDefaultPaths() instead.
* The deprecated MW_DIFF_VERSION constant was removed.
  DifferenceEngine::MW_DIFF_VERSION should be used instead.
* Due to significant refactoring, method ContribsPager::getUserCond() that had
  no access restriction has been removed.
* The Block class will no longer accept usable-but-missing usernames for
  'byText' or ->setBlocker(). Callers should either ensure the blocker exists
  locally or use a new interwiki-format username like "iw>Example".
* The following methods and constants from the WatchedItem class, which were
  deprecated in 1.27, have been removed:
  * WatchedItem::getTitle()
  * WatchedItem::fromUserTitle()
  * WatchedItem::addWatch()
  * WatchedItem::removeWatch()
  * WatchedItem::isWatched()
  * WatchedItem::duplicateEntries()
  * WatchedItem::IGNORE_USER_RIGHTS
  * WatchedItem::CHECK_USER_RIGHTS
  * WatchedItem::DEPRECATED_USAGE_TIMESTAMP
* The $statementsOnOwnLine parameter of JavaScriptMinifier::minify was removed.
  $wgResourceLoaderMinifierStatementsOnOwnLine, the corresponding configuration
  variable, has been deprecated since 1.27 and was removed as well.
* The $maxLineLength parameter of JavaScriptMinifier::minify was removed.
  $wgResourceLoaderMinifierMaxLineLength, the corresponding configuration
  variable, has been deprecated since 1.27 and was removed as well.
* The HtmlFormatter class, deprecated in 1.27, was removed. The namespaced
  HtmlFormatter\HtmlFormatter class should be used instead.
* The driver 'mysql' for MySQL, deprecated in MediaWiki 1.30, has been removed.
  The driver has been deprecated since PHP 5.5 and was removed in PHP 7.0. The
  default driver for MySQL has been 'mysqli' since MediaWiki 1.22.
* The following properties of PreparedEdit were deprecated in 1.21 and have
  been removed:
  * PreparedEdit->newText
  * PreparedEdit->oldText
  * PreparedEdit->pst
* ParserOutput objects which are generated using a non-default value for
  ParserOptions::setWrapOutputClass() can no longer be added to the parser
  cache.
* The following deprecated methods from the OutputPage class have been removed:
  * OutputPage::addExtensionStyle(); deprecated in 1.27
  * OutputPage::getExtStyle(); deprecated in 1.27
  * OutputPage::setETag(); deprecated in 1.28 (obsolete no-op)
  * OutputPage::setSquidMaxage(); deprecated in 1.27
  * OutputPage::readOnlyPage(); deprecated in 1.25
  * OutputPage::rateLimited(); deprecated in 1.25
  * Additionally, the protected OutputPage::$mExtStyles array, only accessed
    through the above and with no known uses, was removed.
* The no-op method Skin::showIPinHeader(), deprecated in 1.27, was removed.
* The following variables and methods in EditPage, deprecated in MediaWiki 1.30,
  were removed:
  * $isCssJsSubpage — use ::isUserConfigPage()
  * $isCssSubpage — use ::isUserCssConfigPage()
  * $isJsSubpage — use ::isUserJsConfigPage()
  * $isWrongCaseCssJsPage – use ::isWrongCaseUserConfigPage()
  * ::getSummaryInput() – use ::getSummaryInputWidget()
  * ::getSummaryInputOOUI() – use ::getSummaryInputWidget()
  * ::getCheckboxes() – use ::getCheckboxesWidget() or
      ::getCheckboxesDefinition()
  * ::getCheckboxesOOUI() – use ::getCheckboxesWidget() or
      ::getCheckboxesDefinition()
* ResourceLoaderModule::getPosition(), deprecated in 1.29, has been removed.
* In User, the cookie-related methods which were wrappers for the functions on
  the response object, and were deprecated in 1.27, have been removed:
  * ::setCookie()
  * ::clearCookie()
  * ::setExtendedLoginCookie()
  Note that User::setCookies() remains, and is not deprecated.
* Also in User, some auth-related methods which were deprecated in 1.27 have
  been removed:
  * ::getEditTokenTimestamp() – use MediaWiki\Session\Token::getTimestamp()
  * ::getPasswordFactory() – create a PasswordFactory directly
  * ::passwordChangeInputAttribs()
* The global functions wfProfileIn and wfProfileOut, deprecated in 1.25, have
  been removed.
* SpecialPageFactory::getList(), deprecated in 1.24, has been removed. You can
  use ::getNames() instead.
* OpenSearch::getOpenSearchTemplate(), deprecated in 1.25, has been removed. You
  can use ApiOpenSearch::getOpenSearchTemplate() instead.
* The global function wfBaseConvert, deprecated in 1.27, has been removed. Use
  Wikimedia\base_convert() directly.
* Calling Database::begin() explicitly during an implicit transaction or when
  DBO_TRX is set results in an exception. Calling Database::commit() explicitly
  for an implicit transaction also results in an exception. Previously these
  were logged as errors. The startAtomic() and endAtomic() methods, or
  AtomicSectionUpdate should be used instead.
* The global function wfOutputHandler() was removed, use the its replacement
  MediaWiki\OutputHandler::handle() instead. The global function was only
  sometimes defined. Its replacement is always available via the autoloader.
* ChangeTags::listExtensionActivatedTags and ::listExtensionDefinedTags,
  deprecated in 1.28, have been removed. Use ::listSoftwareActivatedTags() and
  ::listSoftwareDefinedTags() instead.
* Title::getTitleInvalidRegex(), deprecated in 1.25, has been removed. You can
  use MediaWikiTitleCodec::getTitleInvalidRegex() instead.
* HTMLForm & VFormHTMLForm::isVForm(), deprecated in 1.25, have been removed.
* The ProfileSection class, deprecated in 1.25 and unused, has been removed.
* The ResourceLoaderGetLessVars hook, deprecated in 1.30, has been removed. Use
  ResourceLoaderModule::getLessVars() to expose local variables instead of
  global ones.
* As part of work to modernise user-generated content clean-up, a config option
  and some methods related to HTML validity were removed without deprecation.
  The public methods MWTidy::checkErrors() and the path through which it was
  called, TidyDriverBase::validate(), are removed, as are the testing methods
  MediaWikiTestCase::assertValidHtmlSnippet() and ::assertValidHtmlDocument().
  The $wgValidateAllHtml configuration option is removed and will be ignored.
* Execution of external programs using MediaWiki\Shell\Command now applies
  the RESTRICT_DEFAULT Firejail restriction by default.
* The ResourceLoaderModule::getHashMtime() and ::getDefinitionMtime() methods,
  deprecated in 1.26, were removed.
* The deprecated 'mediawiki.widgets.CategorySelector' module alias was removed.
  Use the 'mediawiki.widgets.CategoryMultiselectWidget' module directly.

=== Deprecations in 1.31 ===
* The Revision class was deprecated in favor of RevisionStore, BlobStore, and
  RevisionRecord and its subclasses.
* The global function wfBCP47 is deprecated in favour of LanguageCode::bcp47.
* The global function wfCountDown is now deprecated in favor of
  Maintenance::countDown.
* Several methods for returning lists of fields to select from the database
  have been deprecated in favor of similar methods that also return the tables
  to select from and the join conditions for those tables.
  * Block::selectFields() → Block::getQueryInfo()
  * RecentChange::selectFields() → RecentChange::getQueryInfo()
  * ArchivedFile::selectFields() → ArchivedFile::getQueryInfo()
  * LocalFile::selectFields() → LocalFile::getQueryInfo()
  * LocalFile::getCacheFields() with a prefix no longer works
  * LocalFile::getLazyCacheFields() with a prefix no longer works
  * OldLocalFile::selectFields() → OldLocalFile::getQueryInfo()
  * RecentChange::selectFields() → RecentChange::getQueryInfo()
  * Revision::userJoinCond() → Revision::getQueryInfo( [ 'user' ] )
  * Revision::selectUserFields() → Revision::getQueryInfo( [ 'user' ] )
  * Revision::pageJoinCond() → Revision::getQueryInfo( [ 'page' ] )
  * Revision::selectPageFields() → Revision::getQueryInfo( [ 'page' ] )
  * Revision::selectTextFields() → Revision::getQueryInfo( [ 'text' ] )
  * Revision::selectFields() → Revision::getQueryInfo()
  * Revision::selectArchiveFields() → Revision::getArchiveQueryInfo()
  * User::selectFields() → User::getQueryInfo()
  * WikiPage::selectFields() → WikiPage::getQueryInfo()
* Revision::setUserIdAndName() was deprecated.
* Access to TitleValue class properties was deprecated, the relevant getters
  should be used instead.
* DifferenceEngine::getDiffBodyCacheKey() is deprecated. Subclasses should
  override DifferenceEngine::getDiffBodyCacheKeyParams() instead.
* Use of Maintenance::error( $err, $die ) to exit script was deprecated. Use
  Maintenance::fatalError() instead.
* Passing a ParserOptions object to OutputPage::parserOptions() is deprecated.
* The RevisionInsertComplete hook is now deprecated; use instead the hook
  RevisionRecordInserted. RevisionInsertComplete is still called, but the second
  and third parameter will always be null. Hard deprecation is scheduled for
  1.32.
* The following methods that get and set ParserOutput state are deprecated.
  Callers should use the new stateless $options parameter to
  ParserOutput::getText() instead.
  * ParserOptions::getEditSection()
  * ParserOptions::setEditSection()
  * ParserOutput::getEditSectionTokens()
  * ParserOutput::setEditSectionTokens()
  * ParserOutput::getTOCEnabled()
  * ParserOutput::setTOCEnabled()
  * OutputPage::enableSectionEditLinks()
  * OutputPage::sectionEditLinksEnabled()
  * The public ParserOutput state fields $mTOCEnabled and $mEditSectionTokens
    are also deprecated.
* License::getLicenses has been deprecated; use License::getLines instead.
* QuickTemplate::setRef() was deprecated in favour of QuickTemplate::set().
  Setting template variables by reference allowed violating the principle of
  data being immutable once added to the skin template. In practice, this method
  was not being used for that. Rather, setRef() existed as memory optimisation
  for PHP 4.
* QuickTemplate::setTranslator() and MediaWikiI18N::set() were deprecated in
  favour of Skin::msg() parameters.
* MediaWikiI18N::translate() was deprecated in favour of Skin::msg() or
  wfMessage().
* Passing false to ParserOptions::setWrapOutputClass() is deprecated. Use the
  'unwrap' transform to ParserOutput::getText() instead.
* \ObjectFactory (no namespace) is deprecated, the namespaced class
  \Wikimedia\ObjectFactory from the wikimedia/object-factory library should be
  used instead.
* CommentStore::newKey is deprecated. Instead, get an instance from
  MediaWikiServices.
* The following CommentStore methods have had their signatures changed to
  introduce a $key parameter, usage of the methods on instances retrieved from
  CommentStore::newKey will remain unchanged but deprecated:
  * CommentStore::getFields
  * CommentStore::getJoin
  * CommentStore::getComment
  * CommentStore::getCommentLegacy
  * CommentStore::insert
  * CommentStore::insertWithTemplate
* The following methods in Title have been renamed, and the old ones are
  deprecated:
  * Title::getSkinFromCssJsSubpage – use ::getSkinFromConfigSubpage
  * Title::isCssOrJsPage – use ::isSiteConfigPage
  * Title::isCssJsSubpage – use ::isUserConfigPage
  * Title::isCssSubpage – use ::isUserCssConfigPage
  * Title::isJsSubpage – use ::isUserJsConfigPage
* The following methods related to caching of half-parsed HTML were deprecated:
  * Parser::serializeHalfParsedText()
  * Parser::unserializeHalfParsedText()
  * Parser::isValidHalfParsedText()
  * StripState::getSubState()
  * StripState::merge()
* The DeferredStringifier class is deprecated, use Message::listParam() instead.
* The type string for the parameter $lang of DateFormatter::getInstance is
  deprecated.
* Wikimedia\Rdbms\SavepointPostgres is deprecated.
* The DO_MAINTENANCE constant is deprecated. RUN_MAINTENANCE_IF_MAIN should be
  used instead.
* The function wfShellWikiCmd() has been deprecated, use
  MediaWiki\Shell::makeScriptCommand().
* In the future, the hooks 'PreferencesFormPreSave' and 'PreferencesGetLegend'
  will be allowed to provide any HTMLForm object rather than PreferencesForm.

=== Other changes in 1.31 ===
* Browser support for Internet Explorer 10 was lowered from Grade A to Grade C.
* Browser support for Opera 12 and older was dropped entirely. Opera 15+
  continues at Grade A.
* Multi-content-revision capability was introduced into the storage layer. See
  <https://mediawiki.org/wiki/Requests_for_comment/Multi-Content_Revisions>.
* The "free" CSS class is now only applied to unbracketed URLs in wikitext.
  Links written using square brackets will get the class "text" not "free".
* RFC 157418: Whitespace is trimmed from wikitext headings, wikitext list items,
  wikitext table captions, wikitext table headings, wikitext table cells. HTML
  headings, HTML list items, HTML table captions, HTML table headings, HTML
  table cells will not have this trimming behavior.

== Compatibility ==
MediaWiki 1.31 requires PHP 7.0.0 or later. Although HHVM 3.18.5 or later is
supported, it is generally advised to use PHP 7.0.0 or later for long term
support.

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
but support for them is somewhat less mature. There is experimental support for
Oracle and Microsoft SQL Server.

The supported versions are:

* MySQL 5.5.8 or later
* PostgreSQL 9.2 or later
* SQLite 3.3.7 or later
* Oracle 9.0.1 or later
* Microsoft SQL Server 2005 (9.00.1399)

== Upgrading ==
1.31 has several database changes since 1.30, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed upgrade instructions, including
important information when upgrading from versions prior to 1.11.

For notes on 1.30.x and older releases, see HISTORY.

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.freenode.net.


= MediaWiki 1.30 =

== MediaWiki 1.30.2 ==

This is a security and maintenance release of the MediaWiki 1.30 branch.

=== Changes since MediaWiki 1.30.1 ===
* (T204729) WatchedItemStore::countVisitingWatchersMultiple() shouldn't query
  all titles when asked for none.
* (T109121) Remove deprecated pear/mail_mime-decode from composer suggested
  libraries.
* (T207540) Include IP address in "Login for $1 succeeded" log entry.
* (T205765) Don't link to the obsolete "Extension Matrix" page in installer.
* (T207603) SECURITY: User JS may no longer be loaded with mime type
  text/javascript if there is no account associated with the username.
* (T113042) SECURITY: Do not allow loading pages raw with a text/javascript MIME
  type if non-admins can edit the page.
* (T207541) Pass email address to mail().
* Fix addition of ug_expiry column to user_groups table on MSSQL.
* (T204531) rdbms: reduce LoadBalancer replication log spam.
* (T213489) Avoid session double-start in Setup.php.
* (T195525) Fix db error outage page.
* (T208871) The hard-coded Google search form on the database error page was
  removed.
* (T216968) Return pageid as int in both list=iwbacklinks and
  list=langbacklinks.
* (T218608) SECURITY: Fix an issue that prevents Extension:OAuth working when
  $wgBlockDisablesLogin is true.
* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
  token.
* (T222385) resourceloader: Use AND instead of OR for upsert conds in
  saveFileDependencies().
* (T224374) Fix message parameters so that the message that says SQLite is out
  of date makes sense.
* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
  reauthenticating.
* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
  getLoginSecurityLevel() returns non-false.
* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
* (T208881) SECURITY: blacklist CSS var().
* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
* (T222036, T222038) SECURITY: Add permission check for user is permitted to
  view the log type.
* (T221739) SECURITY: resources: Patch jQuery 1.11.3 for CVE-2019-11358.

== MediaWiki 1.30.1 ==

This is a security and maintenance release of the MediaWiki 1.30 branch.

=== Changes since MediaWiki 1.30.0 ===
* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
  'newbie'.
* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
  account lock.
* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative
  array.
* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).
* (T189567) the CLI installer (maintenance/install.php) learned to detect and
  include extensions. Pass --with-extensions to enable that feature.
* (T190503) Let built-in web server (maintenance/dev) handle .php requests.
* (T167507) selenium: Run Chrome headlessly.
* selenium: Pass -no-sandbox to Chrome under Docker.
* (T179190) selenium: Move logic for running tests from package.json to
  selenium.sh
* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().
* Add default edit rate limit of 90 edits/minute for all users.
* (T186565) Fix PHP Notice from `ob_end_flush()` in `FileRepo::streamFile()`.
* oojs/oojs-ui updated to remove an unnecessary dependancy.
* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
* (T118683) Fix exception from &$user deref on HHVM in the TitleMoveComplete
  hook.
* (T196672) The mtime of extension.json files is now able to be zero
* (T180403) Validate $length in padleft/padright parser functions.
* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
* (T193995) Fix undefined patchPath() method call in parser tests.
* Special:BotPasswords now requires reauthentication.
* (T191608, T187638) Add 'logid' parameter to Special:Log.
* (T193829) Indicate when a Bot Password needs reset.
* (T151415) Log email changes.
* (T200861) Fix total breakage of SQLite web upgrade.
* (T202550) Unbreak SpecialListusersHeaderForm and SpecialListusersHeader
  hooks.
* (T190539) Explicitly require Postgres 9.1.
* (T118420) Unbreak Oracle installer.

== MediaWiki 1.30.0 ==

=== Changes since MediaWiki 1.30.0-rc.0 ===
* Upgraded Moment.js from v2.15.0 to v2.19.3.
* Add ip_changes to postgres/tables.sql.
* Skip null shell parameters.
* Add wfWaitForSlaves() to maintenance/migrateComments.php.
* (T182245) Fix join conditions in ImageListPager.
* (T178626) Revert #contentSub and #jump-to-nav margin changes.

=== MySQL version requirement in 1.30 ===
As of 1.30, MediaWiki now requires MySQL 5.5.8 or higher (see Compatibility
section).

=== Configuration changes in 1.30 ===
* The "C.UTF-8" locale should be used for $wgShellLocale, if available, to avoid
  unexpected behavior when code uses locale-sensitive string comparisons. For
  example, the Scribunto extension considers "bar" < "Foo" in most locales
  since it ignores case.
* $wgShellLocale now affects LC_ALL rather than only LC_CTYPE. See
  documentation of $wgShellLocale for details.
* $wgShellLocale is now applied for all requests. wfInitShellLocale() is
  deprecated and a no-op, as it is no longer needed.
* $wgJobClasses may now specify callback functions as an alternative to plain
  class names. This is intended for extensions that want control over the
  instantiation of their jobs, to allow for proper dependency injection.
* $wgResourceModules may now specify callback functions as an alternative
  to plain class names, using the 'factory' key in the module description
  array. This allows dependency injection to be used for ResourceLoader modules.
* $wgExceptionHooks has been removed.
* (T163562) $wgRangeContributionsCIDRLimit was introduced to control the size
  of IP ranges that can be queried at Special:Contributions.
* (T45547) $wgUsePigLatinVariant added (off by default).
* (T152540) MediaWiki now supports a section ID escaping style that allows to
  display non-Latin characters verbatim on many modern browsers. This is
  controlled by the new configuration setting, $wgFragmentMode.
* $wgExperimentalHtmlIds is now deprecated and will be removed in a future
  version, use $wgFragmentMode to migrate off it to a modern alternative.
* $wgExternalInterwikiFragmentMode was introduced to control how fragments in
  sinterwikis going outside of current wiki farm are encoded.
* (T120333) Soft-deprecated the use of PHP extension 'mysql' in favor of
  'mysqli'. This PHP extension was deprecated in PHP 5.5 and removed in PHP 7.0.
  MediaWiki auto-selects the 'mysqli' driver since MediaWiki 1.22, except if
  explicitly requested through the configuration parameter $wgDBservers.
* $wgOOUIEditPage was removed, as it is now the default. This was documented as
  a temporary variable during the migration period.

=== New features in 1.30 ===
* (T37247) Output from Parser::parse() will now be wrapped in a div with
  class="mw-parser-output" by default. This may be changed or disabled using
  ParserOptions::setWrapOutputClass().
* (T163562) Added ability to search for contributions within an IP ranges
  at Special:Contributions.
* Added 'ChangeTagsAllowedAdd' hook, enabling extensions to allow software-
  specific tags to be added by users.
* Added a 'ParserOptionsRegister' hook to allow extensions to register
  additional parser options.
* (T45547) Included Pig Latin, a language game in English, as a
  LanguageConverter variant.  This allows English-speaking developers
  to develop and test LanguageConverter more easily.  Pig Latin can be
  enabled by setting $wgUsePigLatinVariant to true.
* Added RecentChangesPurgeRows hook to allow extensions to purge data that
  depends on the recentchanges table.
* Added JS config values wgDiffOldId/wgDiffNewId to the output of diff pages.
* (T2424) Added direct unwatch links to entries in Special:Watchlist (if the
  'watchlistunwatchlinks' preference option is enabled). With JavaScript
  enabled, these links toggle so the user can also re-watch pages that have
  just been unwatched.
* Added $wgParserTestMediaHandlers, where mock media handlers can be passed to
  MediaHandlerFactory for parser tests.
* Edit summaries, block reasons, and other "comments" are now stored in a
  separate database table. Use the CommentFormatter class to access them.
** This is currently gated by $wgCommentTableSchemaMigrationStage. Most wikis
   can set this to MIGRATION_NEW and run maintenance/migrateComments.php as
   soon as any necessary extensions are updated.
* (T138166) Added ability for users to prohibit other users from sending them
  emails with Special:Emailuser. Can be enabled by setting
  $wgEnableUserEmailBlacklist to true.
* (T67297) $wgBrowserBlacklist is deprecated, and changing it will have no
  effect. Instead, users using browsers that do not support Unicode will be
  unable to edit and should upgrade to a modern browser instead.

=== External library changes in 1.30 ===

==== Upgraded external libraries ====
* Updated justinrainbow/json-schema from v3.0 to v5.2.
* Updated mediawiki/mediawiki-codesniffer from v0.7.2 to v0.12.0.
* Updated wikimedia/composer-merge-plugin from v1.4.0 to v1.4.1.
* Updated wikimedia/relpath from v1.0.3 to v2.0.0.
* Updated OOjs from v2.0.0 to v2.1.0.
* Updated OOUI from v0.21.1 to v0.23.0.
* Updated QUnit from v1.23.1 to v2.4.0.
* Updated phpunit/phpunit from v4.8.35 to v4.8.36.
* Upgraded Moment.js from v2.15.0 to v2.19.3.

==== New external libraries ====
* The class \TestingAccessWrapper has been moved to the external library
  wikimedia/testing-access-wrapper and renamed \Wikimedia\TestingAccessWrapper.
* Purtle, a fast, lightweight RDF generator.

=== Bug fixes in 1.30 ===
* (T151633) Ordered list items use now Devanagari digits in Nepalese
  (thanks to Sfic)

=== Action API changes in 1.30 ===
* (T37247) action=parse output will be wrapped in a div with
  class="mw-parser-output" by default. This may be changed or disabled using
  the new 'wrapoutputclass' parameter.
* When errorformat is not 'bc', abort reasons from action=login will be
  formatted as specified by the error formatter parameters.
* action=compare can now handle arbitrary text, deleted revisions, and
  returning users and edit comments.
* (T164106) The 'rvdifftotext', 'rvdifftotextpst', 'rvdiffto',
  'rvexpandtemplates', 'rvgeneratexml', 'rvparse', and 'rvprop=parsetree'
  parameters to prop=revisions are deprecated, as are the similarly named
  parameters to prop=deletedrevisions, list=allrevisions, and
  list=alldeletedrevisions. Use action=compare, action=parse, or
  action=expandtemplates instead.

=== Action API internal changes in 1.30 ===
* ApiBase::getDescriptionMessage() and the "apihelp-*-description" messages are
  deprecated. The existing message should be split between "apihelp-*-summary"
  and "apihelp-*-extended-description".
* (T123931) Individual values of multi-valued parameters can now be marked as
  deprecated.

=== Languages updated in 1.30 ===
MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.

* Added: kbp (Kabɩyɛ / Kabiyè)
* Added: skr (Saraiki, سرائیکی)
* Added: tay (Tayal / Atayal)
* Removed: tokipona (Toki Pona)

==== Pig Latin added ====
* (T45547) Added Pig Latin, a made-up English variant (en-x-piglatin),
  for easier variant development and testing. Disabled by default. It can be
  enabled by setting $wgUsePigLatinVariant to true.

=== Other changes in 1.30 ===
* The use of an associative array for $wgProxyList, where the IP address is in
  the key instead of the value, is deprecated (e.g. [ '127.0.0.1' => 'value' ]).
  Please convert these arrays to indexed/sequential ones (e.g. [ '127.0.0.1' ]).
* mw.user.bucket (deprecated in 1.23) was removed.
* LoadBalancer::getServerInfo() and LoadBalancer::setServerInfo() are
  deprecated. There are no known callers.
* File::getStreamHeaders() was deprecated.
* MediaHandler::getStreamHeaders() was deprecated.
* Title::canTalk() was deprecated. The new Title::canHaveTalkPage() should be
  used instead.
* MWNamespace::canTalk() was deprecated. The new MWNamespace::hasTalkNamespace()
  should be used instead.
* The ExtractThumbParameters hook (deprecated in 1.21) was removed.
* The OutputPage::addParserOutputNoText and ::getHeadLinks methods (both
  deprecated in 1.24) were removed.
* wfMemcKey() and wfGlobalCacheKey() were deprecated. BagOStuff::makeKey() and
  BagOStuff::makeGlobalKey() should be used instead.
* (T146304) Preprocessor handling of LanguageConverter markup has been improved.
  As a result of the new uniform handling, '-{' may need to be escaped
  (for example, as '-<nowiki/>{') where it occurs inside template arguments
  or wikilinks.
* (T163966) Page moves are now counted as edits for the purposes of
  autopromotion, i.e., they increment the user_editcount field in the database.
* Two new hooks, LogEventsListLineEnding and NewPagesLineEnding, were added for
  manipulating Special:Log and Special:NewPages lines.
* The OldChangesListRecentChangesLine, EnhancedChangesListModifyLineData,
  PageHistoryLineEnding, ContributionsLineEnding and
  DeletedContributionsLineEnding hooks have an additional parameter, for
  manipulating HTML data attributes of RC/history lines.
  EnhancedChangesListModifyBlockLineData can do that via the
  $data['attribs'] subarray.
* (T130632) The OutputPage::enableTOC() method was removed.
* WikiPage::getParserOutput() will now throw an exception if passed
  ParserOptions that would pollute the parser cache. Callers should use
  WikiPage::makeParserOptions() to create the ParserOptions object and only
  change options that affect the parser cache key.
* Article::viewRedirect() is deprecated.
* IP::isValidBlock() was deprecated. Use the equivalent IP::isValidRange().
* DeprecatedGlobal no longer supports passing in a direct value, it requires a
  callable factory function or a class name.
* The $parserMemc global, wfGetParserCacheStorage(), and
  ParserCache::singleton() are all deprecated. The main ParserCache instance
  should be obtained from MediaWikiServices instead. Access to the underlying
  BagOStuff is possible through the new ParserCache::getCacheStorage() method.
* .mw-ui-constructive CSS class (deprecated in 1.27) was removed.
* Sanitizer::escapeId() was deprecated, use escapeIdForAttribute(),
  escapeIdForLink() or escapeIdForExternalInterwiki() instead.
* Title::escapeFragmentForURL() was deprecated, use one of the aforementioned
  Sanitizer functions or, if possible, Title::getFragmentForURL().
* Second parameter to Sanitizer::escapeIdReferenceList() ($options) now does
  nothing and is deprecated.
* mw.util.escapeId() was deprecated, use escapeIdForAttribute() or
  escapeIdForLink().
* MagicWord::replaceMultiple() (deprecated in 1.25) was removed.
* WikiImporter now requires the second parameter to be an instance of the
  Config, class. Prior to that, the Config parameter was optional (a behavior
  deprecated in 1.25).
* Removed 'jquery.mwExtension' module. (deprecated since 1.26)
* mediawiki.ui: Deprecate greys, which are not part of WikimediaUI color palette
  any more.
* CdbReader, CdbWriter, CdbException classes (deprecated in 1.25) were removed.
  The namespaced classes in the Cdb namespace should be used instead.
* IPSet class (deprecated in 1.26) was removed. The namespaced IPSet\IPSet
  should be used instead.
* RunningStat class (deprecated in 1.27) was removed. The namespaced
  RunningStat\RunningStat should be used instead.
* MWMemcached and MemCachedClientforWiki classes (deprecated in 1.27) were
  removed.
  The MemcachedClient class should be used instead.
* EditPage underwent some refactoring and deprecations:
  * EditPage::isOouiEnabled() is deprecated and will always return true.
  * EditPage::getSummaryInput() and ::getSummaryInputOOUI() are deprecated.
    Please use ::getSummaryInputWidget() instead.
  * EditPage::getCheckboxes() and ::getCheckboxesOOUI() are deprecated. Please
    use ::getCheckboxesWidget() instead.
  * Creating an EditPage instance without calling EditPage::setContextTitle()
    should be avoided and will be deprecated in a future release.
  * EditPage::safeUnicodeInput() and ::safeUnicodeOutput() are deprecated and
    no-ops.
  * EditPage::$isCssJsSubpage, ::$isCssSubpage, and ::$isJsSubpage are
    deprecated. The corresponding methods from Title should be used instead.
  * EditPage::$isWrongCaseCssJsPage is deprecated. There is no replacement.
  * EditPage::$mArticle and ::$mTitle are deprecated for public usage. The
    getters ::getArticle() and ::getTitle() should be used instead.
  * Trying to control or fake EditPage context by overriding $wgUser,
    $wgRequest, $wgOut, and $wgLang is no longer supported and won't work. The
    IContextSource returned from EditPage::getContext() must be modified
    instead.
* Parser::getRandomString() (deprecated in 1.26) was removed.
* Parser::uniqPrefix() (deprecated in 1.26) was removed.
* Parser::extractTagsAndParams() now only accepts three arguments. The fourth,
  $uniq_prefix was deprecated in 1.26 and has now been removed.
* (T172514) The following tables have had their UNIQUE indexes turned into
  proper PRIMARY KEYs for increased maintainability: categorylinks, imagelinks,
  iwlinks, langlinks, log_search, module_deps, objectcache, pagelinks,
  query_cache, site_stats, templatelinks, text, transcache, user_former_groups,
  user_properties.
* IDatabase::nextSequenceValue() is no longer needed by any database backends
  (formerly it was needed by PostgreSQL and Oracle), and is now deprecated.
* (T146591) The lc_lang_key index on the l10n_cache table has been changed into
  a PRIMARY KEY.
* (T157227) bot_password.bp_user, change_tag.ct_log_id, change_tag.ct_rev_id,
  page_restrictions.pr_user, tag_summary.ts_log_id, tag_summary.ts_rev_id and
  user_properties.up_user have all been made unsigned on MySQL.
* DB_SLAVE is deprecated. DB_REPLICA should be used instead.
* wfUsePHP() is deprecated.
* wfFixSessionID() was removed.
* wfShellExec() and related functions are deprecated, use Shell::command(). This
  also slightly changes the behavior of how execution time limits are calculated
  when only some of defaults are overridden per-call. When in doubt, always
  override both wall clock and CPU time.
* (T138166) SpecialEmailUser::getTarget() now requires a second argument, the
  sending user object. Using the method without the second argument is
  deprecated.
* (T67297) Browsers that don't support Unicode will have their edits rejected.
* (T178450) The module 'jquery.badge' is deprecated and will be removed in a
  future release. For notifying the user of an event, the Notifications ("Echo")
  system should be used instead.
* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
  browser sends non-standard url escaping.
* (T165846) SECURITY: BotPassword login attempts weren't throttled.

= MediaWiki 1.29 =

== MediaWiki 1.29.3 ==

This is a security and maintenance release of the MediaWiki 1.29 branch.

=== Changes since 1.29.2 ===
* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
  'newbie'.
* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
  account lock.
* (T180551) Fix LanguageSrTest for language converter
* (T180552) Fix language converter parser test with self-close tags
* (T180537) Remove $wgAuth usage from wrapOldPasswords.php
* (T180485) InputBox: Have inputbox langconvert certain attributes
* (T161732, T181547) Upgraded Moment.js from v2.15.0 to v2.19.3.
* (T172927) Drop vendor from MW release branch
* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative array
* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).
* (T189567) the CLI installer (maintenance/install.php) learned to detect and
  include extensions. Pass --with-extensions to enable that feature.
* (T182381) Mask deprecated call in WatchedItemUnitTest
* (T190503) Let built-in web server (maintenance/dev) handle .php requests.
* The karma qunit tests would fail on some configuration due to headers already
  sent. Check headers_sent() before sending cpPosTime headers
* (T167507) selenium: Run Chrome headlessly.
* selenium: Pass -no-sandbox to Chrome under Docker
* (T191247) Use MediaWiki\SuppressWarnings around trigger_error('') instead @
* (T75174, T161041) Unit test ChangesListSpecialPageTest::testFilterUserExpLevel
  fails under SQLite.
* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().
* (T179190) selenium: Move test running logic from package.json to selenium.sh.
* (T117839, T193200) PDFHandler: Fix for pdfinfo changes in poppler-utils 0.48.
* Add default edit rate limit of 90 edits/minute for all users.
* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
* (T196672) The mtime of extension.json files is now able to be zero
* (T180403) Validate $length in padleft/padright parser functions.
* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
* (T194237) Special:BotPasswords now requires reauthentication.
* (T191608, T187638) Add 'logid' parameter to Special:Log.
* (T176097) resourceloader: Disable a flaky MessageBlobStoreTest case
* (T193829) Indicate when a Bot Password needs reset.
* (T151415) Log email changes.
* (T118420) Unbreak Oracle installer.

== MediaWiki 1.29.2 ==

This is a security and maintenance release of the MediaWiki 1.29 branch.

=== Changes since 1.29.1 ===
* (T166757) Avoid scoped lock errors in Category::refreshCounts() due to
  nesting.
* (T175439) Unbreak Postgres Updater when setting defaults for a column.
* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
* Fixed login button label to accept RawMessage.
* Fixed case of SpecialRecentChanges class usage.
* (T174255) Declare uploadCount property in importDump.php.
* (T163646) Pass a string not an int to mysql_real_escape_string().
* (T180143) Bump justinrainbow/json-schema development dependency to ~5.2.
* Updated dev dependancy phpunit/phpunit from v4.8.35 to v4.8.36.
* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
  browser sends non-standard url escaping.
* (T165846) SECURITY: BotPassword login attempts weren't throttled.
* (T128209) SECURITY: Reflected File Download from api.php.
* (T134100) SECURITY: Do not reveal if user exists during login failure.
* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
* (T125163) SECURITY: Make anchor for headlines escape > and <.
* (T180237) SECURITY: Protect vendor folder with .htaccess.
* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in
  update.php.
* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
* (T119158) SECURITY: Handle -{}- syntax in attributes safely.
* (T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly
  fixed in all branches in the previous security release.

== MediaWiki 1.29.1 ==

This is a maintenance release of the MediaWiki 1.29 branch.

The SpamBlacklist and PdfHandler extensions were missing from the generated
packages.

=== Changes since 1.29.1 ===
* (T164999) Define mw.Upload.Dialog.static.name in mediawiki.Upload.Dialog.js.
* (T172061) Fix fatal when passing a category to refreshLinks.php.

== MediaWiki 1.29.0 ==

=== Configuration changes in 1.29 ===
* Default cookie expiration time has been reduced to 30 days. Login cookie
  expiration time is kept at 180 days.
* A new configuration variable has been added: $wgCookieSetOnAutoblock. This
  determines whether to set a cookie when a user is autoblocked. Doing so means
  that a blocked user, even after logging out and moving to a new IP address,
  will still be blocked.
* The resetpassword right and associated password reset capture feature has
  been removed.
* The $error parameter to the EmailUser hook should be set to a Status object
  or boolean false. This should be compatible with at least MediaWiki 1.23 if
  not earlier. Returning a raw HTML string is now deprecated.
* The $message parameter to the ApiCheckCanExecute hook should be set to an
  ApiMessage. This is compatible with MediaWiki 1.27 and later. Returning a
  code for ApiBase::parseMsg() will no longer work.
* ApiBase::$messageMap is no longer public. Code attempting to access it will
  result in a PHP fatal error.
* $wgUserEmailUseReplyTo is now true by default to work around restrictive DMARC
  policies.
* Subpages are now enabled by default in the Template namespace. Set
  $wgNamespacesWithSubpages[NS_TEMPLATE] to false to keep the old behavior.
* $wgRunJobsAsync is now false by default (T142751). This change only affects
  wikis with $wgJobRunRate > 0.
* (T158474) "Unknown user" has been added to $wgReservedUsernames.
* (T156983) $wgRateLimitsExcludedIPs now accepts CIDR ranges as well as single
  IPs.
* $wgDummyLanguageCodes is deprecated. Additional language code mappings may be
  added to $wgExtraLanguageCodes instead.
* (T161453) LocalisationCache will no longer use the temporary directory in it's
  fallback chain when trying to work out where to write the cache.
* The user right 'editusercssjs' (deprecated in 1.16) was removed. Use
  'editusercss' and 'edituserjs' in $wgGroupPermissions and elsewhere instead.

=== New features in 1.29 ===
* (T5233) A cookie can now be set when a user is autoblocked, to track that user
  if they move to a new IP address. This is disabled by default.
* Added ILocalizedException interface to standardize the use of localized
  exceptions, largely so the API can handle them more sensibly.
* Blocks created automatically by MediaWiki, such as for configured proxies or
  dnsbls, are now indicated as such and use a new i18n message when displayed.
* Added new $wgHTTPImportTimeout setting. Sets timeout for
  downloading the XML dump during a transwiki import in seconds.
* Parser limit report is now available in machine-readable format to JavaScript
  via mw.config.get('wgPageParseReport').
* Added $wgSoftBlockRanges, to allow for automatically blocking anonymous edits
  from certain IP ranges (e.g. private IPs).
* (T59603) Added new magic word {{PAGELANGUAGE}} which returns the language code
  of the page being parsed.
* HTML5 form validation attributes will no longer be suppressed. Originally
  browsers had poor support for them, but modern browsers handle them fine.
  This might affect some forms that used them and only worked because the
  attributes were not actually being set.
* Expiry times can now be specified when users are added to user groups.
* Completely new user interface for the RecentChanges page, which
  structures filters into user-friendly groups.  This has corresponding
  changes to how filters are registered by core and extensions.
* The edit form now uses pretty OOjs UI buttons, checkboxes and summary input.
  Because this change can cause problems for extensions and on-wiki
  scripts depending on the exact HTML, the old version is still available
  and can be used by setting $wgOOUIEditPage = false; in LocalSettings.php.
  This will be removed later and OOjs UI will become the only option.
  To make testing easier, users can also force either mode by adding
  &ooui=true or &ooui=false to the action=edit URL.

=== External library changes in 1.29 ===

==== Upgraded external libraries ====
* Updated QUnit from v1.22.0 to v1.23.1.
* Updated cssjanus from v1.1.2 to v1.2.0.
* Updated psr/log from v1.0.0 to v1.0.2.
* Update Moment.js from v2.8.4 to v2.15.0.
* Updated oyejorge/less.php from v1.7.0.10 to v1.7.0.14.
* Updated monolog from v1.18.2 to 1.22.1.
* Updated wikimedia/composer-merge-plugin from v1.3.1 to v1.4.0.
* Updated OOjs from v1.1.10 to v2.0.0.
* Updated jQuery from v1.11.3 to v3.2.1 (including jQuery Migrate v3.0.0).

==== New external libraries ====
* Added wikimedia/timestamp v1.0.0.
* Added wikimedia/remex-html v1.0.1.

==== Removed and replaced external libraries ====

=== Bug fixes in 1.29 ===
* (T62604) Core parser functions returning a number now format the number
  according to the page content language, not wiki content language.
* (T27187) Search suggestions based on jquery.suggestions will now correctly
  only highlight prefix matches in the results.
* (T157035) "new mw.Uri()" was ignoring options when using default URI.
* Special:Allpages can no longer be filtered by redirect in miser mode.
* (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is
  installed.
* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
  redirect to interwiki links.
* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
  $wgAdvancedSearchHighlighting is true.
* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
  their values out of the logs.
* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
  CSRF token.
* (T156184) SECURITY: Escape content model/format url parameter in message.
* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
  declaration.
* (T161453) SECURITY: LocalisationCache will no longer use the temporary
  directory in it's fallback chain when trying to work out where to write the
  cache.
* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
  inclusion syntax's link parameter.
* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
  against it.

=== Action API changes in 1.29 ===
* Submitting sensitive authentication request parameters to action=login,
  action=clientlogin, action=createaccount, action=linkaccount, and
  action=changeauthenticationdata in the query string is now an error. They
  should be submitted in the POST body instead.
* The capture option for action=resetpassword has been removed
* action=clearhasmsg now requires a POST.
* (T47843) API errors and warnings may be requested in non-English languages
  using the new 'errorformat', 'errorlang', and 'errorsuselocal' parameters.
* API error codes may have changed. Most notably, errors from modules using
  parameter prefixes (e.g. all query submodules) will no longer be prefixed.
* ApiPageSet-using modules will report the 'invalidreason' using the specified
  'errorformat'.
* action=emailuser may return a "Warnings" status, and now returns 'warnings'
  and 'errors' subelements (as applicable) instead of 'message'.
* action=imagerotate returns an 'errors' subelement rather than 'errormessage'.
* action=move now reports errors when moving the talk page as an array under
  key 'talkmove-errors', rather than using 'talkmove-error-code' and
  'talkmove-error-info'. The format for subpage move errors has also changed.
* action=revisiondelete no longer includes a "rendered" property on warnings
  and errors for each item. Use errorformat=wikitext if you're wanting parsed
  output.
* action=rollback no longer returns a "messageHtml" property. Use
  errorformat=html if you're wanting HTML formatting of error messages.
* action=upload now reports optional stash failures as an array under key
  'stasherrors' rather than a 'stashfailed' text string.
* action=watch reports 'errors' and 'warnings' instead of a single 'error', and
  no longer returns a 'message' on success.
* Added action=validatepassword to validate passwords for the account creation
  and password change forms.
* action=purge now requires a POST.
* There is a new `languagevariants` siprop for action=query&meta=siteinfo,
  which returns a list of languages with active LanguageConverter instances.
* action=query&query=allpages will no longer filter redirects using a database
  query in miser mode. This may result in less results being returned than were
  requested.

=== Action API internal changes in 1.29 ===
* New methods were added to ApiBase to handle errors and warnings using i18n
  keys. Methods for using hard-coded English messages were deprecated:
  * ApiBase::dieUsage() was deprecated
  * ApiBase::dieUsageMsg() was deprecated
  * ApiBase::dieUsageMsgOrDebug() was deprecated
  * ApiBase::getErrorFromStatus() was deprecated
  * ApiBase::parseMsg() was deprecated
  * ApiBase::setWarning() was deprecated
* ApiBase::$messageMap is no longer public. Code attempting to access it will
  result in a PHP fatal error.
* The $message parameter to the ApiCheckCanExecute hook should be set to an
  ApiMessage. This is compatible with MediaWiki 1.27 and later. Returning a
  code for ApiBase::parseMsg() will no longer work.
* UsageException is deprecated in favor of ApiUsageException. For the time
  being ApiUsageException is a subclass of UsageException to allow things that
  catch only UsageException to still function properly.
* If, for some strange reason, code was using an ApiErrorFormatter instead of
  ApiErrorFormatter_BackCompat, note that the result format has changed and
  various methods now take a module path rather than a module name.
* ApiMessageTrait::getApiCode() now strips 'apierror-' and 'apiwarn-' prefixes
  from the message key, and maps some message keys for backwards compatibility.
* API parameters may now be marked as "sensitive" to keep their values out of
  the logs.

=== Languages updated in 1.29 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.

* Based as always on linguistic studies on intelligibility and language
  knowledge by geography, language fallbacks have been expanded. When a
  translation is missing in the user's preferred interface language, the
  corresponding translation for the fallback language will be used instead.
  English will only be used as last resort when there are no translations.
  Some configurations (such as date formats and gender namespaces) have also
  been updated when using the fallback language's configuration was inadequate.
  The new or reinstated language fallbacks are (after cs ↔ sk in 1.28):
  ca ↔ oc; hsb ↔ dsb; io → eo; mdf → ru; pnt → el; roa-tara → it; rup → ro;
  sh → bs, sr-el, hr.
* (T137376) New language support: Atikamekw (atj).
* (T163600) New language support: Dinka (din).
* (T155957) Talk Namespaces for Javanese language (jv) have been updated.

==== No fallback for Ukrainian ====
* (T39314) The fallback from Ukrainian to Russian was removed. The Ukrainian
  language will now use the default fallback language: English. When a
  translation to Ukrainian is not available, an English string will be shown.

=== Other changes in 1.29 ===
* Database::getSearchEngine() (deprecated in 1.28) was removed. Use
  SearchEngineFactory::getSearchEngineClass() instead.
* $wgSessionsInMemcached (deprecated in 1.20) was removed. No replacement is
  required as all sessions are stored in Object Cache now.
* MWHttpRequest::execute() should be considered to return a StatusValue; the
  Status return type is deprecated.
* User::edits() (deprecated in 1.21) was removed.
* Xml::escapeJsString() (deprecated in 1.21) was removed.
* Article::getText() and Article::prepareTextForEdit() (deprecated in 1.21)
  were removed.
* Article::getAutosummary() and WikiPage::getAutosummary() (deprecated in 1.21)
  were removed.
* Hook ArticleViewCustom (deprecated in 1.21) was removed. Use
  ArticleContentViewCustom instead.
* Hooks EditPageGetDiffText and ShowRawCssJs (deprecated in 1.21) were removed.
* Class RevisiondeleteAction (deprecated in 1.25) was removed.
* WikiPage::prepareTextForEdit() (deprecated in 1.21) was removed.
* WikiPage::getText() (deprecated in 1.21) was removed.
* Article::fetchContent() (deprecated in 1.21) was removed.
* User::getPassword() (deprecated in 1.27) was removed.
* User::getTemporaryPassword() (deprecated in 1.27) was removed.
* User::isPasswordReminderThrottled() (deprecated in 1.27) was removed.
* Class FSRepo (deprecated in 1.19) was removed.
* WebRequest::checkSessionCookie() (deprecated in 1.27) was removed. Use
  \MediaWiki\Session\SessionManager::singleton()->getPersistedSessionId()
  instead.
* Class ImageGallery (deprecated in 1.22) was removed.
  Use ImageGalleryBase::factory instead.
* Title::moveNoAuth() (deprecated in 1.25) was removed. Use MovePage class
  instead.
* Hook UnknownAction (deprecated in 1.19) was actually deprecated (it will now
  emit warnings). Create a subclass of Action and add it to $wgActions instead.
* WikiRevision::getText() (deprecated since 1.21) is no longer marked
  deprecated.
* Linker::getInterwikiLinkAttributes() (deprecated since 1.25) was removed.
* Linker::getInternalLinkAttributes() (deprecated since 1.25) was removed.
* Linker::getInternalLinkAttributesObj() (deprecated since 1.25) was removed.
* Linker::getLinkAttributesInternal() (deprecated since 1.25) was removed.
* RedisConnectionPool::handleException (deprecated since 1.23) was removed.
* The static properties mw.Api.errors and mw.Api.warnings, containing incomplete
  and outdated lists of errors/warnings returned by the API, are now deprecated.
* wiki.phtml entry point was removed.  Refer to index.php instead. If you want
  "wiki.phtml" URLs to continue to work, set up redirects. In Apache, this can
  be done by enabling mod_rewrite and adding the following rules to your
  configuration:

    RewriteEngine On
    RewriteBase /
    RewriteRule ^/w/wiki\.phtml$ /w/index.php [R=301,L]
* Hook ArticleAfterFetchContent (deprecated in 1.21) was removed.
  Use ArticleAfterFetchContentObject instead.
* Hook ArticleInsertComplete (deprecated in 1.21) was removed.
  Use PageContentInsertComplete instead.
* Hook ArticleSave (deprecated in 1.21) was removed.
  Use PageContentSave instead.
* Hook ArticleSaveComplete (deprecated in 1.21) was removed.
  Use PageContentSaveComplete instead.
* Hook EditFilterMerged (deprecated in 1.21) was removed.
  Use EditFilterMergedContent instead.
* Hook EditPageGetPreviewText (deprecated in 1.21) was removed.
  Use EditPageGetPreviewContent instead.
* Hook TitleIsCssOrJsPage (deprecated in 1.21) was removed.
  Use ContentHandlerDefaultModelFor instead.
* Hook TitleIsWikitextPage (deprecated in 1.21) was removed.
  Use ContentHandlerDefaultModelFor instead.
* Article::getContent() (deprecated in 1.21) was removed.
* Revision::getText() (deprecated in 1.21) was removed.
* Article::doEdit() and WikiPage::doEdit() (deprecated in 1.21) were removed.
* Parser::replaceUnusualEscapes() (deprecated in 1.24) was removed.
* Article::doEditContent() was marked as deprecated, to be removed in 1.30
  or later.
* ContentHandler::runLegacyHooks() was removed.
* refreshLinks.php now can be limited to a particular category with
  --category=... or a tracking category with --tracking-category=...
* User-like objects that are passed to SpecialUserRights and its subclasses are
  now required to have a getGroupMemberships() method. See UserRightsProxy for
  an example.
* User::$mGroups (instance variable) was marked private. Use User::getGroups()
  instead.
* User::getGroupName(), User::getGroupMember(), User:getGroupPage(),
  User::makeGroupLinkHTML(), and User::makeGroupLinkWiki() were deprecated.
  Use equivalent methods on the UserGroupMembership class.
* Maintenance scripts and tests that call User::addGroup() must now ensure that
  User objects have been added to the database prior to calling addGroup().
* Protected function UsersPager::getGroups() was removed, and protected function
  UsersPager::buildGroupLink() was changed from a static to an instance method.
* The third parameter ($cache) to the UsersPagerDoBatchLookups hook was changed;
  see docs/hooks.txt.
* User::crypt() (deprecated in 1.24) was removed.
* User::comparePasswords() (deprecated in 1.24) was removed.
* ArchivedFile::getUserText() (deprecated in 1.23) was removed.
* HTMLFileCache::newFromTitle() (deprecated in 1.24) was removed.
* BREAKING CHANGE: Internal signature changes to ChangesListSpecialPage
  and subclasses.  It should only break if you call buildMainQueryConds
  (changed to buildQuery with new signature) or doMainQuery (new
  signature).  Subclasses are likely to call at least doMainQuery
  (possibly both), but other classes might too, because they were
  public.
  Also, some related hooks were deprecated, but this is not yet a
  breaking change.
* Removed 'jquery.arrowSteps' module. (deprecated since 1.28)
* The 'jquery.autoEllipsis' ResourceLoader module is now deprecated.
* WikiRevision::$fileIsTemp was deprecated.
* WikiRevision::$importer was deprecated.
* WikiRevision::$user was deprecated.
* Article::getLastPurgeTimestamp(), WikiPage::getLastPurgeTimestamp(), and the
  WikiPage::PURGE_* constants are deprecated, and the functions will always
  return false. They were a hack for an issue that has since been fixed.
* Hook 'EditPageBeforeEditChecks' is now deprecated. Instead use the new hook
  'EditPageGetCheckboxesDefinition', or 'EditPage::showStandardInputs:options'
  if you don't actually care about checkboxes and just want to add some HTML
  to the page.
* Selflinks are now rendered as href-less <a> tags with the class mw-selflink
  rather than <strong> tags. The old class name, "selflink", was deprecated
  and will be removed in a future release. (T160480)
* (T156184) $wgRawHtml will no longer apply to internationalization messages.
* Browser support for non-ES5 JavaScript browsers, including Android 2,
  Opera <12.10, and Internet Explorer 9, was lowered from Grade A to Grade C.
* Removed wikibits global methods deprecated since MediaWiki 1.17 (T122755):
  is_gecko, is_chrome_mac, is_chrome, webkit_version, is_safari_win, is_safari,
  webkit_match, is_ff2, ff2_bugs, is_ff2_win, is_ff2_x11, opera95_bugs,
  opera7_bugs, opera6_bugs, is_opera_95, is_opera_preseven, is_opera,
  ie6_bugs, clientPC, changeText, killEvt, addHandler, hookEvent,
  addClickHandler, removeHandler, getElementsByClassName, getInnerText,
  setupCheckboxShiftClick, addCheckboxClickHandlers, mwEditButtons,
  mwCustomEditButtons, injectSpinner, removeSpinner, escapeQuotes,
  escapeQuotesHTML, jsMsg, addPortletLink, appendCSS, tooltipAccessKeyPrefix,
  tooltipAccessKeyRegexp, updateTooltipAccessKeys.
* The ID of the <li> element containing the login link has changed from
  'pt-login' to 'pt-login-private' in private wikis.
* The old, neglected "bulletin board style toolbar" in the edit form is now
  deprecated (T30856). This old code dates from 2006, and was replaced in the
  MediaWiki release tarball and in Wikimedia production by the WikiEditor
  extension in 2010. It is only shown to users if no other editor was
  installed, and leads to confusion.
* (T92459) Loading ResourceLoader modules containing JavaScript through
  addModuleStyles() is deprecated and will log a warning server-side.

= MediaWiki 1.28 =

== MediaWiki 1.28.3 ==

This is a security and maintenance release of the MediaWiki 1.28 branch.

=== Changes since 1.28.2 ==
* (T168856) Allow SVGs created by Dia to be uploaded.
* (T157545) Add missing doUpdates() call to refreshLinks.php.
* (T165714) (T100085) Better handling of jobs execution in post-connection
  shutdown.
* (T154425) (T154438) (T157679) Use AutoCommitUpdate instead of
  Database->onTransactionIdle.
* (T154425) Make DeferredUpdates detect LBFactory transaction rounds.
* (T149454) Restore erroneously removed realTableName call from
  DatabasePostgres.
* (T167798) Fix phrase search and highlighting for phrase queries.
* (T151136) Provide credits information to callbacks in extension registration.
* (T160462) Allow namespaces defined in extension.json to be overwritten
  locally.
* (T168337) Fix ErrorPageError to work from non-UI contexts.
* (T143788) Backports for PHP 7.0 and 7.1 support.
* (T175439) Unbreak Postgres Updater when setting defaults for a column.
* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
* (T174255) Declare uploadCount property in importDump.php.
* (T180231) SECURITY: Updated dev dependancy phpunit/phpunit from v4.8.24 to
  v4.8.36.
* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
  browser sends non-standard url escaping.
* (T165846) SECURITY: BotPassword login attempts weren't throttled.
* (T128209) SECURITY: Reflected File Download from api.php.
* (T134100) SECURITY: Do not reveal if user exists during login failure.
* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
* (T125163) SECURITY: Make anchor for headlines escape > and <.
* (T180237) SECURITY: Protect vendor folder with .htaccess.
* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in
  update.php.
* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
* (T119158) SECURITY: Handle -{}- syntax in attributes safely.

== MediaWiki 1.28.2 ==

Due to a packaging error, the wrong version of the SyntaxHighlight extension was
included in the tarball version of MediaWiki 1.28.1. The version included had a
serious security issue in it (T158689). There was also some minor code fixes in
MediaWiki itself since 1.28.1, but none of them were security relevant.

== MediaWiki 1.28.1 ==

This is a security and maintenance release of the MediaWiki 1.28 branch.

=== Changes since 1.28.0 ===

* $wgRunJobsAsync is now false by default (T142751). This change only affects
  wikis with $wgJobRunRate > 0.
* Fix fatal from "WaitConditionLoop" not being found, experienced when a wiki
  has more than one database server setup.
* (T152717) Better escaping for PHP mail() command,
* (T154670) A missing method causing the MySQL installer to fatal in rare
  circumstances was restored.
* (T154672) Un-deprecate ArticleAfterFetchContentObject hook.
* (T158766) Avoid SQL error on MSSQL when using selectRowCount().
* (T145635) Fix too long index error when installing with MSSQL.
* (T156184) $wgRawHtml will no longer apply to internationalization messages.
* (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is
  installed.
* (T154872) Fix incorrect ar_usertext_timestamp index names in new 1.28
  installs.
* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
  redirect to interwiki links.
* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
  $wgAdvancedSearchHighlighting is true.
* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
  their values out of the logs.
* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
  CSRF token.
* (T156184) SECURITY: Escape content model/format url parameter in message.
* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
  declaration.
* (T161453) SECURITY: LocalisationCache will no longer use the temporary
  directory in it's fallback chain when trying to work out where to write the
  cache.
* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
  inclusion syntax's link parameter.
* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
  against it.

== MediaWiki 1.28 ==

=== Changes since 1.28.0-rc1 ===
* (T148957) Replace wgShowExceptionDetails with wgShowDBErrorBacktrace on db
  errors.
* (T148956) Only apply wgDBschema to postgres/mssql.
* (T145991) Introduce separate log action for deleting pages on move.
* (T141474) (T110464) Bypass login page if no user input is required.

=== Changes since 1.28.0-rc0 ===
* (T142210) The changes to move the parser "NewPP limit report" from a HTML
  comment to a machine-readable JavaScript config option 'wgPageParseReport'
  have been undone. They caused the human-readable limit report to be shown
  incompletely or not at all. ParserOutput::setLimitReportData() and
  getLimitReportData() behave as they did in MediaWiki 1.27 again.
* (T149510) Value of {{DISPLAYTITLE:}} parser function will not be used for
  the text of subheadings on a category page when creating it. This wasn't
  working correctly.
* (T106793) MediaWiki will no longer try to perform a HTTP redirect to the
  canonical pretty URL when a non-pretty URL is used. It resulted in redirect
  loops in some clients and in some server configurations. This undoes a change
  made in MediaWiki 1.26.
* (T149759) manifest_version: 2 was removed.

=== Configuration changes in 1.28 ===
* $wgSend404Code now affects status code of action=history if the page is not
  there.
* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
  made by MediaWiki via a proxy. Relying on the http_proxy environment
  variable is no longer supported.
* The load.php entry point now enforces the existing policy of not allowing
  access to session data, which includes the session user and the session
  user's language. If such access is attempted, an exception will be thrown.
* The number of internal PBKDF2 iterations used to derive the session secret
  is configurable via $wgSessionPbkdf2Iterations.
* Upload dialog's file upload log comment can now be configured separately for
  local and foreign uploads.
* $wgForeignUploadTargets now defaults to `[ 'local' ]`, where `'local'`
  signifies local uploads. A value of `[]` (empty array) now means that
  no upload targets are allowed, effectively disabling the upload dialog.
* The deprecated $wgEditEncoding variable has been removed; it was only used
  for Esperanto language character conversion. You are now recommended to use
  input methods provided by the UniversalLanguageSelector extension.
* When $wgPingback is true, MediaWiki will periodically ping
  https://www.mediawiki.org/beacon with basic information about the local
  MediaWiki installation. This data includes, for example, the type of system,
  PHP version, and chosen database backend. This behavior is off by default.
* When $wgEditSubmitButtonLabelPublish is true, MediaWiki will label the button
  to store-to-database-and-show-to-others as "Publish page"/"Publish changes";
  if false, the default, they will be "Save page"/"Save changes".
* The 'editcontentmodel' permission is now granted to all logged-in users
  ('user').
  instead of just administrators ('sysop'). Documentation for this feature is
  available at <https://www.mediawiki.org/wiki/Help:ChangeContentModel>.
* $wgRevisionCacheExpiry is now set to one week by default instead of being
  disabled.
* Magic links are now disabled by default, and can be re-enabled by modifying
  the value of $wgEnableMagicLinks. Their usage is discouraged, but if they are
  manually enabled, a tracking category will be added to help identify usage and
  make it easier to migrate away from. If you depend upon magic link
  functionality, it is requested that you comment on
  <https://www.mediawiki.org/wiki/Requests_for_comment/Future_of_magic_links>
  and explain your use case(s).
* New config variable $wgCSPFalsePositiveUrls to control what URLs to ignore
  in upcoming Content-Security-Policy feature's reporting.

=== New features in 1.28 ===
* User::isBot() method for checking if an account is a bot role account.
* Added a new 'slideshow' mode for galleries.
* Added a new hook, 'UserIsBot', to aid in determining if a user is a bot.
* Added a new hook, 'ApiMakeParserOptions', to allow extensions to better
  interact with API parsing.
* Added a new hook, 'UploadVerifyUpload', which can be used to reject a file
  upload. Unlike 'UploadVerifyFile' it provides information about upload comment
  and the file description page, but does not run for uploads to stash.
* (T141604) Extensions can now provide a better error message when their
  maintenance scripts are run without the extension being installed.
* (T8948) Numeric sorting in categories is now supported by setting
  $wgCategoryCollation to 'uca-default-u-kn' or 'uca-<langcode>-u-kn'. If you
  can't use UCA collations, a 'numeric' collation is also available. If
  migrating from another collation, you will need to run the updateCollation.php
  maintenance script.
* Two new codes have been added to #time parser function: "xit" for days in
  current month, and "xiz" for days passed in the year, both in Iranian
  calendar.
* mw.Api has a new option, useUS, to use U+001F (Unit Separator) when
  appropriate for sending multi-valued parameters. This defaults to true when
  the mw.Api instance seems to be for the local wiki.
* After a client performs an action which alters a database that has replica
  databases, MediaWiki will wait for the replica databases to synchronize with
  the master database while it renders the HTML output. However, if the output
  is a redirect to another wiki on the wiki farm with a different domain,
  MediaWiki will instead alter the redirect URL to include a ?cpPosTime
  parameter that triggers the database synchronization when the URL is followed
  by the client. The same-domain case uses a new cpPosTime cookie.
* Added new hooks, 'ApiQueryBaseBeforeQuery', 'ApiQueryBaseAfterQuery', and
  'ApiQueryBaseProcessRow', to make it easier for extensions to add 'prop' and
  'show' parameters to existing API query modules.

=== External library changes in 1.28 ===

==== Upgraded external libraries ====
* Updated es5-shim from v4.1.5 to v4.5.8
* Updated composer/semver from v1.4.1 to v1.4.2
* Updated wikimedia/php-session-serializer from v1.0.3 to v1.0.4

==== New external libraries ====
* Added wikimedia/scoped-callback v1.0.0
* Added wikimedia/wait-condition-loop v1.0.1

=== Bug fixes in 1.28 ===
* (T146496) action=history pages should return 404 HTTP error code if the page
  does not exist
* (T137264) SECURITY: XSS in unclosed internal links
* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
* (T133147) SECURITY: Require login to preview user CSS pages
* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
  the top file
* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
  permissions
* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
* (T139670) Move 'UserGetRights' call before application of
  Session::getAllowedUserRights()

=== Action API changes in 1.28 ===
* Added 'maxarticlesize' property to action=query&meta=siteinfo which contains
  the value of $wgMaxArticleSize.
* Property 'modulemessages' from action=parse&prop=modules was removed
  (deprecated since 1.26).
* The following response properties from action=login, deprecated in 1.27, are
  now removed: lgtoken, cookieprefix, sessionid. Clients should handle cookies
  to properly manage session state.
* Submitting the lgtoken and lgpassword parameters in the query string to
  action=login is now deprecated and outputs a warning. They should be submitted
  in the POST body instead.
* Submitting sensitive authentication request parameters to action=clientlogin,
  action=createaccount, action=linkaccount, and action=changeauthenticationdata
  in the query string is now deprecated and outputs a warning. They should be
  submitted in the POST body instead.
* (T141960) Multi-valued parameters may now be separated using U+001F
  (Unit Separator) instead of the pipe character. This will be useful if some of
  the multiple values need to contain pipes, e.g. for action=options.
* The API will now warn if input is not NFC-normalized Unicode or if it
  contains invalid characters.
* The 'normalized' list output by action=query and other modules that use
  ApiPageSet may contain entries where the 'from' value is percent-encoded as
  the raw value cannot be represented in a valid API response. These are
  indicated by a 'fromencoded' boolean alongside the existing 'from' parameter.
* (T28680) action=paraminfo can now return info about all submodules of a
  module without listing them all explicitly.
* (T146770) It is now possible to assert that the current user is a specific
  named user, using the 'assertuser' parameter.
* (T141963) Added a 'known' property when missing-but-known titles (e.g. from
  the 'TitleIsAlwaysKnown' hook) are output in various modules.

=== Action API internal changes in 1.28 ===
* Added a new hook, 'ApiMakeParserOptions', to allow extensions to better
  interact with ApiParse and ApiExpandTemplates.
* (T139565) SECURITY: API: Generate head items in the context of the given title
* (T115333) SECURITY: Check read permission when loading page content in
  ApiParse
* ApiBase::getResultData() was removed (deprecated since 1.25)
* ApiBase::makeHelpArrayToString() was removed (deprecated since 1.25)
* ApiBase::makeHelpMsgParameters() was removed (deprecated since 1.25)
* ApiBase::makeHelpMsg() was removed (deprecated since 1.25)
* ApiFormatBase::formatHTML() was removed (deprecated since 1.25)
* ApiFormatBase::getNeedsRawData() was removed (deprecated since 1.25)
* ApiFormatBase::getWantsHelp() was removed (deprecated since 1.25)
* ApiFormatBase::setBufferResult() was removed (deprecated since 1.25)
* ApiFormatBase::setHelp() was removed (deprecated since 1.25)
* ApiFormatBase::setUnescapeAmps() was removed (deprecated since 1.25)
* ApiMain::makeHelpMsgHeader() was removed (deprecated since 1.25)
* ApiMain::reallyMakeHelpMsg() was removed (deprecated since 1.25)
* ApiMain::setHelp() was removed (deprecated since 1.25)
* ApiResult::beginContinuation() was removed (deprecated since 1.25)
* ApiResult::cleanUpUTF8() was removed (deprecated since 1.25)
* ApiResult::convertStatusToArray() was removed (deprecated since 1.25)
* ApiResult::disableSizeCheck() was removed (deprecated since 1.24)
* ApiResult::enableSizeCheck() was removed (deprecated since 1.24)
* ApiResult::endContinuation() was removed (deprecated since 1.25)
* ApiResult::getData() was removed (deprecated since 1.25)
* ApiResult::getIsRawMode() was removed (deprecated since 1.25)
* ApiResult::setContent() was removed (deprecated since 1.25)
* ApiResult::setContinueParam() was removed (deprecated since 1.25)
* ApiResult::setElement() was removed (deprecated since 1.25)
* ApiResult::setGeneratorContinueParam() was removed (deprecated since 1.25)
* ApiResult::setIndexedTagName_internal() was removed (deprecated since 1.25)
* ApiResult::setIndexedTagName_recursive() was removed (deprecated since 1.25)
* ApiResult::setMainForContinuation() was removed (deprecated since 1.25)
* ApiResult::setParsedLimit() was removed (deprecated since 1.25)
* ApiResult::setRawMode() was removed (deprecated since 1.25)
* ApiResult::size() was removed (deprecated since 1.25)
* Added new hooks, 'ApiQueryBaseBeforeQuery', 'ApiQueryBaseAfterQuery', and
  'ApiQueryBaseProcessRow', to make it easier for extensions to add 'prop' and
  'show' parameters to existing API query modules. A query module can enable
  these hooks by passing an array for $hookData to ApiQueryBase::select() and
  by calling ApiQueryBase->processRow() before adding a row's data to the
  result.

=== Languages updated in 1.28 ===

MediaWiki supports over 375 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.

* (T137411) ban (Balinese), thanks to translators Adi Mayndra, Andru,
  BASAbali, M. Adiputra, Naval Scene, Nemo bis, NoiX180, and 아라.
* (T135867) shn (Shan), thanks to translators Khun Sar, Piangpha,
  Saiddzone Saimawnkham, Saosukham, and Sengwan.
* Czech (cs) and Slovak (sk) set as reciprocal fallbacks.
* (T146744) Livvi-Karelian (olo) namespace messages created thanks to translator
  Ilja.mos.

=== Other changes in 1.28 ===
* (T128697) Improved handling of large diffs.
* [BREAKING CHANGE] $wgExtendedLoginCookies has been removed. You can
  use or update a custom session provider if needed.
* Deprecated APIEditBeforeSave hook in favor of EditFilterMergedContent.
* The 'UploadVerification' hook is deprecated. Use 'UploadVerifyFile' instead.
* SiteConfiguration::isLocalVHost() was removed (deprecated since 1.25).
* The 'UserLoginComplete' hook has a new parameter to differentiate between
  actual login and visiting the login page while already logged in.
* ResourceLoader::makeLoaderURL() was removed (deprecated since 1.24).
* $.fn.liveAndTestAtStart was removed (deprecated since 1.24).
* mw.util.tooltipAccessKeyPrefix was removed (deprecated since 1.24).
* mw.util.tooltipAccessKeyRegexp was removed (deprecated since 1.24).
* Linker::link() and Linker::linkKnown() were deprecated; please instead use
  MediaWiki\Linker\LinkRenderer. In addition, the LinkBegin and LinkEnd hooks
  were replaced by HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd
  respectively. See docs/hooks.txt for the specific changes needed for those
  hooks.
* Linker::formatSize() was deprecated. Use Language::formatSize() directly.
* Aliases for Linker methods, deprecated since 1.21, were removed from Skin:
  * Skin::commentBlock() (use Linker::commentBlock() instead)
  * Skin::generateRollback() (use Linker::generateRollback() instead)
  * Skin::link() (use MediaWiki\Linker\LinkRenderer instead)
  * Skin::linkKnown() (use MediaWiki\Linker\LinkRenderer instead)
  * Skin::userLink() (use Linker::userLink() instead)
  * Skin::userToolLinks() (use Linker::userToolLinks() instead)
* Disabled "bug 2702" HTML tidying of parsed UI messages on wikis where Tidy is
  disabled.
* DifferenceEngine::generateDiffBody() was removed (deprecated since 1.21).
* UploadBase::stashFileGetKey() and UploadBase::stashSession() were deprecated.
  Use ...->stashFile()->getFileKey() instead.
* "Public domain" was removed as a wiki license option from the installer, in
  favour of CC-0.
* AuthenticationRequest::$required is now changed from REQUIRED to
  PRIMARY_REQUIRED on requests needed by primary providers even if all primaries
  need them.
  Primary providers are discouraged from returning multiple REQUIRED requests.
* OOjs UI PHP widgets constructed with the `'infusable' => true` config option
  will no longer be automatically infused. You should call `OO.ui.infuse()`
  on them yourself from your JavaScript code.
* parserTests.php has moved to tests/parser/parserTests.php
* The command line options specific to parser tests have been removed from
  phpunit.php: --regex and --keep-uploads. Instead of --regex, use --filter.
  Instead of --keep-uploads, use the same option to parserTests.php, but you
  must specify a directory with --upload-dir.
* The 'jquery.arrowSteps' ResourceLoader module is now deprecated.
* IP::isConfiguredProxy() and IP::isTrustedProxy() were removed. Callers should
  migrate to using the same functions on a ProxyLookup instance, obtainable from
  MediaWikiServices.
* The ArticleAfterFetchContent, ArticleInsertComplete, ArticleSave,
  ArticleSaveComplete, ArticleViewCustom, EditFilterMerged, EditPageGetDiffText,
  EditPageGetPreviewText and ShowRawCssJs hooks will now emit deprecation
  warnings if used.
* (T68404) CSS3 attr() function with url type is no longer allowed
  in inline styles.
* Database::getSearchEngine() is deprecated, use
  SearchEngineFactory::getSearchEngineClass instead.

== Compatibility ==

MediaWiki 1.28 requires PHP 5.5.9 or later. There is experimental support for
HHVM 3.6.5 or later.

MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but
support for them is somewhat less mature. There is experimental support for
Oracle and Microsoft SQL Server.

The supported versions are:

* MySQL 5.0.3 or later
* PostgreSQL 8.3 or later
* SQLite 3.3.7 or later
* Oracle 9.0.1 or later
* Microsoft SQL Server 2005 (9.00.1399)

== Upgrading ==

1.28 has several database changes since 1.27, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).

If upgrading from before 1.11, and you are using a wiki as a commons
repository, make sure that it is updated as well. Otherwise, errors may arise
due to database schema changes.

If upgrading from before 1.7, you may want to run refreshLinks.php to ensure
new database fields are filled with data.

If you are upgrading from MediaWiki 1.4.x or earlier, you should upgrade to
1.5 first. The upgrade script maintenance/upgrade1_5.php has been removed
with MediaWiki 1.21.

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed upgrade instructions.

For notes on 1.27.x and older releases, see HISTORY.

== Online documentation ==

Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==

A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==

There's usually someone online in #mediawiki on irc.freenode.net.

= MediaWiki 1.27 =

== MediaWiki 1.27.7 ==

This is a maintenance release of the MediaWiki 1.27 branch.

=== Changes since MediaWiki 1.27.6 ===
* Add missing `use MediaWiki\MediaWikiServices;` to LogEventsList.php.
* Remove broken tests from ApiBlockTest.php.

== MediaWiki 1.27.6 ==

This is a security and maintenance release of the MediaWiki 1.27 branch.

=== Changes since MediaWiki 1.27.5 ===
* (T204729) WatchedItemStore::countVisitingWatchersMultiple() shouldn't query
  all titles when asked for none.
* (T109121) Remove deprecated pear/mail_mime-decode from composer suggested
  libraries.
* (T207241) Augment precision of updatelist time.
* (T207540) Include IP address in "Login for $1 succeeded" log entry.
* (T205765) Don't link to the obsolete "Extension Matrix" page in installer.
* (T207603) SECURITY: User JS may no longer be loaded with mime type
  text/javascript if there is no account associated with the username.
* (T113042) SECURITY: Do not allow loading pages raw with a text/javascript MIME
  type if non-admins can edit the page.
* (T207541) Pass email address to mail().
* (T209335) Clarify the default sidebar 'Help' link is about MediaWiki itself.
* (T213359) Update mediawiki/mediawiki-codesniffer to 0.8.1.
* (T208871) The hard-coded Google search form on the database error page was
  removed.
* (T216968) Return pageid as int in both list=iwbacklinks and
  list=langbacklinks.
* (T218608) Fix an issue that prevents Extension:OAuth working when
  $wgBlockDisablesLogin is true.
* (T219728) Added support for new Japanese era name "Reiwa".
* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
  token.
* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
  reauthenticating.
* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
  getLoginSecurityLevel() returns non-false.
* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
* (T208881) SECURITY: blacklist CSS var().
* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
* (T222036, T222038) SECURITY: Add permission check for user is permitted to
  view the log type.
* (T221739) SECURITY: resources: Patch jQuery 1.11.3 for CVE-2019-11358.

== MediaWiki 1.27.5 ==

This is a security and maintenance release of the MediaWiki 1.27 branch.

=== Changes since 1.27.4 ===
* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
  'newbie'.
* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
  account lock.
* Upgraded Moment.js from v2.8.4 to v2.19.3.
* (T160298) Fixed Special:ActiveUsers due to bad backport.
* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative
  array.
* Updated list of SPDX licenses for extensions.
* (T189567) the CLI installer (maintenance/install.php) learned to detect and
  include extensions. Pass --with-extensions to enable that feature.
* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().
* Add default edit rate limit of 90 edits/minute for all users.
* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
* (T196672) The mtime of extension.json files is now able to be zero.
* (T118683) Fix exception from &$user deref on HHVM in the TitleMoveComplete
  hook.
* (T180403) Validate $length in padleft/padright parser functions.
* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
* Special:BotPasswords now requires reauthentication.
* (T191608, T187638) Add 'logid' parameter to Special:Log.
* (T193829) Indicate when a Bot Password needs reset.
* (T151415) Log email changes.
* (T118420) Unbreak Oracle installer.

== MediaWiki 1.27.4 ==
This is a security and maintenance release of the MediaWiki 1.27 branch.

=== Changes since 1.27.3 ===
* (T100085) Better handling of jobs execution in post-connection shutdown.
* (T141604) Support conditionally registered namespaces.
* (T167798) Fix highlighting for phrase queries and phrase search.
* (T151136) Provide credits information to callbacks.
* (T160462) Allow namespaces defined in extension.json to be overwritten
  locally.
* (T168856) Allow SVGs created by Dia to be uploaded.
* (T144705) (T148662) Password reset link is no longer shown when no reset
  options are available.
* (T143788) (T174262) Various backports for PHP 7.0 and 7.1 support.
* (T66795) $wgUserEmailUseReplyTo is now true by default to work around
  restrictive DMARC policies.
* DB_REPLICA constant added from REL1_28+ to ease backports to extensions and
  core.
* (T175439) Unbreak Postgres Updater when setting defaults for a column.
* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
* (T142304) Allow putting the app ID in the password for bot passwords.
* Updated dev dependancy phpunit/phpunit from v4.8.24 to v4.8.36.
* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
  browser sends non-standard url escaping.
* (T165846) SECURITY: BotPassword login attempts weren't throttled.
* (T128209) SECURITY: Reflected File Download from api.php.
* (T134100) SECURITY: Do not reveal if user exists during login failure.
* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
* (T125163) SECURITY: Make anchor for headlines escape > and <.
* (T180237) SECURITY: Protect vendor folder with .htaccess.
* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in
  update.php.
* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
* (T119158) SECURITY: Handle -{}- syntax in attributes safely.

== MediaWiki 1.27.3 ==
Due to a packaging error, the wrong version of the SyntaxHighlight extension was
included in the tarball version of MediaWiki 1.27.2. The version included had a
serious security issue in it (T158689). There was also some minor code fixes in
MediaWiki itself since 1.27.2, but none of them were security relevant.

=== Changes since 1.27.2 ===
* (T145664) Fix broken wincache merge() implementation
* (T163434) Add wikimedia/testing-access-wrapper for forwards compatibility
* (T153505) Fix php warnings on php 7.1 due to use of &$this

== MediaWiki 1.27.2 ==
This is a security and maintenance release of the MediaWiki 1.27 branch.

ApiCreateAccount was removed in 1.27.0. It was incorrectly still marked as
deprecated (rather than already removed) in the RELEASE-NOTES at the point
1.27.0 was released.

=== Changes since 1.27.1 ===

* (T68404) CSS3 attr() function with url type argument is no longer allowed
  in inline styles.
* $wgRunJobsAsync is now false by default (T142751). This change only affects
  wikis with $wgJobRunRate > 0.
* (T152717) Better escaping for PHP mail() command
* Submitting the lgtoken and lgpassword parameters in the query string to
  action=login is now deprecated and outputs a warning. They should be submitted
  in the POST body instead.
* Submitting sensitive authentication request parameters to action=clientlogin,
  action=createaccount, action=linkaccount, and action=changeauthenticationdata
  in the query string is now deprecated and outputs a warning. They should be
  submitted in the POST body instead.
* (T158766) Avoid SQL error on MSSQL when using selectRowCount()
* (T145635) Fix too long index error when installing with MSSQL.
* (T156184) $wgRawHtml will no longer apply to internationalization messages.
* (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is
  installed.
* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
  redirect to interwiki links.
* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
  $wgAdvancedSearchHighlighting is true.
* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
  their values out of the logs.
* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
  CSRF token.
* (T156184) SECURITY: Escape content model/format url parameter in message.
* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
  declaration.
* (T161453) SECURITY: LocalisationCache will no longer use the temporary
  directory in it's fallback chain when trying to work out where to write the
 cache.
* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
  inclusion syntax's link parameter.
* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
  against it.

== MediaWiki 1.27.1 ==

This is a maintenance release of the MediaWiki 1.27 branch.

=== Changes since 1.27.0 ===
* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
  made by MediaWiki via a proxy. Relying on the http_proxy environment
  variable is no longer supported.
* (T139565) SECURITY: API: Generate head items in the context of the given title
* (T137264) SECURITY: XSS in unclosed internal links
* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
* (T133147) SECURITY: Require login to preview user CSS pages
* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
  the top file
* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
  permissions
* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
* (T115333) SECURITY: Check read permission when loading page content in
  ApiParse
* (T57548) Remove support for $wgWellFormedXml = false, all output is now well
  formed
* (T139670) Move 'UserGetRights' call before application of
  Session::getAllowedUserRights()

== MediaWiki 1.27.0 ==

=== PHP version requirement in 1.27 ===
As of 1.27, MediaWiki now requires PHP 5.5.9 or higher (see Compatibility
section). Additionally, the following PHP extensions are required:
* ctype
* iconv
* json
* mbstring (new requirement in 1.27)
* xml
The following PHP extensions are strongly recommended:
* openssl

=== Configuration changes in 1.27 ===
* $wgAllowMicrodataAttributes and $wgAllowRdfaAttributes were removed,
  now always enabled. If you use RDFa on your wiki, you now have to explicitly
  set $wgHtml5Version to 'HTML+RDFa 1.0' or 'XHTML+RDFa 1.0'.
* $wgUseLinkNamespaceDBFields was removed.
* Deprecated $wgResourceLoaderMinifierStatementsOnOwnLine and
  $wgResourceLoaderMinifierMaxLineLength, because there was little value in
  making the behavior configurable. The default values (`false` for the former,
  1000 for the latter) are now hard-coded.
* $wgDebugDumpSqlLength was removed (deprecated in 1.24).
* $wgDebugDBTransactions was removed (deprecated in 1.20).
* $wgUseXVO has been removed, as it provides functionality only used by
  custom Wikimedia patches against Squid 2.x that probably noone uses in
  production anymore. There is now $wgUseKeyHeader that provides similar
  functionality but instead of the MediaWiki-specific X-Vary-Options header,
  uses the draft Key header standard.
* $wgScriptExtension (and support for '.php5' entry points) was removed. See the
  deprecation notice in the release notes for version 1.25 for advice on how to
  preserve support for '.php5' entry points via URL rewriting.
* Password handling via the User object has been deprecated and partially
  removed, pending the future introduction of AuthManager. In particular:
** expirePassword(), getPasswordExpireDate(), resetPasswordExpiration(), and
   getPasswordExpired() have been removed. They were unused outside of core.
** The mPassword, mNewpassword, mNewpassTime, and mPasswordExpires fields are
   now private and will be removed in the future.
** The getPassword() and getTemporaryPassword() methods now throw
   BadMethodCallException and will be removed in the future.
** The ability to pass 'password' and 'newpassword' to createNew() has been
   removed. The only users of it seem to have been using it to set invalid
   passwords, and so shouldn't be greatly affected.
** setPassword(), setInternalPassword(), and setNewpassword() have been
   deprecated, pending the introduction of AuthManager.
** User::randomPassword() is deprecated in favor of a new method
   PasswordFactory::generateRandomPasswordString()
** User::getPasswordFactory() is deprecated, callers should just create a
   PasswordFactory themselves.
** A new constructor, User::newSystemUser(), has been added to simplify the
   creation of passwordless "system" users for logged actions.
* $wgMaxSquidPurgeTitles was removed.
* $wgAjaxWatch was removed. This is now enabled by default.
* $wgUseInstantCommons now hotlinks Commons images by default instead of
  downloading originals and thumbnailing them locally. This allows wikis to save
  on CPU and bandwidth while reducing time to first byte for pages, even without
  a thumbnail handler. See $wgForeignFileRepos documentation for tweaks.
* (T27397) WebP is enabled by default as an uploadable filetype.
* (T48998) $wgArticlePath must now be either a full url, or start with a "/".
* $wgRateLimitLog was removed; use $wgDebugLogGroups['ratelimit'] instead.
* Deprecated API formats dbg, txt, and yaml have been removed.
* CLDRPluralRule* classes have been replaced with
  wikimedia/cldr-plural-rule-parser.
* Removed $wgProfilePerHost, $wgUDPProfilerHost, $wgUDPProfilerPort,
  $wgUDPProfilerFormatString, $wgStatsMethod, $wgAggregateStatsID,
  $wgStatsFormatString, and $wgProfileCallTree (deprecated since 1.20).
* For proper operation of LocalIdLookup with shared user tables, ensure that
  $wgSharedDB and $wgSharedTables are properly set even on the "central" wiki
  that all others are sharing from and that $wgLocalDatabases is set to the
  full list of sharing wikis on all those wikis.
* Massive overhaul to session handling:
** $wgSessionsInObjectCache is no longer supported and must be true, due to
   MediaWiki\Session\SessionManager. $wgSessionHandler is similarly no longer
   used.
** ObjectCacheSessionHandler is removed, replaced with
   MediaWiki\Session\PhpSessionHandler.
** PHP session handling in general ($_SESSION, session_id(), and so on) is
   deprecated. Use MediaWiki\Session\SessionManager instead. A new config
   variable, $wgPHPSessionHandling, is available to cause use of $_SESSION to
   issue a deprecation warning or to cause most PHP session handling to throw
   exceptions.
** Deprecated UserSetCookies hook. Session-handling extensions should generally
   be creating a custom subclass of CookieSessionProvider. Other extensions
   messing with cookies can no longer count on user data being saved in cookies
   versus other methods.
** Deprecated UserLoadFromSession hook, extensions should create a
   MediaWiki\Session\SessionProvider.
** The User cannot be loaded from session until after Setup.php completes.
   Attempts to do so will be ignored and the User will remain unloaded.
** CSRF tokens may be fetched from the MediaWiki\Session\Session, which uses
   the MediaWiki\Session\Token class.
* MediaWiki will now auto-create users as necessary, removing the need for
  extensions to do so. An 'autocreateaccount' right is added to allow
  auto-creation when 'createaccount' is not granted to all users.
* Deprecated AuthPluginAutoCreate hook in favor of LocalUserCreated.
* Most cookie-handling methods in User are deprecated.
* $wgAllowAsyncCopyUploads and $CopyUploadAsyncTimeout were removed. This was an
  experimental feature that has never worked.
* Login and createaccount tokens now vary by timestamp.
* LoginForm::getLoginToken() and LoginForm::getCreateaccountToken()
  return a MediaWiki\Session\Token, and tokens must be checked using that
  class's methods.
* $wgEnotifUseJobQ was removed and the job queue is always used.
* The functionality of the ApiSandbox extension has been merged into core. The
  extension should no longer be used.
* $wgPreloadJavaScriptMwUtil was removed (deprecated in 1.26).
  Extensions, skins, gadgets and scripts that use the mediawiki.util module must
  express a dependency on it.
* $wgIncludeLegacyJavaScript, deprecated in MediaWiki 1.26, now defaults false.
  Extensions, skins, gadgets and scripts that need the mediawiki.legacy.wikibits
  module should express a dependency on it.
* Removed configuration option $wgCopyrightIcon (deprecated since 1.18). Use
  $wgFooterIcons['copyright']['copyright'] instead.
* If the openssl and mcrypt PHP extensions are both unavailable, secure
  session storage (used for login) will raise an exception. This exception may
  be bypassed by setting $wgSessionInsecureSecrets = true.
* Massive overhaul to authentication:
** AuthPlugin and AuthPluginUser are deprecated.
** LoginForm and associated templates are deprecated. Extensions which called
   static LoginForm methods should be converted into authentication providers.
** The following hooks are deprecated:
*** AbortAutoAccount (create a MediaWiki\Auth\PreAuthenticationProvider instead)
*** AbortLogin (create a MediaWiki\Auth\PreAuthenticationProvider instead)
*** AbortNewAccount (create a MediaWiki\Auth\PreAuthenticationProvider instead)
*** AddNewAccount (use LocalUserCreated instead)
*** AuthPluginSetup (create a MediaWiki\Auth\PrimaryAuthenticationProvider
    instead)
*** ChangePasswordForm (use AuthChangeFormFields instead, or security levels)
*** LoginUserMigrated (create a MediaWiki\Auth\PreAuthenticationProvider
    instead)
*** UserCreateForm (create a MediaWiki\Auth\AuthenticationProvider of some type
    instead)
*** UserLoginForm (create a MediaWiki\Auth\AuthenticationProvider of some type
    instead)
** The following hooks are removed:
*** AbortChangePassword
*** LoginPasswordResetMessage
*** PrefsPasswordAudit
** The UserLoginComplete hook will no longer be called for all logins, only for
   those via the web UI. Use UserLoggedIn if you need to do something on all
   logins.
** $wgRequirePasswordforEmailChange is removed.

=== New features in 1.27 ===
* $wgDataCenterUpdateStickTTL was also added. This decides how long a user
  sticks to the primary DC (via cookies) after they make changes to the site.
* Added a new hook, 'UserMailerTransformContent', to transform the contents
  of an email. This is similar to the EmailUser hook but applies to all mail
  sent via UserMailer.
* Added a new hook, 'UserMailerTransformMessage', to transform the contents
  of an emai after MIME encoding.
* Added a new hook, 'UserMailerSplitTo', to control which users have to be
  emailed separately (ie. there is a single address in the To: field) so
  user-specific changes to the email can be applied safely.
* $wgCdnMaxageLagged was added, which limits the CDN cache TTL
  when any load balancer uses a DB that is lagged beyond the 'max lag'
  setting in the relevant section of $wgLBFactoryConf.
* User::newSystemUser() may be used to simplify the creation of passwordless
  "system" users for logged actions from scripts and extensions.
* Extensions can now return detailed error information via the API when
  preventing user actions using 'getUserPermissionsErrors' and similar hooks
  by using ApiMessage instances instead of strings for the $result value.
* $wgAPIMaxLagThreshold was added to limit bot changes when databases lag
  becomes too high.
* Skins and extensions can now use FlexBox mixins (.flex-display(@display: flex)
  and .flex(@grow: 1, @shrink: 1, @width: auto, @order: 1)) in Less to create
  cross-browser-compatible FlexBox rules. Users will still need to add fallback
  float rules or the like for compatibility with IE9- separately.
* Added MWTimestamp::getTimezoneString() which returns the localized timezone
  string, if available. To localize this string, see the comments of
  $wgLocaltimezone in includes/DefaultSettings.php.
* Added CentralIdLookup, a service that allows extensions needing a concept of
  "central" users to get that without having to know about specific central
  authentication extensions.
* $wgMaxUserDBWriteDuration added to limit huge user-generated transactions.
  Regular web request transactions that takes longer than this are aborted.
* Added a new hook, 'TitleMoveCompleting', which runs before a page move is
  committed.
* $wgCdnReboundPurgeDelay was added to provide secondary delayed purges of URLs
  from CDN to mitigate DB replication lag and WAN cache purge lag.
* (T49162) Installer will default to setting CACHE_ACCEL as the main cache type
  if it is available.
* It is now possible to patrol file uploads (both for new files and new versions
  of existing files). Special:NewFiles has gained an option to filter by patrol
  status. This functionality can be disabled using $wgUseFilePatrol.
* MediaWiki\Session infrastructure allows for easier use of session mechanisms
  other than the usual cookies.
** SessionMetadata and SessionCheckInfo hooks allow for setting and checking
   custom session metadata.
* Added MWGrants and associated configuration settings $wgGrantPermissions and
  $wgGrantPermissionGroups to hold configuration for authentication features
  such as OAuth that want to allow restricting the user rights a user may make
  use of.
** If you're already using the OAuth extension, these new variables are
   identical to (and will replace) $wgMWOAuthGrantPermissions and
   $wgMWOAuthGrantPermissionGroups.
* Added MWRestrictions as a class to check restrictions on a WebRequest, e.g.
  to assert that the request comes from a particular IP range.
* Added bot passwords, a rights-restricted login mechanism for API-using bots.
* Whitelisted the following HTML attributes for all elements in wikitext:
  aria-describedby, aria-flowto, aria-label, aria-labelledby, aria-owns.
* Removed "presentation" restriction on the HTML role attribute in wikitext.
  All values are now allowed for the role attribute.
* $wgContentHandlers now also supports callbacks to create an instance of the
  appropriate ContentHandler subclass.
* Added $wgAuthenticationTokenVersion, which if non-null prevents the
  user_token database field from being exposed in cookies. Setting this would
  be a good idea, but will log out all current sessions.
* $wgEventRelayerConfig was added, for managing PubSub event relay
  configuration, specifically for reliable CDN url purges.
* Requests have unique IDs, equal to the UNIQUE_ID environment variable (when
  MediaWiki is behind Apache+mod_unique_id or something similar) or a randomly-
  generated 24-character string. This request ID is used to annotate log records
  and error messages. It is available client-side via
  mw.config.get( 'wgRequestId' ).
  The request ID supplants exception IDs. Accordingly,
  MWExceptionHandler::getLogId() is deprecated.
* (T33313) Add a preference for watching uploads by default, also applies
  to API-based upload tools.
* $wgJpegPixelFormat was added to override chroma subsampling for JPEG image
  thumbnails created via ImageMagick. Defaults to 'yuv420', providing bandwidth
  savings versus the previous behavior on many files.
* MediaWiki\Auth infrastructure (called "AuthManager") allows for more flexible
  configuration of multiple authentication pieces that was possible with
  AuthPlugin. For example, it's now easy to plug in second-factor
  authentication, or add additional checks to the login process, or to support
  multiple login methods at once, or to support non-password-based login
  methods.
** Providers are configured via the global setting $wgAuthManagerConfig.
** A global, $wgDisableAuthManager, is temporarily available to disable
   AuthManager until extensions are ready to support it.
** New hook, AuthChangeFormFields, to adjust the form fields on
   AuthManager-related special pages.
** New hook, AuthManagerLoginAuthenticateAudit, for additional logging of
   AuthManager-related authentication requests.
** New hook, ChangeAuthenticationDataAudit, for additional logging of
   AuthManager-related authentication data changes.
** New hook, SecuritySensitiveOperationStatus, to work with the new mechanism
   for requiring a recent login before taking security-sensitive operations
   like changing a password.
** Two new globals, $wgChangeCredentialsBlacklist and
   $wgRemoveCredentialsBlacklist can be used to prevent the web UI and the API
   changing certain authentication data.
* The file upload dialog (available if you install WikiEditor or VisualEditor)
  can now be configured using $wgUploadDialog.

=== External library changes in 1.27 ===

==== Upgraded external libraries ====
* Updated oojs/oojs-ui from v0.12.12 to v0.13.3.
* Updated composer/semver from v1.0.0 to v1.2.0.
* Updated liuggio/statsd-php-client to 1.0.18.
* Updated QUnit from v1.18.0 to v1.22.0.

==== New external libraries ====
* Added wikimedia/base-convert v1.0.1.
* Added wikimedia/cldr-plural-rule-parser v1.0.0.
* Added wikimedia/relpath v1.0.3.
* Added wikimedia/running-stat v1.1.0.
* Added wikimedia/php-session-serializer v1.0.3.

==== Removed and replaced external libraries ====

=== Bug fixes in 1.27 ===
* Special:Upload will now display correct maximum allowed file size when running
  under HHVM (T116347).
* (T54077) The APIEditBeforeSave hook will once again give only the content of
  the section being edited, rather than the whole revision. This reverts the
  change made in MediaWiki 1.22.

=== Action API changes in 1.27 ===
* Added list=allrevisions.
* generator=recentchanges now has the option to generate revids.
* ApiPageSet::setRedirectMergePolicy() was added. This allows generator
  modules to define how generator data for a redirect source gets merged
  into the redirect destination.
* prop=imageinfo&iiprop=uploadwarning will no longer include the possibility of
  "was-deleted" warning.
* Added difftotextpst to query=revisions which preforms a pre-save transform on
  the text before diffing it.
* Deprecated formats dbg, txt, and yaml have been removed.
* (T47988) The protect log event details now use new-style formatting.
* The following response properties from action=login are deprecated, and may
  be removed in the future: lgtoken, cookieprefix, sessionid. Clients should
  handle cookies to properly manage session state.
* action=login transparently allows login using bot passwords. Clients should
  merely need to change the username and password used after setting up a bot
  password.
* action=upload no longer understands statuskey, asyncdownload or leavemessage.
* Several changes when $wgDisableAuthManager is false:
** action=login is deprecated for uses other than bot passwords.
** list=users can now indicate if a missing username is creatable.
** action=createaccount is changed in a non-backwards-compatible manner.
** Added action=query&meta=authmanagerinfo.
** Added action=clientlogin to be used to log into the main account instead of
   action=login.
** Added action=linkaccount.
** Added action=unlinkaccount.
** Added action=changeauthenticationdata.
** Added action=removeauthenticationdata.
** Added action=resetpassword.

=== Action API internal changes in 1.27 ===
* ApiQueryORM removed.
* The following classes have been removed:
** ApiFormatDbg
** ApiFormatTxt
** ApiFormatYaml
* ApiBase::addTokenProperties() was removed (deprecated since 1.24).
* ApiBase::getFinalPossibleErrors() was removed (deprecated since 1.24).
* ApiBase::getFinalResultProperties() was removed (deprecated since 1.24).
* ApiBase::getRequireAtLeastOneParameterErrorMessages() was removed (deprecated
  since 1.24).
* ApiBase::getPossibleErrors() was removed (deprecated since 1.24).
* ApiBase::getRequireMaxOneParameterErrorMessages() was removed (deprecated
  since 1.24).
* ApiBase::getRequireOnlyOneParameterErrorMessages() was removed (deprecated
  since 1.24).
* ApiBase::getResultProperties() was removed (deprecated since 1.24).
* ApiBase::getTitleOrPageIdErrorMessage() was removed (deprecated since 1.24).
* ApiBase::parseErrors() was removed (deprecated since 1.24).
* ApiQueryBase::titleToKey(), ApiQueryBase::keyToTitle() and
  ApiQueryBase::keyPartToTitle() all removed (deprecated since 1.24).
* ApiQueryBase::checkRowCount() was removed (deprecated since 1.24).
* ApiQueryBase::getDirectionDescription() was removed (deprecated since 1.25).
* ApiQuery::getGenerators() was removed (deprecated since 1.21).
* ApiQuery::getModules() was removed (deprecated since 1.21).
* ApiQuery::getModuleType() was removed (deprecated since 1.21).
* ApiQuery::setGeneratorContinue() was removed (deprecated since 1.24).
* ApiMain::getModules() was removed (deprecated since 1.21).
* ApiBase::getVersion() was removed (deprecated since 1.21).
* ApiMain::getShowVersions() was removed (deprecated in 1.21).
* ApiMain::addModule() was removed (deprecated in 1.21).
* ApiMain::addFormat() was removed (deprecated in 1.21).
* ApiMain::getFormats() was removed (deprecated in 1.21).
* ApiPageSet::finishPageSetGeneration() was removed (deprecated in 1.21).
* ApiCreateAccount was removed.

=== Languages updated in 1.27 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.

* (T113688) Change default numerals from Gurmukhi to Arabic for Punjabi locale.
* (T116020) Aliases of magic words in MessagesXx.php are sorted by usage.

=== Other changes in 1.27 ===
* Added dependency injection (DI) infrastructure, see docs/injection.txt for
  details.
  It is planned to incrementally move MediaWiki code towards using DI, using the
  service locator (SL) pattern as a stepping stone.
* ProfilerOutputUdp was removed. Note that there is a ProfilerOutputStats class.
* WikiPage::doDeleteArticleReal() and WikiPage::doDeleteArticle() now
  ignore the 2nd and 3rd arguments (formerly $id and $commit).
* Removed "loaderScripts" option from ResourceLoaderFileModule class.
* Removed ORM-like wrapper added in 1.20.
* LinkCache::getGoodLinks and LinkCache::getBadLinks were removed
  (deprecated in 1.26).
* WikiPage::doQuickEdit() was removed (deprecated since 1.21).
* Removed SiteObject and SiteArray classes (deprecated in 1.21).
* MessageBlobStore::getInstance() was removed (deprecated since 1.25).
* (T84937) Free external links ("autolinked" urls) will now be terminated
  by &nbsp; and HTML entity encodings of &nbsp, <, and >.
* (T36948) The default file revert message's timestamp is now in
  $wgLocaltimezone, instead of UTC.
* The default name of the 'suppress' group page has been changed from
  'Project:Oversight' to 'Project:Suppress'.
* DatabaseBase::resultObject() is now protected (use outside Database classes
  not necessary since 1.11).
* Calling ResourceLoaderFileModule::readStyleFiles() without a
  ResourceLoaderContext instance is deprecated.
* ResourceLoader::getLessCompiler() now takes an optional parameter of
  additional LESS variables to set for the compiler.
* wfBaseConvert() marked as deprecated, use Wikimedia\base_convert() directly
  instead.
* Obsolete maintenance scripts clearCacheStats.php and showCacheStats.php
  were removed. The underlying data is sent to StatsD (see $wgStatsdServer).
* Removed msg_resource_links database table and associated code.
* Removed msg_resource database table and associated code.
* Skin::getNamespaceNotice() was removed.
* wfIsConfiguredProxy() was removed (deprecated since 1.24).
* wfDebugTimer() was removed (deprecated since 1.25).
* wfIsTrustedProxy() was removed (deprecated since 1.24).
* wfGetIP() was removed (deprecated since 1.19).
* MWHookException was removed.
* OutputPage::appendSubtitle() was removed (deprecated since 1.19).
* OutputPage::loginToUse() was removed (deprecated since 1.19).
* Article::loadContent() was removed (deprecated since 1.19).
* User::editToken() was removed (deprecated since 1.19).
* Removed --force-normal option of dumpBackup.php, as it no longer served
  any useful purpose since 1.22.
* The functions processOption() and processArgs() on the BackupDumper and
  TextPassDumper classes have been removed.
* The maintenance/backupTextPass.inc file was deleted. You should include
  maintenance/dumpTextPass.php instead.
* WikiPage::getUsedTemplates() was removed (deprecated since 1.19).
* wfEmptyMsg() was removed (deprecated since 1.18).
* OutputPage::permissionRequired() was removed (deprecated since 1.18).
* OutputPage::blockedPage() was removed (deprecated since 1.18).
* User::getSkin() was removed (deprecated since 1.18).
* OutputPage::includeJQuery() was removed (deprecated since 1.17).
* WikiPage::updateRestrictions() was removed (deprecated since 1.19).
* WikiPage::testPreSaveTransform() was removed (deprecated since 1.19).
* LogPage::logName() was removed (deprecated since 1.19).
* LogPage::logHeader() was removed (deprecated since 1.19).
* wfCheckLimits() was removed (deprecated since 1.24).
* Linker::makeKnownLinkObj() was removed (deprecated since 1.16).
* Linker::makeLinkObj() was removed (deprecated since 1.16).
* wfMsgForContentNoTrans() was removed (deprecated since 1.18).
* ChangesList::usePatrol was removed (deprecated since 1.22).
* wfMsgNoTrans() was removed (deprecated since 1.18).
* Linker::makeImageLink2 was removed (deprecated since 1.20).
* Title::userIsWatching() was removed (deprecated since 1.20).
* Removed WaitForSlave maintenance script; use SELECT MASTER_POS_WAIT()
  database function directly instead.
* wfMsg() was removed (deprecated since 1.18).
* wfMsgForContent() was removed (deprecated since 1.18).
* wfMsgReal() was removed (deprecated since 1.18).
* wfMsgGetKey() was removed (deprecated since 1.18).
* wfMsgHtml() was removed (deprecated since 1.18).
* wfMsgWikiHtml() was removed (deprecated since 1.18).
* wfMsgExt() was removed (deprecated since 1.18).
* Language::armourMath() was removed (deprecated since 1.22).
* LanguageConverter::armourMath() was removed (deprecated since 1.22).
* FakeConverter::armourMath() was removed (deprecated since 1.22).
* The unused jquery.validate ResourceLoader module was removed.
* FileRepo::getRootUrl() was removed (deprecated since 1.20).
* User::generateToken() was removed (deprecated since 1.20).
* WikiPage::getRawText() was removed (deprecated since 1.21).
* ParserOutput::hasCustomDataUpdates() was removed (deprecated since 1.25).
* ParserOutput::addSecondaryDataUpdate() was removed (deprecated since 1.25).
* ParserOutput::getSecondaryDataUpdates() was removed (deprecated since 1.25).
* Gallery images with multiple caption pipes no longer concatenate them all
  together but instead pick the final one, similar to image syntax.
* XML-like parser tags (such as <gallery>), when unclosed, will be left unparsed
  rather than consume everything until the end of the page.
* New maintenance script resetUserEmail.php allows sysadmins to reset user
  emails in case a user forgot password/account was stolen.
* wfCheckEntropy() was removed (deprecated in 1.27).
* Browser support for Internet Explorer 8 lowered from Grade A to Grade C.
* ContentHandler::supportsCategories method added. Default is true.
  CategoryMembershipChangeJob updates are skipped for content that
  does not support categories.
* wikidiff difference engine is no longer supported, anyone still using it are
  encouraged to upgrade to wikidiff2 which is actively maintained and has better
  package availability.
* Database logic was removed from WatchedItem and a WatchedItemStore was
  created:
** WatchedItem::IGNORE_USER_RIGHTS and WatchedItem::CHECK_USER_RIGHTS were
   deprecated. User::IGNORE_USER_RIGHTS and User::CHECK_USER_RIGHTS were
   introduced.
** WatchedItem::fromUserTitle was deprecated in favour of the constructor.
** WatchedItem::resetNotificationTimestamp was deprecated.
** WatchedItem::batchAddWatch was deprecated.
** WatchedItem::addWatch was deprecated.
** WatchedItem::removeWatch was deprecated.
** WatchedItem::isWatched was deprecated.
** WatchedItem::duplicateEntries was deprecated.
** EmailNotification::updateWatchlistTimestamp was deprecated.
** User::getWatchedItem was removed.
* Unit tests don't work with external PHPUnit anymore, Composer is now the only
  supported way. Run `composer install` to install it and other dev dependencies
  to run unit tests.
* wl_id field added to the watchlist table.
* Revision::getRawText() was removed (deprecated since 1.21).
* WikiPage::replaceSection() was removed (deprecated since 1.21).
* Article::replaceSection() was removed (deprecated since 1.21).
* Language::getLangObj() was removed (deprecated since 1.24).
* Language::getLanguageName() was removed (deprecated since 1.20).
* Language::getLanguageNames() was removed (deprecated since 1.20).
* Language::getTranslatedLanguageNames() was removed (deprecated since 1.20).
* Language::specialPage() was removed (deprecated since 1.24).
* MediaWikiTestCase::assertException() was removed (deprecated since 1.22).
* OutputPage::getHeadItems() was removed (deprecated since 1.24).
* OutputPage::getScript() was removed (deprecated since 1.24).
* OutputPage::out() was removed (deprecated since 1.22).
* OutputPage::setAllowedModules() was removed (deprecated since 1.24).
* UserrightsPage::makeGroupNameListForLog() was removed (deprecated since 1.21).
* MediaWikiSite::newFromGlobalId() was removed (deprecated since 1.21).
* Title::newFromRedirect() was removed (deprecated since 1.21).
* Skin::commonPrintStylesheet() was removed (deprecated since 1.22).
* Skin::getCommonStylePath() was removed (deprecated since 1.24).
* Skin::newFromKey() was removed (deprecated since 1.24).
* Skin::getUsableSkins() was removed (deprecated since 1.23).
* LoadBalancer::pickRandom() was removed (deprecated in 1.21).
* Article::getUndoText() and WikiPage::getUndoText were removed (deprecated
  since 1.21).
* DifferenceEngine::setText() was removed (deprecated in 1.21).
* Title::newFromRedirectArray() was removed (deprecated in 1.21).
* UserMailer::send() no longer accepts $replyto as the 5th argument and
  $contentType as the 6th. These must be passed in the options array now.
* Title::newFromRedirectRecurse() was removed (deprecated in 1.21).
* Skin::accesskey was removed (deprecated since 1.21).
* Skin::blockLink was removed (deprecated since 1.21).
* Skin::buildRollbackLink was removed (deprecated since 1.21).
* Skin::emailLink was removed (deprecated since 1.21).
* Skin::formatComment was removed (deprecated since 1.21).
* Skin::formatHiddenCategories was removed (deprecated since 1.21).
* Skin::formatLinksInComment was removed (deprecated since 1.21).
* Skin::formatRevisionSize was removed (deprecated since 1.21).
* Skin::formatSize was removed (deprecated since 1.21).
* Skin::formatTemplates was removed (deprecated since 1.21).
* Skin::generateTOC was removed (deprecated since 1.21).
* Skin::getInternalLinkAttributes was removed (deprecated since 1.21).
* Skin::getInternalLinkAttributesObj was removed (deprecated since 1.21).
* Skin::getInterwikiLinkAttributes was removed (deprecated since 1.21).
* Skin::getInvalidTitleDescription was removed (deprecated since 1.21).
* Skin::getLinkColour was removed (deprecated since 1.21).
* Skin::getRevDeleteLink was removed (deprecated since 1.21).
* Skin::getRollbackEditCount was removed (deprecated since 1.21).
* Skin::makeBrokenImageLinkObj was removed (deprecated since 1.21).
* Skin::makeCommentLink was removed (deprecated since 1.21).
* Skin::makeExternalImage was removed (deprecated since 1.21).
* Skin::makeExternalLink was removed (deprecated since 1.21).
* Skin::makeHeadline was removed (deprecated since 1.21).
* Skin::makeImageLink was removed (deprecated since 1.21).
* Skin::makeMediaLinkFile was removed (deprecated since 1.21).
* Skin::makeMediaLinkObj was removed (deprecated since 1.21).
* Skin::makeSelfLinkObj was removed (deprecated since 1.21).
* Skin::makeThumbLink2 was removed (deprecated since 1.21).
* Skin::makeThumbLinkObj was removed (deprecated since 1.21).
* Skin::normaliseSpecialPage was removed (deprecated since 1.21).
* Skin::normalizeSubpageLink was removed (deprecated since 1.21).
* Skin::processResponsiveImages was removed (deprecated since 1.21).
* Skin::revComment was removed (deprecated since 1.21).
* Skin::revDeleteLink was removed (deprecated since 1.21).
* Skin::revDeleteLinkDisabled was removed (deprecated since 1.21).
* Skin::revUserLink was removed (deprecated since 1.21).
* Skin::revUserTools was removed (deprecated since 1.21).
* Skin::specialLink was removed (deprecated since 1.21).
* Skin::splitTrail was removed (deprecated since 1.21).
* Skin::titleAttrib was removed (deprecated since 1.21).
* Skin::tocIndent was removed (deprecated since 1.21).
* Skin::tocLine was removed (deprecated since 1.21).
* Skin::tocLineEnd was removed (deprecated since 1.21).
* Skin::tocList was removed (deprecated since 1.21).
* Skin::tocUnindent was removed (deprecated since 1.21).
* Skin::tooltip was removed (deprecated since 1.21).
* Skin::tooltipAndAccesskeyAttribs was removed (deprecated since 1.21).
* Skin::userTalkLink was removed (deprecated since 1.21).
* Skin::userToolLinksRedContribs was removed (deprecated since 1.21).
* wikidiff3 is now the default and only PHP diff engine. It provides improved
  diff performance on complex changes. $wgExternalDiffEngine = 'wikidiff3'
  therefore makes no difference now. Users are still recommended to use
  wikidiff2 if possible, though.
* User::addNewUserLogEntry() was deprecated.
* User::addNewUserLogEntryAutoCreate() was deprecated.
* User::isPasswordReminderThrottled() was deprecated.
* Bot-oriented parameters to Special:UserLogin (wpCookieCheck,
  wpSkipCookieCheck) were removed.
* Installer can now be customized without patching MediaWiki code, see
  mw-config/overrides/README for details.

=== Compatibility ===

MediaWiki 1.27 requires PHP 5.5.9 or later. There is experimental support for
HHVM 3.6.5 or later.

MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but
support for them is somewhat less mature. There is experimental support for
Oracle and Microsoft SQL Server.

The supported versions are:

* MySQL 5.0.3 or later
* PostgreSQL 8.3 or later
* SQLite 3.3.7 or later
* Oracle 9.0.1 or later
* Microsoft SQL Server 2005 (9.00.1399)

=== Upgrading ===

1.27 has several database changes since 1.26, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).

If upgrading from before 1.11, and you are using a wiki as a commons
repository, make sure that it is updated as well. Otherwise, errors may arise
due to database schema changes.

If upgrading from before 1.7, you may want to run refreshLinks.php to ensure
new database fields are filled with data.

If you are upgrading from MediaWiki 1.4.x or earlier, you should upgrade to
1.5 first. The upgrade script maintenance/upgrade1_5.php has been removed
with MediaWiki 1.21.

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed upgrade instructions.

For notes on 1.26.x and older releases, see HISTORY.


= MediaWiki 1.26 =

== MediaWiki 1.26.4 ==

This is a maintenance release of the MediaWiki 1.26 branch.

=== Changes since 1.26.3 ===
* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
  made by MediaWiki via a proxy. Relying on the http_proxy environment
  variable is no longer supported.
* (T124163) Fixed fatal error in DifferenceEngine under HHVM.
* (T139565) SECURITY: API: Generate head items in the context of the given title
* (T137264) SECURITY: XSS in unclosed internal links
* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
* (T133147) SECURITY: Require login to preview user CSS pages
* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
  the top file
* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
  permissions
* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
* (T115333) SECURITY: Check read permission when loading page content in
  ApiParse
* Remove support for $wgWellFormedXml = false, all output is now well formed

== MediaWiki 1.26.3 ==

This is a maintenance release of the MediaWiki 1.26 branch.

=== Changes since 1.26.2 ===
* (T116266) Fixed undefined property notices in DairikiDiff under HHVM.
* (T123166) Fix fatal error when importing pages to titles which cannot be
  created, such as invalid titles or titles the user is not allowed to edit.
* (T122056) Old tokens are remaining valid within a new session
* (T127114) Login throttle can be tricked using non-canonicalized usernames
* (T123653) Cross-domain policy regexp is too narrow
* (T123071) Incorrectly identifying http link in a's href attributes, due to
  m modifier in regex
* (T129506) MediaWiki:Gadget-popups.js isn't renderable
* (T125283) Users occasionally logged in as different users after
  SessionManager deployment
* (T103239) Patrol allows click catching and patrolling of any page
* (T122807) [tracking] Check php crypto primatives
* (T98313) Graphs can leak tokens, leading to CSRF
* (T130947) Diff generation should use PoolCounter
* (T133507) Careless use of $wgExternalLinkTarget is insecure
* (T132874) API action=move is not rate limited
* (T110143) strip markers can be used to get around html attribute escaping in
  (many?) parser tags
* (T116030) Increase pbkdf2 parameter strengths
* (T127420) Pbkdf2Password does not check if hash_pbkdf2() succeeded
* (T126685) Globally throttle password attempts

== MediaWiki 1.26.2 ==

This is a maintenance release of the MediaWiki 1.26 branch.

=== Changes since 1.26.1 ===
* (T121892) Fix fatal error on some Special pages, introduced in 1.26.1.

== MediaWiki 1.26.1 ==

This is a maintenance release of the MediaWiki 1.26 branch.

=== Changes since 1.26.0 ===
* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
  that do not begin with a slash. This enabled trivial XSS attacks.
  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
  error.
* (T119309) SECURITY: Use hash_compare() for edit token comparison
* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
  with '@' as file uploads
* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
  longer be shorter than $wgMinimalPasswordLength
* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
  result in improper blocks being issued
* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
  and related pages no longer use HTTP redirects and are now redirected by
  MediaWiki
* Fixed ConfigException in ExpandTemplates due to AlwaysUseTidy.
* Fixed stray literal \n in Special:Search.
* Fix issue that breaks HHVM Repo Authorative mode.
* (T120267) Work around APCu memory corruption bug

== MediaWiki 1.26.0 ==

=== Configuration changes in 1.26 ===
* $wgPasswordResetRoutes['email'] = true by default.
* $wgEnableParserCache was deprecated, set $wgParserCacheType to CACHE_NONE
  instead if you want to disable the parser cache.
* New-style continuation is now the default for API action=continue. Clients may
  use the 'rawcontinue' parameter to receive raw query-continue data, but the
  new style is encouraged as it's harder to implement incorrectly.
* Deprecated API formats dump and wddx have been completely removed.
* (T7645) The "Signature" button on the edit toolbar is now hidden by default
  in non-talk namespaces. A new configuration variable,
  $wgExtraSignatureNamespaces, controls in which subject (non-talk) namespaces
  the "Signature" button on the edit toolbar will be displayed.
* $wgResourceLoaderUseESI was deprecated and removed. This was an experimental
  feature that was never enabled by default.
* $wgResourceLoaderExperimentalAsyncLoading was deprecated and removed.
  This experimental feature was never enabled by default and is obsolete as of
  MediaWiki 1.26, in where ResourceLoader became fully asynchronous.
* $wgMasterWaitTimeout was removed (deprecated in 1.24).
* Fields in ParserOptions are now private. Use the accessors instead.
* Custom LESS functions (defined via $wgResourceLoaderLESSFunctions or
  in extension.json) have been removed, after being deprecated in 1.24.
* $wgAlwaysUseTidy has been removed.
* ResetSessionID hook has been removed. Nothing seems to use it.
* Certain AuthPlugin methods are deprecated in favor of new hooks:
** AuthPlugin::initUser() is replaced by LocalUserCreated.
** AuthPlugin::updateUser() is replaced by UserLoggedIn.
** AuthPlugin::updateExternalDB() is replaced by the existing UserSaveSettings.
** AuthPlugin::updateExternalDBGroups() is replaced by UserGroupsChanged.
** AuthPluginUser::isHidden() is replaced by UserIsHidden.
** AuthPluginUser::isLocked() is replaced by UserIsLocked.
* The UserRights hook is deprecated in favor of the new UserGroupsChanged hook.
* AuthPlugin::initUser() and AuthPlugin::updateUser() should no longer replace
  the passed User object.
* $wgBlockAllowsUTEdit is now set to true by default. This allows
  blocked users to edit their talk pages unless explicitly disabled
  when they are being blocked.

=== New features in 1.26 ===
* (T51506) Now action=info gives estimates of actual watchers for a page.
  See $wgRCMaxAge, $wgWatchersMaxAge and $wgUnwatchedPageSecret
  to learn how to configure if needed.
* Change tags can now be hidden in the interface by disabling the associated
  "tag-<id>" interface message.
* ':' (colon) is now invalid in usernames for new accounts. Existing accounts
  are not affected.
* Added a new hook, 'LogException', to log exceptions in nonstandard ways.
* Revive the 'SpecialSearchResultsAppend' hook which occurs after the list of
  search results are rendered. The initial use case is to append a "give us
  feedback" link beneath the search results.
* Added a new hook, 'RejectParserCacheValue', which allows extensions to
  reject an otherwise-successful parser cache lookup. The intent is to allow
  extensions to manage the eviction of archaic HTML output from the cache.
* (T68699) The expiration of the UserID and Token login cookies
  ($wgExtendedLoginCookieExpiration) can be configured independently of the
  expiration of all other cookies ($wgCookieExpiration).
* (T50519) Support for generating JPEG/PNG thumbnails from WebP images added
  if ImageMagick is used as image scaler ($wgUseImageMagick = true). Uploading
  of WebP images still disabled by default. Add $wgFileExtensions[] =
  'webp'; to LocalSettings.php to enable uploading of WebP images.
* Added new hooks 'EnhancedChangesListModifyLineData' &
  'EnhancedChangesListModifyBlockLineData', to modify the data used to build
  lines in enhanced recentchanges and watchlist.
* Caches that need purging ability now use the WANObjectCache interface.
  This corresponds to a new $wgMainWANCache setting, which defaults to using
  the $wgMainCacheType settings.
* Callers needing fast light-weight data stores use $wgMainStash to select
  the store type from $wgObjectCaches. The default is the local database.
* Interface message overrides in the MediaWiki namespace will now be cached in
  memcached and APC (if available), rather than memcached and local files.
* Added a new hook, 'RandomPageQuery', to allow modification of the query used
  by Special:Random to select random pages.
* $wgTransactionalTimeLimit was added, which controls the request time limit
  for potentially slow POST requests that need to be as atomic as possible.
* ResourceLoader now loads all scripts asynchronously. The top-queue and
  startup modules are no longer synchronously loaded.
* 'mediawiki.ui.button' styles are no longer unconditionally loaded on every
  page. During the deprecation period, the styles will only be loaded on pages
  which contain 'mw-ui-button' in their HTML. Starting in 1.28, the styles will
  only be loaded if explicitly required.
* If search returns zero results and current search engine has a "did you mean"
  suggestion, results for suggestion will be shown. Can be disabled by setting
  $wgSearchRunSuggestedQuery to false.
* Added several JavaScript libraries for uploading files to MediaWiki
  from the client-side. See documentation for mw.Upload and its
  subclasses for more information.
* Added OOUI dialogs and layout for file upload interfaces. See
  documentation for mw.Upload.Dialog, mw.Upload.BookletLayout and its
  subclasses for more information.

=== extension.json changes in 1.26 ===
* (T99344) The extension.json schema is now versioned. All extensions
  and skins should set a "manifest_version" property corresponding to
  the schema version they were written for. The only supported version
  currently is "1".
* (T102523) The error message if a non-array attribute is set was improved.
* (T107646) Configuration settings can now specify how they should be merged,
  which is necessary for arrays using integer keys.
* (T110389) Adding namespaces through extension.json now actually works
* $wgNamespaceProtection can now be set in extension.json.
* $wgCapitalLinkOverrides can now be set in extension.json.
* (T97186) Extensions using a custom prefix for their configuration settings
  can now set a "_prefix" key to override the default of "wg".
* (T99084) Extensions can now specify what MediaWiki core versions they
  depend upon.
* (T105236) The extension.json schema now validates custom classes in
  the "ResourceModules" property properly.

=== External library changes in 1.26 ===
==== Upgraded external libraries ====
* Updated es5-shim from v4.0.0 to v4.1.5.
* Updated json2 from revision 2014-02-04 to 2015-05-03.
* Updated Sinon.JS from 1.10.3 to 1.15.4.
* Updated jQuery Client from v1.0.0 to v2.0.0.
* Updated QUnit from v1.17.1 to v1.18.0.
* Updated liuggio/statsd-php-client from v1.0.12 to v1.0.16.
* Updated oojs/oojs-ui from v0.11.3 to v0.12.12.
* Updated wikimedia/cdb from v1.0.1 to v1.3.0.
* Updated wikimedia/utfnormal from v1.0.2 to v1.0.3.
* Updated wikimedia/composer-merge-plugin from v1.0.0 to v1.3.0.
* Updated zordius/lightncandy from v0.18 to v0.21.

==== New external libraries ====
* Added composer/semver v1.0.0.
* Added mediawiki/at-ease v1.1.0.
* Added wikimedia/assert v0.2.2.
* Added wikimedia/ip-set v1.0.1.
* Added wikimedia/wrappedstring v2.0.0.

==== Removed and replaced external libraries ====
* Replaced leafo/lessphp v0.5.0 with oyejorge/less.php v1.7.0.9.

=== Bug fixes in 1.26 ===
* (T53283) load.php sometimes sends 304 response without full headers
* (T65198) Talk page tabs now have a "rel=discussion" attribute
* (T98841) {{msgnw:}} now preserves comments even when subst: is not used.
* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default
  value if set to an empty string.

=== Action API changes in 1.26 ===
* New-style continuation is now the default for action=continue. Clients may
  use the 'rawcontinue' parameter to receive raw query-continue data, but the
  new style is encouraged as it's harder to implement incorrectly.
* Deprecated API formats dump and wddx have been completely removed.
* API action=query&list=tags: The displayname can now be boolean false if the
  tag is meant to be hidden from user interfaces.
* action=import no longer allows both the namespace= and rootpage= parameters
  to be set. If they are both set, the value of rootpage= will be ignored.
* prop=revision output in enum mode is now sorted by timestamp rather than
  revision ID. This usually won't make any difference.
* (T102645) Namespace list from meta=siteinfo&siprop=namespaces is now an array
  with formatversion=2.
* Various other output from meta=siteinfo will now always be arrays instead of
  sometimes being numerically-indexed objects with formatversion=2.
* When errors about users being blocked are returned, they now include
  information about the relevant block.
* (T99926) list=random has higher limits, in line with other API modules.
* list=random's rnredirect parameter is deprecated in favor of a new
  rnfilterredir parameter that also allows for listing both redirects and
  non-redirects.
* list=random now supports continuation.
* API responses to GET requests may now include ETag and Last-Modified headers,
  and will honor corresponding If-None-Match and If-Modified-Since on such
  requests.

=== Action API internal changes in 1.26 ===
* New metadata item ApiResult::META_KVP_MERGE to allow for merging the KVP key
  into the value when the value is an assoc.
* API action modules may now provide values for the RFC 7232 ETag and
  Last-Modified headers. The API will check these against If-None-Match and
  If-Modified-Since request headers on GET requests and avoid executing the
  module when appropriate.

=== Languages updated in 1.26 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.

* Languages added:
** ase (American sign language), thanks to translator Icemandeaf
** dty (डोटेली/Doteli), thanks to translators जनक राज भट्ट, बिप्लब आनन्द,
   मेश सिंह बोहरा, and राम प्रसाद जोशी
** luz (لئری دوٙمینی / Southern Luri)
** olo (Livvinкarjala / Livvi-Karelian), thanks to translators Denö, Hiloin
   Natoi, Ilja.mos, and Mashoi7

=== Other changes in 1.26 ===
* ChangeTags::tagDescription() will return false if the interface message
  for the tag is disabled.
* Added PageHistoryPager::doBatchLookups hook.
* Added $wikiId parameter to FormatAutocomments hook.
* Added ParserCacheSaveComplete to ParserCache
* supportsDirectEditing and supportsDirectApiEditing methods added to
  ContentHandler, to provide a way for ApiEditPage and EditPage to check
  if direct editing of content is allowed. These methods return false,
  by default for the ContentHandler base class and true for TextContentHandler
  and it's derivative classes (everything in core). For Content types that
  do not support direct editing, an alternative mechanism should be provided
  for editing, such as action overrides or specific api modules.
* mediaWiki.confirmCloseWindow now returns an object of functions, instead of
  one function. The callback can't be called directly any more. The callback
  function is replaced with confirmCloseWindow.release().
* BREAKING CHANGE: Added an optional ResouceLoaderContext parameter to
  ResourceLoaderModule::getDependencies(). Extension classes that override that
  method should be updated. If they aren't updated, PHP Strict standards
  warnings will appear when E_STRICT error reporting is enabled. Note: in the
  near future, this parameter will probably become non-optional.
* Removed maintenance script deleteImageMemcached.php.
* MWFunction::newObj() was removed (deprecated in 1.25).
  ObjectFactory::getObjectFromSpec() should be used instead.
* The parser will no longer randomize the string it uses to mark the place of
  items that were stripped during parsing. It will use a fixed string instead.
  This causes the parser to re-use the regular expressions it uses to search
  and replace markers rather than generate novel expressions on each parse.
  Re-using regular expressions will improve performance on HHVM and the
  forthcoming PHP 7. The interfaces changes accompanying this change are:
  - Parser::getRandomString() and Parser::uniqPrefix() have been deprecated.
  - The $uniq_prefix argument for Parser::extractTagsAndParams() and the
    $prefix argument for StripState::_construct() are deprecated and their
    value is ignored.
* wfSuppressWarnings() and wfRestoreWarnings() were split into a separate
  library, mediawiki/at-ease, and are now deprecated. Callers should use
  MediaWiki\suppressWarnings() and MediaWiki\restoreWarnings() directly.
* The Block class constructor now takes an associative array of parameters
  instead of many optional positional arguments. Calling the constructor the old
  way will issue a deprecation warning.
* The jquery.mwExtension module was deprecated.
* $wgSpecialPageGroups was removed (deprecated in 1.21).
* SpecialPageFactory::setGroup was removed (deprecated in 1.21).
* SpecialPageFactory::getGroup was removed (deprecated in 1.21).
* DatabaseBase::ignoreErrors() is now protected.
* BREAKING CHANGE: mediawiki.legacy.ajax has been removed, following
  a lengthy deprecation period.
* The ScopedPHPTimeout class was removed.
* Removed maintenance script fixSlaveDesync.php.
* Watchlist tokens, SpecialResetTokens, and User::getTokenFromOption()
  are deprecated. Applications using those can work via the OAuth
  extension instead. New tokens types should not be added.
* DatabaseBase::errorCount() was removed (unused).
* $wgDeferredUpdateList was removed.
* DeferredUpdates::addHTMLCacheUpdate() was removed.

= MediaWiki 1.25 =

== MediaWiki 1.25.6 ==

This is a maintenance release of the MediaWiki 1.25 branch.

=== Changes since 1.25.5 ===
* (T123166) Fix fatal error when importing pages to titles which cannot be
  created, such as invalid titles or titles the user is not allowed to edit.
* (T122056) Old tokens are remaining valid within a new session
* (T127114) Login throttle can be tricked using non-canonicalized usernames
* (T123653) Cross-domain policy regexp is too narrow
* (T123071) Incorrectly identifying http link in a's href attributes, due to
  m modifier in regex
* (T129506) MediaWiki:Gadget-popups.js isn't renderable
* (T125283) Users occasionally logged in as different users after
  SessionManager deployment
* (T103239) Patrol allows click catching and patrolling of any page
* (T122807) [tracking] Check php crypto primatives
* (T98313) Graphs can leak tokens, leading to CSRF
* (T130947) Diff generation should use PoolCounter
* (T133507) Careless use of $wgExternalLinkTarget is insecure
* (T132874) API action=move is not rate limited
* (T110143) strip markers can be used to get around html attribute escaping in
  (many?) parser tags
* (T116030) Increase pbkdf2 parameter strengths
* (T127420) Pbkdf2Password does not check if hash_pbkdf2() succeeded
* (T126685) Globally throttle password attempts

== MediaWiki 1.25.5 ==

This is a maintenance release of the MediaWiki 1.25 branch.

=== Changes since 1.25.4 ===
* (T121892) Fix fatal error on some Special pages, introduced in 1.25.4.

== MediaWiki 1.25.4 ==

This is a security and maintenance release of the MediaWiki 1.25 branch.

=== Changes since 1.25.3 ===
* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
  that do not begin with a slash. This enabled trivial XSS attacks.
  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
  error.
* (T119309) SECURITY: Use hash_compare() for edit token comparison
* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
  with '@' as file uploads
* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
  longer be shorter than $wgMinimalPasswordLength
* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
  result in improper blocks being issued
* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
  and related pages no longer use HTTP redirects and are now redirected by
  MediaWiki
* (T103237) $wgUseGzip had no effect when using file cache.
* (T114606) mw.notify was not correctly fixed to the page if
  initialized while not at the top of the page.
* Fix issue that breaks HHVM Repo Authorative mode.

== MediaWiki 1.25.3 ==

This is a security and maintenance release of the MediaWiki 1.25 branch.

=== Changes since 1.25.2 ===

* (T98975) Fix having multiple callbacks for a single hook.
* (T107632) maintenance/refreshLinks.php did not always remove all links
  pointing to nonexistent pages.
* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default
  value if set to an empty string.
* (T62174) Provide fallbacks for use of mb_convert_encoding() in
  HtmlFormatter. It was causing an error when accessing the api help page
  if the mbstring PHP extension was not installed.
* (T105896) Confirmation emails would sometimes contain invalid codes.
* (T105597) Fixed edit stash inclusion queries.
* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload
* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading
* (T95589) SECURITY: RevDel: Check all revisions for suppression, not just the
  first
* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails

== MediaWiki 1.25.2 ==

This is a security and maintenance release of the MediaWiki 1.25 branch.

=== Changes since 1.25.1 ===

* (T94116) SECURITY: Compare API watchlist token in constant time
* (T97391) SECURITY: Escape error message strings in thumb.php
* (T106893) SECURITY: Don't leak autoblocked IP addresses on
  Special:DeletedContributions
* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only
  policy of Wikimedia Commons.
* (T100767) Setting a configuration setting for skin or extension to
  false in LocalSettings.php was not working.
* (T100635) API action=opensearch json output no longer breaks when
  $wgDebugToolbar is enabled.
* (T102522) Using an extension.json or skin.json file which has
  a "manifest_version" property for 1.26 compatability will no longer
  trigger warnings.
* (T86156) Running updateSearchIndex.php will not throw an error as
  page_restrictions has been added to the locked table list.
* Special:Version would throw notices if using SVN due to an incorrectly
  named variable. Add an additional check that an index is defined.

== MediaWiki 1.25.1 ==

This is a bug fix release of the MediaWiki 1.25 branch.

=== Changes since 1.25 ===
* (T100351) Fix syntax errors in extension.json of ConfirmEdit extension

== MediaWiki 1.25.0 ==

=== Configuration changes in 1.25 ===
* $wgPageShowWatchingUsers was removed.
* $wgLocalVirtualHosts has been added to replace $wgConf->localVHosts.
* $wgAntiLockFlags was removed.
* $wgJavaScriptTestConfig was removed.
* Edit tokens returned from User::getEditToken may change on every call. Token
  validity must be checked by passing the user-supplied token to
  User::matchEditToken rather than by testing for equality with a
  newly-generated token.
* (T74951) The UserGetLanguageObject hook may be passed any IContextSource
  for its $context parameter. Formerly it was documented as receiving a
  RequestContext specifically.
* Profiling was restructured and $wgProfiler now requires an 'output' parameter.
  See StartProfiler.sample for details.
* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
  might be a flash policy directive configurable.
* ApiOpenSearch now supports XML output. The OpenSearchXml extension should no
  longer be used. If extracts and page images are desired, the TextExtracts and
  PageImages extensions are required.
* $wgOpenSearchTemplate is deprecated in favor of $wgOpenSearchTemplates.
* Edits are now prepared via AJAX as users type edit summaries. This behavior
  can be disabled via $wgAjaxEditStash.
* (T46740) The temporary option $wgIncludejQueryMigrate was removed, along
  with the jQuery Migrate library, as indicated when this option was provided in
  MediaWiki 1.24.
* ProfilerStandard and ProfilerSimpleTrace were removed. Make sure that any
  StartProfiler.php config is updated to reflect this. Xhprof is available
  for zend/hhvm. Also, for hhvm, one can consider using its xenon profiler.
* Default value of $wgSVGConverters['rsvg'] now uses the 'rsvg-convert' binary
  rather than 'rsvg'.
* Default value of $wgSVGConverters['ImageMagick'] now uses transparent
  background with white fallback color, rather than just white background.
 * MediaWikiBagOStuff class removed, make sure any object cache config
   uses SqlBagOStuff instead.
* The 'daemonized' flag must be set to true in $wgJobTypeConf for any redis
  job queues. This means that mediawiki/services/jobrunner service has to
  be installed and running for any such queues to work.
* $wgAutopromoteOnce no longer supports the 'view' event. For keeping some
  compatibility, any 'view' event triggers will still trigger on 'edit'.
* $wgExtensionDirectory was added for when your extensions directory is
  somewhere other than $IP/extensions (as $wgStyleDirectory does with the skins
  directory).

=== New features in 1.25 ===
* (T64861) Updated plural rules to CLDR 26. Includes incompatible changes
  for plural forms in Russian, Prussian, Tagalog, Manx and several languages
  that fall back to Russian.
* (T60139) ResourceLoaderFileModule now supports language fallback
  for 'languageScripts'.
* Added a new hook, "ContentAlterParserOutput", to allow extensions to modify
  the parser output for a content object before links update.
* (T37785) Enhanced recent changes and extended watchlist are now default.
  Documentation: https://meta.wikimedia.org/wiki/Help:Enhanced_recent_changes
  and https://www.mediawiki.org/wiki/Manual:$wgDefaultUserOptions
* (T69341) SVG images will no longer be base64-encoded when being embedded
  in CSS. This results in slight size increase before gzip compression (due to
  percent-encoding), but up to 20% decrease after it.
* Update jStorage to v0.4.12.
* MediaWiki now natively supports page status indicators: icons (or short text
  snippets) usually displayed in the top-right corner of the page. They have
  been in use on Wikipedia for a long time, implemented using templates and CSS
  absolute positioning.
  - Basic wikitext syntax:
    <indicator name="foo">[[File:Foo.svg|20px]]</indicator>
  - Usage instructions:
    https://www.mediawiki.org/wiki/Help:Page_status_indicators
  - Adjusting custom skins to support indicators:
    https://www.mediawiki.org/wiki/Manual:Skinning#Page_status_indicators
* Edit tokens may now be time-limited: passing a maximum age to
  User::matchEditToken will reject any older tokens.
* The debug logging internals have been overhauled, and are now using the
  PSR-3 interfaces.
* Update CSSJanus to v1.1.1.
* Update lessphp to v0.5.0.
* Added a hook, "ApiOpenSearchSuggest", to allow extensions to provide extracts
  and images for ApiOpenSearch output. The semantics are identical to the
  "OpenSearchXml" hook provided by the OpenSearchXml extension.
* PrefixSearchBackend hook now has an $offset parameter. Combined with $limit,
  this allows for pagination of prefix results. Extensions using this hook
  should implement supporting behavior. Not doing so can result in undefined
  behavior from API clients trying to continue through prefix results.
* Update jQuery from v1.11.1 to v1.11.3.
* External libraries installed via composer will now be displayed
  on Special:Version in their own section. Extensions or skins that are
  installed via composer will not be shown in this section as it is assumed
  they will add the proper credits to the skins or extensions section. They
  can also be accessed through the API via the new siprop=libraries to
  ApiQuerySiteinfo.
* Update QUnit from v1.14.0 to v1.16.0.
* Update Moment.js from v2.8.3 to v2.8.4.
* Special:Tags now allows for manipulating the list of user-modifiable change
  tags.
* Added 'managetags' user right and 'ChangeTagCanCreate', 'ChangeTagCanDelete',
  and 'ChangeTagCanCreate' hooks to allow for managing user-modifiable change
  tags.
* Added 'ChangeTagsListActive' hook, to separate the concepts of "defined" and
  "active" formerly conflated by the 'ListDefinedTags' hook.
* Added TemplateParser class that provides a server-side interface to cachable
  dynamically-compiled Mustache templates (currently uses lightncandy library).
* Clickable anchors for each section heading in the content are now generated
  and appear in the gutter on hovering over the heading.
* Added 'CategoryViewer::doCategoryQuery' and 'CategoryViewer::generateLink'
  hooks to allow extensions to override how links to pages are rendered within
  NS_CATEGORY
* (T19665) Special:WantedPages only lists page which having at least one red
  link pointing to it.
* New hooks 'ApiMain::moduleManager' and 'ApiQuery::moduleManager', can be
  used for conditional registration of API modules.
* New hook 'EnhancedChangesList::getLogText' to alter, remove or add to the
  links of a group of changes in EnhancedChangesList.
* A full interface for StatsD metric reporting has been added to the context
  interface, reachable via IContextSource::getStats().
* Move the jQuery Client library from being mastered in MediaWiki as v0.1.0 to a
  proper, published library, which is now tagged as v1.0.0.
* A new message (defaulting to blank), 'editnotice-notext', can be shown to
  users when they are editing if no edit notices apply to the page being edited.
* (T94536) You can now make the sitenotice appear to logged-in users only by
  editing MediaWiki:Anonnotice and replacing its content with "". Setting it to
  "-" (default) will continue disable it and fallback to MediaWiki:Sitenotice.
* Modifying the tagging of a revision or log entry is now available via
  Special:EditTags, generally accessed via the revision-deletion-like interface
  on history pages and Special:Log is likely to be more useful.
* Added 'applychangetags' and 'changetags' user rights.
* (T35235) LogFormatter subclasses are now responsible for formatting the
  parameters for API log event output. Extensions should implement the new
  getParametersForApi() method in their log formatters.

==== External libraries ====
* MediaWiki now requires certain external libraries to be installed. In the past
  these were bundled inside the Git repository of MediaWiki core, but now they
  need to be installed separately. For users using the tarball, this will be
  taken care of and no action will be required. Users using Git will either need
  to use composer to fetch dependencies or use the mediawiki/vendor repository
  which includes all dependencies for MediaWiki core and ones used in Wikimedia
  deployment. Detailed instructions can be found at:
  https://www.mediawiki.org/wiki/Download_from_Git#Fetch_external_libraries
* The following libraries are now required:
** psr/log
   This library provides the interfaces set by the PSR-3 standard
   (http://www.php-fig.org/psr/psr-3/) which are used by MediaWiki internally
   via the MediaWiki\Logger\LoggerFactory class.
   See the structured logging RfC
   <https://www.mediawiki.org/wiki/Requests_for_comment/Structured_logging>
   for more background information.
** cssjanus/cssjanus
   This library was formerly bundled with MediaWiki core and has been removed.
   It automatically flips CSS for RTL support.
** leafo/lessphp
   This library was formerly bundled with MediaWiki core and has been removed.
   It compiles LESS files into CSS.
** wikimedia/cdb
   This library was formerly a part of MediaWiki core, and has been moved into a
   separate library. It provides CDB functions which are used in the Interwiki
   and Localization caches. More information about the library can be found at
   https://www.mediawiki.org/wiki/CDB.
** liuggio/statsd-php-client
   This library provides a StatsD client API for logging application metrics to
   a remote server.

=== Bug fixes in 1.25 ===
* (T73003) No additional code will be generated to try to load CSS-embedded
  SVG images in Internet Explorer 6 and 7, as they don't support them anyway.
* (T69021) On Special:BookSources, corrected validation of ISBNs (both
  10- and 13-digit forms) containing "X".
* Page moving was refactored into a MovePage class. As part of that:
** The AbortMove hook was removed.
** MovePageIsValidMove is for extensions to specify whether a page
   cannot be moved for technical reasons, and should not be overridden.
** MovePageCheckPermissions is for checking whether the given user is
   allowed to make the move.
** Title::moveNoAuth() was deprecated. Use the MovePage class instead.
** Title::moveTo() was deprecated. Use the MovePage class instead.
** Title::isValidMoveOperation() broken down into MovePage::isValidMove()
   and MovePage::checkPermissions().
* (T18530) Multiple autocomments are now formatted in an edit summary.
* (T70361) Autocomments containing "/*" are parsed correctly.
* The Special:WhatLinksHere page linked from 'Number of redirects to this page'
  on action=info about a file page does not list file links anymore.
* (T78637) Search bar is not autofocused unless it is empty so that proper
  scrolling using arrow keys is possible.
* (T50853) Database::makeList() modified to handle 'NULL' separately when
  building IN clause
* (T85192) Captcha position modified in Usercreate template. As a result:
** extrafields parameter added to Usercreate.php to insert additional data
** 'extend' method added to QuickTemplate to append additional values to any
  field of data array
* (T86974) Several Title methods now load from the database when necessary
  (instead of returning incorrect results) even when the page ID is known.
* (T74070) Duplicate search for archived files on file upload now omits the
  extension.
  This requires the fa_sha1 field being populated.
* Removed rel="archives" from the "View history" link, as it did not pass
  HTML validation.
* $wgUseTidy is now set when parserTests are run with the tidy option to match
  output on wiki.
* (T37472) update.php will purge ResourceLoader cache unless --nopurge is passed
  to it.
* (T72109) mediawiki.language should respect $wgTranslateNumerals in
  convertNumber().

=== Action API changes in 1.25 ===
* (T67403) XML tag highlighting is now only performed for formats
  "xmlfm" and "wddxfm".
* action=paraminfo supports generalized submodules (modules=query+value),
  querymodules and formatmodules are deprecated
* action=paraminfo no longer outputs descriptions and other help text by
  default. If needed, it may be requested using the new 'helpformat' parameter.
* action=help has been completely rewritten, and outputs help in HTML
  rather than plain text.
* Hitting api.php without specifying an action now displays only the help for
  the main module, with links to submodule help.
* API help is no longer displayed on errors.
* 'uselang' is now a recognized API parameter; "uselang=user" may be used to
  explicitly select the language from the current user's preferences, and
  "uselang=content" may be used to select the wiki's content language.
* Default output format for the API is now jsonfm.
* Simplified continuation will return a "batchcomplete" property in the result
  when a batch of pages is complete.
* Pretty-printed HTML output now has nicer formatting and (if available)
  better syntax highlighting.
* Deprecated list=deletedrevs in favor of newly-added prop=deletedrevisions and
  list=alldeletedrevisions.
* prop=revisions will gracefully continue when given too many revids or titles,
  rather than just ignoring the extras.
* prop=revisions will no longer die if rvcontentformat doesn't match a
  revision's content model; it will instead warn and omit the content.
* If the user has the 'deletedhistory' right, action=query's revids parameter
  will now recognize deleted revids.
* prop=revisions may be used as a generator, generating revids.
* (T68776) format=json results will no longer be corrupted when
  $wgMangleFlashPolicy is in effect. format=php results will cleanly return an
  error instead of returning invalid serialized data.
* Generators may now return data for the generated pages when used with
  action=query.
* Query page data for generator=search and generator=prefixsearch will now
  include an "index" field, which may be used by the client for sorting the
  search results.
* ApiOpenSearch now supports XML output.
* ApiOpenSearch will now output descriptions and URLs as array indexes 2 and 3
  in JSON format.
* (T76051) list=tags will now continue correctly.
* (T76052) list=tags can now indicate whether a tag is defined.
* (T75522) list=prefixsearch now supports continuation
* (T78737) action=expandtemplates can now return page properties.
* (T78690) list=allimages now accepts multiple pipe-separated values
  for the 'aimime' parameter.
* prop=info with inprop=protections will now return applicable protection types
  with the 'restrictiontypes' key.
* (T85417) When resolving redirects, ApiPageSet will now add the targets of
  interwiki redirects to the list of interwiki titles.
* (T85417) When outputting the list of redirect titles, a 'tointerwiki'
  property (like the existing 'tofragment' property) will be set.
* Added action=managetags to allow for managing the list of
  user-modifiable change tags. Actually modifying the tagging of a revision or
  log entry is not implemented yet.
* list=tags has additional properties to indicate 'active' status and tag
  sources.
* siprop=libraries was added to ApiQuerySiteinfo to list installed external
  libraries.
* (T88010) Added action=checktoken, to test a CSRF token's validity.
* (T88010) Added intestactions to prop=info, to allow querying of
  Title::userCan() via the API.
* Default type param for query list=watchlist and list=recentchanges has
  been changed from all types (e.g. including 'external') to 'edit|new|log'.
* Added formatversion to format=json. Still "experimental" as further changes
  to the output formatting might still be made.
* (T73020) Log event details are now always under a 'params' subkey for
  list=logevents, and a 'logparams' subkey for list=watchlist and
  list=recentchanges.
* Log event details are changing formatting:
  * block events now report flags as an array rather than as a comma-separated
    list.
  * patrol events now report the 'auto' flag as a boolean (absent/empty string
    for BC formats) rather than as an integer.
  * rights events now report the old and new group lists as arrays rather than
    as comma-separated lists.
  * merge events use new-style formatting.
  * delete/event and delete/revision events use new-style formatting.
* The root node and various other nodes will now always be an object in formats
  such as json that distinguish between arrays and objects.
  * Except for action=opensearch where the spec requires an array.

=== Action API internal changes in 1.25 ===
* ApiHelp has been rewritten to support i18n and paginated HTML output.
  Most existing modules should continue working without changes, but should do
  the following:
  * Add an i18n message "apihelp-{$moduleName}-description" to replace
    getDescription().
  * Add i18n messages "apihelp-{$moduleName}-param-{$param}" for each parameter
    to replace getParamDescription(). If necessary, the settings array returned
    by getParams() can use the new ApiBase::PARAM_HELP_MSG key to override the
    message.
  * Implement getExamplesMessages() to replace getExamples().
* Modules with submodules (like action=query) must have their submodules
  override ApiBase::getParent() to return the correct parent object.
* The 'APIGetDescription' and 'APIGetParamDescription' hooks are deprecated,
  and will have no effect for modules using i18n messages. Use
  'APIGetDescriptionMessages' and 'APIGetParamDescriptionMessages' instead.
* Api formatters will no longer be asked to display the help screen on errors.
* ApiMain::getCredits() was removed. The credits are available in the
  'api-credits' i18n message.
* ApiFormatBase has been changed to support i18n and syntax highlighting via
  extensions with the new 'ApiFormatHighlight' hook. Core syntax highlighting
  has been removed.
* ApiFormatBase now always buffers. Output is done when
  ApiFormatBase::closePrinter is called.
* Much of the logic in ApiQueryRevisions has been split into
  ApiQueryRevisionsBase.
* The 'revids' parameter supplied by ApiPageSet will now count deleted
  revisions as "good" if the user has the 'deletedhistory' right. New methods
  ApiPageSet::getLiveRevisionIDs() and ApiPageSet::getDeletedRevisionIDs() are
  provided to access just the live or just the deleted revids.
* Added ApiPageSet::setGeneratorData() and ApiPageSet::populateGeneratorData()
  to allow generators to include data in the action=query result.
* New hooks 'ApiMain::moduleManager' and 'ApiQuery::moduleManager', can be
  used for conditional registration of API modules.
* Added ApiBase::lacksSameOriginSecurity() to allow modules to easily check if
  the current request was sent with the 'callback' parameter (or any future
  method that breaks the same-origin policy).
* Profiling methods in ApiBase are deprecated and no longer need to be called.
* ApiResult was greatly overhauled. See inline documentation for details.
* ApiResult will automatically convert objects to strings or arrays (depending
  on whether a __toString() method exists on the object), and will refuse to
  add unsupported value types.
  * An informal interface, ApiSerializable, exists to override the default
    object conversion.
* ApiResult/ApiFormatBase "raw mode" is deprecated.
* ApiFormatXml now assumes defaults and so on instead of throwing errors when
  metadata isn't set.
* (T35235) LogFormatter subclasses are now responsible for formatting log event
  parameters for the API.
* Many modules have changed result data formats. While this shouldn't affect
  clients not using the experimental formatversion=2, code using
  ApiResult::getResultData() without the transformations for backwards
  compatibility may need updating, as will code that wasn't following the old
  conventions for API boolean output.
* The following methods have been deprecated and may be removed in a future
  release:
  * ApiBase::getDescription
  * ApiBase::getParamDescription
  * ApiBase::getExamples
  * ApiBase::makeHelpMsg
  * ApiBase::makeHelpArrayToString
  * ApiBase::makeHelpMsgParameters
  * ApiBase::getModuleProfileName
  * ApiBase::profileIn
  * ApiBase::profileOut
  * ApiBase::safeProfileOut
  * ApiBase::getProfileTime
  * ApiBase::profileDBIn
  * ApiBase::profileDBOut
  * ApiBase::getProfileDBTime
  * ApiBase::getResultData
  * ApiFormatBase::setUnescapeAmps
  * ApiFormatBase::getWantsHelp
  * ApiFormatBase::setHelp
  * ApiFormatBase::formatHTML
  * ApiFormatBase::setBufferResult
  * ApiFormatBase::getDescription
  * ApiFormatBase::getNeedsRawData
  * ApiMain::setHelp
  * ApiMain::reallyMakeHelpMsg
  * ApiMain::makeHelpMsgHeader
  * ApiResult::setRawMode
  * ApiResult::getIsRawMode
  * ApiResult::getData
  * ApiResult::setElement
  * ApiResult::setContent
  * ApiResult::setIndexedTagName_recursive
  * ApiResult::setIndexedTagName_internal
  * ApiResult::setParsedLimit
  * ApiResult::beginContinuation
  * ApiResult::setContinueParam
  * ApiResult::setGeneratorContinueParam
  * ApiResult::endContinuation
  * ApiResult::size
  * ApiResult::convertStatusToArray
  * ApiQueryImageInfo::getPropertyDescriptions
  * ApiQueryLogEvents::addLogParams
* The following classes have been deprecated and may be removed in a future
  release:
  * ApiQueryDeletedrevs

=== Languages updated in 1.25 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* Languages added:
** awa (अवधी / Awadhi), thanks to translator 1AnuraagPandey;
** bgn (بلوچی رخشانی / Western Balochi), thanks to translators
   Baloch Afghanistan, Ibrahim khashrowdi and Rachitrali;
** ses (Koyraboro Senni), thanks to translator Songhay.
* (T66440) Kazakh (kk) wikis should no longer forcefully reset the user's
  interface language to kk where unexpected.
* The Chinese conversion table was substantially updated to fix a lot of
  bugs and ensure better reading experience for different variants.

=== Other changes in 1.25 ===
* (T45591) Links to MediaWiki.org translatable help were added to indicators,
  mostly in special pages. Local custom target titles can be placed in the
  relevant '(namespace-X|action name|special page name)-helppage' system
  message. Extensions can use the addHelpLink() function to do the same.
* The skin autodiscovery mechanism, deprecated in MediaWiki 1.23, has been
  removed. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery for
  migration guide for creators and users of custom skins that relied on it.
* Javascript variables 'wgFileCanRotate' and 'wgFileExtensions' now only
  available on Special:Upload.
* (T58257) Set site logo from mediawiki.skinning.interface module instead of
  inline styles in the HTML.
* Removed ApiQueryUsers::getAutoGroups(). (deprecated since 1.20)
* Removed XmlDumpWriter::schemaVersion(). (deprecated since 1.20)
* Removed LogEventsList::getDisplayTitle(). (deprecated since 1.20)
* Removed Preferences::trySetUserEmail(). (deprecated since 1.20)
* Removed mw.user.name() and mw.user.anonymous() methods. (deprecated since
  1.20)
* Removed 'ok' and 'err' parameters in the mediawiki.api modules. (deprecated
  since 1.20)
* Removed 'async' parameter from the  mw.Api#getCategories() method. (deprecated
  since 1.20)
* Removed 'jquery.json' module. (deprecated since 1.24)
  Use the 'json' module and global JSON object instead.
* Deprecated OutputPage::readOnlyPage() and OutputPage::rateLimited().
  Also, the former will now throw an MWException if called with one or more
  arguments.
* Removed hitcounters and associated code.
* The "temp" zone of the upload respository is now considered private. If it
  already exists (such as under the images/ directory), please make sure that
  the directory is not web readable (e.g. via a .htaccess file).
* BREAKING CHANGE: In the XML dump format used by Special:Export and
  dumpBackup.php, the <model> and <format> tags now apprear before the <text>
  tag, instead of after the <text> and <sha1> tags.
  The new schema version is 0.10, the new schema URI is:
  https://www.mediawiki.org/xml/export-0.10.xsd
* MWFunction::call() and MWFunction::callArray() were removed, having being
  deprecated in 1.22.
* Deprecated the getInternalLinkAttributes, getInternalLinkAttributesObj,
  and getInternalLinkAttributes methods in Linker, and removed
  getExternalLinkAttributes method, which was deprecated in MediaWiki 1.18.
* Removed Sites class, which was deprecated in 1.21 and replaced by
  SiteSQLStore.
* Added wgRelevantArticleId to the client-side config, for use on special pages.
* Deprecated the TitleIsCssOrJsPage hook. Superseded by the
  ContentHandlerDefaultModelFor hook since MediaWiki 1.21.
* Deprecated the TitleIsWikitextPage hook. Superseded by the
  ContentHandlerDefaultModelFor hook since MediaWiki 1.21.
* Changed parsing of variables in schema (.sql) files:
** The substituted values are no longer parsed. (Formerly, several passes
   were made for each variable, so depending on the order in which variables
   were defined, variables might have been found inside encoded values. This
   is no longer the case.)
** Variables are no longer string encoded when the /*$var*/ syntax is used.
   If string encoding is necessary, use the '{$var}' syntax instead.
** Variable names must only consist of one or more of the characters
   "A-Za-z0-9_".
** In source text of the form '{$A}'{$B}' or `{$A}`{$B}`, where variable A
   does not exist yet variable B does, the latter may not be replaced.
   However, this difference is unlikely to arise in practice.
* (T67278) RFC, PMID, and ISBN "magic links" must be surrounded by non-word
  characters on both sides.
* The FormatAutocomments hook will now receive $pre and $post as booleans,
  rather than as strings that must be prepended or appended to $comment.
* (T30950, T31025) RFC, PMID, and ISBN "magic links" can no longer contain
  newlines; but they can contain &nbsp; and other non-newline whitespace.
* The 'mediawiki.action.edit' ResourceLoader module no longer generates the edit
  toolbar, which has been moved to a separate 'mediawiki.toolbar' module. If you
  relied on this behavior, update your scripts' dependencies.
* HTMLForm's 'vform' display style has been separated to a subclass. Therefore:
  * HTMLForm::isVForm() is now deprecated.
  * You can no longer do this:
      $form = new HTMLForm( … );
      $form->setDisplayFormat( 'vform' ); // throws exception
    Instead, do this:
      $form = HTMLForm::factory( 'vform', … );
* Deprecated Revision methods getRawUser(), getRawUserText() and
  getRawComment().
* BREAKING CHANGE: mediawiki.user.generateRandomSessionId:
  The alphabet of the prior string returned was A-Za-z0-9 and now it is 0-9A-F
* (T87504) Avoid serving SVG background-images in CSS for Opera 12, which
  renders them incorrectly when combined with border-radius or background-size.
* Removed maintenance script dumpSisterSites.php.
* DatabaseBase class constructors must be called using the array argument style.
  Ideally, DatabaseBase:factory() should be used instead in most cases.
* Deprecated ParserOutput::addSecondaryDataUpdate and
  ParserOutput::getSecondaryDataUpdates.
  This is a hard deprecation, with getSecondaryDataUpdates returning an empty
  array and addSecondaryDataUpdate throwing an exception. These functions will
  be removed in 1.26, since they interfere with caching of ParserOutput objects.
* Introduced new hook 'SecondaryDataUpdates' that allows extensions to inject
  custom updates.
* Introduced new hook 'OpportunisticLinksUpdate' that allows extensions to
  perform updates when a page is re-rendered.
* EditPage::attemptSave has been modified not to call handleStatus itself and
  instead just returns the Status object. Extension calling it should be aware
  of this.
* Removed class DBObject. (unused since 1.10)
* wfDiff() is deprecated.
* The -m (maximum replication lag) option of refreshLinks.php was removed.
  It had no effect since MediaWiki 1.18 and should be removed from any cron
  jobs or similar scripts you may have set up.
* (T85864) The following messages no longer support raw html: redirectto,
  thisisdeleted, viewdeleted, editlink, retrievedfrom, version-poweredby-others,
  retrievedfrom, thisisdeleted, viewsourcelink, lastmodifiedat, laggedslavemode,
  protect-summary-cascade
* All BloomCache related code has been removed. This was largely experimental.
* $wgResourceModuleSkinStyles no longer supports per-module local or remote
  paths. They can only be set for the entire skin.
* Removed global function swap(). (deprecated since 1.24)
* Deprecated the ".php5" file extension entry points and the $wgScriptExtension
  configuration variable. Refer to the ".php" files instead. If you want
  ".php5" URLs to continue to work, set up redirects. In Apache, this can be
  done by enabling mod_rewrite and adding the following rules to your
  configuration:

    RewriteEngine On
    RewriteBase /
    RewriteRule ^(.*)\.php5 $1.php [R=301,L]

* The global importScriptURI and importStylesheetURI functions, as well as the
  loadedScripts object, from wikibits.js (deprecated since 1.17) now emit
  warnings through mw.log.warn when accessed.

= MediaWiki 1.24 =

== MediaWiki 1.24.6 ==

This is a maintenance release of the MediaWiki 1.24 branch.

=== Changes since 1.24.5 ===
* (T121892) Fix fatal error on some Special pages, introduced in 1.24.5.

== MediaWiki 1.24.5 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.24.4 ===
* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
  that do not begin with a slash. This enabled trivial XSS attacks.
  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
  error.
* (T119309) SECURITY: Use hash_compare() for edit token comparison
* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
  with '@' as file uploads
* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
  longer be shorter than $wgMinimalPasswordLength
* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
  result in improper blocks being issued
* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
  and related pages no longer use HTTP redirects and are now redirected by
  MediaWiki
* (T103237) $wgUseGzip had no effect when using file cache.

== MediaWiki 1.24.4 ==

This is a security and maintenance release of the MediaWiki 1.24 branch.

=== Changes since 1.24.3 ===

* (T91653) Minimal PSR-3 debug logger to support backports from 1.25+.
* (T68650) Fix indexing of moved pages with PostgreSQL. Requires running
  update.php to fix.
* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload
* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading
* (T95589) SECURITY: RevDel: Check all revisions for suppression, not just the
  first
* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails

== MediaWiki 1.24.3 ==

This is a security and maintenance release of the MediaWiki 1.24 branch.

=== Changes since 1.24.2 ===

* (T94116) SECURITY: Compare API watchlist token in constant time
* (T97391) SECURITY: Escape error message strings in thumb.php
* (T106893) SECURITY: Don't leak autoblocked IP addresses on
  Special:DeletedContributions
* Update jQuery from v1.11.2 to v1.11.3.
* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only
  policy of Wikimedia Commons.

== MediaWiki 1.24.2 ==

This is a security and maintenance release of the MediaWiki 1.24 branch.

=== Changes since 1.24.1 ===

* (T85848, T71210) SECURITY: Don't parse XMP blocks that contain XML entities,
  to prevent various DoS attacks.
* (T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce
  likelihood of DoS.
* (T88310) SECURITY: Always expand xml entities when checking SVG's.
* (T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
* (T85855) SECURITY: Don't execute another user's CSS or JS on preview.
* (T64685) SECURITY: Allow setting maximal password length to prevent DoS when
  using PBKDF2.
* (T85349, T85850, T86711) SECURITY: Multiple issues fixed in SVG filtering to
  prevent XSS and protect viewer's privacy.
* Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix
  loading these special pages when $wgAutoloadAttemptLowercase is false.
* (bug T70087) Fix Special:ActiveUsers page for installations using
  PostgreSQL.
* (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change
  and running update.php to fix.

== MediaWiki 1.24.1 ==

This is a security and maintenance release of the MediaWiki 1.24 branch.

=== Changes since 1.24.0 ===

* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
  could lead to xss. Permission to edit MediaWiki namespace is required to
  exploit this.
* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in
  $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as
  part of its name.
* (bug T74222) The original patch for T74222 was reverted as unnecessary.
* Fixed a couple of entries in RELEASE-NOTES-1.24.
* (bug T76168) OutputPage: Add accessors for some protected properties.
* (bug T74834) Make 1.24 branch directly installable under PostgreSQL.

== MediaWiki 1.24.0 ==

=== Configuration changes in 1.24 ===
* MediaWiki will no longer run if register_globals is enabled. It has been
  deprecated for 5 years now, and was removed in PHP 5.4. For more information
  about why, see <https://www.mediawiki.org/wiki/register_globals>.
* MediaWiki now requires PHP's iconv extension. openSUSE users may need to
  install the php5-iconv package. Users of other systems may need to add
  extension=iconv.so to php.ini or recompile PHP without --without-iconv.
* MediaWiki will no longer function if magic quotes are enabled. It has
  been deprecated for 5 years now, and was removed in PHP 5.4.
* The server's canonical hostname is available as $wgServerName, which is
  exposed in both mw.config and ApiQuerySiteinfo.
* Introduced $wgPagePropsHaveSortkey as a backwards-compatibility switch,
  for using the old schema of the page_props table, in case the respective
  schema update was not applied.
* $wgSearchEverythingOnlyLoggedIn was removed as the 'searcheverything'
  user option was removed. Use $wgNamespacesToBeSearchedDefault instead or
  if you used to have $wgDefaultUserOptions['searcheverything'] = 1.
* $wgMasterWaitTimeout has been deprecated.
* $wgDBClusterTimeout has been removed.
* $wgProxyKey has been removed. It is no longer used by MediaWiki core.
  Ensure $wgSecretKey is set in LocalSettings.php.
* $wgExtraInterlanguageLinkPrefixes is a new configuration variable that
  contains an array of interwiki prefixes that should be treated as language
  prefixes (i.e. turned into interlanguage links when $wgInterwikiMagic is set
  to true).
* $wgParserTestRemote has been removed.
* $wgCountTotalSearchHits has been removed. If you're concerned about efficiency
  of search, you should use something like CirrusSearch instead of built in
  search.
* Users in the 'sysop' group have access to Special:MergeHistory by default.
* $wgFileStore was removed after having been deprecated in 1.17. Alternative
  configurations are $wgDeletedDirectory and $wgHashedUploadDirectory.
* The deprecated $wgUseCommaCount variable has been removed.
* $wgEnableSorbs and $wgSorbsUrl have been removed.
* The UserCryptPassword and UserComparePassword hooks are no longer called.
  Any extensions using them must be updated to use the Password Hashing API.
* $wgCompiledFiles has been removed.
* $wgSortSpecialPages was removed, the listing on Special:SpecialPages is
  now always sorted.
* $wgSpecialPages may now use callback functions as an alternative to plain
  class names. This allows more control over constructor parameters.
* $wgHTCPMulticastAddress, $wgHTCPMulticastRouting and $wgHTCPPort were removed.
* $wgRC2UDPAddress, $wgRC2UDPInterwikiPrefix, $wgRC2UDPOmitBots, $wgRC2UDPPort
  and $wgRC2UDPPrefix have been removed.
* The default password type for MediaWiki has been changed from MD5 to PBKDF2.
  Password hashes will automatically be updated as users log in. If necessary,
  the old MD5 hashing can be restored by changing $wgPasswordDefault to 'B'.
  In addition, there is a maintenance script wrapOldPassword.php that can wrap
  all passwords in PBKDF2 (or the hashing algorithm of your choice) if you don't
  want to wait for your users to log in.
* $wgImportSources can now either be a regular array, or an associative map
  specifying subprojects on the interwiki map of the target wiki, or a mix of
  the two. Existing configurations will still work.
* Users must be able to edit through a page's protection to be able to delete
  it.
* The default thumb size ($wgDefaultUserOptions['thumbsize']) is now 300px, up
  from 180px. If you have altered the number of entries in $wgThumbLimits for
  your wiki, you may need to adjust your default user settings to compensate for
  the index change.
* $wgDeferredUpdateList is now deprecated, you should use
  DeferredUpdates::addUpdate() instead.
* $wgCanonicalLanguageLinks has been removed. Per Google recommendations, we
  will not send a rel=canonical pointing to a variant-neutral page, however
  we will send rel=alternate.
* $wgResourceLoaderLESSFunctions has been deprecated and will be removed in the
  future.
* $wgGoToEdit has been removed. Use the SpecialSearchNogomatch hook for similar
  functionality.

=== New features in 1.24 ===
* Added new hook WatchlistEditorBeforeFormRender, allowing subscribers to
  manipulate the list of pages and/or preload lots of data at once.
* Added new argument &$link in hook WatchlistEditorBuildRemoveLine, allowing the
  link to the title to be changed.
* Added a new hook, "WhatLinksHereProps", to allow extensions to annotate
  WhatLinksHere entries.
* Added a new hook, "ContentGetParserOutput", to customize parser output for
  a given content object.
* Deprecated the hook "ShowRawCssJs", use "ContentGetParserOutput" instead.
* HTMLForm's HTMLTextField now supports the 'url' type.
* HTMLForm fields may now be dynamically hidden based on the values of other
  fields in the form.
* HTMLForm now supports multiple copies of an input field or set of input
  fields, e.g. the form may request "one or more usernames" without having to
  have the user enter delimited list of names into a text field.
* Added a new hook, "SidebarBeforeOutput", to allow to edit the structure of
  the sidebar just before its display.
* (bug 49156) Added the mediawiki.cookie ResourceLoader module, which wraps
  jquery.cookie so that getting/setting a cookie is syntactically and
  functionally similar to using the WebRequest::getCookie() and
  WebResponse::setcookie() methods.
* (bug 44740) jQuery upgraded from 1.8.3 to 1.11.1. A new configuration option,
  $wgIncludejQueryMigrate, also loads the jQuery Migrate hack to let extensions
  and gadgets use the long-deprecated functions that were removed in jQuery 1.9.
  This option is turned off by default, and will be removed in MediaWiki 1.25.
* (bug 47076) jQuery UI upgraded from 1.8.24 to 1.9.2.
* Changes to content typography (fonts, etc.). See
  https://www.mediawiki.org/wiki/Typography_refresh for further information.
* WikitextContent will now render redirects with the expected "redirect"
  header, rather than as an ordered list. Code calling Article::viewRedirect
  can probably be changed to no longer special-case redirects.
* Header font set to a serif font stack. See
  https://www.mediawiki.org/wiki/Typography_refresh for further information.
* (bug 65567) Added a new hook, "BeforeHttpsRedirect", to allow cancellation of
  the HTTP to HTTPS redirect due to forceHTTPS cookie, userRequires, etc. This
  is only for page views, since this hook doesn't affect UserLogin, OAuth,
  CentralAuth, etc. ATTENTION: This hook is likely to be removed soon due to
  overall design of the system.
* (bug 17367) It is now possible to add pages to your watchlist from
  Special:UnwatchedPages without reloading the special page.
* New methods setVolatile and isVolatile are added to PPFrame, so that
  extensions such as Cite.php can mark that their output is volatile and
  shouldn't be cached.
* (bug 52817) Advanced search options are now saved on the search page itself,
  rather than in a dedicated pane in the preferences panel.
* (bug 44591) The dropdown actions menu (little triangle next to page tabs) in
  the Vector skin has gained a label that should make it more discoverable.
* MWCryptHKDF added for fast, cryptographically secure random number generation
  that won't deplete openssl's entropy pool.
* ResourceLoader: File modules can now provide a skip function that uses an
  inline feature test to bypass loading of the module.
* (bug 20210) Special pages may now provide autocompletion of their subpage
  names in search suggestions. Right now the only useful implementation is in
  Special:Log, but more are to come.
* Special:MostLinkedTemplates is no longer limited to transclusions from the
  Template namespace.
* Skins can now use 'remoteSkinPath' when defining ResourceLoader modules.
  This works the same as 'remoteExtPath' but is relative to the skins/ folder
  instead of the extensions/ folder.
* Added the json2.js polyfill for the ES5 JSON.stringify and JSON.parse methods.
  Exposed as module "json" with a skip function to optimise loading.
* Extensions and skins may now use 'namemsg' in $wgExtensionCredits in addition
  to 'name', to allow for the name to be localizable. 'name' should still be
  specified for backwards-compatibility and to define the path Special:Version
  uses to find extension license information.
* Browser tests are now included to verify basic wiki functionality in developer
  environments. For details on running tests, see
  tests/browser/README.mediawiki.
* Upgrade jStorage to v0.4.10.
* {{!}} is now a magic word that produces the | character. This removes the need
  for Template:! for purposes such as passing pipes inside of parameters.
* (bug 20790) The block log snippet on Special:Contributions and while
  editing user and user talk pages now works for IP range blocks.
* (bug 9360) Added ability to change the page language for MediaWiki pages using
  Special:PageLanguage. All pages are set to wiki language by default.
  The feature needs to be enabled with $wgPageLanguageUseDB=true and
  permission needs to be set for 'pagelang'.
* Upgrade Moment.js to v2.8.3.
* (bug 67042) Added support for the HTML5 <rtc> tag for East Asian typography.
* Upgrade Sinon.JS to 1.10.3.
* Added the es5-shim polyfill for older or non-compliant javascript engines.
* Upgrade jQuery Cookie to v1.3.1.
* (bug 20476) Add a "viewsuppressed" user right to be able to view
  suppressed content but not suppress it ("suppressrevision" right).
* (bug 66440) The MediaWiki web installer will now allow you to choose the skins
  to enable (from the ones included in download tarball) and decide which one
  should be the default.
* (bug 68085, 68802) Links like [[localInterwikiPrefix:languageCode:pageTitle]],
  where localInterwikiPrefix is a member of the $wgLocalInterwikis array, will
  no longer be displayed in the sidebar when $wgInterwikiMagic is true. In a
  similar way, links like [[localInterwikiPrefix:File:Image.png]] and
  [[localInterwikiPrefix:Category:Hello]] will now render as regular links, and
  will not include the file or add the page to the category.
* New special page, MyLanguage, to redirect users to subpages with localised
  versions of a page. (Integrated from Extension:Translate)
* MediaWiki now supports multiple password types, including bcrypt and PBKDF2.
  The default type can be changed with $wgPasswordDefault and the type
  configurations can be changed with $wgPasswordConfig.
* Skins can now define custom styles for default ResourceLoader modules using
  the $wgResourceModuleSkinStyles global. See the Vector skin for examples.
* (bug 4488) There is now a preference to watch pages where the user has
  rollbacked an edit by default.
* (bug 15484) Users will now be redirected to the login page when they need to
  log in, rather than being shown a page asking them to log in and having to
  click another link to actually get to the login page.
* A JsonContent and JsonContentHandler were added for extensions to extend.
* (bug 35045) Redirects to sections will now update the URL in browser's address
  bar using the HTML5 History API. When [[Dog]] redirects to [[Animals#Dog]],
  the user will now see "Animals#Dog" in their browser instead of "Dog#Dog".
* API token handling has been rewritten. Any API module using tokens will need
  to be updated. See the entry below under "Action API internal changes".
* Added HTMLAutoCompleteSelectField.
* Added a new hook, "SkinPreloadExistence", to allow extensions to add titles to
  link existence cache before the page is rendered.
* Config::set() was moved to its own interface, MutableConfig.
  GlobalVarConfig::set() is now deprecated, does not implement MutableConfig.
* A MutableConfig named HashConfig was added, that stores an array of
  configuration settings.
* (bug 69418) A MultiConfig implementation was added that supports fallback
  to multiple Config instances.
* Update CSSJanus to v1.1.0.
* Added FormatJson::parse() returning status with result or localized error
  message
* Added DeletedContribsPager::reallyDoQuery hook allowing extensions to data to
  Special:DeletedContributions
* Added DeletedContributionsLineEnding hook allowing extensions to format
  Special:DeletedContributions lines
* (T69525) You can now make MediaWiki speed up its thumbnail rendering by using
  intermediary thumbnails. $wgThumbnailBuckets must be set to a list of target
  thumbnail widths; when a new thumbnail needs to be rendered, MediaWiki will
  find the smallest bucket smaller than the original but larger than the target
  width + $wgThumbnailMinimumBucketDistance, and it will scale that thumbnail,
  rather than the original, down to the target size at greater speed in return
  for minor loss of fidelity.

=== Bug fixes in 1.24 ===
* (bug 50572) MediaWiki:Blockip should support gender
* (bug 49116) Footer copyright notice is now always displayed in user language
  rather than content language (same as copyright notice for editing interface).
* (bug 62258) A bug was fixed in File::getUnscaledThumb when a height
  restriction was present in the parameters. Images with both the "frame"
  option and a size specification set will now always ignore the provided
  size and display an unscaled image, as the documentation has always
  claimed it would.
* (bug 39035) Improved Vector skin performance by removing collapsibleNav,
  which used to collapse some sidebar elements by default.
  This removes -list id suffixes like p-lang-list: instead of using things like
  #p-lang-list, you can do #p-lang .body ul.
* (bug 890) Links in Special:RecentChanges and Special:Watchlist no longer
  follow redirects to their target pages.
* Parser now dies early if called recursively, instead of producing subtle bugs.
* (bug 14323) Redirect pages, when viewed with redirect=no, no longer hide the
  remaining page content.
* (bug 52587) Maintenance script deleteBatch.php no longer follows redirects
  in the file namespace and delete the file on the target page. It will still
  however delete the redirect page.
* (bug 22683) {{msgnw:}} and other uses of PPFrame::RECOVER_ORIG will correctly
  recover the original code of extension tags.
* (bug 65757) MSSQL: Update script drops unnamed constraints to be prepared
  for future updates. Because it's doing so heuristically, it may fail or drop
  wrong constraints.
* (bug 67870) wfShellExec() cuts off stdout at multiples of 8192 bytes.
* $wgRunJobsAsync now works with private wikis (e.g. read requires login).
* (bugs 57238, 65206) Blank pages can now be directly created.
* (bug 69789) Title::getContentModel() now loads from the database when
  necessary instead of incorrectly returning the default content model.
* (bug 69249) wfBaseConvert() now works around PHP Bug #50175 when using GMP.
* (bug 57909) URLs in the externallinks table will no longer have certain
  characters decoded in the query string.
* (bug 67368) LESS mixins like .background-image() correctly flip image
  references for RTL stylesheets now.

=== Action API changes in 1.24 ===
* action=parse API now supports prop=modules, which provides the list of
  ResourceLoader modules that should be used to enhance the parsed content.
* action=query&meta=siteinfo&siprop=interwikimap returns a new "protorel"
  field which is true if protocol-relative urls can be used to access
  a particular interwiki map entry.
* list=logevents now provides logpage, which is the page ID from the
  logging table, if ids are requested and the user has the permissions.
* action=edit now requires that appendtext, prependtext, or section=new be used
  when using the 'redirect' parameter, to prevent clients accidentally
  overwriting the target page with the content of the redirect.
* list=logevents will now return an error if both letitle and leprefix are
  specified.
* list=logevents has a new parameter, lenamespace, to allow filtering by
  namespace.
* action=expandtemplates has a new parameter, prop, and a new output format.
  The old format is still used if prop isn't provided, but this is deprecated.
* meta=userinfo can now return the count of unread pages on the watchlist.
* list=watchlist can now filter by unread status.
* The deprecated action=parse&prop=languageshtml has been removed.
* (bug 48071) action=setnotificationtimestamp no longer throws PHP or database
  errors when no pages are given.
* (bug 60734) Actions that use ApiPageSet (e.g. purge, watch,
  setnotificationtimestamp) will now include continuation information when
  using a generator.
* Removed 'props' and 'errors' from action=paraminfo, as they have extremely
  limited use and are generally inaccurate, unmaintained, and impossible to
  properly maintain.
* Formats dbg, dump, txt, wddx, and yaml are now deprecated.
* action=paraminfo now indicates when a parameter is specifying a submodule.
* The iwurl parameter to prop=iwlinks is deprecated in favor of iwprop=url, for
  parallelism with prop=langlinks.
* All tokens should be fetched from action=query&meta=tokens; all other methods
  of fetching tokens are deprecated. The value needed for meta=tokens's 'type'
  parameter for each module is documented in the action=help output and is
  returned from action=paraminfo.
* New action ClearHasMsg that can be used to clear HasMsg flag.
* The cmstartsortkey and cmendsortkey parameters to list=categorymembers are
  deprecated in favor of cmstarthexsortkey and cmendhexsortkey.
* (bug 63326) Add blockedtimestamp field to output of blockinfo property for
  the list=allusers and list=users modules.
* prop=imageinfo no longer requires iiurlwidth to be set when using iiurlparam.
* Added prop=linkshere, prop=fileusage, and prop=transcludedin, which are
  roughly equivalent to list=backlinks, list=imageusage, and list=embeddedin
  but can work on a list of titles (including titles from a generator).
* prop=redirects can now filter returned redirects by namespace.

=== Action API internal changes in 1.24 ===
* Methods for handling continuation are added to ApiResult, so actions other
  than query that use generators can easily support continuation.
* $wgAPIModules (and the related $wgAPIFormatModules, $wgAPIMetaModules,
  $wgAPIPropModules, and $wgAPIListModules settings) now allow API modules
  to be specified using a "module spec" array instead of a plain class name.
  A "module spec" is an associative array containing at least the 'class' key
  for the module's class, and optionally a 'factory' key for the factory
  function to use for the module. This is intended for extensions that want
  control over the instantiation of their API modules, to allow for proper
  dependency injection.
* A new param type 'submodule' is available. Parameters of this type will take
  the list of valid values from the module's ApiModuleManager for the group
  corresponding to the parameter name.
* The 'APIGetPossibleErrors' and 'APIGetResultProperties' hooks are no longer
  used.
* API token handling has been rewritten. Any API module using tokens will need
  to be updated:
  * ApiBase::needsToken now returns a token type instead of boolean true when a
    token is needed. Returning true will throw an exception. See documentation
    of that method for details.
  * Information for the 'token' parameter is automatically set by ApiBase
    getFinalParams and getFinalParamDescription.
  * ApiBase::getTokenSalt has been removed.
  * The hooks APIQueryInfoTokens, APIQueryRevisionsTokens,
    APIQueryRecentChangesTokens, APIQueryUsersTokens, and
    ApiTokensGetTokenTypes are deprecated, but are still called to support
    backwards-compatible token access.
* ApiBase::validateLimit and ApiBase::validateTimestamp are now protected.
* ApiQueryRedirects was removed; prop=redirects is now implemented by
  ApiQueryBacklinksProp along with the newly-added prop modules.
* The following methods have been deprecated and may be removed in a future
  release:
  * ApiBase::getResultProperties
  * ApiBase::getFinalResultProperties
  * ApiBase::addTokenProperties
  * ApiBase::getRequireOnlyOneParameterErrorMessages
  * ApiBase::getRequireMaxOneParameterErrorMessages
  * ApiBase::getRequireAtLeastOneParameterErrorMessages
  * ApiBase::getTitleOrPageIdErrorMessage
  * ApiBase::getPossibleErrors
  * ApiBase::getFinalPossibleErrors
  * ApiBase::parseErrors
  * ApiQuery::setGeneratorContinue
  * ApiQueryBase::checkRowCount
  * ApiQueryBase::titleToKey
  * ApiQueryBase::keyToTitle
  * ApiQueryBase::keyPartToTitle
  * ApiQueryInfo::getTokenFunctions
  * ApiQueryInfo::resetTokenCache
  * ApiQueryInfo::getEditToken
  * ApiQueryInfo::getDeleteToken
  * ApiQueryInfo::getProtectToken
  * ApiQueryInfo::getMoveToken
  * ApiQueryInfo::getBlockToken
  * ApiQueryInfo::getUnblockToken
  * ApiQueryInfo::getEmailToken
  * ApiQueryInfo::getImportToken
  * ApiQueryInfo::getWatchToken
  * ApiQueryInfo::getOptionsToken
  * ApiQueryRecentChanges::getTokenFunctions
  * ApiQueryRecentChanges::getPatrolToken
  * ApiQueryRevisions::getTokenFunctions
  * ApiQueryRevisions::getRollbackToken
  * ApiQueryUsers::getTokenFunctions
  * ApiQueryUsers::getUserrightsToken
* The following classes have been deprecated and may be removed in a future
  release:
  * ApiFormatDbg
  * ApiFormatDump
  * ApiFormatTxt
  * ApiFormatWddx
  * ApiFormatYaml
  * ApiTokens
* The following class constants have been deprecated and may be removed in a
  future release:
  * ApiBase::PROP_ROOT
  * ApiBase::PROP_LIST
  * ApiBase::PROP_TYPE
  * ApiBase::PROP_NULLABLE

=== Languages updated in 1.24 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

=== Other changes in 1.24 ===
* The deprecated jquery.delayedBind ResourceLoader module was removed.
* The deprecated function mw.util.toggleToc was removed.
* The Special:Search hooks SpecialSearchGo and SpecialSearchResultsAppend
  were removed as they were unused.
* (bug 65477) User::pingLimiter() now has an additional profile point varying
  by action being used.
* mediawiki.util.$content no longer supports old versions of the Vector,
  Monobook, Modern and CologneBlue skins that don't yet implement the "mw-body"
  and/or "mw-body-primary" class name in their html.
* Added pp_sortkey column to page_props table, so pages can be efficiently
  queried and sorted by property value (bug 58032).
  See $wgPagePropsHaveSortkey if you want to postpone the schema change.
* BREAKING CHANGE: All four built-in MediaWiki skins (Vector, MonoBook, Modern
  and Cologne Blue) were moved out of MediaWiki core to their own respective
  repositories. They will be installed with the release tarball, but you must
  install them separately if installing MediaWiki from source code. A warning
  message displayed until you do it should guide you through the process. See
  also <https://www.mediawiki.org/wiki/Manual:Skin_configuration>.
* BREAKING CHANGE: Skins built for MediaWiki 1.15 and earlier that do not use
  the "headelement" template key are no longer supported. Setting
  $useHeadElement = false; is no longer supported and will not cause old keys
  like "headlinks", "skinnameclass", etc. to be defined.
* BREAKING CHANGE: The files commonElements.css, commonContent.css and
  commonInterface.css (in skins/common/) have been removed. Skins may no longer
  rely on their presence and include them in their style modules. ResourceLoader
  modules introduced in MediaWiki 1.23 should be loaded instead:
  - skins/common/commonElements.css  → 'mediawiki.skinning.elements' module
  - skins/common/commonContent.css   → 'mediawiki.skinning.content' module
  - skins/common/commonInterface.css → 'mediawiki.skinning.interface' module
* The deprecated 'SpecialVersionExtensionTypes' hook was removed.
* (bug 63891) Add 'X-Robots-Tag: noindex' header in action=render pages.
* SpecialPage no longer supports the syntax for invoking wfSpecial*() functions.
  Special pages should subclass SpecialPage and implement the execute() method.
* (bug 63755) The deprecated constants RC_MOVE and RC_MOVE_OVER_REDIRECT were
  removed.
* Special:MostLinkedTemplates has been renamed to Special:MostTranscludedPages.
* The skin autodiscovery mechanism has been deprecated and will be removed in
  MediaWiki 1.25. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery
  for migration guide for creators and users of custom skins that relied on it.
* ResourceLoaderFileModule#getAllStyleFiles now returns all style files and all
  skin style files used by the module.
* Removed getLang() from IContextSource and subclasses. (deprecated since 1.19)
* Removed setLang() from subclasses of IContextSource. (deprecated since 1.19)
* Removed WebRequest::escapeAppendQuery(). (deprecated since 1.20)
* Removed info(), purge(), revert() and rollback() from the Article class; they
  have since become subclasses of the Action class. (deprecated since 1.19)
* SearchEngineReplacePrefixesComplete hook was removed.
* The "jquery.json" module has been deprecated. Use the "json" module instead.
* Removed HTMLForm::addJS(). (deprecated since 1.18)
* Removed LogEventsList::showHeader(). (deprecated since 1.19)
* Removed ImageGalleryBase::useSkin(). (deprecated since 1.18)
* Removed DatabaseMysqlBase::getLagFromProcesslist(). (deprecated since 1.19)
* Removed LoadBalancer::closeConnecton(). (deprecated since 1.18)
* Removed ApiBase::createContext(). (deprecated since 1.19)
* BREAKING CHANGE: The undocumented Special{$this->getName()}BeforeFormDisplay
  set of hooks has been removed and replaced by a single new hook
  SpecialPageBeforeFormDisplay.
* (bug 65781) Removed block warning on included {{Special:Contributions}}
* Removed Skin::makeGlobalVariablesScript(). (deprecated since 1.19)
* Removed MWNamespace::isMain(). (deprecated since 1.19)
* Removed Preferences::loadOldSearchNs(). (deprecated since 1.19)
* Removed OutputPage::getStatusMessage(). (deprecated since 1.18)
* Removed OutputPage::isUserJsAllowed(). (deprecated since 1.18)
* Removed Title::updateTitleProtection(). (deprecated since 1.19)
* Removed ParserOptions::setSkin(). (deprecated since 1.19)
* Removed Title::escapeCanonicalURL(). (deprecated since 1.19)
* Removed Title::escapeLocalURL(). (deprecated since 1.19)
* Removed Title::escapeFullURL(). (deprecated since 1.19)
* Removed User::isValidEmailAddr(). (deprecated since 1.18)
* Removed Title::getEscapedText(). (deprecated since 1.19)
* Removed Language::getFallbackLanguageCode(). (deprecated since 1.19)
* Removed WikiPage::isBigDeletion(). (deprecated since 1.19)
* Removed MWInit class which contained functions related to a now discontinued
  PHP compiler called hphpc. (deprecated since 1.22)
* ApiResult::enableSizeCheck() and disableSizeCheck() are now obsolete.
* Removed ResourceLoaderGetStartupModules hook. (deprecated since 1.23)
* Removed getFormFields(), onSubmit() and onSuccess() from FormlessAction, as
  these were meant specifically for FormAction instead.
* Removed Action::execute().
* Removed AjaxAddScript which has been obsolete since ResourceLoader and
  is unused by any modern extension.
* Removed maintenance/nextJobDB.php; no longer in use.
* Removed global function wfViewPrevNext(). (deprecated since 1.19)
* Removed global function xmlsafe() from Export.php. (moved to OAIRepo
  extension)
* Removed Title::userCanRead(). (deprecated since 1.19)
* Removed maintenance script importTextFile.php. Use edit.php script instead.
* A _from_namespace field has been added to the templatelinks, pagelinks,
  and filelinks tables. Run update.php to apply this change to the schema.
* Removed File::sha1Base36(). (deprecated since 1.19)
* Removed File::getPropsFromPath(). (deprecated since 1.19)
* Removed functions blockedPage(), noCreatePermission(), readOnlyPage() and
  userNotLoggedInPage() from EditPage.php. (deprecated since 1.19)
* Removed functions getContent(), getPreloadedText(), mergeChangesInto() and
  setPreloadedText() from EditPage.php. (deprecated since 1.21)
* Removed global functions wfArrayLookup(), wfArrayMerge(),
  wfDebugDieBacktrace() and wfTime(). (deprecated since 1.22)
* Browser support for Internet Explorer 6 and 7 lowered from Grade A to Grade C,
  meaning that JavaScript is no longer executed in these browser versions.
* Browser support for Opera 11 lowered from Grade A to Grade C.
* Removed IEFixes module which existed purely to provide support for MSIE
  versions below 7 (conditionally loaded only for those browsers).
* Deprecated SpecialPageFactory::getList() in favor of
  SpecialPageFactory::getNames()
* Action::checkCanExecute() no longer has a return value.
* Removed cleanupForIRC(), loadFromCurRow(), newFromCurRow(), notifyRC2UDP()
  and sendToUDP() from RecentChange.php. (deprecated since 1.22)
* Removed EnhancedChangesList::arrow(), sideArrow(), downArrow(), spacerArrow().
* Removed Xml::namespaceSelector(). (deprecated since 1.19)
* Removed WikiPage::estimateRevisionCount(). (deprecated since 1.19)
* MYSQL: Enum item added to "major MIME type" columns.
  Running update.php on MySQL < v5.1 may result in heavy processing.
* RSS and Atom feeds generated by MediaWiki no longer include a fallback
  stylesheet. It was ignored by most browsers these days anyway.
* SpecialSearchNoResults hook has been removed. SpecialSearchResults is now
  called unconditionally.
* TablePager::getBody() is now 'final' and can't be overridden in subclasses.
* TablePager::getBody() is deprecated, use getBodyOutput() or getFullOutput().
* Added $outputPage parameter to the SkinTemplateGetLanguageLink hook.
* log_page for move log entries store the original page ID, rather than that
  of the new redirect page. This is not retroactive.
* LCStoreAccel was removed. $wgLocalisationCacheConf can no longer be set to
  use this store class.
* Html::infoBox() no longer accepts paths relative to skins/common/images/.
* Deprecated defunct Skin::getCommonStylePath().
* Some extensions had their ResourceLoader modules depend on the "mediawiki"
  and "jquery" modules. In the past, this behavior was undefined, now it will
  throw an error.
* Removed BagOStuff::replace(). (deprecated since 1.23)
* In Linker.php, link(), linkText() and makeBrokenImageLinkObj() now display
  warnings if their first parameter is not a Title object. Also makeImageLink()
  now requires a Parser as its first parameter.
* (bug 67368) LESS functions embed() and embeddable(), added in MediaWiki 1.23
  and broken by design, have been removed. Use appropriate LESS mixins instead.
* Removed cssjanus.py from maintenance directory as it was unused.
* Removed maintenance/purgeOldText.inc and the PurgeRedundantText() function
  it contained (superseded by Maintenance::purgeRedundantText() in 1.16).
  The purgeOldText.php maintenance script has been retained.
* PHPUnit tests can be found by directory discovery, by adding the directory
  path from your UnitTestsList callback. Older versions of MediaWiki core will
  barf at this usage.

==== Renamed classes ====
* CLDRPluralRuleConverter_Expression to CLDRPluralRuleConverterExpression
* CLDRPluralRuleConverter_Fragment to CLDRPluralRuleConverterFragment
* CLDRPluralRuleConverter_Operator to CLDRPluralRuleConverterOperator
* CLDRPluralRuleEvaluator_Range to CLDRPluralRuleEvaluatorRange
* CSSJanus_Tokenizer to CSSJanusTokenizer
* MediaWiki_I18N to MediaWikiI18N
* Parser_DiffTest to ParserDiffTest
* RevDel_ArchiveItem to RevDelArchiveItem
* RevDel_ArchiveList to RevDelArchiveList
* RevDel_ArchivedFileItem to RevDelArchivedFileItem
* RevDel_ArchivedFileList to RevDelArchivedFileList
* RevDel_ArchivedRevisionItem to RevDelArchivedRevisionItem
* RevDel_FileItem to RevDelFileItem
* RevDel_FileList to RevDelFileList
* RevDel_Item to RevDelItem
* RevDel_List to RevDelList
* RevDel_LogItem to RevDelLogItem
* RevDel_LogList to RevDelLogList
* RevDel_RevisionItem to RevDelRevisionItem
* RevDel_RevisionList to RevDelRevisionList
* WebInstaller_Complete to WebInstallerComplete
* WebInstaller_Copying to WebInstallerCopying
* WebInstaller_DBConnect to WebInstallerDBConnect
* WebInstaller_DBSettings to WebInstallerDBSettings
* WebInstaller_Document to WebInstallerDocument
* WebInstaller_ExistingWiki to WebInstallerExistingWiki
* WebInstaller_Install to WebInstallerInstall
* WebInstaller_Language to WebInstallerLanguage
* WebInstaller_Name to WebInstallerName
* WebInstaller_Options to WebInstallerOptions
* WebInstaller_Readme to WebInstallerReadme
* WebInstaller_ReleaseNotes to WebInstallerReleaseNotes
* WebInstaller_Restart to WebInstallerRestart
* WebInstaller_Upgrade to WebInstallerUpgrade
* WebInstaller_UpgradeDoc to WebInstallerUpgradeDoc
* WebInstaller_Welcome to WebInstallerWelcome

==== Removed classes ====
* IPBlockForm - Use SpecialBlock directly
* WatchlistEditor - Use SpecialEditWatchlist directly
* FormatExif - Use FormatMetadata directly
* RevertFileAction - Use RevertAction directly
* HistoryPage - Use HistoryAction directly
* RawPage - Use RawAction directly
* StubContLang - Use Language::factory() instead
* XMLReader2 - Use XMLReader directly
* ResourceLoaderLESSFunctions - No longer in use, not intended for public usage

==== Removed files ====
The skins/common/ directory, previously containing some assets intended to be
used by skins and a number of legacy styles and scripts, has been removed. Its
contents have been deleted or relocated into the resources/ directory. Full list
of files that are no longer available follows.

* skins/common/ajax.js
* skins/common/commonContent.css
* skins/common/commonElements.css
* skins/common/commonInterface.css
* skins/common/commonPrint.css
* skins/common/config-cc.css
* skins/common/config.css
* skins/common/config.js
* skins/common/feed.css
* skins/common/IEFixes.js
* skins/common/oldshared.css
* skins/common/protect.js
* skins/common/shared.css
* skins/common/upload.js
* skins/common/wikibits.js
* skins/common/images/add.png
* skins/common/images/ajax-loader.gif
* skins/common/images/arrow_disabled_first_25.png
* skins/common/images/arrow_disabled_last_25.png
* skins/common/images/arrow_disabled_left_25.png
* skins/common/images/arrow_disabled_right_25.png
* skins/common/images/arrow_first_25.png
* skins/common/images/arrow_last_25.png
* skins/common/images/arrow_left_25.png
* skins/common/images/arrow_right_25.png
* skins/common/images/Arr_.png
* skins/common/images/Arr_d.png
* skins/common/images/Arr_l.png
* skins/common/images/Arr_r.png
* skins/common/images/Arr_u.png
* skins/common/images/bullet.gif
* skins/common/images/button_bold.png
* skins/common/images/button_extlink.png
* skins/common/images/button_headline.png
* skins/common/images/button_hr.png
* skins/common/images/button_image.png
* skins/common/images/button_italic.png
* skins/common/images/button_link.png
* skins/common/images/button_media.png
* skins/common/images/button_nowiki.png
* skins/common/images/button_sig.png
* skins/common/images/button_template.png
* skins/common/images/cc-0.png
* skins/common/images/cc-by-nc-sa.png
* skins/common/images/cc-by-sa.png
* skins/common/images/cc-by.png
* skins/common/images/Checker-16x16.png
* skins/common/images/closewindow.png
* skins/common/images/closewindow19x19.png
* skins/common/images/critical-32.png
* skins/common/images/diffunderline.gif
* skins/common/images/download-32.png
* skins/common/images/feed-icon.png
* skins/common/images/feed-icon.svg
* skins/common/images/gnu-fdl.png
* skins/common/images/help-question-hover.gif
* skins/common/images/help-question.gif
* skins/common/images/info-32.png
* skins/common/images/link_icon.gif
* skins/common/images/magnify-clip-rtl.png
* skins/common/images/magnify-clip.png
* skins/common/images/mediawiki.png
* skins/common/images/nextredirectltr.png
* skins/common/images/nextredirectrtl.png
* skins/common/images/poweredby_mediawiki_88x31.png
* skins/common/images/public-domain.png
* skins/common/images/question-small.png
* skins/common/images/question.svg
* skins/common/images/redirectltr.png
* skins/common/images/redirectrtl.png
* skins/common/images/remove.png
* skins/common/images/spinner.gif
* skins/common/images/tick-32.png
* skins/common/images/tipsy-arrow.gif
* skins/common/images/tooltip_icon.png
* skins/common/images/warning-32.png
* skins/common/images/wiki.png
* skins/common/images/Zoom_sans.gif
* skins/common/images/ar/button_bold.png
* skins/common/images/ar/button_headline.png
* skins/common/images/ar/button_italic.png
* skins/common/images/ar/button_link.png
* skins/common/images/ar/button_nowiki.png
* skins/common/images/be-tarask/button_bold.png
* skins/common/images/be-tarask/button_italic.png
* skins/common/images/be-tarask/button_link.png
* skins/common/images/cyrl/button_bold.png
* skins/common/images/cyrl/button_italic.png
* skins/common/images/cyrl/button_link.png
* skins/common/images/de/button_bold.png
* skins/common/images/de/button_italic.png
* skins/common/images/fa/button_bold.png
* skins/common/images/fa/button_headline.png
* skins/common/images/fa/button_italic.png
* skins/common/images/fa/button_link.png
* skins/common/images/fa/button_nowiki.png
* skins/common/images/icons/fileicon-c.png
* skins/common/images/icons/fileicon-cpp.png
* skins/common/images/icons/fileicon-deb.png
* skins/common/images/icons/fileicon-djvu.png
* skins/common/images/icons/fileicon-djvu.xcf
* skins/common/images/icons/fileicon-dvi.png
* skins/common/images/icons/fileicon-exe.png
* skins/common/images/icons/fileicon-h.png
* skins/common/images/icons/fileicon-html.png
* skins/common/images/icons/fileicon-iso.png
* skins/common/images/icons/fileicon-java.png
* skins/common/images/icons/fileicon-mid.png
* skins/common/images/icons/fileicon-mov.png
* skins/common/images/icons/fileicon-o.png
* skins/common/images/icons/fileicon-ogg.png
* skins/common/images/icons/fileicon-ogg.xcf
* skins/common/images/icons/fileicon-pdf.png
* skins/common/images/icons/fileicon-ps.png
* skins/common/images/icons/fileicon-psd.png
* skins/common/images/icons/fileicon-rm.png
* skins/common/images/icons/fileicon-rpm.png
* skins/common/images/icons/fileicon-svg.png
* skins/common/images/icons/fileicon-tar.png
* skins/common/images/icons/fileicon-tex.png
* skins/common/images/icons/fileicon-ttf.png
* skins/common/images/icons/fileicon-txt.png
* skins/common/images/icons/fileicon.png
* skins/common/images/ksh/button_S_italic.png

= MediaWiki 1.23 =

== MediaWiki 1.23.17 ==

=== Changes since 1.23.16 === <!--T:69-->
* Fix syntax errors introduced in 1.23.16 when running PHP 5.3.

== MediaWiki 1.23.16 ==
This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.15 ===
* (T68404) CSS3 attr() function with url type is no longer allowed
  in inline styles.
* (T156184) $wgRawHtml will no longer apply to internationalization messages.
* Submitting the lgtoken and lgpassword parameters in the query string to
  action=login is now deprecated and outputs a warning. They should be submitted
  in the POST body instead.
* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
  redirect to interwiki links.
* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
  $wgAdvancedSearchHighlighting is true.
* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
  their values out of the logs.
* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
  CSRF token.
* (T156184) SECURITY: Escape content model/format url parameter in message.
* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
  declaration.
* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
  inclusion syntax's link parameter.
* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
  against it.

== MediaWiki 1.23.15 ==

This is a maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.14 ===
* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
  made by MediaWiki via a proxy. Relying on the http_proxy environment
  variable is no longer supported.
* (T139565) SECURITY: API: Generate head items in the context of the given title
* (T137264) SECURITY: XSS in unclosed internal links
* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
* (T133147) SECURITY: Require login to preview user CSS pages
* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
  the top file
* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
  permissions
* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
* (T115333) SECURITY: Check read permission when loading page content in
  ApiParse
* Remove support for $wgWellFormedXml = false, all output is now well formed

== MediaWiki 1.23.13 ==

This is a maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.12 ===
* (T121892) Fix fatal errors on some Special pages, introduced in 1.23.12.

== MediaWiki 1.23.12 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.11 ===
* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
  that do not begin with a slash. This enabled trivial XSS attacks.
  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
  error.
* (T119309) SECURITY: Use hash_compare() for edit token comparison
* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
  with '@' as file uploads
* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
  longer be shorter than $wgMinimalPasswordLength
* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
  result in improper blocks being issued
* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
  and related pages no longer use HTTP redirects and are now redirected by
  MediaWiki

== MediaWiki 1.23.11 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.10 ===

* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload
* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading
* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails

== MediaWiki 1.23.10 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.9 ===

* (T94116) SECURITY: Compare API watchlist token in constant time
* (T97391) SECURITY: Escape error message strings in thumb.php
* (T106893) SECURITY: Don't leak autoblocked IP addresses on
  Special:DeletedContributions
* (bug 67644) Make AutoLoaderTest handle namespaces
* (T91653) Minimal PSR-3 debug logger to support backports from 1.25+.
* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only
  policy of Wikimedia Commons.

== MediaWiki 1.23.9 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.8 ===

* (T85848, T71210) SECURITY: Don't parse XMP blocks that contain XML entities,
  to prevent various DoS attacks.
* (T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce
  likelihood of DoS.
* (T88310) SECURITY: Always expand xml entities when checking SVG's.
* (T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
* (T85855) SECURITY: Don't execute another user's CSS or JS on preview.
* (T85349, T85850, T86711) SECURITY: Multiple issues fixed in SVG filtering to
  prevent XSS and protect viewer's privacy.
* (bug T68650) Fix indexing of moved pages with PostgreSQL. Requires running
  update.php to fix.
* (bug T70087) Fix Special:ActiveUsers page for installations using
  PostgreSQL.

== MediaWiki 1.23.8 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.7 ===

* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
  could lead to xss. Permission to edit MediaWiki namespace is required to
  exploit this.
* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in
  $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as
  part of its name.
* (bug T74222) The original patch for T74222 was reverted as unnecessary.

== MediaWiki 1.23.7 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.6 ===

* (bugs 66776, 71478) SECURITY:  User PleaseStand reported a way to inject code
  into API clients that used format=php to process pages that underwent flash
  policy mangling. This was fixed along with improving how the mangling was done
  for format=json, and allowing sites to disable the mangling using
  $wgMangleFlashPolicy.
* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update
  the content model for a page could allow an unprivileged attacker to edit
  another user's common.js under certain circumstances. The user right
  "editcontentmodel" was added, and is needed to change a revision's content
  model.
* (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw
  HTML, it is not safe to preview wikitext coming from an untrusted source such
  as a cross-site request. Thus add an edit token to the form, and when raw HTML
  is allowed, ensure the token is provided before showing the preview. This
  check is not performed on wikis that both allow raw HTML and anonymous
  editing, since there are easier ways to exploit that scenario.
* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with
  DELETED_ACTION. NOTICE: this may be reverted in a future release pending a
  public RFC about the desired functionality. This issue was reported by user
  Bawolff.
* (bug 71621) Make allowing site-wide styles on restricted special pages a
  config option.
* (bug 42723) Added updated version history from 1.19.2 to 1.22.13
* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
  might be a flash policy directive configurable.

== MediaWiki 1.23.6 ==

This is a maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.5 ===
* (Bug 72274) Job queue not running (HTTP 411) due to missing
  Content-Length: header
* (Bug 67440) Allow classes to be registered properly from installer

== MediaWiki 1.23.5 ==

This is a security release of the MediaWiki 1.23 branch.

=== Changes since 1.23.4 ===
* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
  allowance.

== MediaWiki 1.23.4 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.3 ===

* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style>
  elements; normalize style elements and attributes before filtering; add
  checks for attributes that contain css; add unit tests for html5sec and
  reported bugs.
* (bug 65998) Make MySQLi work with non-standard socket.
* (bug 66986) GlobalVarConfig shouldn't throw exceptions for null-valued config
  settings.

== MediaWiki 1.23.3 ==

This is a maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.2 ===

* (bug 68501) Correctly handle incorrect namespace in cleanupTitles.php.
* (bug 64970) Fix support for blobs on DatabaseOracle::update.
* (bug 66574) Display MediaWiki:Loginprompt on the login page.
* (bug 67870) wfShellExec() cuts off stdout at multiples of 8192 bytes.
* (bug 60629) Handle invalid language code gracefully in
  Language::fetchLanguageNames.
* (bug 62017) Restore the number of rows shown on Special:Watchlist.
* Check for boolean false result from database query in SqlBagOStuff.

== MediaWiki 1.23.2 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.1 ===

* (bug 68187) SECURITY: Prepend jsonp callback with comment.
* (bug 66608) SECURITY: Fix for XSS issue in bug 66608: Generate the URL used
  for loading a new page in Javascript,instead of relying on the URL in the link
  that has been clicked.
* (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and
  ParserOutput.
* (bug 68313) Preferences: Turn stubthreshold back into a combo box.
* (bug 65214) Fix initSiteStats.php maintenance script.
* (bug 67594) Special:ActiveUsers: Fix to work with PostgreSQL.

== MediaWiki 1.23.1 ==

This is a security and maintenance release of the MediaWiki 1.23 branch.

=== Changes since 1.23.0 ===

* (bug 65839) SECURITY: Prevent external resources in SVG files.
* (bug 67025) Special:Watchlist: Don't try to render empty row.
* (bug 66922) Don't allow some E_NOTICE messages to end up in the
  LocalSettings.php.
* (bug 66467) FileBackend: Avoid using popen() when "parallelize" is disabled.
* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects
  like only extracting the tail of the file partially or not at all.
* (bug 66182) Removed -x flag on some php files.

== MediaWiki 1.23.0 ==

=== Configuration changes in 1.23 ===
* (bug 13250) Restored method for clearing a watchlist in web UI
  so that users with large watchlists don't have to perform
  contortions to clear them.
* When $wgJobRunRate is higher than zero, jobs are now executed via an
  asynchronous HTTP request to a MediaWiki entry point. This may require
  increasing the number of server worker threads. $wgRunJobsAsync has been
  added to disable this feature if needed, falling back to executing the job
  on the same process but making the execution synchronously.
* $wgDebugLogGroups values may be set to an associative array with a
  'destination' key specifying the log destination. The array may also contain
  a 'sample' key with a positive integer value N indicating that the log group
  should be sampled by dispatching one in every N messages on average. The
  sampling is random.
* In addition to the current exception log format, MediaWiki now serializes
  exception metadata to JSON and logs it to the 'exception-json' log group.
  This makes MediaWiki easier to integrate with log aggregation and analysis
  tools.
* $wgSquidServersNoPurge now supports the use of Classless Inter-Domain
  Routing (CIDR) notation to specify contiguous blocks of IPv4 and/or IPv6
  addresses that should be trusted to provide X-Forwarded-For headers.
* Preferences 'watchcreations', 'watchdefault', 'enotifwatchlistpages' ("Add
  pages I create and files I upload to my watchlist", "Add pages and files I
  edit to my watchlist", "Email me when a page or file on my watchlist is
  changed") are now enabled by default. In addition new user accounts' personal
  and talk pages are now watched by them by default.
* $wgLBFactoryConf: Class names have had underscores removed. The configuration
  should be updated if LBFactory_Simple or LBFactory_Multi is configured.
* $wgPasswordSenderName has been removed and is no longer functional. To set a
  custom mailer name, the system message 'emailsender' should be modified
  (default: "{{SITENAME}}").
* (bug 63269) Email notifications were not correctly handling the
  [[MediaWiki:Helppage]] message being set to a full URL (the default).
  If you customized [[MediaWiki:Enotif body]] (the text of email notifications),
  you'll need to edit it locally to include the URL via the new variable
  $HELPPAGE instead of the parser functions fullurl and canonicalurl; otherwise
  you don't have to do anything.
* $wgDBAhandler was removed as the only class using it was also removed
* The 'max threads' setting was removed from $wgDBservers.
* Support for AdminSettings.php has been completely removed. All configuration
  belongs in LocalSettings.php.
* $wgSkipSkin, which has been replaceable by $wgSkipSkins since 2005 (r9249), is
  now formally deprecated.
* Removed deprecated $wgDisabledActions as it is hardly used anywhere.
* $wgRateLimitLog has been deprecated and replaced by
  $wgDebugLogGroup['ratelimit'].
* $wgLocalInterwikis is an array containing multiple local interwiki prefixes
  (interwiki prefixes that point back to the current wiki). This effectively
  allows more than one value of $wgLocalInterwiki to be specified and
  understood by the parser. The value of $wgLocalInterwiki is automatically
  prepended to the start of this array.
* $wgQueryPages has been removed. Query Pages should be added to by using the
  wgQueryPages hook.
* $wgHttpOnlyBlacklist has been removed.
* $wgLicenseTerms has been removed as it was unused.
* $wgProfileOnly is now deprecated; set the log file in
  $wgDebugLogGroups['profileoutput'] to replace it.
* $wgMaxBacklinksInvalidate was removed; use $wgJobBackoffThrottling instead
* Deprecated ResourceLoaderGetStartupModules hook.

=== New features in 1.23 ===
* ResourceLoader can utilize the Web Storage API to cache modules client-side.
  Compared to the browser cache, caching in Web Storage allows ResourceLoader
  to be more granular about evicting stale modules from the cache while
  retaining the ability to retrieve multiple modules in a single HTTP request.
  This capability can be enabled by setting $wgResourceLoaderStorageEnabled to
  true. This feature is currently considered experimental and should only be
  enabled with care.
* (bug 6092) Add expensive parser functions {{REVISIONID:}}, {{REVISIONUSER:}}
  and {{REVISIONTIMESTAMP:}} (with friends).
* Add "wgRelevantUserName" to mw.config containing the current
  Skin::getRelevantUser value.
* (bug 56033) Add content model to the page information.
* Added Article::MissingArticleConditions hook to give extensions a chance to
  hide their (unrelated) log entries.
* Added LonelyPagesQuery hook to let extensions modify the query used to
  generate Special:LonelyPages.
* Added $wgOpenSearchDefaultLimit defining the default number of entries to show
  on action=opensearch API call.
* For namespaces with $wgNamespaceProtection (including the MediaWiki
  namespace), the "protect" tab will be shown only if there are restriction
  levels available that would restrict editing beyond what
  $wgNamespaceProtection already applies. The protection form will offer only
  those protection levels.
* Added $wgAPIFormatModules, allowing extensions to add additional output
  formatting modules for the API.
* (bug 47812) The MediaWiki:Group-user.{css,js} pages can now be used to add
  custom CSS or JavaScript enabled only for registered users.
* (bug 52005) Special pages RecentChanges, RecentChangesLinked and Watchlist
  now include a legend describing the symbols used in lists of changes.
* Improved the accessibility of the tabs in Special:Preferences.
* Added ApiBeforeMain hook, roughly equivalent to the BeforeInitialize hook:
  it's called after everything is set up but before any major processing
  happens.
* The jquery.client module now performs a component-wise version comparison in
  its #test method when strings are used in the browser map: version '1.10' is
  now correctly considered larger than '1.2'. Using numbers in the version map
  is not affected.
* All API modules now support an assert parameter, which can either be
  'user' or 'bot'. The API will throw an error if the user is not logged
  in (user) or does not have the 'bot' userright (bot). Based off of the
  AssertEdit extension by Steve Sanbeg.
* [[Special:Diff]] was added, allowing users to create internal links to
  revision comparison pages using syntax such as [[Special:Diff/12345]],
  [[Special:Diff/12345/prev]] or [[Special:Diff/12345/98765]].
* New user accounts' personal and talk pages are now watched by them by default.
* Added SkinTemplateGetLanguageLink hook to allow changing the html of language
  links.
* Added MessageCache::get hook as a new way to customize messages across
  multiple sites.
* Added jquery.throttle-debounce ResourceLoader module to limit the number of
  callbacks for frequently occurring events.
* Special:ProtectedPages shows now a table. The timestamp, the reason and
  the protecting user are also shown.
* Added experimental support for using Microsoft SQL Server as the database
  backend.
** Added new Microsoft SQL Server-specific configuration variable
   $wgDBWindowsAuthentication, which makes the web server authenticate against
   the database server using Integrated Windows Authentication instead of
   $wgDBuser/$wgDBpassword.
* HTMLForm 'select', 'selectandother', 'selectorother', 'multiselect', and
  'radio' fields can now use message keys as labels via the 'options-messages'
  parameter, which overrides the 'options' parameter.
* Admins can expire users passwords manually, or on a schedule using the
  $wgPasswordExpirationDays configuration setting.
* Add new hook SendWatchlistEmailNotification, this will be used to determine
  whether to send a watchlist email notification.
* (bug 42026) Special:Contributions now includes an option to filter page
  creations, similar to the topOnly option.
* Add mediawiki.ui.button styling to all pages so wiki content can use styled
  buttons.
* Special:UserLogin/signup now does AJAX checks for invalid and taken usernames,
  displaying the error live.
* Added BaseTemplateAfterPortlet hook to allow injecting html after portlets in
  skins.
* Support has been added for a JSON based localisation file format. The
  installer has been updated to use it.
* Changes to content typography (colors, line-height etc.). See
  https://www.mediawiki.org/wiki/Typography_refresh for further information.
* The Vector skin's visual treatment of external links has been simplified to a
  single icon (from nine). This should not affect local rules unless they were
  re-using these icons, which have now been deleted.
* ResourceLoader: mw.loader.using() now implements a Promise interface.
* Add new hook ChangesListInitRows accessed via
  ChangesList::initChangesListRows.
  If called by the ChangesList consumer this gives extensions a chance to batch
  process the result set prior to rendering.
* A PoolCounterRedis class was added which can be make use of in
  $wgPoolCounterConf. This requires at least one Redis 2.6+ server.
* $wgProfileToDatabase was removed. Set $wgProfiler to ProfilerSimpleDB
  in StartProfiler.php instead of using this.
* (bug 63444) Made it possible to change the indent string (default: 4 spaces)
  used by FormatJson::encode().

=== Bug fixes in 1.23 ===
* (bug 41759) The "updated since last visit" markers (on history pages, recent
  changes and watchlist) and the talk page message indicator are now correctly
  updated when the user is viewing old revisions of pages, instead of always
  acting as if the latest revision was being viewed.
* (bug 56443) Special:ConfirmEmail no longer shows a "Mail a confirmation code"
  when the email address is already confirmed. Also, consistently use
  "confirmed", rather than "authenticated", when messaging whether or not the
  user has confirmed an email address.
* (bug 19415) action=render no longer shows section edit links. This affects
  behavior of several other features where (bogus) section edit links will
  disappear, such as file description pages loaded via $wgUseInstantCommons or
  pages transcluded cross-wiki via $wgEnableScaryTranscluding.
* (bug 56912) Show correct link color on cached result of Special:DeadendPages.
* Classes TitleListDependency and TitleDependency have been removed, as they
  have been found unused in core and extensions for a long time.
* (bug 57098) SpecialPasswordReset now obeys returnto parameter
* (bug 37812) ResourceLoader will notice when a module's definition changes and
  recompile it accordingly.
* (bug 57201) SpecialRecentChangesFilters hook is now executed for feeds.
* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages
  to appear blank or with missing text.
* (bug 56931) Updated the plural rules to CLDR 24. They are in new format
  which is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as
  the JavaScript evaluator were updated to support the new format. Plural rules
  for some languages have changed, most notably Russian. Affected software
  messages have been updated and marked for review at translatewiki.net.
* (bug 23542) imagelinks now stores both the redirect and target (as
  templatelinks does).
* (bug 58167) The web installer no longer throws an exception when PHP is
  compiled without support for MySQL yet with support for another DBMS.
* (bug 56199) Raw option of parser functions must now match complete word,
  to take effect.
* (bug 60543) Special:PrefixIndex forgot stripprefix=1 for "Next page" link
* (bug 29762) Undoing an already-undone edit will now display an appropriate
  message instead of leading the user to make a null edit.
* (bug 52659) mediawiki.notification: Notification area remained visible when
  empty and thus was stealing pointer events from links on the page.
* (bug 26811) When a DBUnexpectedError occurs, DB server hostnames are now
  hidden unless $wgShowExceptionDetails is true, and $wgShowDBErrorBacktrace
  no longer applies in such cases.
* (bug 60960) Avoid doing file_exist() checks on data: URIs, as they cause
  warnings to be printed on Windows due to large path length.
* (bug 48084) Fixed a bug in the installer that could cause $wgLogo to hold
  the wrong path to the placeholder logo (skins/common/images/wiki.png).
* (bug 64289) jquery.textSelection: Don't throw errors on empty collections.

=== Web API changes in 1.23 ===
* (bug 54884) action=parse&prop=categories now indicates hidden and missing
  categories.
* action=query&meta=filerepoinfo now returns additional information for each
  repo.
* action=parse&prop=languageshtml was deprecated in 1.18 and will be removed in
  MediaWiki 1.24.
* action=parse now has disabletoc flag to disable table of contents in output.
* (bug 25702) list=allcategories, list=allimages, list=alllinks, list=allpages,
  list=deletedrevs and list=filearchive did not handle case-sensitivity
  properly for all parameters.
* ApiQueryBase::titlePartToKey allows an extra parameter that indicates the
  namespace in order to properly capitalize the title part.
* (bug 57874) action=feedcontributions no longer has one item more than limit.
* All API modules now support an assert parameter. See the new features section
  for more details.
* Added prop=contributors to fetch the list of contributors to the page.
* The following API modules will now return entries where fields have been
  revision-deleted: list=deletedrevs, list=filearchive, list=recentchanges,
  list=watchlist. "hidden" indicators will be included, in the same style as is
  already done for prop=revisions.
* The following API modules will now return the content of revision-deleted
  fields, in addition to the "hidden" indicators, if the querying user has the
  necessary rights: list=logevents, list=usercontribs, prop=imageinfo,
  prop=revisions.
* The above modules, where applicable, will now return entries filtered by
  revision-deleted fields if the querying user has the necessary rights. For
  example, prop=revisions with rvuser or rvexcludeuser will no longer skip
  revisions where the user was revision-deleted if the current user has the
  deletedhistory right.
* The 'hideuser' right, used when blocking, is no longer necessary or
  sufficient for seeing contributions with revision-deleted in
  list=usercontribs.
* list=watchlist now uses the querying user's rights rather than the wlowner's
  rights when checking whether wlprop=patrol is allowed.
* (bug 32151) ApiWatch now has pageset capabilities (titles/pageids/generators).
  Title parameter is now deprecated.
* (bug 23005) Added action=revisiondelete.
* Added siprop=restrictions to API action=query&meta=siteinfo for querying
  possible page restriction (protection) levels and types.
* Added prop 'limitreportdata' and 'limitreporthtml' to action=parse.
* (bug 58627) Provide language names on action=parse&prop=langlinks.
* Deprecated llurl= in favour of llprop=url for action=query&prop=langlinks.
* Added llprop=langname and llprop=autonym for action=query&prop=langlinks.
* prop=redirects is added, to return redirects to the pages in the query.
* list=allredirects is added, to list all redirects pointing to a namespace.
* (bug 42026) Added ucshow={new,!new,top,!top} to list=usercontribs.
  Also added newonly to action=feedcontributions.
* (bug 42026) Deprecated uctoponly in favor of ucshow=top.
* list=search no longer has a "srredirects" parameter. Redirects are now
  included in all searches.
* Added list=prefixsearch that works like action=opensearch but can be used as
  a generator.
* (bug 24782) Various modules will now use unique continuation parameters.
* (bug 63249) Cache RecentChanges Atom feed in varnish for 15 seconds.

=== Languages updated in 1.23 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* Support was added for Algerian Spoken Arabic (arq).
* Support was added for Riograndenser Hunsrückisch (hrx).
* Support was added for Northern Luri (lrc).

=== Other changes in 1.23 ===
* The rc_type field in the recentchanges table has been superseded by a new
  rc_source field.  The rc_source field is a string representation of the
  change type where rc_type was a numeric constant.  This field is not yet
  queried but will be in a future release.
** Utilize update.php to create and populate this new field.  On larger wikis
   which do not wish to update recentchanges table in one large update please
   review the SQL and comments in maintenance/archives/patch-rc_source.sql.
** The rc_type field of recentchanges will be deprecated in a future release.
* The global variable $wgArticle has been removed after a lengthy deprecation.
* The global functions addButton and insertTags (for mw.toolbar.addButton and
  mw.toolbar.insertTags) now emits mw.log.warn when accessed.
* The ExpandTemplates extension has been moved into MediaWiki core.
* (bug 52812) Removed "Disable search suggestions" from Preference.
* (bug 52809) Removed "Disable browser page caching" from Preference.
* Three new modules intended for use by custom skins were added:
  'mediawiki.skinning.elements', 'mediawiki.skinning.content', and
  'mediawiki.skinning.interface', representing three levels of standard
  MediaWiki styling. Previously skin creators wishing to use them had to refer
  to the file names of appropriate files directly, which is now discouraged.
* The modules 'skins.vector' and 'skins.monobook' have been renamed to
  'skins.vector.styles' and 'skins.monobook.styles', respectively,
  and their definition was changed not to include the common*.css files;
  the two skins now load the 'mediawiki.skinning.interface' module instead.
* A page_links_updated field has been added to the page table.
* SpecialPage::getTitle has been deprecated in favor of
  SpecialPage::getPageTitle.
* BREAKING CHANGE: Two potentially backwards-incompatible changes have been made
  to the 'SpecialWatchlistQuery' hook's last parameter (array $values) to make
  the hook more consistent with the 'SpecialRecentChangesQuery' one:
** Several array keys have been renamed: hideMinor → hideminor,
   hideBots → hidebots, hideAnons → hideanons, hideLiu → hideliu,
   hidePatrolled → hidepatrolled, hideOwn → hidemyself.
** The parameter value is now a FormOptions object, not a plain array (array
   access operators should continue to work, as it implements the ArrayAccess
   interface).
* Option to mark hooks as deprecated has been added.
* (bug 52811) Preference "Enable section editing via [edit] links" was removed.
* (bug 52813) Preference "Show table of contents (for pages with more than
  3 headings)" was removed.
* (bug 52810) Preference "Justify paragraphs" was removed.
* OutputPage::showErrorPage raises a notice if arguments are incoherent.
* Thumbnails that keep failing to render in thumb.php will be rate-limited
  against further render attempts for 1 hour. $wgAttemptFailureEpoch can be
  altered to reset all rate-limited thumbnails at once.
* (bug 56572) Builds of the OOjs and OOjs UI libraries are now available.
* mw.loader.go and mw.loader.version have been removed.
* (bug 52815) Preference "Enable simplified search bar (Vector skin only)"
  was removed.
* A user_password_expires column has been added to the user table. The User
  object expects this column to exist. Use update.php to create this new field.
* The jquery.delayedBind ResourceLoader module was deprecated in favor of the
  jquery.throttle-debounce module. It will be removed in MediaWiki 1.24.
* mw.user.bucket has been deprecated.
* On Special:PrefixIndex, a table#mw-prefixindex-list-table was changed to
  table.mw-prefixindex-list-table to avoid duplicate ids when the special page
  is transcluded.
* (bug 62198) window.$j has been deprecated.
* Preference "Disable link title conversion" was removed.
* SpecialRecentChanges no longer includes any functionality for generating feeds
  - it has been factored out to ApiFeedRecentChanges. Old URLs redirect to new
  ones.
* RecentChange::mExtra['lang'] is no longer set and should no longer be used.
  Extensions should read from other configuration variables, including
  $wgLocalInterwikis, to identify the current wiki.
* Sections in the parser test framework have been renamed and the old
  section names are deprecated.  Please use "!!wikitext" and "!!html"
  (or "!!html/php") instead of "!!input" and "!!result".  This allows
  us to extend parser tests to accommodate additional input/output
  pairs, such as "!!html/parsoid" (for the output of the Parsoid
  parser, where it differs from the PHP parser).
* Special:Search no longer has an "include redirects" option on the advanced
  tab. Redirects are now included in all searches.
* mediawiki.api.category's getCategories() 'async' parameter was deprecated.
* The locations of resources have been split between upstream libraries, now in
  resources/lib/, local libaries in resources/src/, and local forks of upstream
  libraries, also in resources/src/.
* BREAKING CHANGE: The automatically-generated function closure with which
  ResourceLoader wraps all modules' JavaScript code now binds the identifier
  names 'jQuery' and '$' to the jQuery object of the version of jQuery that is
  bundled with MediaWiki. If you bind these names to other objects in global
  scope (like Zepto.js or document.querySelectorAll, for example) you will need
  to use different names to or re-bind them at the top of each
  ResourceLoader-loaded module.
* (bug 52342) Preference "Remember my login" was removed.
* The skin autodiscovery mechanism has been deprecated and will be removed in
  MediaWiki 1.25. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery
  for migration guide for creators and users of custom skins that relied on it.

==== Removed classes ====
* FakeMemCachedClient (deprecated in 1.18)
* RdfMetaData (unused)
* TitleDependency (unused)
* TitleListDependency (unused)
* WikiError (deprecated in 1.17)
* WikiXmlError (deprecated in 1.17)
* WikiErrorMsg (deprecated in 1.17)

==== Renamed classes ====
* CdbReader_DBA to CdbReaderDBA
* CdbReader_PHP to CdbReaderPHP
* CdbWriter_DBA to CdbWriterDBA
* CdbWriter_PHP to CdbWriterPHP
* DiffOp_Add to DiffOpAdd
* DiffOp_Change to DiffOpChange
* DiffOp_Copy to DiffOpCopy
* DiffOp_Delete to DiffOpDelete
* HWLDF_WordAccumulator to HWLDFWordAccumulator
* LBFactory_Fake to LBFactoryFake
* LBFactory_Multi to LBFactoryMulti
* LBFactory_Simple to LBFactorySimple
* LBFactory_Single to LBFactorySingle
* LCStore_Accel to LCStoreAccel
* LCStore_CDB to LCStoreCDB
* LCStore_DB to LCStoreDB
* LCStore_Null to LCStoreNull
* LoadBalancer_Single to LoadBalancerSingle
* LoadMonitor_MySQL to LoadMonitorMySQL
* LoadMonitor_Null to LoadMonitorNull
* LocalisationCache_BulkLoad to LocalisationCacheBulkLoad
* csvStatsOutput to CsvStatsOutput
* extensionLanguages to ExtensionLanguages
* languages to Languages
* statsOutput to StatsOutput
* textStatsOutput to TextStatsOutput
* wikiStatsOutput to WikiStatsOutput

==== Removed methods ====
* ApiBase::getValidNamespaces() (deprecated in 1.17)
* ApiMain::setCachePrivate() (deprecated in 1.17)
* ApiMain::setVaryCookie (deprecated in 1.17)
* Article::doRedirect() (deprecated in 1.18)
* Article::doUnwatch() (deprecated in 1.18)
* Article::doWatch() (deprecated in 1.18)
* Article::forUpdate() (deprecated in 1.18)
* Article::markpatrolled() (deprecated in 1.18)
* Article::unwatch() (deprecated in 1.18)
* Article::watch() (deprecated in 1.18)
* Block::clear() (deprecated in 1.18)
* Block::decodeExpiry() (deprecated in 1.18)
* Block::encodeExpiry() (deprecated in 1.18)
* Block::forUpdate() (deprecated in 1.18)
* Block::infinity() (deprecated in 1.18)
* Block::load() (deprecated in 1.18)
* Block::newFromDB() (deprecated in 1.18)
* Block::normaliseRange() (deprecated in 1.18)
* Block::parseExpiryInput() (deprecated in 1.18)
* CategoryViewer::addSubcategory() (deprecated in 1.17)
* EditPage::spamPage() (deprecated since 1.17)
* Exif::getFormattedData() (deprecated in 1.18)
* Exif::makeFormattedData() (deprecated in 1.18)
* in_string (deprecated in 1.21)
* Language::convertLinkToAllVariants() (deprecated in 1.17)
* LanguageConverter::convertLinkToAllVariants() (deprecated in 1.17)
* Linker::makeBrokenLink() (deprecated in 1.16)
* Linker::makeBrokenLinkObj() (deprecated in 1.16)
* Linker::makeColouredLinkObj() (deprecated in 1.16)
* Linker::makeSizeLinkObj() (deprecated in 1.17)
* MediaWiki::articleFromTitle() (deprecated in 1.18)
* ParserOptions::getkin() (deprecated 1.18)
* ProfilerSimple::getCpuTime (deprecated in 1.20)
* Revision::revText() (deprecated in 1.17)
* SkinTemplate::jstext() (deprecated in 1.21)
* SpecialPage::__call() (deprecated in 1.17)
* SpecialPage::executePath() (deprecated in 1.18)
* SpecialPage::exists() (deprecated in 1.18)
* SpecialPage::file() (deprecated in 1.18)
* SpecialPage::func() (deprecated in 1.18)
* SpecialPage::getGroup() (deprecated in 1.18)
* SpecialPage::getPage() (deprecated in 1.18)
* SpecialPage::getPageByAlias() (deprecated in 1.18)
* SpecialPage::getLocalNameFor() (deprecated in 1.18)
* SpecialPage::getRegularPages() (deprecated in 1.18)
* SpecialPage::getRestrictedPages() (deprecated in 1.18)
* SpecialPage::getTitleForAlias() (deprecated in 1.18)
* SpecialPage::getUsablePages() (deprecated in 1.18)
* SpecialPage::includable() (deprecated in 1.18)
* SpecialPage::init()
* SpecialPage::initAliasList() (deprecated in 1.18)
* SpecialPage::initList() (deprecated in 1.18)
* SpecialPage::name() (deprecated in 1.18)
* SpecialPage::removePage() (deprecated in 1.18)
* SpecialPage::resolveAlias() (deprecated in 1.18)
* SpecialPage::resolveAliasWithSubpage() (deprecated in 1.18)
* SpecialPage::restriction() (deprecated in 1.18)
* SpecialPage::setGroup() (deprecated in 1.18)
* SpecialRecentChanges::feedSetup()
* SpecialRevisionDelete::extractBitField() (deprecated in 1.22)
* User::getPageRenderingHash() (deprecated in 1.17)
* WebRequest::getFileSize() (deprecated in 1.17)
* WebRequest::isPathInfoBad() (deprecated in 1.17)
* wfGenerateToken (deprecated in 1.20)
* wfStreamFile (deprecated in 1.19)
* wfUILang (deprecated in 1.18)
* WikiPage::createUpdates() (deprecated in 1.18)
* WikiPage::quickEdit() (deprecated in 1.18)
* WikiPage::useParserCache() (deprecated in 1.18)
* WikiPage::viewUpdates() (deprecated in 1.18)

==== Removed globals ====
* $wgBetterDirectionality (deprecated in 1.18)

= MediaWiki 1.22 =

== MediaWiki 1.22.15 ==

This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.14 ===

* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
  could lead to xss. Permission to edit MediaWiki namespace is required to
  exploit this.
* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in
  $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as
  part of its name.
* (bug T74222) The original patch for T74222 was reverted as unnecessary.

== MediaWiki 1.22.14 ==

This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.13 ===

* (bugs 66776, 71478) SECURITY:  User PleaseStand reported a way to inject code
  into API clients that used format=php to process pages that underwent flash
  policy mangling. This was fixed along with improving how the mangling was done
  for format=json, and allowing sites to disable the mangling using
  $wgMangleFlashPolicy.
* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update
  the content model for a page could allow an unprivileged attacker to edit
  another user's common.js under certain circumstances. The user right
  "editcontentmodel" was added, and is needed to change a revision's content
  model.
* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with
  DELETED_ACTION. NOTICE: this may be reverted in a future release pending a
  public RFC about the desired functionality. This issue was reported by user
  Bawolff.
* (bug 71621) Make allowing site-wide styles on restricted special pages a
  config option.
* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
  might be a flash policy directive configurable.

== MediaWiki 1.22.13 ==
This is a maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.12 ===
* (bug 67440) Allow classes to be registered properly from installer

== MediaWiki 1.22.12 ==
This is a security release of the MediaWiki 1.22 branch.

=== Changes since 1.22.11 ===
* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
  allowance.

== MediaWiki 1.22.11 ==
This is a security release of the MediaWiki 1.22 branch.

=== Changes since 1.22.10 ===
* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style>
  elements; normalize style elements and attributes before filtering; add checks
  for attributes that contain css; add unit tests for html5sec and reported
  bugs.

== MediaWiki 1.22.10 ==
This is a maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.9 ===
* (bug 64970) Fix support for blobs on DatabaseOracle::update
* (bug 60719) In MediaWiki 1.22, the job queue execution on each page request
  was changed (Gerrit change 59797) so, instead of executing the job inside the
  same PHP process that's rendering the page, a new PHP cli command is spawned
  to execute runJobs.php in the background. It will only work if $wgPhpCli is
  set to an actual path or safe mode is off, otherwise, the old method will be
  used. See
  https://www.mediawiki.org/wiki/Manual:Job_queue#Changes_in_MediaWiki_1.22
  for more information. This change was in earlier releases of 1.22 but was not
  noted here until now.

== MediaWiki 1.22.9 ==
This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.8 ===
* (bug 68187) SECURITY: Prepend jsonp callback with comment.
* (bug 66608) SECURITY: Fix for XSS issue in bug 66608: Generate the URL used
  for loading a new page in Javascript,instead of relying on the URL in the
  link that has been clicked.
* (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and
  ParserOutput.
* (bug 59147) The img_metadata field was not being decoded from bytea into text.

== MediaWiki 1.22.8 ==
This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.7 ===
* (bug 65839) SECURITY: Prevent external resources in SVG files.
* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like
  only extracting the tail of the file partially or not at all.

== MediaWiki 1.22.7 ==
This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.6 ===
* (bug 65501) SECURITY: Don't parse usernames as wikitext on
  Special:PasswordReset.
* (bug 36356) Add space between two feed links.
* (bug 63269) Email notifications were not correctly handling the
  MediaWiki:Helppage message being set to a full URL. This is a regression from
  the 1.22.5 point release, which made the default value for it a URL. If you
  customized MediaWiki:Enotif body (the text of email notifications), you'll
  need to edit it locally to include the URL via the new variable $HELPPAGE
  instead of the parser functions fullurl and canonicalurl; otherwise you don't
  have to do anything.
* Add missing uploadstash.us_props for PostgreSQL.
* (bug 56047) Fixed stream wrapper in PhpHttpRequest.

== MediaWiki 1.22.6 ==
This is a security release of the MediaWiki 1.22 branch.

=== Changes since 1.22.5 ===
* (bug 63251) SECURITY: Escape sortKey in pageInfo.

== MediaWiki 1.22.5 ==
This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.4 ===
* (bug 62497) SECURITY: Add CSRF token on Special:ChangePassword.
* (bug 62467) Set a title for the context during import on the cli.
* Fix custom local MediaWiki:Helppage values.
* mediawiki.js: Fix documentation breakage.
* (bug 58153) Make MySQLi work with non standard port.
* (bug 53887) Reintroduced a link to help pages in the default sidebar, that any
  sysop can customize by editing MediaWiki:Sidebar locally. The link now points
  to a mediawiki.org page which is guaranteed to exist. Nothing needs to be done
  on your end, but remember to adjust MediaWiki:Sidebar for the needs of your
  wikis. Everyone can help with the shared documentation by translating:
  https://www.mediawiki.org/wiki/Special:Translate/agg-Help_pages .
* (bug 53888) Corrected a regression in 1.22 which introduced red links on the
  login page. If you previously installed 1.22.x and have created a local page
  to make the red link blue, write its title as in MediaWiki:helplogin-url if
  you didn't already. Otherwise, you don't need to do anything, but you can
  translate the help page at <https://www.mediawiki.org/wiki/Help:Logging_in>.

== MediaWiki 1.22.4 ==
This is a maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.3 ===
* Use the correct branch of the extensions' git repositories.

== MediaWiki 1.22.3 ==
This is a security and bugfix release of the MediaWiki 1.22 branch.

=== Changes since 1.22.2 ===
* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
  namespaces. Also disallow iframe elements. * User will get an error including
  the namespace name if they use a non- whitelisted namespace.
* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
  our token comparison would be vulnerable to timing attacks. This will take
  constant time.
* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
* (bug 53710) Add sequence support for upsert in DatabaseOracle in the same way
  as in selectInsert
* (bug 60231, bug 58719) Various fixes to job running code in Wiki.php: Make it
  async on Windows. Fixed possible "invalid filename" errors on Windows.
  Redirect output to dev/null to avoid hanging PHP.
* (bug 60083) Correct sequence name for fresh Postgres installation. Spotted by
  gebhkla
* (bug 60531) Avoid variable naming conflicts in
  DatabasePostgres::selectSQLText. Spotted by gebhkla
* (bug 60094) Fix rebuildall.php fatal error with PostgreSQL.
* (bug 43817) Add error handling if descriptionmsg isn't defined for extension.
* (bug 60543) Special:PrefixIndex omits stripprefix=1 for "Next page" link.

== MediaWiki 1.22.2 ==
This is a security and bugfix release of the MediaWiki 1.22 branch.

=== Changes since 1.22.1 ===
* (bug 60339) SECURITY: Sanitize shell arguments to DjVu files, and other media
  formats
* (bug 58253) Check for very old PCRE versions in installer and updater
* (bug 60054) Make WikiPage::$mPreparedEdit public

== MediaWiki 1.22.1 ==
This is a security and maintenance release of the MediaWiki 1.22 branch.

=== Changes since 1.22.0 ===
* (bug 57550) SECURITY: Disallow stylesheets in SVG Uploads
* (bug 58088) SECURITY: Don't normalize U+FF3C to \ in CSS Checks
* (bug 58472) SECURITY: Disallow -o-link in styles
* (bug 58553) SECURITY: Return error on invalid XML for SVG Uploads
* (bug 58699) SECURITY: Fix RevDel log entry information leaks
* (bug 58178) Restore compatibility with curl < 7.16.2.
* (bug 56931) Updated the plural rules to CLDR 24. They are in new format which
  is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as the
  JavaScript evaluator were updated to support the new format. Plural rules for
  some languages have changed, most notably Russian. Affected software messages
  have been updated and marked for review at translatewiki.net. This change is
  backported from the development branch of MediaWiki 1.23.
* (bug 58434) The broken installer for database backend Oracle was fixed.
* (bug 58167) The web installer no longer throws an exception when PHP is
  compiled without support for MySQL yet with support for another DBMS.
* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to
  appear blank or with missing text.
* (bug 47055) Changed FOR UPDATE handling in Postgresql
* (bug 57026) Avoid extra parsing in prepareContentForEdit()

== MediaWiki 1.22.0 ==

=== Configuration changes in 1.22 ===
* $wgRedirectScript was removed. It was unused.
* Removed $wgLocalMessageCacheSerialized, it is now always true.
* $wgVectorUseIconWatch is now enabled by default.
* $wgCascadingRestrictionLevels was added.
* ftps, ssh, sftp, xmpp, sip, sips, tel, sms, bitcoin, magnet, urn, and geo
  have been whitelisted inside of $wgUrlProtocols.
* $wgDocType and $wgDTD have been removed and are no longer used for the
  DOCTYPE.
* $wgHtml5 is no longer used by core. Setting it to false will no longer disable
  HTML5. It is still set to true for extension compatibility but doing so in
  extensions is deprecated.
* $wgXhtmlDefaultNamespace is no longer used by core. Setting it will no longer
  change the xmlns used by MediaWiki. Reliance on this variable by extensions
  is deprecated.
* $wgHandheldStyle was removed.
* $wgHandheldForIPhone was removed.
* $wgJsMimeType is no longer used by core. Most usage has been removed since
  HTML output is now exclusively HTML5.
* $wgDBOracleDRCP added. True enables persistent connection with DRCP on Oracle.
* $wgLogAutopatrol added to allow disabling logging of autopatrol edits in the
  logging table.
  Default for $wgLogAutopatrol is true.
* The 'edit' right no longer allows for editing a user's own CSS and JS.
* New rights 'editmyusercss', 'editmyuserjs', 'viewmywatchlist',
  'editmywatchlist', 'viewmyprivateinfo', 'editmyprivateinfo', and
  'editmyoptions' restrict actions that were formerly allowed by default. They
  have been added to the default for $wgGroupPermissions['*'].
* The 'editprotected' right no longer allows bypassing of all page protection
  restrictions. Any group using it for this purpose will now need to have all
  the individual rights listed in $wgRestrictionTypes for the same effect.
* The 'protect' and 'autoconfirmed' rights are no longer used for the default
  page protection levels. The rights 'editprotected' and 'editsemiprotected'
  are now used for this purpose instead.
* (bug 40866) wgOldChangeTagsIndex removed.
* $wgNoFollowDomainExceptions now only matches entire domains. For example,
  an entry for 'bar.com' will still match 'foo.bar.com' but not 'foobar.com'.
* $wgCopyUploadTimeout and $wgCopyUploadAsyncTimeout added to change the timeout
  times for fetching the file during upload by url.
* New key added to $wgGalleryOptions - $wgGalleryOptions['mode'] to set
  default gallery mode.
* New hook 'GalleryGetModes' to allow extensions to make new gallery modes.
* The checkbox for staying in HTTPS displayed on the login form when
  $wgSecureLogin is enabled has been removed. Instead, whether the user stays in
  HTTPS will be determined
  based on the user's preferences, and whether they came from HTTPS or not.
* $wgRC2UDPAddress, $wgRC2UDPInterwikiPrefix, $wgRC2UDPOmitBots, $wgRC2UDPPort,
  and $wgRC2UDPPrefix configuration options have been deprecated in favor of a
  $wgRCFeeds configuration array. $wgRCFeeds makes both the format and
  destination of recent change notifications customizable, and allows for
  multiple destinations to be specified.
* (bug 53862) portal-url, currentevents-url and helppage have been removed from
  the default Sidebar.
* The 'vector-simplesearch' preference is now enabled by default. Previously
  it was only enabled if the Vector extension was installed.
* The precise format of metric datagrams produced by the UDP profiler and stats
  counter may now be specified as $wgUDPProfilerFormatString and
  $wgStatsFormatString, respectively.
* (bug 54597) $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath, and
  $wgProxyMemcExpiry have been removed, along with the open proxy scanner
  script they were added for.
* Default value of $wgMaxShellMemory has been tripled (it's now 300 MB).

=== New features in 1.22 ===
* You can now install extensions using Composer.
  See https://www.mediawiki.org/wiki/Composer
* (bug 44525) mediawiki.jqueryMsg can now parse (whitelisted) HTML elements and
  attributes.
* (bug 33454) Language::sprintfDate now has a timezone parameter, and supports
  the "eIOPTZ" formatting characters.
* EditWarning: A warning is shown when an editor leaves the edit form without
  saving (enabled by default, users can opt-out via the 'useeditwarning'
  preference). This feature was moved from the Vector extension, and is now part
  of core for all skins. Take care when upgrading that you don't use an older
  version of the Vector extension as this feature may conflict.
* New 'mediawiki.ui' CSS module providing mw-ui-* styles for buttons and a
  compact vertical form layout.
* HTMLForm supports a new display format 'vform' which applies this compact
  vertical
  layout and button styling. Special:PasswordReset uses this format.
* New versions of login (Special:UserLogin) and create account
  (Special:UserLogin/signup) forms using the "vform" compact vertical form
  layout. These forms use new messages that assume a "Help logging in" link, see
  https://www.mediawiki.org/wiki/Manual:Page_customizations;
  https://www.mediawiki.org/wiki/Account_creation_user_experience/Strings lists
  the message key changes.
* (bug 23343) Implemented ability to apply IP blocks to the contents of
  X-Forwarded-For headers by adding a new configuration variable
  $wgApplyIpBlocksToXff (disabled by default).
* The new hook 'APIGetPossibleErrors' to modify the list of possible errors was
  added.
* (bug 25592) LogEventsList::showLogExtract() will now ignore various
  Pager-related WebRequest parameters by default, as this is overwhelmingly
  likely to be what was intended by users of the method. If any caller wishes
  to use these parameters, the new param 'useRequestParams' may be set to true.
* mw.util.addPortletLink: Tooltip is no longer required to be plain (without
  an accesskey in it already). As such it now rountrips. Creating a link with a
  message as tooltip, grabbing the title attribute and using it to create
  another portlet will work as expected.
* (bug 6747) {{ROOTPAGENAME}} introduced, contains the name of the topmost
  page without namespace.
* BREAKING CHANGE: (bug 41729) Display editsection links next to headings. Also
  change their class name from .editsection to .mw-editsection and place them at
  the end of the heading element instead of the beginning. Client-side code and
  screen-scrapers will have to be adjusted to handle both cases (old HTML will
  still be visible on cached page renders until they are purged); extensions
  using the DoEditSectionLink or EditSectionLink hooks might need adjustments as
  well.
* (bug 45535) introduced the new 'LanguageLinks' hook for manipulating the
  language links associated with a page before display.
* Chosen (http://harvesthq.github.io/chosen/) was added as module
  'jquery.chosen'
* HTMLForm will turn multiselect checkboxes into a Chosen interface when setting
  cssclass 'mw-chosen'
* rebuildLocalisationCache learned --lang option. Let you rebuild l10n caches
  of the specified languages instead of all of them.
* New GetNewMessagesAlert hook allowing extensions to disable or modify the new
  messages alert
* New wgUserNewMsgRevisionId JS global for logged in users. This will be null
  if the user has no new talk page messages. Otherwise it will be set to the
  revision ID of the oldest new talk page message. This will allow gadgets and
  extensions to create their own new message alerts on the client side.
* mediawiki.log: Added log.warn wrapper (uses console.warn and console.trace).
* mediawiki.log: Implemented log.deprecate. This method defines a property and
  uses ES5 getter/setter to emit a warning when they are used.
* $wgCascadingRestrictionLevels was added, allowing one to specify restriction
  levels which can be cascading (previously 'sysop' was hard-coded as the only
  one).
* XHTML5 support has been improved. If you set
  $wgMimeType = 'application/xhtml+xml' MediaWiki will try outputting markup
  according to XHTML5 rules.
* Altered hook 'ProtectionForm::save', adding the reason page protection is
  changed as third parameter.
* New hook 'TitleSquidURLs' for manipulating the list of URLs to be purged from
  HTTP caches when a page is changed.
* Changed the patrolling system to always show the link for patrolling in case
  the current revision is patrollable. This also removed the usage of the rcid
  URI parameters.
* Oracle DB backend now supports Database Resident Connection Pooling (DRCP).
  Can be enabled by setting $wgDBOracleDRCP=true.
  Requires Oracle DB 11gR1 or above, enabled DRCP inside the DB itself and a
  propper connect string.
  More about DRCP can be found at:
  https://oracle-base.com/articles/11g/database-resident-connection-pool-11gr1
* Add a new parameter $patrolFooterShown to hook ArticleViewFooter so the hook
  handlers can take further action based on the status of the patrol footer
* A new hook TitleQuickPermissions was added to allow overriding of quick
  permissions in the Title class.
* LinkCache singleton can now be altered or cleared, letting one to specify
  another instance that does not rely on a database backend.
* MediaWiki's PHPUnit tests can now use PHPUnit installed using composer --dev.
* (bug 43689) The lists of templates used on the page and hidden categories it
  is a member of, shown below the edit form, are now collapsible (and collapsed
  by default).
* Parser profiling data, formerly only available in the "NewPP limit report"
  HTML comment, is now also displayed at the bottom of page previews.
* Added ParserLimitReportPrepare and ParserLimitReportFormat hooks, deprecated
  ParserLimitReport hook.
* New user rights have been added to increase granularity in rights management
  for extensions such as OAuth:
** editmyusercss controls whether a user may edit their own CSS subpages.
** editmyuserjs controls whether a user may edit their own JS subpages.
** viewmywatchlist controls whether a user may view their watchlist.
** editmywatchlist controls whether a user may edit their watchlist.
** viewmyprivateinfo controls whether a user may access their private
   information (e.g. registered email address, real name).
** editmyprivateinfo controls whether a user may change their private
   information.
** editmyoptions controls whether a user may change their preferences.
* Add new hook AbortTalkPageEmailNotification, this will be used to determine
  whether to send the regular talk page email notification
* Action classes registered in $wgActions are now also supported in the form of
  a callback (which returns an instance of Action) instead of providing the name
  of a subclass of Action.
* (bug 46513) Vector: Add the collapsibleTabs script from the Vector extension.
* Added $wgRecentChangesFlags for defining new flags for RecentChanges and
  watchlists.
* (bug 40518) mw.toolbar: Implemented mw.toolbar.addButtons for adding multiple
 button objects in one call.
* Rights used for the default protection levels ('sysop' and 'autoconfirmed')
  are now used just for that purpose, instead of overloading other rights. This
  allows easy granting of the ability to edit sysop-protected pages without
  also granting the ability to protect and unprotect.
* (bug 48256) Make brackets in section edit links accessible to CSS.
  They are now wrapped in <span class="mw-editsection-bracket" />.
* (bug 8480) Allow handler specific parameters in galleries (like page number)
* jquery.client: Add detection for Opera 15 and Internet Explorer 11.
* Change tags (used by the AbuseFilter extension) are now shown on diff pages.
* Change tag lists (shown on recent changes, watchlist, user contributions,
  history pages, diff pages) now include a link to Special:Tags to distinguish
  them from edit summaries.
* Added a new method and hook, User::isEveryoneAllowed() and
  UserIsEveryoneAllowed, for use in situations where a "does everyone have this
  right?" check is used to avoid more expensive checks.
* (bug 14431) Display "(No difference)" instead of an empty diff (when comparing
  revisions in the history or when previewing changes while editing).
* New hook 'IsUploadAllowedFromUrl' is added which can be used to intercept
  uploads by URL, useful for blacklisting specific URLs
* (bug 21912) Watchlist token implementation has been refactored and
  Special:ResetTokens was added to allow users to reset their tokens
  instead of presenting them in Preferences.
* Special:PrefixIndex now lets you strip the searched prefix from the displayed
  titles. Given a list of articles named Bug1, Bug2, you can now transclude the
  list of bug numbers using: {{Special:PrefixIndex/Bug|stripprefix=1}}.
  The special page form received a new checkbox matching that option.
* (bug 23580) Implement javascript callback interface "mw.hook".
* (bug 30713) New mw.hook "wikipage.content".
* (bug 40430) jquery.placeholder gets a new parameter to set the attribute value
  to be used.
* $wgHTCPMulticastRouting renamed $wgHTCPRouting since it accepts unicast.
* $wgHTCPRouting rules can now be passed an array of hosts/ports to send purge
  too. Can be used whenever several multicast group could be interested by a
  specific purge.
* (bug 25931) Add Special:RandomInCategory.
* mediawiki.util: addPortletLink now supports passing a jQuery object as
  nextnode.
* <wbr> can now be used inside WikiText.
* WebResponse::setcookie is much more featureful. Callers using PHP's
  setcookie() or setrawcookie() should begin using this instead.
* New hook WebResponseSetCookie, called from WebResponse::setcookie().
* New hook ResetSessionID, called when the session id is reset.
* Add a mode parameter to <gallery> tag with potential options of "traditional",
  "nolines", "packed", "packed-overlay", or "packed-hover".
* (bug 47399) A success message is now displayed after changing the password.
* Make thumb.php give HTTP redirects for file redirects
* (bug 30607) Special:ListFiles can now show old versions of files. Additionally
  Special:AllMyUploads was introduced so the user can get a list of all things
  they have ever uploaded, even if it was subsequently overridden.
* Introduced Special:MyFiles and Special:AllMyFiles as an alias for
  Special:MyUploads and Special:AllMyUploads respectively.
* IPv6 addresses in X-Forwarded-For headers are now normalised before checking
  against allowed proxy lists.
* Add deferrable update support for callback/closure.
* Add TitleMove hook before page renames.
* Revision deletion backend code is moved out of SpecialRevisiondelete
* Added {{REVISIONSIZE}} variable to get the current size of a revision.
* Add support for the LESS stylesheet language to ResourceLoader. LESS is a
  stylesheet language that compiles into CSS. ResourceLoader file modules may
  include LESS style files; ResourceLoader will compile these files into CSS
  before sending them to the client.
** The $wgResourceLoaderLESSVars configuration variable is an associative array
   mapping variable names to string CSS values. These variables are considered
   declared for all LESS files. Additional variables may be registered by
   adding keys to the array.
** $wgResourceLoaderLESSFunctions is an associative array of custom LESS
   function names to PHP callables. See
   <http://leafo.net/lessphp/docs/#custom_functions>
   for more details regarding custom functions.
** $wgResourceLoaderLESSImportPaths is an array of file system paths. Files
   referenced in LESS '@import' statements are looked up here first.
* ResourceLoader supports hashes as module cache invalidation trigger (instead
  of or in addition to timestamps).
* Added $wgExtensionEntryPointListFiles for use in mergeMessageFileList.php.
* Added a hook, APIQuerySiteInfoStatisticsInfo, to allow extensions to modify
  the output of the API query meta=siteinfo&siprop=statistics
* Primary keys have been added to both the archive table and the externallinks
  tables.
* Added $wgEnableParserLimitReporting to control whether the NewPP limit report
  is output in a HTML comment.
* The 'UnwatchArticle' and 'WatchArticle' hooks now support a Status object
  instead of just a boolean return value to abort the hook.
* Added a hook, SpecialWatchlistGetNonRevisionTypes, to allow extensions
  with custom recentchanges entries to hook into the Watchlist without
  clobbering each other.
* A hidden, empty input field was added to the edit form, and any edit that
  fills it in will be rejected. This prevents against the simplest form of
  spambots. Previously in the "SimpleAntiSpam" extension by Ryan Schmidt.
* populateRevisionLength.php maintenance script updated to also populate
  archive.ar_len field.
* (bug 43571) DatabaseMySQLBase learned to list views, optionally filtered by a
  prefix. Also fixed PHPUnit test suite when using a MySQL backend containing
  views.

=== Bug fixes in 1.22 ===
* (bug 47271) $wgContentHandlerUseDB should be set to false during the upgrade
* Disable Special:PasswordReset when $wgEnableEmail is false. Previously one
  could still navigate to the page by entering the URL directly.
* (bug 47138) Fixed a fatal error when a blocked user tries to automatically
  create an account on login due external authentication in some circumstances.
* (bug 23393) HTML <hN> headings containing line breaks are now handled
  correctly.
* (bug 45803) Whitespace within == Headline == syntax and within <hN> headings
  is now non-significant and not preserved in the HTML output.
* (bug 47218) Special:BlockList now handles correctly user names with spaces
  when passed as subpage.
* Pager's properly validate which fields are allowed to be sorted on.
* mw.util.tooltipAccessKeyRegexp: The regex now matches "option-" as well.
  Support for Mac "option" was added in 1.16, but the regex was never updated.
* (bug 46768) Usernames of blocking users now display correctly, even if
  numeric.
* (bug 39590) Self-transclusions now show the most up to date result always
  after save instead of being a revision behind.
* A bias in wfRandomString() toward digits 1-7 has been corrected. Generated
  strings will now start with digits 0 and 8-f as often as they should.
* (bug 45371) Removed Parser_LinkHooks and CoreLinkFunctions classes.
* (bug 41545) Allow <kbd>, <samp>, and <var> to be nested like allowed in html.
* PLURAL magic word no longer causes a PHP notice when no matching form exists.
* (bug 36641) Patrol page links no longer show on non-existent revisions.
* (bug 35810) Pages not linked from Special:RecentChanges or Special:NewPages
  are patrollable now.
* (bug 30213) JavaScript for search suggestions is now disabled when the API
  is disabled, and AJAX patrolling and watching are now disabled when use of
  the write API is not allowed.
* (bug 48294) API: Fix chunk upload async mode.
* (bug 46749) Broken files tracking category removed from pages if an image
  with that name is uploaded.
* (bug 14176) System messages that are empty were previously incorrectly treated
  as non-existent, causing a fallback to the default. This stopped users from
  overriding system messages to make them blank.
* (bug 48319) action=parse no longer returns an error if passed none of 'oldid',
  'pageid', 'page', 'title', and 'text' (e.g. if only passed 'summary'). A
  warning will instead be issued if 'title' is non-default, unless no props are
  requested.
* Special:Recentchangeslinked will now include upload log entries
* (bug 41281) Fixed ugly output if file size could not be extracted for
  multi-page media.
* (bug 50315) list=logevents API module will now output log entries by anonymous
  users.
* (bug 38911) Handle headers with rowspan in jquery.tablesorter
* (bug 658) Converted the table of contents on wiki pages from <table> to <div>
  and adjusted skin CSS accordingly. The CSS was carefully crafted to be
  backwards-compatible in all reasonable cases (uses of the __TOC__ magic word,
  the #toc CSS id and the .toc CSS class). However, particularly bad abuse of
  the id or the class can possibly break.
* CSSJanus now supports rgb, hsl, rgba, and hsla color syntaxes.
* Special:Listfiles can no longer be sorted by image name when filtering
  by user in miser mode.
* (bug 49074) CSSJanus: Handle values of border-radius correctly.
* Handle relative inclusions ({{../name}}) in main namespace with subpages
  enabled correctly (previously MediaWiki tried to include Template:Parent/name
  instead of just Parent/name).
* Added $wgAPIUselessQueryPages to allow extensions to flag their query pages
  for non-inclusion in ApiQueryQueryPages.
* (bug 50870) mediawiki.notification: Notification area should remain visible
  when scrolled down.
* (bug 13438) Special:MIMESearch no longer an expensive special page.
* (bug 48342) Fixed a fatal error when $wgValidateAllHtml is set to true and
  the function apache_request_headers() function is not available.
* (bug 33399) LivePreview: Re-run wikipage content handlers
  (jquery.makeCollapsible, jquery.tablesorter) after preview content is loaded.
* (bug 51891) Fixed PHP notice on Special:PagesWithProp when no properties
  are defined.
* (bug 52006) Corrected documentation of $wgTranscludeCacheExpiry.
* (bug 52077) The APIEditBeforeSave hook is giving the content of the whole
  revision as second argument now, rather than just the current section.
* (bug 49694) $wgSpamRegex is now also applied on the new section headline text
  adding a new topic on a page
* (bug 41756) Improve treatment of multiple comments on a blank line.
* (bug 51064) Purge upstream caches when deleting file assets.
* (bug 39012) File types with a mime that we do not know the extension for
  can no longer be uploaded as an extension that we do know the mime type
  for.
* (bug 51742) Add data-sort-value for better sorting of hitcounts Special:Tags
* (bug 26811) On DB error pages, server hostnames are now hidden when both
  $wgShowHostnames and $wgShowSQLErrors are false.
* (bug 6200) line breaks in <blockquote> are handled like they are in <div>
* (bug 14931) Default character set now set to 'utf8' when a new MySQL
  database is created.
* (bug 47191) Fixed "Column 'si_title' cannot be part of FULLTEXT index"
  MySQL error when installing using the binary character set option.
* (bug 45288) Support mysqli PHP extension
* (bug 55818) BREAKING CHANGE: Removed undocumented 'Debug' hook in wfDebug.
  This resolves an infinite loop when using $wgDebugFunctionEntry = true.
* (bug 56707) Correct tooltip of "Next n results" on query special pages.
* (bug 56770) mw.util.addPortletLink: Check length before access array index.

=== API changes in 1.22 ===
* (bug 25553) The JSON output formatter now leaves forward slashes unescaped
  to improve human readability of URLs and similar strings. Also, a "utf8"
  option is now provided to use UTF-8 encoding instead of hex escape codes
  for most non-ASCII characters.
* (bug 46626) xmldoublequote parameter was removed. Because of a bug, the
  parameter has had no effect since MediaWiki 1.16, and so its removal is
  unlikely to impact existing clients.
* (bug 47216) action=query&meta=siteinfo&siprop=skins will now indicate which
  skin is the default and which are unusable (e.g. listed in $wgSkipSkins).
* (bug 25325) Added support for wlshow filtering (bots/anon/minor/patrolled)
  to action=feedwatchlist.
* WDDX formatted output will actually be formatted (and normal output will no
  longer be), and will no longer choke on booleans.
* action=opensearch no longer silently ignores the format parameter.
* action=opensearch now supports format=jsonfm.
* list=usercontribs&ucprop=ids will now include the parent revision id.
* BREAKING CHANGE: action=parse no longer returns all langlinks for the page
  with prop=langlinks by default. The new effectivelanglinks parameter will
  request that the LanguageLinks hook be called to determine the effective
  language links.
* BREAKING CHANGE: list=allpages, list=langbacklinks, and prop=langlinks do not
  apply the new LanguageLinks hook, and thus only consider language links
  stored in the database.
* (bug 47219) Allow specifying change type of Wikipedia feed items
* prop=imageinfo now allows setting iiurlheight without setting iiurlwidth
* prop=info now adds the content model and page language of the title.
* New upload log entries will now contain information on the relevant
  image (sha1 and timestamp).
* (bug 49239) action=parse now can parse in preview and section preview modes.
* (bug 49259) action=patrol now accepts revision ids.
* (bug 48129) list=blocks&bkip= now correctly handles IPv6 CIDR ranges and
  honors $wgBlockCIDRLimit. Note any clients passing invalid values to bkip
  will now receive an error, rather than the previous behavior listing all
  user blocks.
* (bug 48201) action=parse&text=foo now assumes wikitext if no title is given,
  rather than using the content model of the page "API".
* action=watch no longer silently ignores hook abort.
* (bug 50785) action=purge with forcelinkupdate=1 no longer queues refreshLinks
  jobs in the job queue for link table updates of pages that use the given page
  as a template. Instead, forcerecursivelinkupdate=1 is introduced and should
  be used if that behaviour is desirable.
* The 'debugLog' property (enabled by $wgDebugToolbar) no longer sets the log
  entry values through ApiResult::content but directly. This changes the JSON
  output from an array of objects with content in '*' to an array of strings
  with the content.
* (bug 51342) prop=imageinfo iicontinue now contains the dbkey, not the text
  version of the title.
* (bug 52538) action=edit will now use empty text instead of the contents
  of section 0 when passed prependtext or appendtext with section=new.
* Support for the 'gettoken' parameter to action=block and action=unblock,
  deprecated since 1.20, has been removed.
* (bug 49090) Token-getting functions will fail when using jsonp callbacks.
* (bug 52699) action=upload returns normalized file name on warning
  "exists-normalized" instead of filename to be uploaded to.
* (bug 53884) action=edit will now return an error when the specified section
  does not exist in the page.
* Added meta=filerepoinfo API module for getting information about foreign
  file repositories, and related ForeignAPIRepo methods getInfo and getApiUrl.
* The new query module list=allfileusages to enumerate file usages was added.

=== Languages updated in 1.22 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* Batak Toba (bbc-latn) added.
* (bug 46751) Made Buryat (Russia) (буряад) (bxr) fallback to Russian.

=== Other changes in 1.22 ===
* BREAKING CHANGE: Implementation of MediaWiki's JS and JSON value encoding
  has changed:
** MediaWiki no longer supports PHP installations in which the native JSON
   extension is missing or disabled.
** XmlJsCode objects can no longer be nested inside objects or arrays.
   (For Xml::encodeJsCall(), this individually applies to each argument.)
** The sets of characters escaped by default, along with the precise escape
   sequences used, have changed (except for the Xml::escapeJsString()
   function, which is now deprecated).
* BREAKING CHANGE: The Services_JSON class has been removed. If necessary,
  be sure to upgrade affected extensions at the same time (e.g. Collection).
* redirect.php was removed. It was unused.
* ClickTracking integration was dropped from the mediaWiki.user.bucket
  JavaScript function. The 'tracked' option is now ignored.
* BREAKING CHANGE: Legacy skins Simple, MySkin, Chick, Standard and Nostalgia
  were all removed. (Nostalgia was moved to an extension.) The SkinLegacy and
  LegacyTemplate classes that supported them were removed as well and are now a
  part of the Nostalgia extension.
* Event namespace used by jquery.makeCollapsible has been changed from
  'mw-collapse' to 'mw-collapsible' for consistency with the module name.
* BREAKING CHANGE: The "ExternalAuth" authentication subsystem was removed,
  along with its associated globals of $wgExternalAuthType, $wgExternalAuthConf,
  $wgAutocreatePolicy and $wgAllowPrefChange. Affected users are encouraged to
  use AuthPlugin for external authentication/authorization needs.
* The Quickbar feature of the legacy skin model and the last remnants of it
  throughout the code base have been removed.
* Externaledit/externaldiff preference was removed. Very few users used this
  feature, and improper configuration can actually prevent a user from editing
* Calling Linker methods using a skin will now output deprecation warnings.
* (bug 46680) "Return to" links are no longer tagged with rel="next".
* BREAKING CHANGE: mw.util.tooltipAccessKeyRegexp: The match group for the
  accesskey character is now $6 instead of $5.
* HipHop compiler (hphpc) support was removed. HipHop VM support (hhvm) was
  added.
* A new Special:Redirect page was added, providing lookup by revision ID,
  user ID, or file name.  The old Special:Filepath page was reimplemented
  to redirect through Special:Redirect.
* Monobook: Removed the old conditional stylesheets for Opera 6, 7 and 9.
* Support for XHTML 1.0 has been removed. MediaWiki now only outputs (X)HTML5.
* wikibits: User-agent related globals have been deprecated. The following
  properties now default to false and emit mw.log.warn: is_gecko, is_chrome_mac,
  is_chrome, webkit_version, is_safari_win, is_safari, webkit_match, is_ff2,
  ff2_bugs, is_ff2_win, is_ff2_x11, opera95_bugs, opera7_bugs, opera6_bugs,
  is_opera_95, is_opera_preseven, is_opera, and ie6_bugs.
* (bug 48276) MediaWiki will now flash a confirmation message upon successfully
  editing a page.
* (bug 40785) mediawiki.legacy.ajax has been marked as deprecated. The following
  properties now emit mw.log.warn when accessed: sajax_debug, sajax_init_object,
  sajax_do_call and wfSupportsAjax.
* BREAKING CHANGE: meta keywords are no longer supported. A
  <meta name="keywords" will no longer be output and OutputPage::addKeyword no
  longer exists.
* Methods Title::userCanEditCssSubpage and Title::userCanEditJsSubpage,
  deprecated since 1.19, have been removed.
* (bug 50134) Hook functions are no longer required to return a value. When a
  hook function does not return a value (or when it returns an explicit null),
  processing continues. To abort the hook, a hook function must return an
  explicit, boolean false or a string error message. Other falsey values are
  tantamount to a 'return true' in earlier versions of MediaWiki.
* BREAKING CHANGE: The EditSectionLink hook was removed after being
  deprecated since MediaWiki 1.14. Use DoEditSectionLink instead.
* (bug 48256) The 'editsection-brackets' optional message was removed.
  Section edit links' brackets can now be customized using CSS by
  styling span.mw-editsection-bracket.
* The usePatrol function in ChangesList has been marked as deprecated.
* (bug 50785) A "null edit", that is, a save action in which no changes to the
  page text are made and no revision recorded, will no longer send refreshLinks
  jobs to the job table to update pages which use the edited page as a template.
* The LivePreviewPrepare and LivePreviewDone events triggered on "jQuery( mw )"
  have been deprecated in favour of using mw.hook.
* The 'showjumplinks' user preference has been removed, jump links are now
  always included.
* Methods RecentChange::notifyRC2UDP, RecentChange::sendToUDP, and
  RecentChange::cleanupForIRC have been deprecated, as it is now the
  responsibility of classes implementing the RCFeedFormatter and RCFeedEngine
  interfaces to implement the formatting and delivery for recent change
  notifications.
* SpecialPrefixindex methods namespacePrefixForm() and showPrefixChunk() have
  been made protected. They were accepting form variance arguments, this is now
  using properties in the SpecialPrefixindex class.
* (bug 50310) BREAKING CHANGE: wikibits: Drop support for mwCustomEditButtons.
  It defaults to an empty array and emits mw.log.warn when accessed.
* BREAKING CHANGE: Special:Disambiguations has been removed from MediaWiki core.
  Functions related to disambiguation pages are now handled by the Disambiguator
  extension (https://www.mediawiki.org/wiki/Extension:Disambiguator) (bug
  35981).
* BREAKING CHANGE: The 'mediawiki.legacy.wikiprintable' module has been removed.
  The skins/common/wikiprintable.css file no longer exists. Return value of
  Skin#commonPrintStylesheet is ignored. Please use the
  'mediawiki.legacy.commonPrint' module instead or base your skin on
  SkinTemplate.
* (bug 49629) The hook ExtractThumbParameters has been deprecated in favour
  of media handler overriding MediaHandler::parseParamString.
* (bug 46512) The collapsibleNav feature from the Vector extension has been
  moved to the Vector skin in core.
* SpecialRecentChanges::addRecentChangesJS() function has been renamed
  to addModules() and made protected.
* Methods WatchAction::doWatch and WatchAction::doUnwatch now return a Status
  object instead of a boolean.
* Information boxes (CSS classes errorbox, warningbox, successbox) have been
  made more subtle.
* BREAKING CHANGE: The module 'mediawiki.legacy.IEFixes' has been removed as it
  was unused. The file skins/common/IEFixes.js remains but is only used by
  wikibits. The file never contained any re-usable components. To use it in a
  skin, load 'mediawiki.legacy.wikibits' (which IEFixes depends on) and that
  will import IEFixes automatically if user agent conditions are met.
* Code specific to the Math extension was marked as deprecated.
* mediawiki.util: mw.util.wikiGetlink has been renamed to getUrl. (The old name
  still works, but is deprecated.)

= MediaWiki 1.21 =

== MediaWiki 1.21.11 ==
This is a security and maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.10 ===
* (bug 65839) SECURITY: Prevent external resources in SVG files.
* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like
  only extracting the tail of the file partially or not at all.

== MediaWiki 1.21.10 ==
This is a security and maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.9 ===
* (bug 65501) SECURITY: Don't parse usernames as wikitext on
  Special:PasswordReset.
* (bug 36356) Add space between two feed links.

== MediaWiki 1.21.9 ==
This is a security and maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.8 ===
* (bug 63251) SECURITY: Escape sortKey in pageInfo.
* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to
  appear blank or with missing text.

== MediaWiki 1.21.8 ==
This is a security and maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.7 ===
* (bug 62497) SECURITY: Add CSRF token on Special:ChangePassword.
* (bug 62467) Set a title for the context during import on the cli.

== MediaWiki 1.21.7 ==
This is a maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.6 ===
* Use the correct branch of the extensions' git repositories.

== MediaWiki 1.21.6 ==
This is a security release of the MediaWiki 1.21 branch.

=== Changes since 1.21.5 ===
* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
  namespaces. Also disallow iframe elements.
* User will get an error including the namespace name if they use a
  non-whitelisted namespace.
* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
  our token comparison would be vulnerable to timing attacks. This will take
  constant time.
* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.

== MediaWiki 1.21.5 ==
This is a security release of the MediaWiki 1.21 branch.

=== Changes since 1.21.4 ===
* (bug 60339) SECURITY: Sanitize shell arguments to DjVu files, and other media
  formats

== MediaWiki 1.21.4 ==
This is a security release of the MediaWiki 1.21 branch.

=== Changes since 1.21.3 ===
* (bug 57550) SECURITY: Disallow stylesheets in SVG Uploads
* (bug 58088) SECURITY: Don't normalize U+FF3C to \ in CSS Checks
* (bug 58472) SECURITY: Disallow -o-link in styles
* (bug 58553) SECURITY: Return error on invalid XML for SVG Uploads
* (bug 58699) SECURITY: Fix RevDel log entry information leaks

== MediaWiki 1.21.3 ==
This is a security and maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.2 ===
* (bug 53032) SECURITY: Don't cache when a call could autocreate
* (bug 55332) SECURITY: Improve css javascript detection
* (bug 49717) Fix behaviour $wgVerifyMimeType = false; in Upload
* Fix comma errors in various js files
* Translations

== MediaWiki 1.21.2 ==
This is a security and maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.1 ===
* SECURITY: Fix extension detection with 2 .'s
* SECURITY: Support for the 'gettoken' parameter to action=block and
  action=unblock, deprecated since 1.20, has been removed.
* SECURITY: Sanitize ResourceLoader exception messages
* Purge upstream caches when deleting file assets.
* Unit test suite now runs the AutoLoader tests. Also fixed the autoloading
  entry for the PageORMTableForTesting class though it had no impact.

== MediaWiki 1.21.1 ==
This is a maintenance release of the MediaWiki 1.21 branch.

=== Changes since 1.21.0 ===
* An incorrect version number was used for 1.21.0. 1.21.1 has the correct
  number.
* A problem with the Oracle SQL table creation was fixed.
* (PdfHandler extension) Fix warning if pdfinfo fails but pdftext succeeds.

== MediaWiki 1.21.0 ==

=== Configuration changes in 1.21 ===
* (bug 29374) $wgVectorUseSimpleSearch is now enabled by default.
* Deprecated $wgAllowRealName is removed. Use $wgHiddenPrefs[] = 'realname'
  instead.
* (bug 39957) Added $wgUnwatchedPageThreshold, specifying minimum count
  of page watchers required for the number to be accessible to users
  without the unwatchedpages permission.
* $wgBug34832TransitionalRollback has been removed.
* (bug 29472) $wgUseDynamicDates has been removed and its functionality
  disabled.

=== New features in 1.21 ===
* (bug 38110) Schema changes (adding or dropping tables, indices and
  fields) can be now be done separately from other changes that
  update.php makes.  This is useful in environments that use database
  permissions to restrict schema changes but allow the DB user that
  MediaWiki normally runs as to perform other changes that update.php
  makes.  Schema changes can be run separately.  See the file UPGRADE
  for more information.
* (bug 34876) jquery.makeCollapsible has been improved in performance.
* Added ContentHandler facility to allow extensions to support other content
  than wikitext. See docs/contenthandler.txt for details.
* New feature was developed for showing high-DPI thumbnails for high-DPI mobile
  and desktop displays (configurable with $wgResponsiveImages).
* Added new backend to represent and store information about sites and site
  specific configuration.
* jQuery upgraded from 1.8.2 to 1.8.3.
* jQuery UI upgraded from 1.8.23 to 1.8.24.
* Added separate fa_sha1 field to filearchive table. This allows sha1
  searches with the api in miser mode for deleted files.
* Add initial and programmatic sorting for tablesorter.
* Add the event "sortEnd.tablesorter", triggered after sorting has completed.
* The Job system was refactored to allow for different backing stores for
  queues as well as cross-wiki access to queues, among other things. The schema
  for the DB queue was changed to support better concurrency and reduce
  deadlock errors.
* Added ApiQueryORM class to facilitate creation of query API modules based on
  tables that have a corresponding ORMTable class.
* (bug 40876) Icon for PSD (Adobe Photoshop) file types.
* (bug 40641) Implemented Special:Version/Credits with a list of contributors.
* (bug 7851) Implemented one-click AJAX patrolling.
* The <data>, <time>, <meta>, and <link> elements are allowed within WikiText
  for use with Microdata.
* The HTML5 <mark> tag has been whitelisted.
* Added ParserCloned hook for when the Parser object is cloned.
* Added AlternateEditPreview hook to allow extensions to replace the page
  preview from the edit page.
* Added EditPage::showStandardInputs:options hook to allow extensions to add
  new fields to the "editOptions" area of the edit form.
* Upload stash DB schema altered to improve upload performance.
* The following global functions are now reporting deprecated warnings in
  debug mode: wfMsg, wfMsgNoTrans, wfMsgForContent, wfMsgForContentNoTrans,
  wfMsgReal, wfMsgGetKey, wfMsgHtml, wfMsgWikiHtml, wfMsgExt, wfEmptyMsg. Use
  the Message class, or the global method wfMessage.
* Added $wgEnableCanonicalServerLink, off by default. If enabled, a
  <link rel=canonical> tag is added to every page indicating the correct server
  to use.
* Debug message emitted by wfDebugLog() will now be prefixed with the group
  name when its logged to the default log file. That is the case whenever the
  group has no key in wgDebugLogGroups, that will help triage the default log.
* (bug 24620) Add types to LogFormatter.
* jQuery JSON upgraded from 2.3 to 2.4.0.
* Added GetDoubleUnderscoreIDs hook, for modifying the list of magic words.
* DatabaseUpdater class has two new methods to ease extensions schema changes:
  dropExtensionIndex and renameExtensionIndex.
* New preference type - 'api'. Preferences of this type are not shown on
  Special:Preferences, but are still available via the action=options API.
* (bug 39397) Hide rollback link if a user is the only contributor of the page.
* $wgPageInfoTransclusionLimit limits the list size of transcluded articles
  on the info action. Default is 50.
* Added action=createaccount to allow user account creation.
* (bug 40124) action=options API also allows for setting of arbitrary
  preferences, provided that their names are prefixed with 'userjs-'. This
  officially reenables the feature that was undocumented and defective
  in MW 1.20 (saving preferences using Special:Preferences cleared any
  additional fields) and which has been disabled in 1.20.1 as a part of
  a security fix (bug 42202).
* Added option to specify "others" as author in extension credits using
  "..." as author name.
* Added the ability to limit the wall clock time used by shell processes,
  as well as the CPU time. Configurable with $wgMaxShellWallClockTime.
* Allow memory of shell subprocesses to be limited using Linux cgroups
  instead of ulimit -v, which tends to cause deadlocks in recent versions
  of ImageMagick. Configurable with $wgShellCgroup.
* Added $wgWhitelistReadRegexp for regex whitelisting.
* (bug 5346) Categories that are redirects will be displayed italic in
  the category links section at the bottom of a page.
* (bug 43915) New maintenance script deleteEqualMessages.php.
* You can now create checkbox option matrices through the HTMLCheckMatrix
  subclass in HTMLForm.
* WikiText now permits the use of WAI-ARIA's role="presentation" inside of
  html elements and tables. This allows presentational markup, especially
  tables. To be marked up as such.
* maintenance/sql.php learned the --cluster option. Let you run the script
  on some external cluster instead of the primary cluster for a given wiki.
* (bug 20281) test the parsing of inline URLs.
* Added Special:PagesWithProp, which lists pages using a particular page
  property.
* Implemented language-specific collations for category sorting for 67 languages
  based in latin, greek and cyrillic alphabets. This allows one to *finally* get
  articles to be correctly sorted on category pages. They are named
  'uca-<langcode>', where <langcode> is one of: af, ast, az, be, bg, br, bs, ca,
  co, cs, cy, da, de, dsb, el, en, eo, es, et, eu, fi, fo, fr, fur, fy, ga, gd,
  gl, hr, hsb, hu, is, it, kk, kl, ku, ky, la, lb, lt, lv, mk, mo, mt, nl, no,
  oc, pl, pt, rm, ro, ru, rup, sco, sk, sl, smn, sq, sr, sv, tk, tl, tr, tt, uk,
  uz, vi.
* Added 'CategoryAfterPageAdded' and 'CategoryAfterPageRemoved' hooks.
* Added 'HistoryRevisionTools' and 'DiffRevisionTools' hooks.
* Added 'SpecialSearchResultsPrepend' and 'SpecialSearchResultsAppend' hooks.
* (bug 33186) Add image rotation api "imagerotate"
* (bug 34040) Add "User rights management" link on user page toolbox.
* (bug 45526) Add QUnit assertion helper "QUnit.assert.htmlEqual" for asserting
  structual equality of HTML (ignoring insignificant differences like
  quotmarks, order and whitespace in the attribute list).
* (bug 23393) HTML <hN> headings containing line breaks are now handled
  correctly.
* (bug 45803) Whitespace within == Headline == syntax and within <hN> headings
  is now non-significant and not preserved in the HTML output.

=== Bug fixes in 1.21 ===
* (bug 40353) SpecialDoubleRedirect should support interwiki redirects.
* (bug 40352) fixDoubleRedirects.php should support interwiki redirects.
* (bug 9237) SpecialBrokenRedirect should not list interwiki redirects.
* (bug 34960) Drop unused fields rc_moved_to_ns and rc_moved_to_title from
  recentchanges table.
* (bug 32951) Do not register internal externals with absolute protocol,
  when server has relative protocol.
* (bug 39005) When purging proxies listed in $wgSquidServers using HTTP PURGE
  method requests, we now send a Host header by default, for Varnish
  compatibility. This also works with Squid in reverse-proxy mode. If you wish
  to support Squid configured in forward-proxy mode, set
  $wgSquidPurgeUseHostHeader to false.
* (bug 37020) sql.php with readline eats semicolon.
* (bug 11748) Properly handle optionally-closed HTML tags when Tidy is
  disabled, and don't wrap HTML-syntax definition lists in paragraphs.
* (bug 41409) Diffs while editing an old revision should again diff against the
  current revision.
* (bug 41494) Honor $wgLogExceptionBacktrace when logging non-API exceptions
  caught during API execution.
* (bug 37963) Fixed loading process for user options.
* (bug 26995) Update filename field on Upload page after having sanitized it.
* (bug 41793) Contribution links to users with 0 edits on Special:ListUsers
  didn't show up red.
* (bug 41899) A PHP notice no longer occurs when using the "rvcontinue" API
  parameter.
* (bug 42036) Account creation emails now contain canonical (not
  protocol-relative) URLs.
* (bug 41990) Fix regression: API edit with redirect=true and lacking
  starttimestamp and basetimestamp should not cause an edit conflict.
* (bug 41706) EditPage: Preloaded page should be converted if possible and
  needed.
* (bug 41886) Rowspans are no longer exploded by tablesorter until the table is
  actually sorted.
* (bug 2865)  User interface HTML elements don't use lang attribute.
  (completed the fix by adding the lang attribute to firstHeading).
* (bug 42173) Removed namespace prefixes on Special:UncategorizedCategories.
* (bug 36053) Log in "returnto" feature forgets query parameters if no
  title parameter was specified.
* (bug 42410) API action=edit now returns correct timestamp for the new edit.
* (bug 14901) Email notification mistakes log action for new page creation.
  Enotif no longer sends "page has been created" notifications for some log
  actions. The following events now have a correct message: page creation,
  deletion, move, restore (undeletion), change (edit). Parameter
  $CHANGEDORCREATED is deprecated in 'enotif_body' and scheduled for removal in
  MediaWiki 1.23.
* (bug 457) In the sidebar of Vector, CologneBlue, Monobook, and Monobook-based
  skins, the heading levels have been changed from (variously per skin)
  <h4>, <h5> or <h6> to only <h3>s, with a <h2> hidden heading above them.
  If you are styling or scripting the headings in a custom way, this change
  will require updates to your site's CSS or JS.
* (bug 41342) jquery.suggestions should cancel any active (async) fetches
  before it triggers another fetch.
* (bug 42184) $wgUploadSizeWarning missing second variable.
* (bug 34581) removeUnusedAccounts.php maintenance script now ignores newuser
  log when determining whether an account is used.
* (bug 43379) Gracefully fail if rev_len is unavailable for a revision on the
  History page.
* (bug 42949) API no longer assumes all exceptions are MWException.
* (bug 41733) Hide "New user message" (.usermessage) element from printable
  view.
* (bug 39062) Special:Contributions will display changes that don't have
  a parent id instead of just an empty bullet item.
* (bug 37209) "LinkCache doesn't currently know about this title" error fixed.
* wfMerge() now works if $wgDiff3 contains spaces
* (bug 43052) mediawiki.action.view.dblClickEdit.dblClickEdit should trigger
  ca-edit click instead opening URL directly.
* (bug 43964) Invalid value of "link" parameter in <gallery> no longer produces
  a fatal error.
* (bug 44775) The username field is not pre-filled when creating an account.
* (bug 45069) wfParseUrl() no longer produces a PHP notice if passed a "mailto:"
  URL without address
* (bug 45012) Creating an account by e-mail can no longer show a
  "password mismatch" error.
* (bug 44599) On Special:Version, HEADs for submodule checkouts (e.g. for
  extensions) performed using Git 1.7.8+ should now appear.
* (bug 42184) $wgUploadSizeWarning missing second variable
* (bug 40326) Check if files exist with a different extension during uploading
* (bug 34798) Updated CSS for Atom/RSS recent changes feeds to match on-wiki
  diffs.
* (bug 42430) Calling numRows on MySQL no longer propagates unrelated errors.
* (bug 44719) Removed mention of non-existing maintenance/migrateCurStubs.php
  script in includes/DefaultSettings.php
* (bug 45143) jquery.badge: Treat non-Latin variants of zero as zero as well.
* (bug 46151) mwdocgen.php should not ignore exit code of doxygen command.
* (bug 41889) Fix $.tablesorter rowspan exploding for complex cases.

=== API changes in 1.21 ===
* prop=revisions can now report the contentmodel and contentformat.
  See docs/contenthandler.txt.
* action=edit and action=parse now support contentmodel and contentformat
  parameters to control the interpretation of page content.
  See docs/contenthandler.txt for details.
* (bug 35693) ApiQueryImageInfo now suppresses errors when unserializing
  metadata.
* (bug 40111) Disable minor edit for page/section creation by API.
* (bug 41042) Revert change to action=parse&page=... behavior when the page
  does not exist.
* (bug 27202) Add timestamp sort to list=allimages.
* (bug 43137) Don't return the sha1 of revisions through the API if the content
  is revision-deleted.
* ApiQueryImageInfo now also returns imageinfo for redirects.
* list=alltransclusions added to enumerate every instance of page embedding
* list=alllinks & alltransclusions now allow both 'from' and 'continue' in
  the same query. When both are present, 'from' is simply ignored.
* list=alllinks & alltransclusions now allow 'unique' in generators, to yield
  a list of all link/template target pages instead of source pages.
* BREAKING CHANGE: list=logevents output format changed for details of some log
  types. Specifically, details that were formerly reported under a key like
  "4::foo" will now be reported under a key of simply "foo".
* BREAKING CHANGE: '??_badcontinue' error code was changed to '??badcontinue'
  for all query modules.
* ApiQueryBase adds 'badcontinue' error code if module has 'continue' parameter.
* (bug 35885) Removed version parameter and all getVersion() methods.
* action=options now takes a "resetkinds" option, which allows only resetting
  certain types of preferences when the "reset" option is set.
* (bug 36751) ApiQueryImageInfo now returns imageinfo for the redirect target
  when queried with &redirects=.
* (bug 31849) ApiQueryImageInfo no longer gets confused when asked for info on
  a redirect and its target.
* (bug 43849) ApiQueryImageInfo no longer throws exceptions with ForeignDBRepo
  redirects.
* On error, any warnings generated before that error will be shown in the
  result.
* action=help supports generalized submodules (modules=query+value),
  querymodules obsolete
* ApiQueryImageInfo continuation is more reliable. The only major change is
  that the imagerepository property will no longer be set on page objects not
  processed in the current query (i.e. non-images or those skipped due to
  iicontinue).
* Add supports for all pageset capabilities - generators, redirects,
  converttitles to action=purge and action=setnotificationtimestamp.
* (bug 43251) prop=pageprops&ppprop= now accepts multiple props to query.
* ApiQueryImageInfo will now limit the number of calls to File::transform made
  in any one query. If there are too many, iicontinue will be returned.
* action=query&meta=siteinfo&siprop=general will now return the regexes used for
  link trails and link prefixes. Added for Parsoid support.
* Added an API query module list=pageswithprop, which lists pages using a
  particular page property.
* Added an API query module list=pagepropnames, which lists all page prop names
  currently in use on the wiki.
* (bug 44921) ApiMain::execute() will now return after the CORS check for an
  HTTP OPTIONS request.
* (bug 44923) action=upload works correctly if the entire file is uploaded in
  the first chunk.
* Added 'continue=' parameter to streamline client iteration over complex query
  results
* (bug 44909) API parameters may now be marked as type "upload", which is now
  used for action=upload's 'file' and 'chunk' parameters. This type will raise
  an error during parameter validation if the parameter is given but not
  recognized as an uploaded file.
* (bug 44244) prop=info may now return the number of people watching each page.
* (bug 33304) list=allpages will no longer return duplicate entries when
  querying protection.
* (bug 33304) list=allpages will now find really old indefinite protections.
* (bug 45937) meta=allmessages will report a syntactically invalid lang as a
  proper error instead of as an uncaught exception.
* (bug 25325) added support for wlshow filtering (bots/anon/minor/patrolled)
  to action=feedwatchlist
* WDDX formatted output will actually be formatted (and normal output will no
  longer be), and will no longer choke on booleans.

=== API internal changes in 1.21 ===
* For debugging only, a new global $wgDebugAPI removes many API restrictions
  when true.
  Never use on the production servers, as this flag introduces security holes.
  Whenever enabled, a warning will also be added to all output.
* ApiModuleManager now handles all submodules (actions,props,lists) and
  instantiation
* Query stores prop/list/meta as submodules
* ApiPageSet can now be used in any action to process titles/pageids/revids or
  any generator.
* BREAKING CHANGE: ApiPageSet constructor now has two params instead of three,
  with only the first one keeping its meaning. ApiPageSet is now derived from
  ApiBase.
* BREAKING CHANGE: ApiQuery::newGenerator() and executeGeneratorModule() were
  deleted.
* ApiQueryGeneratorBase::setGeneratorMode() now requires a pageset param.
* $wgAPIGeneratorModules is now obsolete and will be ignored.
* Added flags ApiResult::OVERRIDE and ADD_ON_TOP to setElement() and addValue()
* Internal API calls will now include <warnings> in case of unused parameters

=== Languages updated in 1.21 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* South Azerbaijani (azb) added.
* (bug 30040) Autonym for nds-nl is now 'Nedersaksies' (was 'Nedersaksisch').
* (bug 45436) Autonym for pi (Pali) is now 'पालि' (was ''पाळि').
* (bug 34977) Now formatted numbers in Spanish use space as separator
  for thousands, as mandated by the Real Academia Española.
* (bug 35031) Kurdish formatted numbers now use period and comma
  as separators for thousands and decimals respectively.

=== Other changes in 1.21 ===
* BREAKING CHANGE: (bug 44385) Removed the jquery.collapsibleTabs module and
  moved it to the Vector extension. It was entirely Vector-extension-specific,
  deeply interconnected with the extension, and this functionality really
  belongs to the extension instead of the skin anyway. In the unlikely case you
  were using it, you have to either copy it to your extension, or install the
  Vector extension (and possibly disable its features using config settings if
  you don't want them).
* Experimental IBM DB2 support was removed due to lack of interest and
  maintainership
* BREAKING CHANGE: Filenames of maintenance scripts were standardized into
  lowerCamelCase format, and made more explicit:
  - clear_stats.php -> clearCacheStats.php
  - clear_interwiki_cache.php -> clearInterwikiCache.php
  - initStats.php -> initSiteStats.php
  - proxy_check.php -> proxyCheck.php
  - stats.php -> showCacheStats.php
  - showStats.php -> showSiteStats.php.
  Class names were renamed accordingly:
  - clear_stats -> ClearCacheStats
  - InitStats -> InitSiteStats
  - CacheStats -> ShowCacheStats
  - ShowStats -> ShowSiteStats.
* BREAKING CHANGE: (bug 38244) Removed the mediawiki.api.titleblacklist module
  and moved it to the TitleBlacklist extension.

= MediaWiki 1.20 =

== MediaWiki 1.20.8 ==
This is a security release of the MediaWiki 1.20 branch.

=== Changes since 1.20.7 ===
* (bug 53032) SECURITY: Don't cache when a call could autocreate
* (bug 55332) SECURITY: Improve css javascript detection
* (bug 49717) Fix behaviour $wgVerifyMimeType = false; in Upload
* Fix comma errors in various js files
* Translations

== MediaWiki 1.20.7 ==
This is a security release of the MediaWiki 1.20 branch.

=== Changes since 1.20.6 ===
* SECURITY: Fix extension detection with 2 .'s
* SECURITY: Token-getting functions will fail when using jsonp callbacks.
* SECURITY: Sanitize ResourceLoader exception messages
* Purge upstream caches when deleting file assets.

== MediaWiki 1.20.6 ==
This is a security and maintenance release of the MediaWiki 1.20 branch.

=== Changes since 1.20.5 ===
* (bug 48306) SECURITY: Run file validation checks on chunked uploads, and
  chunks of upload, during the upload process.
* (bug 44327) mediawiki.user: Use session ID instead of 1-year cross-session
  cookies
* (bug 47202) wikibits: FF2Fixes.css should not be loaded in Firefox 20.
* (bug 31044) Make ResourceLoader behave in read-only mode

== MediaWiki 1.20.5 ==
This is a security and maintenance release of the MediaWiki 1.20 branch.

=== Changes since 1.20.4 ===
* (bug 46590) Add hook AbortChangePassword to Special:ChangePassword
* (bug 47304) SECURITY: Check SVG xml encoding against whitelist
* Localisation updates from http://translatewiki.net.
* mwdocgen.php: Implement --version option.
* Remove svnstat stuff used in Doxygen generation
* (bug 43594) Correctly suppress warnings that were missed after the upstream
* PHP change to E_STRICT being included in E_ALL.

== MediaWiki 1.20.4 ==
This is a security release of the MediaWiki 1.20 branch.

=== Changes since 1.20.3 ===
* (bug 47251) SECURITY: Disable external entities in Import
* (bug 46859) SECURITY: Disable external entities in XMLReader
* (bug 46084) SECURITY: Sanitize $limitReport before outputting

== MediaWiki 1.20.3 ==
This is a security and maintenance release of the MediaWiki 1.20 branch.

=== Changes since MediaWiki 1.20.2 ===
* New preference type - 'api'. Preferences of this type are not shown on
  Special:Preferences, but are still available via the action=options API.
  (Unbreaks MLEB.)
* (bug 44010) Context is passed to UserGetLanguageObject.
* The recursion guard on RequestContext::getLanguage() was weakened.
* (bug 40585) Don't drop 'step="any"' in HTML input fields.
* (bug 44024) Fixed problems in ObjectCache when using XCache.
* (bug 44010) FauxRequest leaked cookie data from primary request.
* (bug 44135/bug 42441) Pass '2' instead of 'true' to CURLOPT_SSL_VERIFYHOST
* (bug 43518) API action=unblock should return the user name, not the full user
  object
* (bug 45355) Prevent read of arbitrary files through mwdoc-filter.php

== MediaWiki 1.20.2 ==
This is a maintenance release of the MediaWiki 1.20 branch

=== Changes since MediaWiki 1.20.1 ===
* (bug 42638) Fix API action=options&reset=1 & unit tests.
* (bug 42370) Fixed backport of 60cc060 to use mDoneWrites — caused
* (bug 42592) User rights, preferences and other things are not saving in
  1.20.1.

== MediaWiki 1.20.1 ==
This is a security release of the MediaWiki 1.20 branch

=== Changes since 1.20.0 ===
* (bug 42202) Validate options to prevent html injection
* (bug 40995) Prevent session fixation in Special:UserLogin (CVE-2012-5391)
* (bug 41400) Prevent linker regex from exceeding PCRE backtrack limit
* Javscript Lint fixes
* (bug 40632) Remove CleanupPresentationalAttributes feature
* [Database] Fixed case where trx idle callbacks might be lost.

== MediaWiki 1.20.0 ==

=== PHP 5.3 now required ===
Since 1.20, the lowest supported version of PHP is now 5.3.2. Please
upgrade PHP if you have not done so prior to upgrading MediaWiki.

=== Configuration changes in 1.20 ===
* $wgGitRepositoryViewers defines a mapping from Git remote repository to the
  Gitweb instance URL used in Special:Version.
* `$wgUsePathInfo = true;` is no longer needed to make $wgArticlePath work on
  servers using like nginx, lighttpd, and apache over fastcgi. MediaWiki now
  always extracts path info from REQUEST_URI if it's available.
* The user right 'upload_by_url' is no longer given to sysops by default.
  This only affects installations which have $wgAllowCopyUploads set to true.
* Removed f-prot support from $wgAntivirusSetup.
* New variable $wgDBerrorLogTZ to provide dates in the error log in a
  different timezone than the wiki timezone set by $wgLocaltimezone.
* New variables $wgDBssl and $wgDBcompress to enable SSL and compression for
  database connections, if either are available for the selected DB type.
* $wgUseCombinedLoginLink now defaults to false, making MediaWiki output
  separate login and create account links by default.

=== New features in 1.20 ===
* Added TitleIsAlwaysKnown hook which gets called when determining if a page
  exists.
* Added NamespaceIsMovable hook which gets called when determining if pages in a
  certain namespace can be moved.
* Added SpecialPageBeforeExecute hook which gets called before
  SpecialPage::execute.
* Added SpecialPageAfterExecute hook which gets called after
  SpecialPage::execute.
* Added ORMTable, ORMRow and ORMResult classes for additional abstraction of
  database interaction.
* Added CacheHelper and associated SpecialCachedPage and CachedAction helper
  classes.
* (bug 32341) Add upload by URL domain limitation.
* &useskin=default will now always display the default skin. Useful for users
  with a preference for the non-default skin to look at something using the
  default skin.
* (bug 27619) Remove preference option to display broken links as link?
* (bug 34896) jQuery JSON plugin upgraded to v2.3 (2011-09-17).
* (bug 34302) Add CSS classes to email fields in user preferences.
* Introduced $wgDebugDBTransactions to trace transaction status (currently
  PostgreSQL only).
* (bug 23795) Add parser itself to ParserMakeImageParams hook.
* Introduce a cryptographic random number generator source api for use when
  generating various tokens.
* (bug 30963) Option on Special:Prefixindex and Special:Allpages to not show
  redirects.
* (bug 18062) New message when edit or create the local page of a shared file.
* (bug 22870) Separate interface message when creating a page.
* (bug 17615) nosummary option should be reassigned on preview/captcha.
* (bug 34355) Add a variable and parser function for the namespace number.
* (bug 35649) Special:Version now shows hashes of extensions checked out from
  git.
* (bug 35728) Git revisions are now linked on Special:Version.
* "Show Changes" on default messages shows now diff against default message text
* (bug 23006) create #speciale parser function.
* generateSitemap can now optionally skip redirect pages.
* (bug 27757) New API command just for retrieving tokens (not page-based).
* Added GitViewers hook for extensions using external git repositories to have a
  web-based repository viewer linked to from Special:Version.
* Memcached debug logs can now be sent to their own file logs by setting
  $wgDebugLogFile['memcached'] to some filepath.
* (bug 35685) api.php URL and other entry point URLs are now listed on
  Special:Version
* Edit notices can now be translated.
* jQuery upgraded to 1.8.2.
* jQuery UI upgraded to 1.8.23.
* QUnit upgraded from v1.2.0 to v1.10.0.
* (bug 37604) jquery.cookie upgraded to 2011 version.
* (bug 22887) Add warning and tracking category for preprocessor errors
* (bug 31704) Allow selection of associated namespace on the watchlist
* (bug 5445) Now remove autoblocks when a user is unblocked.
* Added $wgLogExceptionBacktrace, on by default, to allow logging of exception
  backtraces.
* Added device detection for determining device capabilities.
* QUnit.newMwEnvironment now supports passing a custom setup and/or teardown
  function. Arguments signature has changed. First arguments is now an options
  object of which 'config' can be a property. Previously 'config' itself was the
  first and only argument.
* New getCreator and getOldestRevision methods added to WikiPage class
* (bug 4220) the XML dump format schema now have unique identity constraints
  for page and revision identifiers. Patch by Elvis Stansvik.
* cleanupSpam.php now can delete spam pages if --delete was specified instead of
  blanking them.
* Added new hook ChangePasswordForm to allow adding of additional fields in
  Special:ChangePassword
* Added new function getDomain to AuthPlugin for getting a user's domain
* (bug 23427) New magic word {{PAGEID}} which gives the current page ID.
  Will be null on previewing a page being created.
* (bug 37627) UserNotLoggedIn() exception to show a generic error page whenever
  a user is not logged in.
* Watched status in changes lists are no longer indicated by <strong></strong>
  tags with class "mw-watched". Instead, each line now has a class
  "mw-changeslist-line-watched" or "mw-changeslist-line-not-watched", and the
  title itself is surrounded by <span></span> tags with class "mw-title".
* Added ContribsPager::reallyDoQuery hook allowing extensions to data to
  MyContribs
* Added new hook ParserAfterParse to allow extensions to affect parsed output
  after the parse is complete but before block level processing, link holder
  replacement, and so on.
* (bug 34678) Added InternalParseBeforeSanitize hook which gets called during
  Parser's internalParse method just before the parser removes
  unwanted/dangerous HTML tags.
* Added new hook AfterFinalPageOutput to allow modifications to buffered page
  output before sent to the client.
* (bug 36783) Implement jQuery Promise interface in mediawiki.api module.
* Make dates in sortable tables sort according to the page content language
  instead of the site content language
* (bug 37926) Deleterevision will no longer allow users to delete log entries,
  the new deletelogentry permission is required for this.
* (bug 14237) Allow PAGESINCATEGORY to distinguish between 'all', 'pages',
  'files' and 'subcats'
* (bug 38362) Make Special:Listuser includeable on wiki pages.
* Added support in jquery.localize for placeholder attributes.
* (bug 38151) Implemented mw.user.getRights for getting and caching the current
  user's user rights.
* Session storage can now configured independently of general object cache
  storage, by using $wgSessionCacheType. $wgSessionsInMemcached has been
  renamed to $wgSessionsInObjectCache, with the old name retained for backwards
  compatibility. When this feature is enabled, the expiry time can now be
  configured with $wgObjectCacheSessionExpiry.
* Added a Redis client for object caching.
* Implemented mw.user.getGroups for getting and caching user groups.
* (bug 37830) Added $wgRequirePasswordforEmailChange to control whether password
  confirmation is required for changing an email address or not.
* HTMLForm mutators can now be chained (they return $this)
* A new message, "api-error-filetype-banned-type", is available for formatting
  API upload errors due to the file extension blacklist.
* New hook 'ParserTestGlobals' allows to set globals before running parser
  tests.
* Allow importing pages as subpage.
* Add lang and hreflang attributes to language links on Login page.
* (bug 22749) Create Special:MostInterwikis.
* Show change tags when transclude Special:Recentchanges(linked) or
  Special:Newpages.
* (bug 23226) Add |class= parameter to image links in order to add class(es) to
  HTML img tag.
* (bug 39431) SVG animated status is now shown in long description.
* (bug 39376) jquery.form upgraded to 3.14.
* SVG files will now show the actual width in the SVG's specified units
  in the metadata box.
* Added ResourceLoader module "jquery.jStorage" (v0.3.0, http://jStorage.info/).
* (bug 39273) Added AJAX support for "Show changes" (diff) in LivePreview.
* Added ResourceLoader module "jquery.badge".
* mw.util.$content now points to the overall content area in the skin rather
  than just page text content area. If you need the old behavior please use
  $( '#mw-content-text').
* jsMessage has been replaced with a floating bubble notification system
  complete with auto-hide, multi-message support, and message replacement tags.
* jquery.messageBox which appears to be unused by both core and extensions has
  been removed.
* (bug 34939) Made link parsing insensitive ([HttP://]).
* (bug 40072) Add CSS classes to items in output of ChangesList pages.
* Added $wgCopyUploadProxy global to define which proxy to use for copy
  uploads.
* (bug 40448) mediawiki.legacy.mwsuggest has been replaced with a new module,
  mediawiki.searchSuggest, based on SimpleSearch from Extension:Vector.

=== Known issues in 1.20.0 ===
These are issues that we're targeting to be fixed in a later release
in the 1.20 series.  Issues may be added or removed from this list as
we see fit.  For now, it is comprised of those bugs on the 1.20.0
milestone in Bugzilla.

* (bug 35894): Reports of secret key generation "hanging" on windows
    This is probably a bug that has been fixed in PHP.  If you run
    into this, try upgrading your PHP.
* (bug 38334): PHP Notice:  Undefined index: href in /www/w/skins/Vector.php on
  line 416
    We think this is a problem in some extension.  If you see this,
    try disabling your extensions and check out the logging patch on
    this bug.  Or try this patch:
    <https://gerrit.wikimedia.org/r/#/c/27937/1/skins/Vector.php>
* (bug 39268): [Regression] Toolbar inserts in main textarea only (instead of
  the focussed textarea)
    This should only be an issue if you are using the ProofreadPage
    extension.
* (bug 40641): Clicking "others" in Special:Version asks to download a file
    If you encounter this, you can tell your webserver to serve the
    CREDITS file with text/plain MIME type to fix it.

=== Bug fixes in 1.20 ===
* (bug 40939): [Regression] InfoAction: Call to a member function getUserText()
  on a non-object
* (bug 40780): searchsuggest-containing line ("containing...") doesn't include
  the entered text
* (bug 37714): [Regression] Incomplete log entries
* (bug 27202): API: Add timestamp sort to list=allimages
* (bug 30245) Use the correct way to construct a log page title.
* (bug 34237) Regenerate an empty user_token and save to the database
  when we try to set the user's cookies for login.
* (bug 32210) New edit emails for watched pages always provide a link to the
  edit which triggered the mail.
* (bug 12021) Added user talk link on Special:Listusers.
* (bug 34445) section edit and TOC hide/show links are excluded from selection
  and copy/paste on supporting browsers.
* (bug 34428) Fixed incorrect hash mismatch errors in the DiffHistoryBlob
  history compression method.
* (bug 34702) Localised parentheses are now used in more special pages.
* (bug 34723) When editing a script page on a RTL wiki the textbox should be
  LTR.
* (bug 34762) Calling close() on a DatabaseBase object now clears the
  connection.
* (bug 34863) Show deletion log extract on non-existent file pages if
  applicable.
* (bug 28019) Let ?preloadtitle=foo be passed on to target of
  Special:MyPage and Special:MyTalk.
* (bug 34929) Show the correct diff when a section edit is rejected by the spam
  filter.
* (bug 15816) Add a switch for SETting the search_path (Postgres).
* (bug 34521) Returning to the previous page after logging in loses any array-
  valued parameters in the query string.
* (bug 34735) Updated compressOld.php documentation to mention the different
  usages of -s and -n parameters depending on compression type.
* (bug 13896) Rendering of devanagari numbers in automatic '#' number lists.
* (bug 33689) Upgrade to 1.19 on Postgres fails due to incomplete query when
  trying to defer foreign key for externallinks.
* (bug 32748) Printer friendly version of article decode Unicode chars as a
  pretty IRI in footer.
* Removed white border around thumbnails in galleries.
* (bug 31236) "Next" and "Previous" buttons are shown incorrectly in
  an RTL environment.
* (bug 35749) Updated maintenance/checkSyntax.php to use Git instead of
  Subversion when invoked with the --modified option.
* (bug 35069) On history pages, the " . . " separator after the number of
  characters changed in a revision is now suppressed if no text would follow.
* (bug 18704) Add a unique CSS class or ID to the tagfilter table row at
  RecentChanges
* (bug 33564) transwiki import sometimes result in invalid title.
* (bug 35572) Blocks appear to succeed even if query fails due to wrong DB
  structure
* (bug 31757) Add a word-separator between help-messages in HTMLForm
* (bug 30410) Removed deprecated $wgFilterCallback and the 'filtered' API error.
* (bug 32604) Some messages needs escaping of wikitext inside username.
* (bug 36537) Rename wfArrayToCGI to wfArrayToCgi for consistency with
  wfCgiToArray.
* (bug 25946) The message on the top of Special:RecentChanges is now displayed
  in user language instead of content language.
* (bug 35264) Wrong type used for <ns> in export.xsd
* (bug 24985) Use $wgTmpDirectory as the default temp directory so that people
  who don't have access to /tmp can specify an alternative.
* (bug 27283) SqlBagOStuff breaks PostgreSQL transactions.
* (bug 35727) mw.Api ajax() should put token parameter last.
* (bug 37708) mw.Uri.clone() should make a deep copy.
* (bug 38024) ResourceLoader should not create empty stylesheets for modules
  that don't have stylesheets.
* (bug 36812) Special:ActiveUsers "Hide bots" should hide users from any group
  having the "bot" user right, instead of just the default "bot" user group.
* (bug 35082) mw.util.addPortletLink incorrectly adds link to mutiple <ul> tags.
* (bug 36991) jquery.tablesorter should extract date sort format from date
  string instead of global config. Dates like "April 1 2012" and "1 April 2012"
  now sort correctly regardless of the content language's DefaultDateFormat.
* (bug 31895) mw.loader mode now correct when triggered from a $.fn.ready
  handler that is bound before mediawiki.js's handler (e.g. browser-userscripts
  like greasemonkey).
* (bug 38152) jquery.tablesorter: Use .data() instead of .attr(), so that live
  values are used instead of just the fixed values from when the tablesorter
  was initialized.
* (bug 38093) Gender of changed user groups missing in Special:Log/rights
* (bug 35893) Special:Block needs to load mediawiki.special.block.js.
* (bug 37331) ResourceLoader modules sometimes execute twice in Firefox
* (bug 31644) GlobalUsage, CentralAuth and AbuseLog extensions should not use
  insecure links to foreign wikis in the WikiMap.
* (bug 36073) Avoid duplicate element IDs on File pages.
* (bug 25095) Special:Categories should also include the first relevant item
  when "from" is filled.
* (bug 35526) jquery.tablesorter now uses a stable sort.
* (bug 38953) --memory-limit switch not working for runJobs.php.
* (bug 33037) Make subpage of Special:newfiles control how many files
  are returned, like in previous versions.
* (bug 36524) "Show" options on Special:RecentChanges and
  Special:RecentChangesLinked are now remembered between successive clicks.
* (bug 26069) Page title is no longer "Error" for all error pages.
* (bug 39297) Show warning if thumbnail of animated image will not be animated.
* (bug 38249) Parser will throw an exception instead of outputting gibberish if
  PCRE is compiled without support for unicode properties.
* (bug 30390) Suggested file name on Special:Upload should not contain
  illegal characters.
* EXIF below sea level GPS altitude data is now shown correctly.
* (bug 39284) jquery.tablesorter should not consider "."" or "?"" to be a
  currency.
* (bug 39273) "Show changes" should not be incorrectly displayed in the Live
  Preview state.
* Made body-content lang attribute honor the variant language when it is set.
* (bug 36761) "Mark pages as visited" now submits previously established filter
  options.
* (bug 39635) PostgreSQL LOCK IN SHARE MODE option is a syntax error.
* (bug 36329) Accesskey tooltips for Firefox 14 on Mac should use "ctrl-option-"
  prefix.
* (bug 32552) Drop unused database field cat_hidden from table category.
* (bug 24502) Do not allow multiple language links to the same language.
* (bug 40214) Category pages no longer use deprecated "width" HTML attribute.
* (bug 39941) Add missing stylesheets to the installer pages
* In HTML5 mode, allow new input element types values (such as color, range..)
* (bug 36151) mw.Title: Don't limit extension in title parsing.
* (bug 38158) jquery.byteLimit sometimes causes an unexpected 0 maxLength being
  enforced.
* (bug 38163) jquery.byteLimit incorrectly limits input when using methods other
  than basic per-char typing.
* (bug 34495) patrol log now credit the user patrolling (instead of patrolled
  user).
* (bug 31676) ResourceLoader should work around IE stylesheet limit.
* (bug 40498) ResourceLoader should not output an empty "@media print { }"
  block.
* (bug 40500) ResourceLoader should not ignore media-type for urls in debug
  mode.
* (bug 40660) ResourceLoaderWikiModule should not convert "&nbsp;" to a space
  for pages from the MediaWiki-namespace.
* (bug 40329) (bug 40632) Removed CleanupPresentationalAttributes feature.

=== API changes in 1.20 ===
* (bug 34316) Add ability to retrieve maximum upload size from MediaWiki API.
* (bug 34313) MediaWiki API intro message about "HTML format" should mention
  the format parameter.
* (bug 32384) Allow descending order for list=watchlistraw.
* (bug 31883) Limit of bkusers of list=blocks and titles of action=query is
  not documented in API help.
* (bug 32492) API now allows editing using pageid.
* (bug 32497) API now allows changing of protection level using pageid.
* (bug 32498) API now allows comparing pages using pageids.
* (bug 30975) API import of pages with invalid characters in this wiki leads to
  Fatal Error.
* (bug 30488) API now allows listing of backlinks/embeddedin/imageusage per
  pageid.
* (bug 34927) Output media_type for list=filearchive.
* (bug 28814) add properties to output of action=parse.
* (bug 33224) add variants of content language to meta=siteinfo.
* (bug 32643) action=purge with forcelinkupdate no longer crashes when ratelimit
  is reached.
* The paraminfo module now also contains result properties for most modules.
* (bug 32348) Allow descending order for list=alllinks.
* (bug 31777) Upload unknown error ``fileexists-forbidden''.
* (bug 32382) Allow descending order for list=iwbacklinks.
* (bug 32381) Allow descending order for list=backlinks, list=embeddedin and
  list=imageusage.
* (bug 32383) Allow descending order for list=langbacklinks.
* API meta=siteinfo can now return the list of known variable IDs.
* (bug 35980) list=deletedrevs now honors drdir correctly in "all" mode
  (mode #3).
* (bug 29290) API avoids mangling fields in continuation parameters
* (bug 36987) API avoids mangling fields in continuation parameters
* (bug 30836) siteinfo prop=specialpagealiases will no longer return nonexistent
  special pages
* (bug 38190) Add "required" flag to some token params for hint in api docs.
* (bug 27567) Add file repo support to prop=duplicatefiles.
* (bug 27610) Add archivename for non-latest image version to list=filearchive
* (bug 38231) Add xml parse tree to action=parse.
* Watchlist notification timestamp may be queried by page and may be updated via
  the API.
* (bug 38904) prop=revisions&rvstart=... no longer blows up when continuing.
* (bug 39032) ApiQuery generates help in constructor.
* (bug 11142) Improve file extension blacklist error reporting in API upload.
* (bug 39665) List of query generators is now not built using reflection,
  instead it is defined in code.
* (bug 35993) Deprecated gettoken parameter - support will be removed in 1.22.

=== Languages updated in 1.20 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* Emilian (egl) added.
* Tornedalen Finnish (fit) added.
* Mizo (lus) added.
* Santali (sat) added.
* (bug 34192) Namespace gender aliases for Albanian languages (sq & aln).
* (bug 35541) Namespace gender aliases for Croatian (hr).
* (bug 36012) Space in $separatorTransformTable should be non-breaking in
  Portuguese, Esperanto and Udmurt.
* Turoyo (tru) added.
* Cyrillic-Latin language converter added for Uzbek (uz).

=== Other changes in 1.20 ===
* The user_token field is now left empty until a user attempts to login and
  cookies need to be set. It is also now possible to reset every user's
  user_token simply by clearing the values in the user_token column.
* Removed ./tests/qunit/index.html from core. It wasn't actively maintained and
  has been made obsolete when [[Special:JavaScriptTest/qunit]] was introduced,
  which actually uses ResourceLoader, LocalSettings and the Skin.
* Removed $wgDBtransactions global. This was only checked in one class
  and only applies to MyISAM or similar DBs. Those should only be used
  for archived sites anyway. We can't get edit conflicts on such sites,
  so the WikiPage code wasn't useful there either.
* Deprecated mw.user.name in favour of mw.user.getName.
* Deprecated mw.user.anonymous in favour of mw.user.isAnon.
* Deprecated DatabaseBase functions newFromParams(), newFromType(), set(),
  quote_ident(), and escapeLike() were removed.
* Use of __DIR__ instead of dirname( __FILE__ ).
* OutputPage::wrapWikiMsg() no longer supports the 'options' parameter. It was
  not used and complicated migration to Message class.
* Live preview functionality has been improved and moved into the
 'mediawiki.action.edit.preview' module. The old 'mediawiki.legacy.preview'
  module has been removed.
* (bug 40448) Removed mediawiki.legacy.mwsuggest module, and removed the
  following that has become obsolete:
  - globals $wgEnableMWSuggest and $wgMWSuggestTemplate.
  - mw.config.values wgMWSuggestTemplate and wgSearchNamespaces.
  - method SearchEngine::getMWSuggestTemplate().

== MediaWiki 1.19 ==

== MediaWiki 1.19.24 ==

This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.23 ===

* ({{bug|T85848}}, {{bug|T71210}}) SECURITY: Don't parse XMP blocks that
contain XML entities, to prevent various DoS attacks.
* ({{bug|T88310}}) SECURITY: Always expand xml entities when checking SVG's.
* ({{bug|T73394}}) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
* ({{bug|T85855}}) SECURITY: Don't execute another user's CSS or JS on preview.
* ({{bug|T85349}}, {{bug|T85850}}, {{bug|T86711}}) SECURITY: Multiple issues
fixed in SVG filtering to prevent XSS and protect viewer's privacy.

== MediaWiki 1.19.23 ==

This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.22 ===

* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
could lead to xss. Permission to edit MediaWiki namespace is required to
exploit this.
* (bug T74222) The original patch for T74222 was reverted as unnecessary.
* Add missing $ in front of variable in OutputPage.php

== MediaWiki 1.19.22 ==

This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.21 ===

* ({{bug|66776}}, {{bug|71478}}) SECURITY:  User PleaseStand reported a way to
inject code into API clients that used format=php to process pages that
underwent flash policy mangling. This was fixed along with improving how the
mangling was done for format=json, and allowing sites to disable the mangling
using $wgMangleFlashPolicy.
* ({{bug|72222}}) SECURITY: Do not show log action when the entry is revdeleted
with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a
public RFC about the desired functionality. This issue was reported by user
Bawolff.
* ({{bug|71621}}) Make allowing site-wide styles on restricted special pages a
config option.
* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
might be a flash policy directive configurable.

== MediaWiki 1.19.21 ==
This is a maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.20 ===
* (bug 67440) Allow classes to be registered properly from installer.
* (bug 47281) Fixed a dumpBackup.php error with --uploads
 --include-filesoptions: Unable to find the wrapper "mwstore".
* System administrators are encouraged to upgrade to this release or 1.22+ and
  produce a full data dump.
  https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Backing_up_a_wiki
* (bug 63049) Removed anonymous functions from ApiFormatBase, added in1.19.13 as
  part of the fix for bug 61362, for PHP 5.2 compatibility.

== MediaWiki 1.19.20 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.19 ===
* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
  allowance.

== MediaWiki 1.19.19 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.18 ===
* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style>
  elements; normalize style elements and attributes before filtering; add checks
  for attributes that contain css; add unit tests for html5sec and reported
  bugs.

== MediaWiki 1.19.18 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.17 ===
* (bug 68187) SECURITY: Prepend jsonp callback with comment.
* (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and
  ParserOutput.

== MediaWiki 1.19.17 ==
This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.16 ===
* (bug 65839) SECURITY: Prevent external resources in SVG files.
* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like
  only extracting the tail of the file partially or not at all.

== MediaWiki 1.19.16 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.15 ===
* (bug 65501) SECURITY: Don't parse usernames as wikitext on
  Special:PasswordReset.

== MediaWiki 1.19.15 ==
This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.14 ===
Fixed resetting passwords.
* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to
  appear blank or with missing text.

== MediaWiki 1.19.14 ==
This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.13 ===
* (bug 62497) SECURITY: Add CSRF token on Special:ChangePassword.
* (bug 62467) Set a title for the context during import on the cli.

== MediaWiki 1.19.13 ==
This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.12 ===
* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
* Use the correct branch of the extensions' git repositories.

== MediaWiki 1.19.12 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.11 ===
* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
  namespaces. Also disallow iframe elements. * User will get an error including
  the namespace name if they use a non- whitelisted namespace.
* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
  our token comparison would be vulnerable to timing attacks. This will take
  constant time.

== MediaWiki 1.19.11 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.10 ===
* (bug 60339) SECURITY: Sanitize shell arguments to DjVu files, and other media
  formats

== MediaWiki 1.19.10 ==
This is a security release of the MediaWiki 1.19 branch.

=== Changes since 1.19.9 ===
* (bug 57550) SECURITY: Disallow stylesheets in SVG Uploads
* (bug 58088) SECURITY: Don't normalize U+FF3C to \ in CSS Checks
* (bug 58472) SECURITY: Disallow -o-link in styles
* (bug 58553) SECURITY: Return error on invalid XML for SVG Uploads
* (bug 58699) SECURITY: Fix RevDel log entry information leaks

== MediaWiki 1.19.9 ==
This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.8 ===
* (bug 53032) SECURITY: Don't cache when a call could autocreate
* (bug 55332) SECURITY: Improve css javascript detection
* (bug 49717) Fix behaviour $wgVerifyMimeType = false; in Upload
* Translations

== MediaWiki 1.19.8 ==
2013-09-03

This is a security and maintenance release of the MediaWiki 1.19 branch.

=== Changes since 1.19.7 ===
* SECURITY: Sanitize ResourceLoader exception messages
* SECURITY: Token-getting functions will fail when using jsonp callbacks.
* SECURITY: Fix extension detection with 2 .'s
* Allow a string other than '*' as condition for DatabaseBase::delete()
* Purge upstream caches when deleting file assets.
* jquery.tablesorter: Add missing dependency on jquery.mwExtension

== MediaWiki 1.19.7 ==
2013-05-21

This is a security release of the MediaWiki 1.19 branch

=== Changes since 1.19.6 ===
* (bug 48306) SECURITY: Run file validation checks on chunked uploads, and
  chunks of upload, during the upload process.

== MediaWiki 1.19.6 ==
2013-04-30

This is a security and maintenance release of the MediaWiki 1.19 branch

=== Changes since 1.19.5 ===
* (bug 47304) SECURITY: Check SVG xml encoding against whitelist
* (bug 46590) Added AbortChangePassword hook to allow extensions to abort
  password changes from Special:ChangePassword
* Localisation updates from http://translatewiki.net.
* mwdocgen.php: Implement --version option.
* Remove svnstat stuff used in Doxygen generation
* E_USER_DEPRECATED undefined prior to php 5.3

== MediaWiki 1.19.5 ==
2013-04-15

This is a security and maintenance release of the MediaWiki 1.19 branch

=== Changes since 1.19.4 ===
* (bug 47251) SECURITY: Disable external entities in Import
* (bug 46859) SECURITY: Disable external entities in XMLReader
* (bug 46084) SECURITY: Sanitize $limitReport before outputting
* (bug 43594) Fix notices displayed on PHP 5.4
* (bug 40585) Don't drop 'step="any"' in HTML input fields.

== MediaWiki 1.19.4 ==
2013-03-04

This is a security release of the MediaWiki 1.19 branch

=== Changes since 1.19.3 ===
* New preference type - 'api'. Preferences of this type are not shown on
  Special:Preferences, but are still available via the action=options API.
* (bug 44010) Context is passed to UserGetLanguageObject.
* The recursion guard on RequestContext::getLanguage() was weakened.
* (bug 44135/bug 42441) Pass '2' instead of 'true' to CURLOPT_SSL_VERIFYHOST
* (bug 43518) API action=unblock should return the user name, not the full user
  object

== MediaWiki 1.19.3 ==
2012-11-30

This is a security release of the MediaWiki 1.19 branch

=== Changes since 1.19.2 ===
* (bug 40995) Prevent session fixation in Special:UserLogin (CVE-2012-5391)
* (bug 41400) Prevent linker regex from exceeding PCRE backtrack limit
* Increase permitted runtime for testParserTest (only used for continuous
  integration).
* Updated messages translations from http://translatewiki.net/

== MediaWiki 1.19.2 ==

This is a security release of the MediaWiki 1.19 branch

=== Changes since 1.19.1 ===
* (bug 39700) File: link to non-existing file can inject html
* (bug 39823) Hidden block text leaking to admins
* (bug 39184) LDAP password leakage
* (bug 39180) Disallow framing of api results
* (bug 37587) Enforce language codes to be html safe
* (bug 39824) Check global blocks on account creation

== MediaWiki 1.19 ==

MediaWiki 1.19 is a large release that contains many new features and bug
fixes. This is a summary of the major changes of interest to users.
You can consult the RELEASE-NOTES-1.19 file for the full list of changes in
this version.

Our thanks go to everyone who helped to improve MediaWiki by testing the beta
release and submitting bug reports.

=== Changes since 1.19.1 ===
* (bug 38406) Properly quote table names in DatabaseBase::tableName()
* (bug 38249) Parser will throw an exception instead of outputting gibberish if
  PCRE is compiled without support for unicode properties.

=== Changes since 1.19.0 ===
* (bug 36568) Fixed "Illegal string offset 'LIMIT'" warnings in updater
* (bug 36938) Correctly escape uselang attribute to prevent xss
* Expanded Blacklist for SVG Files

=== Changes since 1.19 beta 2 ===
* Special:Watchlist no longer sets links to feed when the user is anonymous.
* (bug 35961) Hash comparison should always be strict.
* Fix broken email confirmation expiration caused by MWCryptRand changes.
* (bug 35671) PHP Notice: Undefined index: gettoken in includes/api/ApiMain.php
  on line 598.
* (bug 36042) 'show' causes a fatal in blocks API.

=== Changes since 1.19 beta 1 ===
* (bug 35014) Including a special page no longer sets the page's title to the
  included page
* (bug 35019) Edit summaries are no longer transformed in notification e-mails
* (bug 35152) Help message for e-mail is shown again in user preferences
* (bug 34887) $3 and $4 parameters are now substituted correctly in message
  "movepage-moved"
* (bug 34841) Edit links are no longer displayed when display old page versions
* (bug 34889) User name should be normalized on Special:Contributions
* (bug 35051) If heading has a trailing space after == then its name is not
  preloaded into edit summary on section edit
* (bug 31417) New ID mw-content-text around the actual page text, without
  categories, contentSub, ... The same div often also contains the class
  mw-content-ltr/rtl.
* (bug 35303) Proxy and DNS blacklist blocking works again
* (bug 22555) Remove or skip strip markers from tag hooks like &lt;nowiki&gt; in
  core parser functions which operate on strings, such as padleft.
* (bug 18295) Don't expose strip markers when a tag appears inside a link
  inside a heading.
* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token
  parameter present.
* (bug 34907) Fixed exposure of tokens through load.php that could have
  facilitated CSRF attacks.
* (bug 35317) CSRF in Special:Upload.

=== Configuration changes in 1.19 ===
* Removed SkinTemplateSetupPageCss hook; use BeforePageDisplay instead.
* (bug 27132) movefile right granted by default to registered users.
* Default cookie lifetime ($wgCookieExpiration) is increased to 180 days.
* (bug 31204) Removed old user.user_options.
* $wgMaxImageArea now applies to jpeg files if they are not scaled with
  ImageMagick.
* Introduced $wgQueryPageDefaultLimit (defaults to 50) for the number of
  items to show by default on query pages (special pages such as Whatlinkshere).
* (bug 32470) Increase the length of ug_group.
* (bug 32239) Removed $wgEnableTooltipsAndAccesskeys.
* Removed $wgVectorShowVariantName.
* Removed $wgExtensionAliasesFiles. Use $wgExtensionMessagesFiles.
* Removed $wgResourceLoaderInlinePrivateModules , now always enabled.

=== New features in 1.19 ===
* (bug 19838) Add ability to get all interwiki prefixes also if the interwiki
  cache is used.
* $wgDnsBlacklistUrls now accepts an array with url and key as the
  elements to work with DNSBLs that require keys, such as
  Project Honeypot.
* (bug 30022) Add support for custom loadScript sources to ResourceLoader.
* (bug 19052) Unicode space separator characters (Zs) now terminates external
  links and images links.
* (bug 30160) Add public method to mw.loader to get module names from registry.
* (bug 15558) Parameters to special pages included in wikitext can now be passed
  as with templates.
* Installer now issues a warning if mod_security is present.
* (bug 29455) Add support for a filter callback function in jQuery byteLimit
  plugin.
* Added two new GetLocalURL hooks to better serve extensions working on a
  limited type of titles.
* Added a --no-updates flag to importDump.php that skips updating the links
  tables.
* Most presentational html attributes like valign are now converted to inline
  css style rules. These attributes were removed from html5 and so we clean
  them up when $wgHtml5 is enabled. This can be disabled using
  $wgCleanupPresentationalAttributes.
* Magic words (time and number-formatting ones, plus DIRECTIONMARK, but not
  NAMESPACE) now depend on the page content language instead of the site
  language. In theory this sets the right magic words in system messages,
  although they are not used there.
* (bug 30451) Add page_props to RefreshLinks::deleteLinksFromNonexistent.
* (bug 30450) Clear page_props table on page deletion.
* Hook added to check for exempt from account creation throttle.
* (bug 30344) Add configuration variable for setting custom priorities when
  generating sitemaps.
* (bug 96170) Add array support for space-separated list attributes (like
  'class') in the Html helper class.
* (bug 26470) Add checkered background image on hover on files pages.
* (bug 30774) mediawiki.html: Add support for numbers and booleans in the
  attribute values and element contents.
* Conversion script between Tifinagh and Latin for the Tachelhit language.
* (bug 16755) Add options 'noreplace' and 'noerror' to {{DEFAULTSORT:...}}
  to stop it from replace an already existing default sort, and suppress error.
* (bug 18578) Rewrote revision delete related messages to allow better
  localisation.
* (bug 30364) LanguageConverter now depends on the page content language
  instead of the wiki content language.
* Jump links will now be usable in CSS-capable browsers instead of only
  in outdated text browsers.
* New common*.css files usable by skins instead of having to copy piles
  of generic styles from MonoBook or Vector's css.
* Some deprecated presentational html attributes will now be automatically
  converted to css.
* (bug 31297) Add support for namespaces in Special:RecentChanges subpage filter
  syntax.
* The default user signature now contains a talk link in addition to the user
  link.
* (bug 25306) Add link of old page title to MediaWiki:Delete_and_move_reason.
* Added hook BitmapHandlerCheckImageArea.
* (bug 30062) Add $wgDBprefix option to cli installer.
* getUserPermissionsErrors and getUserPermissionsErrorsExpensive hooks are now
  also called when checking for 'read' permission.
* Introduce $wgEnableSearchContributorsByIP which controls whether searching
  for an IP address redirects to the contributions list for that IP.
* (bug 8859) Database::update should take array of tables too.
* (bug 19698) Add "Inverse namespaces" option to Special:Contributions.
* (bug 24037) Add byte length of revision to Special:Contributions.
* (bug 1672) Added $wgDisableUploadScriptChecks to allow uploading of files
  containing HTML or JS. DISABLING THESE CHECKS IS VERY DANGEROUS.
* New path mappings can be added using the WebRequestPathInfoRouter hook
  and adding paths to the PathRouter.
* (bug 32666) Special:ActiveUsers now allows a subpage to be used as value for
  the "target" query parameter (eg. Special:ActiveUsers/Username).
* New JavaScript variable wgPageContentLanguage.
* Added new debugging toolbar, enabled with $wgDebugToolbar.
* Differences in the history page now uses slightly better colors for people
  perceiving colors differently.
* (bug 32879) Upgrade jQuery to 1.7.1.
* jQuery UI upgraded to 1.8.17.
* Extensions can use the 'Language::getMessagesFileName' hook to define new
  languages using messages files outside of core.
* (bug 32512) Add 'Associated namespace' checkbox to Special:Contributions.
* Added $wgSend404Code, true by default, which can be set to false to send a
  200 status code instead of 404 for nonexistent articles.
* (bug 33447) Link to the broken image tracking category from
  Special:Wantedfiles.
* (bug 27724) Add timestamp to job queue.
* (bug 30339) Implement SpecialPage for running javascript tests. Disabled by
  default, due to tests potentially being harmful, not to be run on a production
  wiki. Enable by setting $wgEnableJavaScriptTest to true.
* Extensions can use the RequestContextCreateSkin hook to override what skin is
  loaded in some contexts.
* (bug 33456) Show $wgQueryCacheLimit on cached query pages.
* (bug 10574) Add an option to allow all pages to be exported by Special:Export.
* mediawiki.js Message object constructor is now publicly available as
  mw.Message.
* (bug 29309) Allow CSS class per tooltip (tipsy).
* (bug 33565) Add accesskey/tooltip to submit buttons on Special:EditWatchlist.
* (bug 17959) Inline rendering/thumbnailing for Gimp XCF images.
* (bug 27775) Namespace has it's own XML tag in the XML dump file.
* (bug 30513) Redirect tag is now resolved in XML dump file.
* sha1 xml tag added to XML dump file.
* (bug 33646) Badtitle error page now emits a 400 HTTP status.
* Special:MovePage now has a dropdown menu for namespaces.
* (bug 34420) Special:Version now shows git HEAD sha1 when available.
* (bug 33952) Refactor mw.toolbar to allow dynamic additions at any time.

=== Bug fixes in 1.19 ===
* $wgUploadNavigationUrl should be used for file redlinks if.
  $wgUploadMissingFileUrl is not set. The first was used for this
  until the second was introduced in 1.17.
* BREAKING CHANGE:  Style rules for wikitable are now more specific and prevent
  inheritance to nested tables which caused various issues (bug 30485 and bug
  33434). If your wiki has overridden rules for ".wikitable", please revise them
  and adjust where necessary. For comparison, use the "table.wikitable" section
  in skins/common/shared.css as base.
* $wgUploadNavigationUrl is now used for file redlinks if
  $wgUploadMissingFileUrl is not set. The former was used for this until the
  second was introduced in 1.17.
* (bug 27894) Move 'editondblclick' event listener down from body to
  div#bodyContent.
* (bug 30172) The check for posix_isatty() in maintenance scripts did not detect
  when the function exists but is disabled. Introduced
  Maintenance::posix_isatty().
* (bug 30264) Changed installer-generated LocalSettings.php to use
  require_once() instead require() for included extensions.
* Do not convert text in the user interface language to another script.
* (bug 26283) Previewing user JS/CSS pages didn't load other user JS/CSS pages.
* (bug 26486) ResourceLoader modules with paths to nonexistent files cause PHP
  warnings/notices to be thrown.
* (bug 30335) Fix for HTMLForms using GET that were breaking when non-friendly
  URLs are used.
* (bug 28649) Preventing half truncated multi-byte unicode characters when
  truncating log comments.
* Show --batch-size option in help of maintenance scripts that support it.
* (bug 4381) Magic quotes cleaning was not comprehensive, key strings were not
  unescaped.
* (bug 23057) Importers no longer can 'edit' or 'create' a fully-protected page
  by importing a new revision into it.
* Allow moving the associated talk pages of subpages even if the base page
  has no subpage.
* Per page edit-notices now work in namespaces without subpages enabled.
* (bug 31081) $wgEnotifUseJobQ is no longer unconditionally enqueueing jobs.
* (bug 30202) File names are now restricted on upload to 240 bytes, because of
  restrictions on some of the database fields.
* Timezones are now recognised in user preferences when offset is different
  due to DST.
* (bug 31692) "summary" parameter now also works when undoing revisions.
* (bug 18823) "move succeeded" text displayed bluelinks even when redirect was
  suppressed.
* (bug 19186) Special:UserLogin's title on Special:SpecialPages now says
  "create account" when the user cannot create an account.
* (bug 31818) 'usercreated' message now supports GENDER.
* (bug 32022) Our phpunit.php script can now be executed from another directory.
* (bug 26020) Setting $wgEmailConfirmToEdit to true no longer removes diffs
  from recent changes feeds.
* (bug 30232) add current time to message wlnote on Special:Watchlist.
* (bug 29110) $wgFeedDiffCutoff did not affect new pages.
* (bug 32168) Add wfRemoveDotSegments for use in wfExpandUrl.
* (bug 32358) Do not display "No higher resolution available" for dimensionless
  files (like audio files).
* (bug 32168) Add wfAssembleUrl for use in wfExpandUrl.
* (bug 32168) fixed - wfExpandUrl expands dot segments now.
* (bug 31535) Upload comments now truncated properly, and don't have brackets.
* (bug 32086) Special:PermanentLink now shows an error message when no subpage
  was specified.
* (bug 30368) Special:Newpages now shows the new page name for moved pages.
* (bug 1697) The way to search blocked usernames in block log should be clearer.
* (bug 29747) eAccelerator shared memory caching has been removed since it is
  now disabled by default and is buggy. APC, XCache and WinCache are not
  affected.
* Installer now refuses to install if php was not compiled with Ctype support.
* (bug 29475) Remove "trackback" feature entirely from core.
* (bug 32665) Special:BlockList prefills the username in the input field if
  using the Special:BlockList/username URL.
* (bug 27721) Make JavaScript variables wgSeparatorTransformTable and
  wgDigitTransformTable depend on page content language so the sort script
  sorts correctly more often.
* (bug 32230) Expose wgRedirectedFrom in JavaScript.
* (bug 31212) History tab not collapsed when the screen is narrow.
* (bug 15521) Use new section summary when the action of adding a new section
  also happens to create the page.
* (bug 32960) Remove EmailAuthenticationTimestamp from database when a
  email address is removed.
* (bug 32414) Empty page get a empty bytes attribute in Export/Dump.
* (bug 33101) Viewing a User or User talk of username resembling IP ending
  with .xxx causes Internal error.
* Warning about undefined index in certain situations when $wgLogRestrictions
  causes the first log type requested to be removed but not the others.
* Use separate message ('prefixindex-namespace') for title of
  Special:PrefixIndex rather then re-using Special:AllPages's allinnamespace.
* (bug 33156) Special:Block now allows you to confirm you want to block yourself
  when using non-normalized username.
* (bug 33246) News icon shown for news:// URLs but not for news: URLs.
* (bug 33305) Make mw.util.addCSS resistant to IE's @font-face bug by setting
  cssText after DOM insertion.
* (bug 30711) When adding a new section to a page with section=new, the text is
  now always added to the current version of the page.
* (bug 31719) Fix uploads of SVGs exported by Adobe Illustrator by expanding
  XML entities correctly.
* (bug 30914) Embeddable ResourceLoader modules (user.options, user.tokens)
  should be loaded in <head> for proper dependency resolution.
* (bug 32702) Removed method Skin::makeGlobalVariablesScript() has been readded
  for backward compatibility.
* (bug 31469) Make sure tracking category messages expand variables like
  {{NAMESPACE}} relative to correct title.
* (bug 33454) ISO-8601 week-based year number (format character 'o') is now
  calculated correctly with respect to timezone.
* (bug 32219) InstantCommons now fetches content from Wikimedia Commons using
  HTTPS when the local wiki is served over HTTPS.
* (bug 33525) clearTagHooks doesn't clear function hooks.
* (bug 33523) Function tag hooks don't appear on Special:Version.
* Files with IPTC blocks we can't read no longer prevent extraction of exif
  or other metadata.
* (bug 33587) Remove action "historysubmit" from history pages.
* (bug 25800) mw.config wgAction should contain the actually performed action
  instead of whatever the query value contains.
* (bug 4438) Add CSS hook for current WikiPage action.
* (bug 33703) Common border-bottom color for <abbr> should inherit default
  (text) color.
* (bug 33819) Display file sizes in appropriate units.
* (bug 32948) {{REVISIONID}} and related variables are no longer blank after
  doing a null edit.
* (bug 33880) $wgUsersNotifiedOnAllChanges should not send e-mail to user who
  made the edit.
* (bug 33902) Decoding %2B with mw.Uri.decode results in ' ' instead of +.
* (bug 33762) QueryPage-based special pages no longer misses *-summary message.
* Other sizes links are no longer generated for wikis without a 404 thumbnail
  handler.
* (bug 29454) Enforce byteLimit for page title input on Special:MovePage.
* (bug 34114) CSSMin::remap() doesn't respect its $embed parameter.
* Special:Contributions/newbies now shows the contributions for the user
  "newbies". New user contributions are obtained using the form or using
  ?contribs=newbie in URL.
* It is now possible to delete images that have no corresponding description
  pages.
* (bug 33165) GlobalFunctions.php line 1312: Call to a member function
  getText() on a non-object.
* (bug 31676) Group dynamically inserted CSS into a single <style> tag, to work
  around a bug where not all styles were applied in Internet Explorer.
* (bug 28936, bug 5280) Broken or invalid titles can't be removed from
  watchlist.
* (bug 34600) Older skins using useHeadElement=false were broken in 1.18.
* (bug 34604) [mw.config] wgActionPaths should be an object instead of a numeral
  array.
* (bug 12262) Indents and lists are now aligned
* (bug 29753) mw.util.tooltipAccessKeyPrefix should be alt-shift for Chrome
   on Windows
* (bug 25095) Special:Categories should also include the first relevant item
   when "from" is filled.
* (bug 34972) An error occurred while changing your watchlist settings for
  [[Special:WhatLinksHere/Example]]

=== API changes in 1.19 ===
* Made action=edit less likely to return "unknownerror", by returning the actual
  error message (which may have come from a hook call or similar).
* (bug 19838) siprop=interwikimap can now use the interwiki cache.
* (bug 29748) Add API search prefix support.
* (bug 29684) Set forgotten parameter types in ApiQueryIWLinks.
* (bug 29685) do not output NULL parentid with list=deletedrevs&drprop=parentid.
* siprop=interwikimap and siprop=languages can use silanguagecode to have
  a best effort language name translation. Use CLDR extension for best result.
* (bug 30230) action=expandtemplates should not silently override invalid title
  inputs.
* (bug 18634) Create API to fetch MediaWiki's language fallback tree structure.
* (bug 26885) Allow show/hide of account blocks, temporary blocks and single IP
  address blocks for list=blocks.
* (bug 30591) Add support to only return keys in ApiAllMessages.
* The API now respects $wgShowHostnames and won't share the hostname in
  servedby if it's set to false.
* wlexcludeuser parameter added to ApiFeedWatchlist.
* (bug 7304) Links on redirect pages no longer cause the redirect page to show
  up as a redirect to the linked page on Special:Whatlinkshere.
* (bug 32609) API: Move captchaid/captchaword of action=edit from core
  to Captcha extension(s).
* Added 'APIGetDescription' hook.
* (bug 32688) Paraminfo for parameter "generator" of the query module shows too
  many types.
* (bug 32415) Empty page get no size attribute in API output.
* (bug 31759) Undefined property notice in querypages API.
* (bug 32495) API should allow purge by pageids.
* (bug 33147) API examples should explain what they do.
* (bug 33482) Api incorrectly calls ApiBase::parseMultiValue if allowed
  values is given as an array.
* (bug 32948) {{REVISIONID}} and related variables are no longer blank after
  calling action=purge&forcelinkupdate.
* (bug 34377) action=watch now parses messages using the correct title instead
  of "API".
* (bug 35036) WikiLove messages were not automatically updated in JavaScript
  after having been changed on-wiki due to a bug in core

=== Languages updated in 1.19 ===

MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* Canadian English (en-ca) (new).
* Norwegian (bokmål) (nb) (renamed from no).
* Uighur (Latin) (ug-latn) was incorrectly marked as right-to-left language.
* (bug 30217) Make pt-br a fallback of pt.
* (bug 31193) Set fallback language of Assamese from Bengali to English.
* Update date format for dsb and hsb: month names need the genitive.
* (bug 28643) Serbian variant conversion improvements (Nikola Smolenski).
* (bug 29405, bug 30809) Lower diacritics are invisible in titles in Indic
  languages Assamese, Bengali, Hindi, Malyalam and Odiya.
* (bug 32826) Titles in indic languages are partially cut.
* (bug 33367) Gendered namespaces for Czech.
* (bug 33014) Language::formatSize()/formatBitrate() should be able to deal
  with larger numbers (tera-yotta).

=== Other changes in 1.19 ===
* BREAKING CHANGE: Legacy global array 'ta' and global function 'akeytt' have
  been removed from wikibits.js.
* jquery.mwPrototypes module was renamed to jquery.mwExtension.
* The maintenance script populateSha1.php was renamed to the more concise
  populateImageSha1.php.
* The Client-IP header is no longer checked for when trying to resolve a
  client's real IP address.
* (bug 22096) Although IE5.x and below was already unsupported officially,
  stylesheets existing exclusively for IE5.0 and IE5.5 have now been removed
  (which were in skins 'chick' and 'monobook').
* The constructor for CategoryView has changed, the second parameter is now a
  Context source and is required.
* The Title::escape{Local,Full,Canonical}URL methods are deprecated, please use
  proper html building methods to escape the normal get{...}URL methods instead.
* The $variant arguments in the Title::get{Local,Full,Link,Canonical}URL methods
  have been replaced with a secondary query argument.
* The $variant argument in the hooks for the
  Title::get{Local,Full,Link,Canonical}URL methods have been removed, the
  variant is now part of the $query argument.
* Removed Title::isValidCssJsSubpage(), deprecated since 1.17 in favor of
  using Title::isCssJsSubpage() or checking Title::isWrongCaseCssJsPage().
* Support for the deprecated hook MagicWordMagicWords was removed.
* The Xml::namespaceSelector method has been deprecated, please use
  Html::namespaceSelector instead (note that the parameters have changed also).
* (bug 33746) Preload popular ResourceLoader modules (mediawiki.util) as
  stop-gap for scripts missing dependencies.
  New configuration variable $wgPreloadJavaScriptMwUtil has been introduced for
  this (set to false by default for new installations). Set to true if your wiki
  has a large amount of user/site scripts that are lacking dependency
  information. In the short to medium term these user/site scripts should be
  fixed by adding the used modules to the dependencies in the module registry
  and/or wrapping them in a callback to mw.loader.using.

== MediaWiki 1.18 ==

== MediaWiki 1.18.6 ==
2012-11-29

This is a maintenance and security release of the MediaWiki 1.18 branch

=== Changes since 1.18.5 ===
* ([[bugzilla:40995|bug 40995]]) Prevent session fixation in Special:UserLogin
(CVE-2012-5391)
* ([[bugzilla:41400|bug 41400]]) Prevent linker regex from exceeding PCRE
backtrack limit
* Localisation updates
* Increase permitted runtime for testParserTest
* ([[bugzilla:36179|bug 36179]]) Unquote 'null' for PostgreSQL.

== MediaWiki 1.18.5 ==
2012-08-30

This is a security release of the MediaWiki 1.18 branch

=== Changes since 1.18.4 ===
* (bug 39700) File: link to non-existing file can inject html
* (bug 39823) Hidden block text leaking to admins
* (bug 39184) LDAP password leakage
* (bug 39180) Disallow framing of api results
* (bug 37587) Enforce language codes to be html safe
* (bug 39824) Check global blocks on account creation

== MediaWiki 1.18.4 ==
2012-06-12

This is a security release of the MediaWiki 1.18 branch.

=== Changes since 1.18.3 ===
* (bug 36938) Correctly escape uselang attribute to prevent xss
* Expanded Blacklist for SVG Files

== MediaWiki 1.18.3 ==
2012-04-25

This is a maintenance release of the MediaWiki 1.18 branch.

=== Changes since 1.18.2 ===
* (bug 35446) Using "{{nse:}}" with an invalid namespace name no longer throws
  a PHP warning.
* (bug 35567) The whole password reminder e-mail is now sent in the same
  language.
* (bug 35961) Hash comparison should always be strict.
* (bug 35671) PHP Notice: Undefined index: gettoken in includes/api/ApiMain.php
  on line 598.
* Fix broken email confirmation expiration caused by MWCryptRand changes.

== MediaWiki 1.18.2 ==
2012-03-21

This is a maintenance and security release of the MediaWiki 1.18 branch.

=== Changes since 1.18.1 ===
* (bug 33686) could not get a list of contributors for an article when using
  a SQLite database.
* (Bug 33865) Exception thrown in action=parse when attempting to use the title
  parameter without setting the text parameter.
* UserMailer could potentially throw a fatal error when a MailAddress object had
  an empty email address.
* (Bug 33087) Exchange server rejected mail sent by MediaWiki
* (bug 34528) Edit section tooltips show correction section name again
* (bug 34246) MediaWiki:Whatlinkshere-summary message is displayed again in
  Special:Whatlinkshere
* (bug 22555) Remove or skip strip markers from tag hooks like &lt;nowiki&gt; in
  core parser functions which operate on strings, such as formatnum.
* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token
  parameter present.
* (bug 34907) Fixed exposure of tokens through load.php that could have
  facilitated CSRF attacks.
* (bug 35317) CSRF in Special:Upload.

== MediaWiki 1.18.1 ==
2012-01-11

This a maintenance and security release of the MediaWiki 1.18 branch.

=== Changes since 1.18.0 ===
* (bug 32712) Fix for search indexing of pages with certain unicode chars
  following URL.
* (bug 3901) Lang, hreflang attribs added to sidebar interlanguage links for
  screen readers.
* (bug 30774) mediawiki.html: Add support for numbers and booleans in the
  attribute values and element contents.
* (bug 32473) [[Special:PasswordReset]] can not be used on private wiki.
* (bug 32853) Fixed CACHE_DBA object cache type.
* (bug 32786) Backward compatibility for extension using 1.17's
  Database::newFromType().
* Fixed exception when using Special:WhatLinksHere on a Media: file.
* (bug 32709) Private Wiki users were always taken to Special:Badtitle on login.
* (bug 33240) Sort images are missing but referenced in css.
* (bug 31921) Magic words REVISIONDAY, REVISIONMONTH and REVISIONYEAR were
  not showing their values on preview.
* (bug 32702) Removed method Skin::makeGlobalVariablesScript() has been readded
  for backward compatibility.
* (bug 30172) The check for posix_isatty() in maintenance scripts did not detect
  when the function exists but is disabled. Introduced
  Maintenance::posix_isatty().
* (bug 33305) Make mw.util.addCSS resistant to IE's @font-face bug by setting
  cssText after DOM insertion.
* (bug 29102) Upgrades no longer fail with the error "Unknown character set:
  'mysql4'.
* (bug 25355) Parser generates edit section links for special pages.
* (bug 33321) Adding a line to MediaWiki:Sidebar that contains a pipe, but
  doesn't have any pipes after being transformed by MessageCache, causes
  exception on all pages.
* Fixed recentchanges FK violation on page delete and cache purge error in
  updater for Oracle DB.
* (bug 33117) prop=revisions allows deleted text to be exposed through cache
  pollution.

== MediaWiki 1.18.0 ==
2011-11-24

This is the first stable release of the MediaWiki 1.18 branch.

=== Summary of selected changes in 1.18 ===

Selected changes since MediaWiki 1.17 that may be of interest:

* Some of the more commonly used MediaWiki extensions are now included in the
  release tarball. These extensions are ConfirmEdit, Gadgets, Nuke,
  ParserFunctions, Renameuser, Vector and WikiEditor.

* Gender support has been improved, meaning user pages can display the correct
  gender variant of "User" can now be used.

* MediaWiki can now detect the camera orientation of an image from the Exif
  metadata, and can rotate the image thumbnail appropriately. Metadata support
  has been generally improved, and can now extract IPTC and XMP metadata.

* Improved directionality support in 1.18 means that MediaWiki is better to use
  for RTL users.

* MediaWiki now supports protocol - relative URLs in links, interwiki targets
  and $wgServer

* Math support has been removed from core

=== Changes since 1.18.0rc1 ===
* (bug 32228) regression in Special:Search which did not conserve profile on
  new search
* (bug 32460) Categories were improperly aligned in Simple and CologneBlue
* (bug 32412) TOC links on [[Special:EditWatchlist]] points to the fieldsets
* (bug 32582) Fix TOC show/hide link regression on IE 8

=== Changes since 1.18 beta 1 ===
* (bug 31886) Wrong titles redirecting to Special:Badtitle in the 1.18
  deployment.
* (bug 32051) Fix description for wlprop=sizes.
* (bug 31913) Special:MostLinkedTemplates had an incorrect GROUP BY clause
  under Microsoft SQL.
* (bug 32100) installer complains about suhosin GET limit.
* (bug 31933) fix 1.18 regression in Monobook sidebar: huge spacing between
  portlets on IE 7 and IE 8/9 in compatibility view.
* (bug 32126) Fix 1.18 regression in watchlist editor when items already removed
  from watchlist.
* (bug 32183) remove the client-* classes added from user-agent-sniffing onto
  the <html> element.
* (bug 29912) Unit tests break if parsertest tables are still present.
* (bug 31694) During installation, tabbing order (cursor focus) goes to logo
  instead of 'continue'.
* (bug 29102) Upgrade fails "Unknown character set: 'mysql4".
* (bug 31990) justify paragraphs pref adds extra space to category listing.
* (bug 20148) Better title for [[Special:Disambiguations]] page.
* (bug 31502) TOC is missing on Special:EditWatchlist.
* (bug 32256) API list=search stops at first invalid result.
* (bug 32047) jquery.tablesorter.js: thead is before caption.
* (bug 29854) Store protocol-relative links twice in the externallinks table,
  one with http: in el_index and once with https.
* (bug 31822) Error during upgrade due to output buffer reset in stdout.

=== Configuration changes in 1.18 ===
* The WantedPages::getSQL hook has been removed and replaced with
  WantedPages::getQueryInfo. This may break older extensions.
* The SkinTemplateBuildContentActionUrlsAfterSpecialPage,
  SkinTemplateContentActions and SkinTemplateTabs hooks have been removed in
  favor of SkinTemplateNavigation and SkinTemplateNavigation::SpecialPage.
* $wgUseCombinedLoginLink controls whether to output a combined
  login / create account link in the personal bar, or to output separate login
  and create account links.
* Skin names are no longer created based on a ucfirst version of the key in
  $wgValidSkinNames but now the value. This means for
  $wgValidSkinNames["monobook"] = "MonoBook"; the skin loader will no longer try
  loading SkinMonobook and will instead load SkinMonoBook.
* $wgMaxUploadSize may now be set to an array to specify the upload size limit
  per upload type.
* $wgAPICacheHelp added in 1.16 is now removed. To disable API help caching, set
  $wgAPICacheHelpTimeout = 0;
* OutputPage::isUserJsAllowed() no longer returns false when scripts are allowed
  by the page, but $wgAllowUserJs is set to false.
* Pure "Skin" class based custom skins are no longer supported, all custom skins
  should be put together using SkinTemplate and BaseTemplate or QuickTemplate.
* The transliteration for passwords in case they were migrated from an old
  Latin-1 install (previous to MediaWiki 1.5) is now only done for wikis with
  $wgLegacyEncoding set.
* (bug 27508) Add $wgSVGMetadataCutoff to limit the maximum amount of an SVG we
  look at when finding metadata to prevent excessive resource usage.
* $wgSysopUserBans and $wgSysopRangeBans (deprecated in 1.17) are now removed.
  Use $wgBlockCIDRLimit = array( 'IPv4' => 43, 'IPv6' => 128 ) to achieve the
  same functionality as $wgSysopRangeBans; you can use the BlockIp hook to
  replicate $wgSysopUserBans functionality.
* The options on the block form have been standardised such that checking a box
  makes the block 'more serious'; so while "check to prevent account creation"
  and "check to enable autoblock" remain the same, "check to allow user-talk
  edit" is reversed to "check to *disable* user-talk edit", and "check to block
  anon-only" becomes "check to block logged-in users too".  The default settings
  remain the same.
* Most of the field names on the Special:Block form have been changed, which
  will probably break screen-scraping bots.
* (bug 26866) The 'trackback' right is no longer granted to sysops by default.
  $wgUseTrackbacks is already false by default.
* (bug 17009) the hiddenStructure CSS class, a highly hackish way of at least
  *appearing* to hide article elements, has been removed.  Use the
  ParserFunctions extension to actually remove unwanted elements from the
  output.
* (bug 14202) $wgUseTeX has been superseded by the Math extension. To re-enable
  math conversion after upgrading, obtain the Math extension from SVN or from
  https://www.mediawiki.org/wiki/Extension:Math and add to LocalSettings.php:
  require_once "$IP/extensions/Math/Math.php";
* $wgProfiler is now a configuration array, see StartProfiler.sample for
  details.
* $wgProfiling has been removed.
* The spyc library is now no longer included in phase3.
* (bug 28343) Unused preferences contextlines/contextchars have been removed
* $wgSkinExtensionFunctions has been removed. Use $wgExtensionFunctions instead.
* $wgProto has been removed. You now only need to set $wgServer to change the
  URL protocol.
* $wgRateLimitsExcludedGroups (deprecated in 1.13) has been removed.
* $wgInputEncoding and $wgOutputEncoding (deprecated in 1.5) have now been
  removed.
* $wgAllowUserSkin (deprecated in 1.16) has now been removed.
* $wgExtraRandompageSQL (deprecated in 1.16) has now been removed.
* LogReader and LogViewer classes (deprecated in 1.14) have now been removed.
* (bug 26033) Added $wgArticleCountMethod to select the method to use to say
  whether a page is an article or not. $wgUseCommaCount is now deprecated.
* $wgEnableDublinCoreRdf and $wgEnableCreativeCommonsRdf no longer work in core,
  and the functionality has been moved to the relevant extensions. See
  https://www.mediawiki.org/wiki/Extension:DublinCoreRdf and
  https://www.mediawiki.org/wiki/Extension:CreativeCommonsRdf as appropriate.
* (bug 21107) Split error "customcssjsprotected" into separate messages for JS
  and CSS
* Removed $wgCheckCopyrightUpload from DefaultSettings, since the relevant
  feature was removed in about 1.5.
* LogPageValidTypes, LogPageLogName, LogPageLogHeader and LogPageActionText
  hooks have been removed.
* New hook "Collation::factory" to allow extensions to create custom
  category collations.
* $wgGroupPermissions now supports per namespace permissions.
* $wgEnableAutoRotation enables or disables auto-rotation. Leaving it set to
  null will cause MediaWiki to determine if auto-rotation is available.

=== New features in 1.18 ===
* BREAKING CHANGE: action=watch / action=unwatch now requires a token.
* BREAKING CHANGE: Article class hierarchy split into WikiPage (backend)
  and Article (frontend) hierarchies. Several hooks now pass a WikiPage object
  instead of an Article object. These hooks all use an $article parameter as
  documented in hooks.txt. Extensions should be updated to account for this,
  though most won't require any changes.
* (bug 27860) Minor edit after clicking 'new section' tab
  Now the "This is a minor edit" checkbox is not available when you
  create a page or new section.
* (bug 8130) Query pages should limit to content namespaces, not just main
  namespace.
* Special:Contribs now redirects to Special:Contributions.
* (bug 6672) Images are now autorotated according to their EXIF orientation.
  This only affects thumbnails; the source remains unrotated.
* (bug 25708) Update case mappings and normalization to Unicode 6.0.0.
* New hook ArticlePrepareTextForEdit added, called when preparing text to be
  saved.
* New parser option PreSaveTransform added, allows the pre-save transformation
  to be selectively disabled.
* Alternative to $wgHooks implemented, using the new Hooks class.
* Add width parameter to Special:Filepath to allow getting the file path of a
  thumbnail.
* (bug 26870) Add size to {{filepath:}}.
* Upload warnings now show a thumbnail of the uploaded file.
* Introduced the edittools-upload message, which will be inserted under the
  upload form instead of edittools if available.
* (bug 26285) Extensions will be automatically generated on upload if the user
  specified a filename without extension.
* (bug 26851) Special:UserRights now allows to prefill the reason field
* New maintenance script to fix double redirects
  (maintenance/fixDoubleRedirects.php).
* (bug 23315) New body classes to allow easier styling of special pages.
* (bug 27159) Make email confirmation code expiration time configurable.
* (bug 29047) CSS/JS for each user group is imported from
  MediaWiki:Group-sysop.js, MediaWiki:Group-autoconfirmed.css, etc.
* (bug 24230) Uploads of ZIP types, such as MS Office or OpenOffice can now be
  safely enabled. A ZIP file reader was added which can scan a ZIP file for
  potentially dangerous Java applets. This allows applets to be blocked
  specifically, rather than all ZIP files being blocked.
* (bug 2429) Allow selection of associated namespace in recent changes.
* (bug 26217) File size is now checked before uploading in HTML5 browsers.
* CSS stylesheet MediaWiki:Noscript.css is now loaded for users with JavaScript
  disabled (enclosed in the head in a <noscript> tag).
* Added UserGetLanguageObject hook to change the language used in $wgLang.
* (bug 14645) When $wgMiserMode is on, expensive special pages are styled
  differently (italicized by default) on Special:SpecialPages.
* Added $wgAggregateStatsID, which allows UDP stats to be aggregated over
  several wikis.
* When $wgAllowMicrodataAttributes is true, all itemtypes are allowed, not just
  the three that were defined in the original specification.
* (bug 14706) Added support for the Imagick PHP extension.
* (bug 18691) Added support for SVG rasterization using the Imagick PHP
  extension.
* (bug 2581, bug 6834) Added links to thumbnail in several resolutions to the
  file description page. The sizes are set by $wgImageLimits.
* (bug 28031) Add pageCount support to ArchivedFile.
* (bug 27924) PhpHttpRequest doesn't return response body if HTTP != 200.
* Added hook BitmapHandlerTransform to allow extension to transform a file
  without overriding the entire handler.
* The parser now attempts to output markers for editsection tokens and defer the
  rendering of them post-cache to reduce parser cache fragmentation and ensure
  skin customizability of edit section links.
* (bug 24755) AuthPlugin auto-creation of local accounts can now be aborted by
  other extensions by handling the 'AbortAutoAccount' hook, similar to the
  'AbortNewAccount' triggered by explicit account creations. (They are separate
  to avoid loops and confusion; auth plugins like CentralAuth need to handle
  AbortNewAccount separately.
* Special:ListFiles is now transcludable.
* (bug 13879) Special:Emailuser asks for suitable target user if called without.
* (bug 16956) IPTC and XMP metadata now extracted from images.
* (bug 23816) A tracking category is now added for any pages with broken images.
* (bug 23495) Allow createAndPromote.php to create non-sysop users.
* (bug 28916) A way to to toggle mw.config legacy globals settings from
  LocalSettings.php has been created by introducing $wgLegacyJavaScriptGlobals.
* (bug 28503) Support for ircs:// URL protocols.
* (bug 26033) It is now possible to count all non-redirect pages in content
  namespaces as articles.
* Images can now be embedded in an XML dump stream using backupDump.php
  --include-files and can be imported using importDump.php --uploads;
  furthermore, it can import files from the filesystem using --image-base-path.
* Three new hooks in Special:Undelete, 'UndeleteForm::showHistory',
  'UndeleteForm::showRevision' and 'UndeleteForm::undelete', so that extensions
  may override the usage of PageArchive class and replace it with their own
  class that extends PageArchive.
* (bug 28915) Implement QUnit test suite for MediaWiki JavaScript.
  Also built-in support for distribution through a TestSwarm instance.
* (bug 29036) For cascade-protected pages, the mw-textarea-cprotected class is
  added to the textarea on the edit form.
* mw.util.wikiScript has been implemented (like wfScript in GlobalFunctions.php)
* (bug 29067) Expose user.tokens (like we do user.options) in ResourceLoader.
* New 'Debug' hook used by wfDebug() and wfDebugLog().
* (bug 27655) Require token for watching/unwatching pages)
* (bug 28904) (bug 29773) Update jQuery version from 1.4.4 to 1.6.2 (the latest
  version)
* (bug 29441) Expose CapitalLinks config in JS to allow modules to properly
  handle titles on case-sensitive wikis.
* (bug 29397) Implement mw.Title module in core.
* In MySQL 4.1.9+ with replication enabled, fetch the slave lag from SHOW SLAVE
  STATUS instead of SHOW PROCESSLIST. This ensures that lag is reported
  correctly in the case where there are no write events occurring. Note that
  the DB user now needs to have the REPLICATION CLIENT privilege if you are
  using replication.
* Language codes in $wgDummyLanguageCodes are now excluded on localization
  statistics (maintenance/language/transstat.php).
* (bug 29586) Make the (next 200) links on categories link directly to
  the relevant section of the category.
* (bug 29109) Allow the automatic edit summary for redirect creation
  show the first bit of the new redirect page.
* (bug 29723) mw.util.wikiGetlink() now defaults to wgPageName.
* (bug 29680) Add GetDefaultSortkey hook to override the default sortkey.
* (bug 16699) {{#language:}} accepts second parameter to specify the language in
  which the language name is wanted. Coverage depends on the cldr extension.
* (bug 15802) An easy way to look up messages: language qqx which returns
  the message keys.
* (bug 29868) Add support for passing parameters to mw.msg in jquery.localize.
* (bug 29558) $wgMiserMode now disables update.php by default.
* AjaxCategories: Easily add, edit or delete categories on article pages.
  Suggests possible categories when typing, all saves are done via AJAX.
  Supports editing of multiple categories and then saving them in one batch.
* $wgAutopromoteOnce was added, allowing for users to be automatically promoted
  to explicit usergroups. If a group is removed from a user via
  Special:UserRights, it will not automatically be re-added. Configuration is
  similar to $wgAutopromote (see DefaultSettings.php).
* The PerformRetroactiveAutoblock hook was added to allow overriding or
  complementing retroactive autoblock handling. This runs when blocking a user
  with the 'autoblock' option.
* MediaWiki now supports using protocol-relative URLs in links, interwiki
  targets and $wgServer.
* Introduced $wgVaryOnXFPForAPI which will cause the API to send
  Vary: X-Forwarded-Proto headers.
* New maintenance script to refresh image metadata
  (maintenance/refreshImageMetadata.php).
* (bug 16428) Include permalink in printable version.
* (bug 30722) Add an identity collation that sorts things based on what the
  unicode code point is (aka pre-1.17 behavior).
* (bug 30940) Add a hook in User:getDefaultOptions.
  To give extensions a better and more flexible way of providing default
  values for preferences a hook has been introduced in User:getDefaultOptions().
  Setting preferences in $wgDefaultUserOptions still work fine, but when reading
  them (i.e. with array_keys) to get a list of all preferences, then
  $wgDefaultUserOptions should no longer be used as it will contain those set
  via User:getDefaultOptions().
* (bug 30497) Add client-nojs and client-js classes on document element
  to let styles easily hide or show things based on general JS availability.
* (bug 31293) If Special:Userlogin is loaded over HTTPS, display
  MediaWiki:loginend-https instead of MediaWiki:loginend, if it's not empty.
  Same for signupend on the account creation page.
* (bug 31233) New OutputPage::addJsConfigVars() method to make the output page
  specific mw.config map extendable.
* mw.util.wikiScript has been implemented (like wfScript in
  GlobalFunctions.php).

=== Bug fixes in 1.18 ===
* (bug 27860) Minor edit after clicking 'new section' tab.
* (bug 23119) WikiError class and subclasses are now marked as deprecated.
* (bug 10871) Javascript and CSS pages in MediaWiki namespace are no longer
  treated as wikitext on preview.
* (bug 22753) Output from update.php is more clear when things changed, entries
  indicating nothing changed are now all prefixed by "...".
* Page existence is now not revealed (in the colour of the tabs) to users who
  cannot read the page in question.
* (bug 19006) {{REVISIONUSER}} no longer acts like {{CURRENTUSER}} in some
  cases.
* (bug 16019) $wgArticlePath = "/$1" no longer breaks API edit/watch actions.
* (bug 18372) File types blacklisted by $wgFileBlacklist will no longer be shown
  as "Permitted file types" on the upload form.
* (bug 26379) importImages.php gives more descriptive error message on failure.
* (bug 26410) + signs are no longer treated as spaces in internal links if
  link has a % sign in it.
* (bug 26412) Search results headers no longer show a bogus edit link.
* (bug 26540) Fixed wrong call to applyPatch in MysqlUpdater.
* (bug 26574) Added 'upload' to $wgRestrictionTypes, allowing upload protected
  pages to be queried via the API and Special:ProtectedPages, and allowing
  disabling upload protection by removing it from $wgRestrictionTypes.
* If an edit summary exceeds 250 bytes and is truncated, add an ellipse.
* (bug 26638) Database error pages display correctly in RTL languages.
* (bug 26187) Confirmrecreate no longer parses the edit summary.
* (bug 26208) Mark directionality of some interlanguage links.
* (bug 26034) Make the "View / Read" tab in content_navigation style tabs remain
  selected when the action is "purge".
* (bug 14267) Support a MediaWiki:Mainpage-nstab override for the subject
  namespace tab on the mainpage of a wiki.
* (bug 10158) Do not mention allowing others to contact you when the feature
  is disabled ($wgEnableUserEmail=false).
* (bug 26733) Wrap initial table creation in transaction.
* (bug 26729) Category pages should return 404 if they do not exist and have no
  members.
* (bug 2585) Image pages should send 404 if no image, no shared image and no
  description page.
* Custom editintro's using the editintro url parameter will no longer show
  <noinclude> sections on pages they are included on.
* (bug 26449) Keep underlines from headings outside of tables and thumbs by
  adding overflow:hidden to h1,h2,h3,h4,h5,h6 (also fixes editsection bunching).
* (bug 26708) Remove background-color:white from tables in Monobook and Vector.
* (bug 28422) Remove color:black from tables in Monobook and Vector. And add it
  to table.wikitable instead.
* (bug 26781) {{PAGENAME}} and related parser functions escape their output
  better.
* (bug 26716) Provide link to instructions for external editor related
  preferences and add a comment to the ini control file explaining what is
  going on.
* Trying to upload a file with no extension or with a disallowed MIME type now
  gives the right message instead of complaining about a MIME/extension
  mismatch.
* (bug 26809) Uploading files with multiple extensions where one of the
  extensions is blacklisted now gives the proper extension in the error message.
* (bug 26961) Hide anon edits in watchlist preference now actually works.
* (bug 19751) Filesystem is now checked during image undeletion.
* Send last modified headers for Special:Recentchanges when RC patrol is
  enabled, but user cannot see rc patrol links.
* (bug 26548) ForeignAPIRepo (InstantCommons) now works with PDF files
  and other multi-paged file formats.
* Files with a mime type that does not match the extension are now properly
  thumbnailed.
* (bug 27201) Special:WhatLinksHere output no longer contains duplicate IDs.
* (bug 15905) Nostalgia skin could become more usable by including a Talk:
  link at the top of the page.
* (bug 27560) Search queries no longer fail in Walloon language.
* (bug 27679) Broken embedded files with special characters are no longer
  double HTML escaped.
* (bug 27700) The upload protection can now also be set for files that do not
  exist.
* (bug 27763) Article::getParserOutput() no longer throws a fatal given when an
  incorrect revision ID is passed.
* Trim the form field for uploading by url to remove extra spaces which could
  cause confusing error messages.
* (bug 27854) Http::isValidURI is way too lax.
* Do not show enotifminoredits preference, if disabled by $wgEnotifMinorEdits.
* AbortLogin returning "ABORTED" now handled.  Also allows message identifier
  for "ABORTED" reason to be returned and displayed to user.
* (bug 28034) uploading file to local wiki when file exists on shared repository
  (commons) gives spurious info in the warning message.
* Usernames get lost when selecting different sorts on Special:listfiles.
* (bug 14005) editing section 0 of an existing but empty page gives no such
  section error.
* (bug 26939) Installer does not set $wgMetaNamespace.
* (bug 28166) UploadBase assumes that 'edit' and 'upload' rights are not per
  page restrictions.
* Make truncate function automatically consider length of '...' string,
  since length can vary by localization.
* (bug 28242) Make redirects generated by urls containing a local interwiki
  prefix be a 301 instead of a 302.
* (bug 15641) blocked administrators are now prevented from deleting or
  protecting their own talk page; and all blocked users are more
  comprehensively prevented from performing other actions.
* (bug 27893) Edit-on-doubleclick now applies only on view and purge actions;
  no longer triggers unexpectedly on delete, history etc.
* (bug 28417) Fix PHP notice when importing revision without a listed id.
* (bug 28430) Make html and TeX output of <math> always be left-to-right.
* (bug 28306) Fix exposure of suppressed usernames in ForeignDBRepo.
* (bug 28372) Fix bogus link to suppressed file versions in ForeignDBRepo.
* (bug 27473) Fix regression: bold, italic no longer interfere with linktrail
  for ca, kaa.
* (bug 28444) Fix regression: edit-on-doubleclick retains revision id again.
* &apos; character entity is now allowed in wikitext.
* UtfNormal::cleanUp on an invalid utf-8 sequence no longer returns false if
  intl installed.
* (bug 28561) The css class small will no longer make nested elements even
  smaller.
* (bug 13172) Array type exif data (like GPS) was not being extracted from
  images.
* (bug 28532) wfMsgExt() and wfMsgWikiHtml() use $wgOut->parse().
* (bug 16129) Transcluded special pages expose strip markers when they output
  parsed messages.
* (bug 27249) "Installed software" table in Special:Version should always be
  left-to-right.
* (bug 28719) Do not call mLinkHolders __destruct explicitly.
* (bug 21196) Article::getContributors() no longer fails on PostgreSQL.
* (bug 28752) XCache doesn't work in CLI mode.
* (bug 28076) Thumbnail height limited to 360 pixels on Special:Listfiles.
* (bug 22227) Special:Listfiles no longer throws an error on bogus file entries.
* (bug 19408) user_properties.up_property: 32 bytes is not enough.
* (bug 25262) Fix for minification of hardcoded data: URIs in CSS.
* (bug 29263) Add LTR class to the shared CSS to be used for left-to-right text
  such as SQL queries shown in dberrortext and similar messages in RTL
  environments.
* (bug 14977) Fixed $wgServer detection in cases where an IPv6 address is used
  as the server name.
* The View X deleted revisions is now shown again on Special:Upload.
* (bug 29071) mediawiki.action.watch.ajax.js should pass uselang to API.
* (bug 28868) Show total pages in the subtitle of an image on the
  file description page for multi-paged documents.
* (bug 28883) Message names for different compression types commonly
  used in Tiff files.
* When transcluding a special page, do not let it interpret url parameters.
* (bug 28887) Special page classes are no longer re-used during 1 request.
* (bug 28888) Searching for something starting with a # sign no longer tells
  the user a page named [[:]] already exists.
* (bug 23002) Imagelinks table not updated after imagemove.
* (bug 27864) Transcluding {{Special:Prefix}} with empty prefix now lists all
  pages.
* (bug 18803) JPEG2000 images should not be uploadable as .jpg files.
* (bug 11868) If using links to count articles, the checking will now be based
  on the real presence of an internal link instead of the "[[" string.
* (bug 28287) The "your changes" box for edit conflicts is now read-only.
* (bug 28940) When making a thumb of an SVG, and only specifying the height
  make the width be the max SVG size, not the natrual width of the SVG.
* (bug 1780) Uploading files with non-ascii characters are now forbidden on
  Windows.
* (bug 23464) File: prefixes are now chopped off during uploading.
* (bug 28174) Message config-logo-help amended to not explicitly assume any
  LTR/RTL screen layout.
* (bug 28992) Revision numbers in the patrol log are transformed in the user
  language.
* (bug 27073) ResourceLoaderDynamicStyles marker should be dynamically appended
  to the document head if it doesn't exist.
* (bug 27023) After the document is ready, mw.loader is broken (calls callback
  before module is parsed).
* (bug 4330) External URLs without a custom title should be treated as LTR,
  even in RTL text.
* (bug 29055) Make "don't send email on minor edits" preference apply to
  changes to talk page in addition to watchlist edits.
* (bug 28272) Special:AllMessages should have only one "Go" button.
* (bug 29101) Special:FileDuplicateSearch no longer shows silly message.
* (bug 29048) jQuery.tabIndex: firstTabIndex() should not output the same
  as lastTabIndex().
* (bug 29332) Warn if user requests mediawiki-announce subscription but does not
  enter an e-mail address.
* (bug 25375) Add canonical namespaces to "wgNamespaceIds" in mw.config.
* The class JpegOrTiffHandler was renamed ExifBitmapHandler.
* (bug 29443) Special:Undelete should use JavaScript to invert all checkboxes
  instead of reloading the page.
* (bug 29325) Setting $wgStrictFileExtensions to false no longer gives incorrect
  warning.
* (bug 29437) Multiple apostrophes in deleted article title cause odd rendering.
* (bug 29485) RSS feed of Special:RecentChange grouped together multiple
  consecutive edits by same user in included diff, but then linked to
  a single ungrouped diff.
* Do not try to group together a page creation and edit in the RSS feed of RC.
* (bug 29342) Patrol preferences shouldn't be visible to users who don't have
  patrol permissions.
* (bug 29471) Exception no longer thrown for files with invalid date in
  metadata.
* (bug 29492) Long-running steps in the installer (such as Upgrade and Install)
  no longer cause timeouts.
* (bug 29507) Change 'image link' to 'file link' in Special:Whatlinkshere.
* If the db is really screwed up, and doesn't have a recentchanges table,
  make the updater throw an exception instead of a fatal.
* wfArrayToCGI() and wfCgiToArray() now handle nested and associative arrays
  correctly.
* (bug 29567) mw.util.addPortletLink should only wrap link in <span> for
  "vectorTabs" portlets.
* (bug 8556) Incorrect session failure warning on preview-on-open
  namespaces (categories) when combined with $wgRawHtml.
* Use content language in formatting of dates in revertpage message
  (rollback revert edit summary) and do not adjust for user timezone.
* (bug 29277) MediaWiki:Filepage.css is also shown on the local wiki
* Make sure Backlink cache does not retrieve interwiki redirects when looking
  for redirects to a local page.
* (bug 6100) Allow different directionality (LTR/RTL) for user interface
  and wiki content, along with many other RTL and directionality improvements
  (such as bugs 28030, 12406, 28349).
* (bug 29712) Removed broken defaultUserOptionOverrides in MessagesXx files and
  unneeded CSS flipping of quickbar. Instead, introduce option 5 which sets
  left/right according to the directionality of your interface language.
* (bug 19514) Unordered list list-style-image should be IE6-compatible (8-bit).
* (bug 27410) The tag filter on a history page is now within a <label> element.
* (bug 29779) DairikiDiff/WikiDiff <ins> and <del> should undo browser default
  styling (strike/underline).
* (bug 28630) Add iwlinks, langlinks, redirect to
  RefreshLinks::deleteLinksFromNonexistent.
* (bug 29797) Error: "Tried to load block with invalid type" when subpages
  are disabled for user pages.
* (bug 12205) Bidirectional names in action=credits are split and displayed
  incorrectly when wrapped to the next line.
* (bug 20781) Move 'mainpagetext' messages to installer's .i18n file.
* (bug 29737) "MediaWiki:Qbsettings-directionality" should refer to script,
  not language.
* (bug 26360) $wgSessionHandler was overriding system settings unconditionally.
* Removed AjaxFunctions.php. The last remaining function js_unescape() was moved
  to the FCKEditor extension.
* (bug 28762) Resizing to specified height broken for very thin images.
* (bug 29959) Installer fatal when cURL and allow_url_fopen is disabled and user
  tries to subscribe to mediawiki-announce.
* (bug 27427) mw.util.getParamValue shouldn't return value from hash even if
  param is only present in hash.
* Installer checked for magic_quotes_runtime instead of register_globals.
* (bug 30131) XCache with variable caching disabled no longer used for variable
  caching (CACHE_ACCEL)
* $wgSVGMaxSize is now applied to the smaller of width or height, making very
  wide pano/timeline/diagram SVGs renderable at saner sizes.
* (bug 30219) The page shown when LocalSettings.php does not exist was broken on
  Windows servers.
* (bug 30074) Moving user JS subpages resulted in JS errors because
  #REDIRECT [[Foo]] is invalid JS.
* (bug 30335) Fix for HTMLForms using GET breaking when non-friendly URLs
  are used.
* (bug 30264) Changed installer-generated LocalSettings.php to use
  require_once() instead of require() for included extensions.
* Tracking categories are no longer shown in footer for special pages.
* (bug 30684) Fix bad escaping in mw.message for inexistent messages (i.e.
  <key>).
* $wgOverrideSiteFeed no longer double escapes urls.
* The preprocessor no longer fails with a PHP warning about XML_PARSE_HUGE when
  processing complex pages using newer versions of libxml2.
* (bug 30907) Special:Unusedcategories should sort ascendingly.
* (bug 28545) When using the uca-default collation, sortkey's starting with a
  space (U+20) will sort under an invisible header like in 1.16 rather than a
  U+6DE.
* (bug 30192) Thumbnails of archived files are now deleted.
* (bug 30843) mediawiki.Title should not convert extensions (anything after the
  last full stop) to lower case).
* (bug 31213) Exception thrown when trying to move file cross-namespace.
* (bug 18424) Special:Prefixindex and Special:Allpages paging links are
  really small, and somewhat inconsistent with each other.
* (bug 30466) Entries in iwlinks table are now cleared when moving a page over
  redirect.
* (bug 31674) Can't edit watchlist if it contains special pages.
* (bug 32100) Installer complains about Suhosin GET limit even if it is
  already set above 1024 bytes.

=== API changes in 1.18 ===
* BREAKING CHANGE: action=watch now requires POST and token.
* (bug 26339) Throw warning when truncating an overlarge API result.
* (bug 14869) Add API module for accessing QueryPage-based special pages.
* (bug 14020) API for Special:Unwatchedpages.
* (bug 24287) Wrap API Help output at 100 characters.
* Add a realname uiprop option to query=userinfo so a user's realname can be
  extracted.
* Add a &watchuser option to ApiBlock.
* (bug 26541) Generator-ise ApiQueryRecentChanges.
* action=parse now correctly returns an error for nonexistent pages.
* (bug 25767) Add userrights properties to allusers and users query lists.
* (bug 26558) list=allusers auprop=groups does not list groups a user is
  automatically a member of.
* (bug 26559) list=allusers auprop=rights does not match
  list=users usprop=rights.
* (bug 26560) On allusers if limit < total number of users, last user gets
  duplicate.
* (bug 25135) add "normalized" to action=parse.
* (bug 26460) Add support for listing category members by category pageid.
* (bug 26482) add a imimages param to prop=images.
* (bug 26498) allow LinksUpdate with API.
* (bug 26485) add a elextlinks param to prop=extlinks.
* (bug 26483) add a iwtitles param to prop=iwlinks.
* (bug 26484) add a lltitles param to prop=langlinks.
* (bug 26480) add a pppageprops param to prop=pageprops.
* (bug 26650) Remove $wgAPICacheHelp in favour of $wgAPICacheHelpTimeout.
* (bug 24650) Fix API to work with categorylinks changes.
* Expose list of skins in meta=siteinfo.
* (bug 26548) Add iiurlparam param to query=imageinfo and query=stashimageinfo.
* (bug 27205) aiprop=metadata and aiprop=parsedcomment need help text.
* Add a amtitle param to meta=allmessages.
* (bug 25832) query=allimages now outputs ns/title as well.
* (bug 27199) Thumbnail urls can be fetched for old files as well.
* (bug 27376) when using ApiBase::PARAM_TYPE => 'integer' without a min or
  max value, API doesn't validate the input is actually an integer.
* (bug 27479) API error when using both prop=pageprops and
  prop=info&inprop=displaytitle.
* (bug 27554) Update API information text to reflect change in bug 26125.
* (bug 27611) list=blocks: Use ipb_by_text instead of join with user table.
* (bug 27616) Add userid of blocked user and blocker to list=blocks.
* (bug 27688) Simplify queries to list user block information.
* (bug 27708) list=users does not have a property to return user id.
* (bug 27715) imageinfo didn't respect revdelete.
* (bug 27862) Useremail module didn't properly return success on success.
* (bug 27590) prop=imageinfo now allows querying the media type.
* (bug 27587) list=filearchive now outputs full title info.
* (bug 27018) Added action=filerevert to revert files to an old version.
* (bug 27897) list=allusers and list=users list hidden users.
* (bug 27717) API's exturlusage module does not respect $wgMiserMode.
* (bug 27588) list=filearchive&faprop=sha1 returns empty attribute.
* (bug 28010) Passing a non existent user to list=users gives internal error.
* (bug 27549) action=query&list=users&usprop=groups doesn't show implicit
  groups if a user doesn't have explicit groups.
* (bug 27670) Ordering by timestamp (and usage of start and end) isn't as clear
  in auto generated document, as it is on mediawiki.org.
* (bug 27182) API: Add filter by prefix for meta=allmessages.
* (bug 27183) API: Add filter by customisation state for meta=allmessages.
* (bug 27340) API: Allow listing of "small" categories.
* (bug 27342) Add audir param to list=allusers.
* (bug 27203) add fato param to list=filearchive.
* (bug 27341) Add drto param to list=deletedrevs.
* (bug 26630) Add API for Special:ActiveUsers.
* (bug 27020) API: Allow title prefix search of logevents (only when not in
  miser mode).
* (bug 26629) add Special:MIMESearch to API.
* (bug 27585) add pagecount to list=filearchive.
* (bug 28104) Namespace for local pages in interwiki backlinks (iwbacklinks)
  is missing.
* (bug 27343) Add parseddescription to list=filearchive.
* (bug 27469) label implicit groups in list=allusers&auprop=groups/
  list=users&usprop=groups.
* Addition of APIQuerySiteInfoGeneralInfo hook to add extra information to
  the general site info results.
* (bug 16288) API: consider making closure status of wikis more clear
  with meta=siteinfo.
* (bug 27589) list=allimages&aiprop=archivename is useless.
* (bug 27586) Remove duplication of props in ApiQueryStashImageInfo
  by using ApiQueryImageInfo.
* (bug 28226) prop=extlinks&eloffset should be an integer.
* (bug 28070) Fix watchlist RSS for databases that store timestamps in a
  real timestamp field.
* API upload errors may now return the parameter that needs to be changed and
  a sessionkey to fix the error.
* (bug 28249) allow dupes in meta=allmessages&amargs.
* (bug 28263) cannot import xml with the API, when have not "import" user
  right, but "importupload".
* (bug 28365) Added description for uiprop=preferencestoken in meta=userinfo.
* (bug 28394) Set forgotten parameters types in ApiUnblock.
* (bug 28395) Set forgotten parameters types in ApiParse.
* (bug 28368) add hint for multipart/form-data to API information of
  action=import&xml=.
* (bug 28391) action=feedwatchlist&allrev should be a bool.
* (bug 28364) add registration date to meta=userinfo.
* (bug 28254) action=paraminfo: Extract type from PARAM_DFLT if
  PARAM_TYPE is not set.
* (bug 27712) add parent_id to list=deletedrevs.
* (bug 28455) Add 'toponly' to recentchanges API module.
* (bug 26873) API: Add 'toponly' filter in usercontribs module.
* (bug 28586) YAML: strings that are the same as boolean literals.
* (bug 28591) Update/replace/supplement spyc (YAML parsing library).
* YAML API output is now 1.2 compliant, using JSON as the formatter.
* (bug 28672) give information about misermode on API.
* (bug 28558) Add iw_api and iw_wikiid to meta=siteinfo&siprop=interwikimap
* (bug 26882) Allow listing of indefinite protections with the API.
* (bug 27344) add drprefix param to list=deletedrevs.
* (bug 28560) list=deletedrevs should die, if combination of param is invalid.
* (bug 28238) paraminfo: output both limits for multi param.
* (bug 27179) API: List of extension tags through meta=siteinfo.
* Get a list of function hooks through meta=siteinfo.
* Get a list of all subscribed hooks, and those subscribers.
* (bug 28225) Allow hiding of user groups in list=allusers.
* (bug 27185) API: Add Special:ComparePages.
* (bug 28265) allow outputting of comments for action=expandtemplates.
* (bug 27790) Add query type for querymodules to output of ApiParamInfo.
* (bug 28963) Add langbacklinks query module to the api.
* (bug 27593) API should return error message when sha1/sha1base36 is invalid.
* (bug 28578) API's parse module should not silently override invalid
  title inputs.
* (bug 20699) Watchlist API should list log-events.
* (bug 29070) Require a token in API action=watch.
* (bug 29221) Expose oldrevid in ApiQueryWatchlist output.
* (bug 29267) Always give the servername for meta=siteinfo&siprop=dbrepllag.
* (bug 28897) rvparse now respects rvsection for action=query&prop=revisions.
* (bug 25734) API: Possible issue with revids validation.
* (bug 28002) Internal error in ApiFormatRaw::getMimeType.
* (bug 29237) ApiQuery now has an option to output the "iwurl" attribute.
* (bug 28392) Mark action=undelete&timestamps as type "timestamp".
* (bug 21346) Make deleted images searchable by hash (disabled in Miser Mode).
* (bug 27595) sha1 search of list=filearchive does not work.
* (bug 26763) Make RSS/Atom of user contributions more visible.
* (bug 25133) Allow redirects also for action=parse&pageid.
* (bug 29745) Fatal error in API search.
* (bug 29476) API returns page title instead of sectiontitle for
  srprop=sectiontitle.
* Correct the documentation of srprop properties.
* (bug 28817) Add reference help page link to API Modules.
* (bug 29935) Improve formatting of examples in ApiParamInfo.
* (bug 29938) list=users&usprop=rights shows rights the user doesn't have.
* (bug 24781) The API will include an XML namespace if the includexmlnamespace
  parameter is set.
* (bug 29392) Setting the start or end parameter now works with lists blocks,
  categorymembers, deletedrevs, logevents, protectedtitles, usercontributions
  and watchlist in Postgres.

=== Languages updated in 1.18 ===

MediaWiki supports over 330 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla reports.

* Angika (anp) (new).
* Brahui (brh) (new).
* Central Dusun (dtp) (new).
* Jamaican Creole English (jam) (new).
* Khowar (khw) (new).
* Liv (liv) (new).
* Kichwa (qug) (new).
* Tokipona (tp) (removed) 'tokipona' is still  valid.
* (bug 17160) Gender specific display text for User namespace.
* Link trail added for sl and sh.
* (bug 27633) Add characters to linkTrail for Portuguese (pt and pt-br).
* (bug 27426) Set $namespaceGenderAliases for Arabic (ar).
* (bug 27385) Set Polish $namespaceGenderAliases.
* (bug 27681) Set $namespaceGenderAliases for Portuguese (pt and pt-br).
* (bug 27785) Fallback language for Kabardian (kbd) is English now.
* (bug 27825) Raw watchlist edit message now uses formatted numbers.
* (bug 28040) Turkish: properly lower case 'I' to 'i' (dotless i) and
  uppercase 'i' to 'I' (dotted i).
* Conversion script between Syllabics and Latin for the Inuktitut language.
* Date formats for Indonesian (id) updated.
* Bhojpuri (bho) (renamed from "bh").
* (bug 29031) When translating block log entries, indefinite, infinite, and
  infinity are now considered the same.
* Aromanian (rup) (renamed from "rua-rup").
* Kashmiri (ks) split into Kashmiri (Perso-Arabic) (ks-arab) and Kashmiri
  (Devanagari) (ks-deva). Defaults to ks-arab.
* (bug 30864) Use bengali numerals for <ol> for Assamese.
* (bug 30817) Restored linktrail for kk (Kazakh).
* (bug 27398) Add $wgExtraGenderNamespaces for configured gendered namespaces.
* (bug 30846) New LanguageOs class.

=== Other changes in 1.18 ===
* Removed legacy wgAjaxWatch javascript global object, no longer in use.
* (bug 28556) Upload support for MacBinary files has been removed (Used by
  Internet Explorer 5 for Mac OS 9).
* On wiki farm setups using $wgConf, 'wgCanonicalServer' is now expected to be
  set for all wikis. This was already the case for 'wgServer'.

== MediaWiki 1.17 ==

== MediaWiki 1.17.5 ==
2012-06-12

This is a security release of the MediaWiki 1.17 branch.

=== Summary of selected changes in 1.17 ===

Selected changes since MediaWiki 1.16 that may be of interest:

* A new installer has been introduced. It has a wizard-style interface which is
  translated into many languages. Many shortcomings in the old installer were
  addressed with this rewrite. Note that it is no longer required for the config
  directory to be made writable by the webserver. Instead the generated
  LocalSettings.php file is offered as a download, which you must then upload
  to the wiki's base directory.

* ResourceLoader, a new framework for delivering client-side resources such as
  JavaScript and CSS, has been introduced. These resources are now delivered
  through the new entry point script "load.php", instead of as static files
  served directly by the web server. This allows minification, compression and
  client-side caching to be used more effectively, which should provide a net
  performance improvement for most users.

* Category sorting has been improved.
** Sorting is now case insensitive.
** Sub-categories, pages and files can now be paged separately.
** When several pages are given the same sort key, they sort by their
   names instead of randomly.

* The lowest supported version of PHP is now 5.2.3. If necessary, please
  upgrade PHP prior to upgrading MediaWiki.

=== Changes since 1.17.4 ===

* (bug 36938) Correctly escape uselang attribute to prevent xss
* Expanded Blacklist for SVG Files

=== Changes since 1.17.3 ===

* (bug 35961) Hash comparison should always be strict.
* Fix broken email confirmation expiration caused by MWCryptRand changes.
* (bug 35671) PHP Notice: Undefined index: gettoken in includes/api/ApiMain.php
  on line 598.

=== Changes since 1.17.2 ===

* (bug 22555) Remove or skip strip markers from tag hooks like &lt;nowiki&gt; in
  core parser functions which operate on strings, such as padleft.
* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token
  parameter present.
* (bug 34907) Fixed exposure of tokens through load.php that could have
  facilitated CSRF attacks.
* (bug 35317) CSRF in Special:Upload.

=== Changes since 1.17.1 ===
* (bug 33117) prop=revisions allows deleted text to be exposed through cache
  pollution.
* (bug 32709) Private Wiki users were always taken to Special:Badtitle on login.

=== Changes since 1.17.0 ===

* (bug 29535) Added missing Creative Commons CC0 icon.
* (bug 29726) Fixed failure to load internationalization messages in
  client-side scripts on WebKit-based browsers.
* Fixed a bug in message transformation where the previous language could leak
  into later transformations in the UI language.
* (bug 29091) Fixed form of native name for Ossetic language (Иронау -> Ирон)
* Fixed maintenance scripts upgrade1_5.php and rebuildImages.php, they did not
  work at all since 1.17 beta 1.
* (bug 29531) Fixed img_auth.php for thumbnails and other filenames with
  multiple dots, was broken by the fix for bug 28840.
* In the maintenance script purgeList.php, fixed a fatal error when a page
  title is given, instead of a URL.
* (bug 19514) Unordered list list-style-image should be IE6-compatible (8-bit).
* Installer checked for magic_quotes_runtime instead of register_globals.
* $wgSVGMaxSize is now applied to the smaller of width or height, making very
  wide pano/timeline/diagram SVGs renderable at saner sizes.
* (bug 29959) Installer fatal when cURL and allow_url_fopen is disabled and user
  tries to subscribe to mediawiki-announce.
* Installer checked for magic_quotes_runtime instead of register_globals
* (bug 30131) XCache with variable caching disabled no longer used for variable
  caching (CACHE_ACCEL)
* (bug 30264) Changed installer-generated LocalSettings.php to use
  require_once() instead require() for included extensions.
* (bug 26486) ResourceLoader modules with paths to nonexistent files cause PHP
  warnings/notices to be thrown
* (bug 30907) Special:Unusedcategories should sort ascendingly.
* (bug 30219) The page shown when LocalSettings.php does not exist was broken on
  Windows servers.
* Hardcoded NLS_NUMERIC_CHARACTERS for Oracle DB to prevent type conversion
  errors.
* Fixed recentchanges FK violation on page delete and cache purge error in
  updater for Oracle DB.
* (bug 32276) Skins were generating output using the internal page title which
  would allow anonymous users to determine whether a page exists, potentially
  leaking private data. In fact, the curid and oldid request parameters would
  allow page titles to be enumerated even when they are not guessable.
* (bug 32616) action=ajax requests were dispatched to the relevant internal
  functions without any read permission checks being done. This could lead to
  data leakage on private wikis.

=== Changes since 1.17.0rc1 ===

* Fixed syntax error in generated LocalSettings.php when a non-default user
  rights profile is chosen.
* (bug 29399) Fixed PostgreSQL installation when the DB user for installation
  is the same as the one for web access.
* (bug 29233) Fixed failover for DB slave servers. When a DB slave went down,
  an error was immediately shown to the user, instead of trying another slave.
  Was broken since 1.17 beta 1.
* (bug 29278) Fixed PHP fatal error when attempting to add text to a page via a
  redirect.
* (bug 29408) Fixed uploads of files with MIME types that aren't detected by
  MediaWiki.
* Removed DEFAULT '' NOT NULL field definitions from Oracle DB schema because
  using the DEFAULT value ('') in DML broke Oracle backend as it treats an
  empty VARCHAR2 value as NULL. Indexes on Oracle do not require NOT NULL
  fields.

=== Changes since 1.17 beta 1 ===

* Fixed warning about missing file "password.js".
* When installing on MySQL, don't attempt to create a new database user if the
  same user is used for installation and web access.
* Fixed SQL query errors in queries with table aliases.
* (bug 27891) Fixed the "chronology protector", broken since 1.17beta1, which
  ensures that when database replication is used, the new version is seen by
  the user immediately after they create or edit an article.
* (bug 28845) Allow PostgreSQL installation using a non-root user account which
  has role creation abilities.
* When installing on PostgreSQL and the install account is the same as the web
  account, check to make sure that the account has suitable privileges in the
  mediawiki schema.
* (bug 28172) Fixed error in PostgreSQL installation when creating the wiki
  sysop account.
* Fixed an issue with the Oracle installer in cases where the user is different
  to the database name.
* Added "unblockself" to the list of available rights.
* In the installer, fixed the "user rights profile" option, it never worked.
* (bug 29117) Fixed Hebrew localisation of the installer.
* (bug 28840) Reduce the collateral damage caused by the fix for bug 28235 (XSS
  on Internet Explorer 6 due to a file extension in the query string) by
  reducing the number of URLs that are blocked, and by redirecting the request
  to a safer URL where possible instead of blocking it.
* (bug 28812) Fixed documentation of API action=parse.
* (bug 28979) Fixed styling of <abbr> and <acronym>.
* Fixed the error message displayed when you try to create an account by email,
  but an email address is not given.
* Fixed JS error due to missing dependency for jquery.suggestions.
* Exposed $wgExtensionAssetsPath in JavaScript.
* (bug 28738) Made ResourceLoader support environments with small URL length
  limits. The length limit can be configured via
  $wgResourceLoaderMaxQueryLength, and this is set automatically in the
  generated LocalSettings.php when the php.ini variable
  "suhosin.get.max_value_length" is set. When a URL exceeds this limit, the
  request is split up. Also, reduced the average length of load.php URLs by
  using a more compact parameter format.
* (bug 25262) Fix for minification of hardcoded data: URIs in CSS.
* (bug 25124) Respect $wgStyleDirectory in ResourceLoader.
* Allow installation when no HTTP client is available, don't throw an exception.
* (bug 27465) Fix metadata extraction for SVG files using unusual namespace
  names.
* (bug 29174) Fix regression in upload-by-URL: uploading files larger than the
  PHP memory limit should work again.
* Fixed the display of comments in the new user log.
* (bug 28237) When installing extensions using the web-based installer, create
  any necessary database tables.
* (bug 28983) Fixed automated installation of extensions that overwrite $path.
* Fixed error caused by missing magic words.
* Fixed breakage of article editing in PostgreSQL due to text search
  configuration errors.
* Fixed the HTTPS client used when Curl is not available. This avoids an error
  during install about failure of the mediawiki-announce subscription.
* (bug 28162) When installing to PostgreSQL, respect the "database port" input,
  it was ignored.

=== Configuration changes in 1.17 ===

* $wgLogAutocreatedAccounts controls whether autocreation of accounts is logged
  to new users log.
* (bug 22858) $wgLocalStylePath is by default set to the same value as
  $wgStylePath but should never point to a different domain than the site is
  on, allowing skins to use .htc files which are not cross-domain friendly.
* $wgFileStore has been deprecated. The only usage $wgFileStore['deleted'] has
  been turned into $wgDeletedDirectory.
* $wgDeletedDirectory has been added to specify what directory to place deleted
  uploads in.
* IBM DB2 database no longer uses the db specific $wgDBport_db2 variable but the
  normal $wgDBport.
* $wgCategoryPrefixedDefaultSortkey was removed and is now always false.  This
  provides more sensible sorting behavior for categories.
* Removed unused globals: $wgEnableSerializedMessages, $wgCheckSerialized,
  $wgUseMemCached, $wgDisableSearchContext, $wgColorErrors, $wgUseZhdaemon,
  $wgZhdaemonHost and $wgZhdaemonPort.
* (bug 24408) The include_path is not modified in the default LocalSettings.php
* $wgVectorExtraStyles was removed, and is no longer in use.
* Removed $wgUpdates for database updates; extensions should use
  DatabaseUpdater::addExtensionUpdate() via the LoadExtensionSchemaUpdates hook.
* Removed $wgServerName. It doesn't need to be set anymore and is no longer
  available as input for other configuration items, either.
* It's no longer necessary for LocalSettings.php to include DefaultSettings.php.
* It's no longer necessary to set $wgCacheEpoch to the file modification time
  of LocalSettings.php, in LocalSettings.php itself. Instead, this is done
  automatically if $wgInvalidateCacheOnLocalSettingsChange is true (which is
  the default).
* $wgCopyrightIcon is deprecated and $wgFooterIcons['copyright']['copyright']
  should be used instead.
* $wgSysopUserBans is deprecated, and will be made permanently true in 1.18.
  If you need this functionality, you should use the BlockIp hook to filter and
  reject such blocks.
* $wgSysopRangeBans is deprecated, you should set $wgBlockCIDRLimit to maximum
  (32 for IPv4, 128 for IPv6), equivalent to allowing rangeblocks of only 1
  address at a time.

=== New features in 1.17 ===

* (bug 10183) Users can now add personal styles and scripts to all skins via
  User:<name>/common.css and /common.js (if user css/js is enabled).
* (bug 22748) Add anchors on Special:ListGroupRights.
* (bug 21981) Add parameter 'showfilename' to <gallery> to automatically
  apply the names of the individual files within the gallery.
* Future-proof redirection to fragments in Gecko, so things work a little nicer
  if they fix <https://bugzilla.mozilla.org/show_bug.cgi?id=516293>.
* Support git:// and mms:// protocols by default for external links.
* (bug 15810) Blocked admins can no longer unblock themselves without the
  'unblockself' permission (which they have by default).
* (bug 18499) Added "enhanced" URL parameter to switch between old and enhanced
  changes list.
* (bug 22925) "sp-contributions-blocked-notice-anon" message now displayed when
  viewing contributions of a blocked IP address.
* (bug 22474) {{urlencode:}} now takes an optional second parameter for type of
  escaping.
* Special:Listfiles now supports a username parameter.
* Special:Random carries over query string parameters.
* (bug 23206) Add Special::Search hook for detecting successful "Go".
* When visiting a "red link" of a deleted file, a deletion and move log excerpt
  is provided on the Upload form.
* (bug 22647) Add category details in search results.
* (bug 23276) Add hook to Special:NewPages to modify query.
* Add accesskey 's' and tooltip to 'Save' button at Special:Preferences.
* Add accesskey 'b' and tooltip to the summary field of edit mode.
* (bug 20186) Allow filtering Special:Contributions for RevisionDeleted edits.
* ajaxwatch now uses the API and JQuery, and can be used to animate arbitrary
  watch links, not just to watch the page the link is on.
* (bug 20976) "searchmenu-new-nocreate" message now displayed when there
  is no title match in search and the user has no rights to create pages.
* (bug 23429) Added new hook WatchlistEditorBuildRemoveLine.
* (bug 22844) Added support for WinCache object caching (for IIS).
* (bug 23580) Add two new events to LivePreview so that scripts can be notified
  about the beginning and finishing of LivePreview actions.
* (bug 21278) Now the sidebar allows inclusion of wiki markup.
* (bug 23733) Add IDs to messages used on CSS/JS pages.
* Show validity period of the login cookie in Special:UserLogin and
  Special:Preferences.
* Interlanguage links display the page title in their tooltip.
* (bug 23621) New Special:ComparePages to compare (diff) two articles.
* (bug 4597) Provide support in Special:Contributions to show only "current"
  contributions
* (bug 17857) {{anchorencode}} acts more like how the parser creates section ids
* (bug 21477) \& can now be used in <math>
* (bug 11641) \dotsc \dotsm \dotsi \dotso can now be used in <math>
* (bug 21475) \mathtt and \textsf can now be used in <math>
* texvc is now run via ulimit4.sh, to limit execution time.
* SQLite now supports $wgSharedDB.
* (bug 8507) Group file links by namespace:title on image pages.
* Stop emitting named entities, so we can use <!DOCTYPE html> while still being
  well-formed XML.
* texvc now supports \bcancel and \xcancel in addition to \cancel and \cancelto
* Added scriptExtension setting to $wgForeignFileRepos.
* ForeignApiRepo uses scriptDirUrl if apiBase not set.
* (bug 24212) Added MediaWiki:Filepage.css which is also included on foreign
  client wikis.
* (bug 14685) Double underscore magic word usage is now tracked in the
  page_props table, as well as the behavioral magic words {{DEFAULTSORT}} and
  {{DISPLAYTITLE}}
* (bug 24045) MediaWiki:Ipb-needreblock is now wrapped in a div with class
  "mw-ipb-needreblock"
* Non-file pages can no longer be moved to the file namespace, nor vice versa.
* (bug 671) The <dfn>, <kbd> and <samp> elements have been whitelisted in user
  input.
* (bug 21503) There's now a "reason" field when creating account for other
  users.
* (bug 24418) action=markpatrolled now requires a token.
* A variety of category sort-related fixes, including:
** (bug 164) In English, lowercase and uppercase letters now sort the same.
** (bug 1211) Subcategories, ordinary pages, and files now page separately.
** When several pages are given the same sort key, they sort by their names
   instead of randomly.
* (bug 23848) Add {{ARTICLEPATH}} Magic Word.
* (bug 8140) Add dedicated CSS classes to Special:Newpages elements.
* (bug 11005) Add CSS class to empty pages in Special:Newpages.
* The parser cache is now shared amongst users whose different settings aren't
  used in the page.
* Any attribute beginning with "data-" can now be used in wikitext, per HTML5.
* (bug 24007) Diff pages now mention the number of users having edited
  intermediate revisions.
* Added new hook GetIP.
* Special:Version now displays whether a SQLite database supports full-text
  search.
* TS_ISO_8691_BASIC was added as a time format, which is used by ResourceLoader
  for versioning.
* Maintenance scripts get a --memory-limit option to override defaults (which
  is usually to set it to -1 to disable the limit).
* (bug 25397) Allow uploading (not displaying) of WebP images, disabled
  by default.
* (bug 23194) Special:ListFiles now has thumbnails.
* Use hreflang to specify canonical and alternate links, search engine friendly
  when a wiki has multiple variant languages.
* (bug 19593) Specifying --server in now works for all maintenance scripts.
* Now rebuildtextindex.php warns if SQLite doesn't support full-text search.
* (bug 10541) Front/backend separation of installation/upgrade code.
* (bug 10596) Allow installer to enable extensions already in extensions folder.
* (bug 20627) Installer should be in languages other than English.
* Support for metadata in SVG files (title, description).
* Special:Search: Add CSS classes to 'none found' and 'create link' messages.
* Add CSS classes (including namespace and pagename) to the enhanced recent
  changes/watchlist entries.
* (bug 22463) Add hook 'SkinGetPoweredBy' to make 'powered by' icon/text
  customizable.
* Added CSS print pagination to the print stylesheets.
* (bug 25960) Add <link rel=canonical"> for File pages of shared/foreign
  file repositories.
* When viewing a redirect, the redirect arrow and redirection target are both
  wrapped in a div that has the class "redirectMsg" so that the redirection
  arrow can be customized with CSS.
* (bug 21911) Hard coded limit for long page warning removed. New message
  [[MediaWiki:Longpage-hint]] (empty per default) can be used instead.
  Parameters: $1 shows the formatted textsize in Byte/KB/MB, $2 is the raw
  number of the textsize in Byte.
* (bug 3276) Give image <gallery>s fluid width.
* Added uploads link to page subtitle in Special:Contributions.
* Added Special:Myuploads special page that redirects to Special:Listfiles.
* The footerlinks used in Monobook/Vector/Modern are now part of common skin
  code, SkinTemplateOutputPageBeforeExec can be used to customize the list.
* Special wrapping setups can now define MW_CONFIG_FILE to load a config file
  other than LocalSettings.php. This is like MW_CONFIG_CALLBACK but works in
  some cases where MW_CONFIG_CALLBACK will not work.
* (bug 26574) Added 'upload' to $wgRestrictionTypes, allowing upload protected
  pages to be queried via the API and Special:ProtectedPages, and allowing
  disabling upload protection by removing it from $wgRestrictionTypes.
* The name attribute of HTMLForm fields can now be overridden by passing a
  'name' key in the descriptor array.  Hidden field names are now treated
  consistently with other fields and, by default, prefixed with 'wp'.
* (bug 27402) Add support for disabling MWSuggest.
* (bug 26563) Add bytes changed per revision for stub and full article dumps.
* (bug 27508) Add $wgSVGMetadataCutoff to limit the maximum amount of an svg we
  look at when finding metadata to prevent excessive resource usage.
* (bug 198) $wgUpgradeKey allows unlocking the web installer for upgrades
  without having to move LocalSettings.php
* Added $wgAllowImageTag, which can be set to true to whitelist the <img> tag
  in wikitext.
* (bug 12797) Add $wgGalleryOptions for adjusting of default gallery display
  options.
* Added the $wgAllowUserCssPrefs option which allows disabling CSS-based
  preferences; which can improve page loading speed.
* Added $wgSQLMode for setting database SQL modes - either performance (null)
  or other reasons (such as enabling stricter checks).
* (bug 20193) Added $wgVectorShowVariantName global configuration variable
  which causes Vector to render the variants drop-down menu with a label
  showing the current variant name. This is off by default, pending further
  research into its user experience implications.
* The upload link for missing files can now be set separately from the
  navigation link with $wgUploadMissingFileUrl.
* $wgAdditionalMailParams added to allow setting extra options to mail() calls.
* Added $wgSecureLogin to optionally login using HTTPS.
* (bug 25728) Added $wgPasswordSenderName to make the name associated
  with $wgPasswordSender configurable.
* (bug 22463) $wgFooterIcons added to allow configuration of the icons shown in
  the footers of skins.
* $wgFileCacheDepth can be used to set the depth of the subdirectory hierarchy
  used for the file cache. Default value is 2, which matches former behavior.

=== Bug fixes in 1.17 ===

* (bug 17560) Half-broken deletion moved image files to deletion archive
  without updating database.
* (bug 22666) Submitting user block form with an invalid user name no longer
  throws an error.
* (bug 22665, bug 22667) User '0' can now be unblocked and have its block
  settings changed.
* (bug 22606) The body of e-mail address confirmation message is now different
  when the address changed.
* (bug 22664) Special:Userrights now accepts '0' as a valid user name.
* (bug 5210)  Preload parser now parses <noinclude>, <includeonly> and
  redirects.
* (bug 22709) IIS7 mishandles redirects generated by OutputPage::output() when
  the URL contains a colon.
* (bug 22353) Categorised recent changes now works again.
* (bug 22747) "Reveal my e-mail address in notification e-mails" preference is
  now only displayed when relevant.
* (bug 22772) {{#special:}} parser function now works with subpages.
* (bug 18664) Relative URIs in interwiki links cause failed redirects.
* (bug 19270) Relative URIs in interwiki links break interwiki transclusion.
* (bug 22903) Revdelete log entries now show in the user preferred language.
* (bug 22905) Correctly handle <abbr> followed by ISBN.
* (bug 22940) Namespace aliases pointing to main namespace don't work.
* (bug 15810) Blocked admins can no longer block/unblock other users.
* (bug 22876) Avoid possible PHP Notice if $wgDefaultUserOptions is not
  correctly set.
* (bug 14952) Page titles are renormalized after html entities are removed so
  that links with non-NFC character references work correctly.
* (bug 22991) wgUserGroups JavaScript variable now reports * group for
  anonymous users instead of null.
* (bug 22627) Remove PHP notice when deleting a page only hidden users edited.
* (bug 21520) Anonymous previews now also gives a warning about not being
  logged in (anonpreviewwarning).
* (bug 22935) image/x-ms-bmp mime type added for BMP files.
* (bug 23024) Special:ListFiles now escapes file names correctly.
* (bug 22867) "View source" tab is now only displayed if there's source text.
* (bug 19393) Feeds now format dates in user language rather than content
  language.
* (bug 22852) "Served in" comment is now the time used to cache a single page
  when using rebuildFileCache.php
* (bug 22496) Viewing diff of a redirect page without specifying "oldid"
  parameter no longer makes the page displayed as being the redirect target.
* (bug 22918) Feed cache keys now use $wgRenderHashAppend.
* (bug 21916) Last-Modified header is now correct when outputting cached feed.
* (bug 20049) Fixed PHP notice in search highlighter that occurs in some cases.
* (bug 23017) Special:Disambiguations now list pages in content namespaces
  rather than only main namespace.
* (bug 23063) $wgMaxAnimatedGifArea is checked against the total size of all
  frames, and $wgMaxImageArea against the size of the first frame, rather than
  the other way around.  Both now default to 12.5 megapixels.  Also, images
  exceeding $wgMaxImageArea can still be embedded at original size.
* (bug 23078) "All public logs" option on Special:Log is now always the first
  item.
* (bug 16817) Group names in user rights log are now singular and in lowercase.
* Special:Preferences no longer crashes if the wiki default date formatting
  style is not valid for the user's interface language.
* (bug 23167) Check the watch checkbox by default if the watchcreations
  preference is set.
* Maintenance script cleanupTitles is now able to fix titles stored
  in a negative namespace (which is invalid).
* (bug 19858) Removed obsolete <big> in interface messages.
* (bug 21456) "Bad title" error when showing non-local interwiki pages no longer
  displays incorrect tabs.
* (bug 23190) Improved math representation for text browsers.
* (bug 22015) Improved upload-by-url error handling and error display.
* (bug 17941) $wgMaxUploadSize is now honored by all upload sources.
* (bug 23080) New usernames now limited to 235 bytes so that custom skin files
  work.
* (bug 23075) Correct MediaTransformError default width in gallery.
* (bug 16487) The Anonymous user account used on Postgres is no longer
  displayed on Special:Listusers.
* (bug 23313) Move watchlisthidepatrolled above token in watchlist preferences
  to enhance preference grouping.
* (bug 23298) Interwiki links with prefix only in log summaries now link to the
  correct link.
* (bug 23284) Times are now rounded correctly.
* (bug 23375) Added ogv, oga, spx as extensions for ogg files.
* (bug 18408) All required permissions for uploading (upload, edit, create)
  are now checked when loading Special:Upload. Toolbar link for Special:Upload
  is no longer shown if the user does not have the required permissions.
* (bug 23397) texvc in html mode renders \sim as &tilde; not &sim;
* (bug 23241) License selector should be disabled during upload of a new
  version.
* (bug 23240) Add ID to namespace selector form on Special:Watchlist.
* The pipe | character in urls is now escaped.
* (bug 23422) mp3 files can now be moved.
* (bug 23448) MediaWiki:Summary-preview is now displayed instead of
  MediaWiki:Subject-preview when previewing summary.
* (bug 23426) The {{REVISIONMONTH}} variable is now zero-padded and added
  new variable {{REVISIONMONTH1}} when unpadded version is needed.
* Special:Userrights didn't recognize user as changing his/her own rights if
  user did not capitalize first letter of username.
* (bug 23507) Add styles for printing wikitables.
* (bug 19586) Avoid JS errors in mwsuggest when using old browsers such
  as Opera 8.
* (bug 23563) Old skins now support $wgUploadNavigationUrl and take into
  account upload rights.
* (bug 1347) Render \phi in math using images, in order to create consistent
  and correct render results.
* (bug 16573) Render \epsilon in math using images, in order to create
  consistent and correct render results.
* (bug 22541) Support image redirects when using ForeignAPIRepo.
* (bug 22967) Make edit summary length cut-off behave correctly for multibyte
  characters.
* (bug 8689) Long numeric lines no longer kill the parser.
* (bug 23740) Article::doRedirect() now use $extraQuery parameter correctly if
  the $noRedir parameter is set to true.
* (bug 23688) Correct mime types for Office 2007 OpenXML documents.
* (bug 23787) Corrected $wgDefaultSkin's comment in DefaultSettings.php.
* (bug 23797) Xml::input() now allows '0' for the value parameter.
* (bug 23747) Make sure that on History pages, the RevDel button is not
  accidentally activated when hitting enter.
* (bug 23845) Special:ListFiles now uses correct file names without underscores.
* Ask for permanent login in Special:Preferences only if $wgCookieExpiration >
  0.
* (bug 16356) Repair dumpInterwiki.inc to use proper normalization.
* (bug 24006) deleteArchivedRevisions.php maintenance script now longer throws
  a fatal error.
* (bug 23465) Don't ignore the predefined destination filename on
  Special:Upload after following a red link.
* (bug 23642) Recognize mime types of MS OpenXML documents.
* (bug 22784) Normalise underscores and spaces in autocomments.
* (bug 19910) Headings of the form ===+\s+ are now displayed as valid headings.
* (bug 24022) Only check file extensions on the uploadpage when needed.
* (bug 24076) Recognize Office 2003 files with OpenXML trailers.
* (bug 24244) Updated comments in DefaultSettings.php to reflect
  Image: --> File: namespace rename.
* Make wfTimestamp recognize negative unix timestamp values.
* (bug 24401) SimpleSearch: No button/text indicating 'Search' if image is
  disabled.
* (bug 23293) Do not show change tags when Special:RecentChanges(linked) or
  Special:Newpages is transcluded into another page as it messes up the page.
* (bug 24517) LocalFile::newFromKey() and OldLocalFile::newFromKey() no longer
  throw fatal errors.
* (bug 23380) Uploaded files that are larger than allowed by PHP now show a
  useful error message.
* Uploading to a protected title will allow the user to choose a new name
  instead of showing an error page.
* (bug 24425) Use Database::replace instead of delete/insert in
  SqlBagOStuff::set to avoid query errors about duplicate keynames.
* (bug 15470) First letters of filenames are always capitalized by upload JS.
* (bug 21215) NoLocalSettings.php doesn't tolerate rewrite rules.
* (bug 21052) Fix link color for stubs in NewPages.
* (bug 24714) Usage of {{#dateformat: }} in wikis without $wgUseDynamicDates no
  longer pollutes the parser cache.
* (bug 17031) Correct which characters the parser allows in tag attributes (a
  letter, colon or underscore followed by 0 or more letters, numbers, colons,
  underscores, hyphens, and/or periods).
* Save 200 useless queries on each category page view.
* Shell commands will now work on Linux in filesystems mounted noexec.
* (bug 24804) Corrected commafying in Polish and Ukrainian.
* "Difference between pages" is now displayed instead of "Difference between
  revisions" on diffs when appropriate.
* (bug 23703) ForeignAPIRepo fails on findBySha1() when using a 1.14 install as
  a repository due to missing 'name' attribute from the API list=allimages.
* (bug 24898) MediaWiki uses /tmp even if a vHost-specific tempdir is set, also
  make wfTempDir() return a sane value for Windows on worst-case.
* (bug 24824) Support ImageMagick 6.5.6-2+ JPEG decoder size hint, to reduce
  memory usage when such an ImageMagick is used for scaling.
* Disable multithreaded behavior in recent ImageMagick, to avoid a deadlock
  when a resource limit such as $wgMaxShellMemory is hit.
* (bug 24981) Allow extensions to access SpecialUpload variables again.
* (bug 20744) Wiki forgets about an uploaded file.
* (bug 17913) Don't show "older edit" when no older edit available.
* (bug 6204) TOC not properly rendered when using $wgMaxTocLevel.
* (bug 24977) The accesskey in history page now lead directly to the diff
  instead of alternating focus between the two buttons.
* (bug 24987) Special:ListUsers does not take external groups into account.
* (bug 20633) update.php has mixed language output.
* SQLite system table names are now never prefixed.
* (bug 25292) SkinSubPageSubtitle hook now passes the Skin object as second
  parameter.
* (bug 25167) Correctly load JS fixes for IE6 (fixing a regression in 1.16).
* (bug 25367) wfShellExec() is more explicit when failing due to disabled
  passthru().
* (bug 25462) Fix double-escaping for section edit link tooltips.
* action=raw was removed for Special:Statistics. This information is still
  available via the API.
* (bug 23934) Groups defined in $wgRevokePermissions but not in
  $wgGroupPermissions now appear on Special:ListGroupRights.
* (bug 23923) Special:Prefixindex no longer shows results if nothing was
  requested.
* (bug 22308) Search now finds text in default main page immediately after
  setup.
* (bug 25697) Make sure empty lines render in diff view.
* Use an actual minus sign in diff views, instead of a hyphen.
* (bug 23732) Clarified "n links" message on Special:MostLinkedFiles.
* (bug 23731) Clarified "n links" message on Special:MostLinkedTemplates.
* (bug 25642) A exception is now thrown instead of a fatal error when using
  $wgSMTP without PEAR mail package.
* (bug 19633) When possible, Upscale small SVGs when creating thumbnails.
* (bug 11013) Database driver detection needs rewriting for robustness.
* (bug 13409) Installer prompts could use clarification--now has help boxes.
* (bug 16902) Installer spews warnings when exec() and dl() are not available.
* (bug 19129) Only show MyISAM/InnoDB when supported.
* (bug 17762) Only show other e-mail options when e-mail is globally enabled.
* Cache multiple sizes of InstantCommons thumbnails.
* (bug 25488) Disallowing anonymous users to read pages no longer throws error
  on discussion pages with vector as default skin.
* (bug 24833) Files name in includes/diff/ are now less confusing.
* (bug 25713) SpecialPage::resolveAlias() now normalise spaces to underscores.
* (bug 25829) Special:Mypage and Special:Mytalk now forward oldid, diff and dir
  parameters.
* (bug 25175) HTML file cache now honor $wgCacheDirectory if
  $wgFileCacheDirectory is not set.
* (bug 13353) Diff3 version checks were too strict, did not detect working
  diff3.
* (bug 25843) Links to special pages using link= attribute on images are now
  normalised like normal links to special pages.
* (bug 21364) External links using link= attribute on images now respect
  $wgExternalLinkTarget.
* (bug 17789) Added a note to the total views on Special:Statistics saying that
  is doesn't count non-existing pages and special pages.
* (bug 17996) HTTP redirects are now combined when requesting a special page.
* (bug 19944) Link on image thumbnails no longer link to "Media:" namespace in
  some cases.
* (bug 25670) wfFindFile() now checks the namespace of the given title, only
  "File" and "Media" are allowed now.
* (bug 25872) Rename the HttpRequest class to MWHttpRequest to avoid conflict
  with php extension that defines same class.
* (bug 20591) There's now a different message on Special:MovePage when
  $wgFixDoubleRedirects is set to false.
* Fixed PHP warnings when updating a broken MySQL database.
* (bug 26023) Corrected deleteBacth.php's documentation.
* (bug 25451) Improved datetime representation in 32 bit php >= 5.2.
* Show "skin does not exist error" only when the skin is inputted in the wrong
  case.
* (bug 26164) Potential html injection when the database server isn't available.
* (bug 26160) Upload description set by extensions are not propagated.
* (bug 9675) generateSitemap.php now takes an --urlpath parameter to allow
  absolute URLs in the sitemap index (as required e.g. by Google).
* Partial workaround for bug 6220: at least make files on shared repositories
  show up as (struck-out) bluelinks instead of redlinks on Special:WantedFiles.
* rebuildFileCache.php no longer creates inappropriate cache files for
  redirects.
* (bug 25512) Subcategory list should not include category prefix for members.
* (bug 10871) Javascript and CSS pages in MediaWiki namespace are no longer
  treated as wikitext on preview.
* Page existence is now not revealed (in the colour of the tabs) to users who
  cannot read the page in question.
* (bug 22753) Output from update.php is more clear when things changed, entries
  indicating nothing changed are now all prefixed by "..."
* (bug 16019) $wgArticlePath = "/$1" no longer breaks API edit/watch actions.
* (bug 18372) File types blacklisted by $wgFileBlacklist will no longer be shown
  as "Permitted file types" on the upload form.
* (bug 26540) Fixed wrong call to applyPatch in MysqlUpdater.
* (bug 26034) Make the "View / Read" tab in content_navigation style tabs remain
  selected when the action is "purge".
* (bug 26733) Wrap initial table creation in transaction.
* (bug 26208) Mark directionality of some interlanguage links.
* (bug 26716) Provide link to instructions for external editor related
  preferences.
* (bug 26961) Hide anon edits in watchlist preference now actually works.
* (bug 1379) Installer directory conflicts with some hosts' configuration panel.
* (bug 27781) Installer does not warn about 5.1.x. Added a compatibility
  function for array_key_exists().
* Fix XML well-formedness on a few pages when $wgHtml5 is true (the default).
* (bug 28069) MediaWiki fails streaming files when mod_deflate and ob_gzhandler
  are also set.
* (bug 26223) Concurrently moving an article to different titles leaks a
  redirect revision with no page.
* (bug 15641) Fixed permissions checks in Special:Import which allowed users
  without the 'import' permission to import pages from configured import
  sources.
* (bug 26449) Keep underlines from headings outside of tables and thumbs by
  adding overflow:hidden to h1,h2,h3,h4,h5,h6 (also fixes editsection bunching).
* (bug 26708) Remove background-color:white from tables in Monobook and Vector.
* (bug 26781) {{PAGENAME}} and related parser functions escape their output
  better.
* (bug 26716) Provide link to instructions for external editor related
  preferences and add a comment to the ini control file explaining what is going
  on.
* (bug 28422) Remove color:black from tables in Monobook and Vector. And add it
  to table.wikitable instead.
* (bug 27560) Search queries no longer fail in walloon language.
* (bug 27700) The upload protection can now also be set for files that do not
  exist.
* (bug 28034) uploading file to local wiki when file exists on shared repository
  (commons) gives spurious info in the warning message.
* Usernames get lost when selecting different sorts on Special:listfiles.
* (bug 28166) UploadBase assumes that 'edit' and 'upload' rights are not per
  page restrictions.
* (bug 28242) Make redirects generated by urls containing a local interwiki
  prefix be a 301 instead of a 302.
* (bug 28568) Entries in the iwlinks table are now removed on page deletion.
* (bug 28306) Fix exposure of suppressed usernames in ForeignDBRepo.
* (bug 28444) Fix regression: edit-on-doubleclick retains revision id again.
* UtfNormal::cleanUp on an invalid utf-8 sequence no longer returns false if
  intl installed.
* (bug 26729) Category pages should return 404 if they do not exist and have no
  members.
* (bug 28214) When page not found, sends malformed HTTP/1.x instead of HTTP/1.1
  in header of response.
* (bug 27634) TOC title appears in wrong language.
* (bug 27761) Fix regression: pages with Esperanto titles containing convertible
  character sequences became unreachable.
* (bug 27508) SVGMetadataExtractor takes too much resources on huge svgs.
* (bug 27465) SVG thumbnail generation.
* (bug 27467) preload can leave UNIQ.
* (bug 27539) Allow attributes beginning with a digit in wikitext tag
  parameters.
* (bug 27328) using relative paths in CSS imports in MediaWiki:Common.css broken
  in 1.17.
* (bug 27333) Fix repetitive last-seen time queries on page history.
* (bug 26250, bug 23817) Fix wfObjectToArray() to descend into arrays; fixes
  processing of JSON return values for ForeignAPIRepo when native json module
  not present.
* (bug 25675) Fix search suggestions for Special: pages with spaces.
* (bug 25571) Xml::encodeJsVar now passes floats natively instead of converting
  to strings.
* (bug 27338) Gallery in 1.17 breaks for audio/video + ogghandler.
* (bug 27302) Don't append the current timestamp for user/site modules when no
  user/site JS/CSS is present.
* (bug 27016) dumpTextPass.php now consider the "output" parameter.
* (bug 22606) don't send the "someone registred an account" message when setting
  email address (i.e. old one empty) in user preferences.
* (bug 26458) Section edit links appear on pages that user does not have right
  to edit.
* (bug 28611) Don't die in SqlBagOStuff::incr() if there's a race condition.
* (bug 16886) Sister projects box moves down the extract of the first result
  in IE 7.
* (bug 17398) Fixed "link" parameter in image links with "thumb" or "frame"
  parameter.

=== API changes in 1.17 ===

* BREAKING CHANGE: action=patrol now requires POST.
* BREAKING CHANGE: patrol token is no longer the same as edit token.
* BREAKING CHANGE: Session keys returned by ApiUpload are now strings instead
  of integers.
* BREAKING CHANGE: (bug 25303) Fix API parameter integer validation to actually
  enforce validation on the input values in addition to giving a warning.
  Also add flag to enforce (die) if integer out of range.
* (bug 24650) Fix API to work with categorylinks changes.
* action=parse now correctly returns an error for nonexistent pages.
* (bug 27201) Special:WhatLinksHere output no longer contains duplicate IDs.
* (bug 26560) On allusers if limit < total number of users, last user gets
  duplicated.
* (bug 27715) imageinfo didn't respect revdelete.
* (bug 27479) API error when using both prop=pageprops and
  prop=info&inprop=displaytitle.
* (bug 27862) Useremail module didn't properly return success on success.
* (bug 27590) prop=imageinfo now allows querying the media type.
* (bug 27587) list=filearchive now outputs full title info.
* (bug 27897) list=allusers and list=users list hidden users.
* (bug 22738) Allow filtering by action type on query=logevent.
* (bug 22764) uselang parameter for action=parse.
* (bug 22944) API: watchlist options are inconsistent.
* (bug 22868) don't list infinite block expiry date as "now" in API logevents.
* (bug 22290) prop=revisions now outputs "comment" field even when comment
  is empty, for consistency with list=recentchanges.
* (bug 19721) API action=help should have a way to just list for a specific
  module.
* (bug 23458) Add support for pageid parameter to action=parse requests.
* (bug 23460) Parse action should have a section option.
* (bug 21346) Make deleted images searchable by hash.
* (bug 23461) Normalise usage of parameter names in parameter descriptions.
* (bug 23548) Allow access of another users watchlist through watchlistraw
  using token and username.
* (bug 23524) Api Modules as followup to bug 14473 (Add iwlinks table to
  track inline interwiki link usage).
* Add pltitles and tltemplates to prop=links and prop=templates respectively,
  similar to prop=categories's clcategories.
* (bug 23834) Invalid "thumbwidth" and "thumbheight" in "imageinfo" query when
  thumbnailing larger than original image.
* (bug 23835) Need "thumbmime" result in "imageinfo" query.
* (bug 23851) Repair diff for file redirect pages.
* (bug 24009) Include implicit groups in action=query&list=users&usprop=groups.
* (bug 24016) API: Handle parameters specified in simple string syntax
  ( 'paramname' => 'defaultval' ) correctly when outputting help.
* (bug 24089) Logevents causes PHP Notice if leprop=title isn't supplied.
* (bug 23473) Give description of properties on all modules.
* (bug 24136) unknownerror when adding new section without summary, but
  forceditsummary.
* (bug 22339) Added srwhat=nearmatch to list=search to get a "go" result.
* (bug 24303) Added new &servedby parameter to all actions which adds the
  hostname that served the request to the result. It is also added
  unconditionally on error.
* (bug 24185) Titles in the Media and Special namespace are now supported for
  title normalization in action=query. Special pages have their name resolved
  to the local alias.
* (bug 24296) Added converttitles parameter to convert titles to their
  canonical language variant.
* (bug 23936) Add "displaytitle" to query/info API.
* (bug 24485) Make iwbacklinks a generator, optionally display iwprefix and
  iwtitle.
* (bug 24564) Fix fatal errors when using list=deletedrevs, prop=revisions or
  one of the backlinks generators with limit=max.
* (bug 24656) API's parse module needs option to disable PP report.
* PARAM_REQUIRED parameter flag added. If this flag is set, and the end user
  does not set the parameter, the API will automatically throw an error.
* (bug 24665) When starttimestamp is not specified, fake it by setting it to
  NOW, not to the timestamp of the last edit.
* (bug 24677) axto= parameters added to allcategories, allimages, alllinks,
  allmessages, allpages, and allusers.
* (bug 24236) Add add, remove, add-self, remove-self tags to
  meta=siteinfo&siprop=usergroups.
* (bug 24484) Add prop=pageprops module.
* (bug 24330) Add &redirect parameter to ?action=edit.
* (bug 24722) For list=allusers&auprop=blockinfo, only show blockedby and
  blockreason if the user is actually blocked.
* Add format=dump and format=dumpfm, outputs results in PHP's var_dump() format.
* For required string parameters, if '' is provided, this is now classed as
  missing.
* (bug 24724) list=allusers is out by 1 (shows total users - 1).
* (bug 24166) API error when using rvprop=tags.
* Introduced "asynchronous download" mode for upload-by-url. Requires
  $wgAllowAsyncCopyUploads to be true.
* sinumberingroup correctly gives size of 'user' group, and omits size of
  implicit groups rather than showing 0.
* (bug 25248) API: paraminfo errors with certain modules.
* (bug 24792) API help for action=purge sometimes wrongly stated whether a
  POST request was needed due to cache pollution.
* Added iiprop=parsedcomment to prop=imageinfo, similar to prop=revisions.
* Added rvparse to parse revisions. For performance reasons if this option is
  used, rvlimit is enforced to 1.
* (bug 25748) If a action=parse request provides an oldid that is actually the
  current revision id, try the parser cache, and save it to it if necessary.
* (bug 25463) Export header should not be shown if no pages were requested, to
  reduce confusion.
* (bug 25648) API discovery information has been added as RSD link in page
  <head> and by providing an API module action=rsd. Added hook
  ApiRsdServiceApis for extensions to add their own service to the services
  list.
* The HTML of diff output markers has changed. Hyphens are now minus signs,
  empty markers are now filled with non-breaking-space characters.
* (bug 25741) Add more data to list=search's srprop.
* (bug 25760) counter property still reported by the API when
  $wgDisableCounters enabled.
* (bug 25987) prop=info&inprop=watched now also works for missing pages.
* (bug 26006) prop=langlinks now allows obtaining full URL.
* (bug 26075) ApiDelete.php now calls correctly ArticleDelete hook.
* (bug 26089) add block expiration to blockinfo.
* (bug 26125) prop=imageinfo&iiprop=size now returns the page count if the
  file is a multi-page file.
* (bug 10268) Added linktodiffs parameter on action=feedwatchlist.
* (bug 26219) Show API limits for multi values in description.
* (bug 28070) Fix watchlist RSS for databases that store timestamps in a
  real timestamp field.
* (bug 27722) list=filearchive now supports revdel.

=== Language support changes in 1.17 ===

MediaWiki supports over 330 languages. Many localizations are updated regularly.

The following languages were added:

* Moroccan Spoken Arabic (ary)
* Banjar (bjn)
* Kabardian (kbd)
* Kabardian (Cyrillic) (kbd-cyrl)
* Latgalian (ltg)
* Minangkabau (min)
* Dutch (informal) (nl-informal)
* Rusyn (rue)

Other significant changes to MediaWiki's language support:

* Fiji Hindi (Devangari script) was removed.
* Removed deprecated language code "dk" (Danish), use "da" instead.
* Link trail added for sl and sh.
* (bug 27633) Add characters to linkTrail for Portuguese (pt and pt-br).
* (bug 23156) Commafy and search normalization updated for Belarusian
  (Taraškievica).
* (bug 23283) Native name for Old English -> Ænglisc.
* (bug 23364) Native name for Azerbaijani -> Azərbaycanca.
* (bug 24593) Native name for Sorani now uses only Arabic script.
* (bug 24628) Generic translations for NS_USER/NS_USER_TALK for Esperanto.
* (bug 24917) Polish as fallback for Kashubia.
* (bug 24794) Tatar link trail updated.
* Esperanto date format corrected.
* (bug 28159) Change interwiki name of language kbd to Къэбэрдеибзэ /
  Qabardjajəbza.
* (bug 28184) Namespaces for the Latgalian Wikipedia.
* (bug 25010) Bashkir-language interwikis: linktext change from Башҡорт
  to Башҡортса.
* (bug 26395) Change name of Cornish language to Kernowek.

=== Other changes in 1.17 ===

* DatabaseFunctions.php that was needed for compatibility with pre-1.3
  extensions has been removed.
* XmlFunctions.php has been removed. Use the Xml or Html classes as appropriate.
* The FailFunction "error handling" method has now been removed
* Sysops now have the "suppressredirect" right by default
* Removed $wgRemoteUploads. It was not well supported and superseded by
  $wgUploadNavigationUrl.
* (bug 26253) $wgPostCommitUpdateList has been removed
* The PHPUnit test suite has been removed from this release due to serious
  issues which should be resolved by the 1.18 release.
* Oracle DB now uses the __destruct function to commit/close connection as it
  doesn't commit on close if transation is triggered in OCI.

== MediaWiki 1.16 ==

== MediaWiki 1.16.5 ==
=== Changes since 1.16.4 ===

* (bug 28534) Fixed XSS vulnerability for IE 6 clients. This is the third
  attempt at fixing bug 28235.
* (bug 28639) Fixed potential privilege escalation when $wgBlockDisablesLogin
  is enabled.

== MediaWiki 1.16.4 ==
=== Changes since 1.16.3 ===

* (bug 28507) The change we made in 1.16.3 to fix bug 28235 (XSS for IE 6
  clients) was not actually sufficient to fix that bug. This release contains
  a second attempt, hopefully we have fixed it this time.

== MediaWiki 1.16.3 ==
=== Changes since 1.16.2 ===

* (bug 28449) Fixed permissions checks in Special:Import which allowed users
  without the 'import' permission to import pages from the configured import
  sources.
* (bug 28235) Fixed XSS affecting IE 6 and earlier clients only, due to those
  browsers looking for a file extension in the query string of the URL, and
  ignoring the Content-Type header if one is found.
* (bug 28450) Fixed a CSS validation issue involving escaped comments, which
  led to XSS for Internet Explorer clients and privacy loss for other clients.

== MediaWiki 1.16.2 ==
=== Changes since 1.16.1 ===

* (bug 26642) Fixed incorrect translated namespace due to a regression in the
  language converter.
* The interface translations were updated.
* (bug 27093, CVE-2011-0047): Fixed CSS injection vulnerability.
* (bug 27094) Fixed server-side arbitrary script inclusion vulnerability.
  Affects Windows servers only. A malicious file with extension ".php" must
  exist on the server for the exploit to be effective.

== MediaWiki 1.16.1 ==
=== Changes since 1.16.0 ===

* (bug 24981) Allow extensions to access SpecialUpload variables again
* (bug 24724) list=allusers was out by 1 (shows total users - 1)
* (bug 24166) Fixed API error when using rvprop=tags
* For wikis using French as a content language, Special:Téléchargement works
  again as an alias for Special:Upload.
* (bug 25167) Correctly load JS fixes for IE6 (fixing a regression in 1.16.0)
* (bug 25248) Fixed paraminfo errors in certain API modules.
* The installer now has improved handling for situations where safe_mode is
  active or exec() and similar functions are disabled.
* (bug 19593) Specifying --server in now works for all maintenance scripts.
* Fixed $wgLicenseTerms register globals.
* (bug 26561) Fixed clickjacking vulnerabilities by introducing support for
  X-Frame-Options. The header value can be configured using $wgBreakFrames and
  $wgEditPageFrameOptions.

== MediaWiki 1.16.0 ==
=== Changes since 1.16 beta 3 ===

* (bug 23769) Disabled HTML 5 client-side form validation. Was introduced in
  1.16 beta 1, but is currently poorly supported by browsers.
* (bug 23175) Re-added window.ta variable for backwards compatibility.
* (bug 23264) Fixed breakage of various command line scripts due to extra line
  endings being inserted by Maintenance::output().
* Fixed HTTP client functionality with safe_mode=On.
* Fixed parser tests broken in 1.16 beta 3.
* For Oracle DB backend: fixed parser tests and table prefix feature.
* (bug 23767) Fixed PHP warning when REQUEST_URI is blank (IIS issue).
* Fixed plural function for Northern Sami (se)
* (bug 23597) Fixed conflicts between ID attributes in the Vector skin and
  parser-generated heading IDs. Renamed head, panel, head-base and page-base.
* Disabled $wgHitcounterUpdateFreq>1 feature on SQLite, does not work yet.
* (bug 23465) Don't ignore the predefined destination filename on
  Special:Upload after following a red link to a file.
* In SQLite full-text search feature: fixed "move page" feature, was non-
  functional.
* (bug 24565) Fixed Cache-Control headers sent from API modules, to protect
  user privacy in the case where an attacker can access the wiki through the
  same HTTP proxy as a logged-in user.
* Fixed an XSS vulnerability in profileinfo.php for installations with
  $wgEnableProfileInfo = true (false by default)
* Fixed a case where an X-Vary-Options header was sent despite $wgUseXVO being
  false. Fixed a minor header parsing issue when $wgUseXVO = true.
* Fixed a register_globals arbitrary inclusion vulnerability in
  MediaWikiParserTest.php, introduced in 1.16 beta 1.

=== Changes since 1.16 beta 2 ===

* Fixed bugs in the [[Special:Userlogin]] and [[Special:Emailuser]] handling of
  invalid usernames.
* Fixed sorting in [[Special:Allmessages]]
* (bug 23113) Fixed title in the show/hide links on diff pages
* (bug 23117) Fixed API rollback, was returning "badtoken" for valid requests
* (bug 23127) Re-added missing $1 parameter to the uploadtext message
* Fixed a bug in the Vector skin where personal tools display behind the logo
* (bug 23139) Fixed a bug in edit conflict resolution, where both textboxes
  showed the same text.
* (bug 23115, bug 23124) Fixed various problems with <title> and <h1> elements
  in page views and previews when the language converter is enabled.
* (bug 23148) Fixed a local path disclosure vulnerability in ImageMagick image
  scaling, which was introduced in 1.16 beta 1.
* Improved error checking on installer.
* (bug 22970) Fixed a JavaScript error in the upload destination conflict
  check.
* (bug 23167) Check the watch checkbox by default if the watchcreations
  preference is set.
* (bug 23171) Improve IE6 version check to avoid false positives.
* (bug 23176) Fixed upload warning override feature "upload new version",
  broken in 1.16 beta 1.
* Fixed regression in unwatch links sent out in notification emails. When the
  mailing job was deferred via the job queue, the title was incorrect.
* (bug 23534) Fixed SQL query error in API list=allusers.
* Fixed a bug in uploads for non-JavaScript clients. An empty string was used
  as the default destination filename, instead of the source filename as
  expected.
* (bug 23371) Fixed CSRF vulnerability in "e-mail me my password", "create
  account" and "create by e-mail" features of [[Special:Userlogin]]
* (bug 23687) Fixed XSS vulnerability affecting IE clients only, due to a CSS
  validation issue.
* Fixed a DoS vulnerability in ImageMagick image scaling. ImageMagick
  expanded wildcard characters "?" and "*" in image filenames, potentially
  causing large numbers of images to be scaled in response to a single request.
  The fix for this involves breaking the scaling of such image filenames until
  ImageMagick 6.6.1-5 or later is deployed, see bug 23361 for more details.
* (bug 23608) Fixed invalid HTML in diff pages.

=== Changes since 1.16 beta 1 ===

* Fixed errors in maintenance/patchSql.php
* (bug 19627) Fix regression from r57867 where HTMLForm would output
  <element classes="foo bar"> rather than <element class="foo bar">
* Fixed broken "-r" option to maintenance/lag.php
* (bug 23076) Fixed login CSRF vulnerability. Logins now require a token to
  be submitted along with the user name and password.

=== Configuration changes in 1.16 ===

* (bug 18222) $wgMinimalPasswordLength default is now 1
* $wgSessionHandler can be used to configure session.save_handler
* $wgLocalFileRepo/$wgForeignFileRepos now have a 'fileMode' parameter to
  be used when uploading/moving files
* (bug 18761) $wgHiddenPrefs is a new array for specifying preferences not
  to be shown to users
* $wgAllowRealName and $wgAllowUserSkin were deprecated in favor of
  $wgHiddenPrefs[] = 'realname', but the former are still retained
  for backwards-compatibility
* (bug 9257) $wgRCMaxAge now defaults to three months
* $wgDevelopmentWarnings can be set to true to show warnings about deprecated
  functions and other potential errors when developing.
* Subpages are now enabled in the MediaWiki namespace by default.  This is
  mainly a cosmetic change, and does not in any way affect the MessageCache,
  which was already effectively treating the namespace as if it had subpages.
* Oracle: maintenance/ora/user.sql script for creating DB user on oracle with
  appropriate privileges. Creating this user with web-install page requires
  oci8.privileged_connect set to On in php.ini.
* Removed UserrightsChangeableGroups hook introduced in 1.14
* Added $wgCacheDirectory, to replace $wgFileCacheDirectory,
  $wgLocalMessageCache, and any other local caches which need a place to put
  files.
* $wgFileCacheDirectory is no longer set to anything by default, and so either
  needs to be set explicitly, or $wgCacheDirectory needs to be set instead.
* $wgLocalMessageCache has been removed. Instead, set $wgUseLocalMessageCache
  to true
* Removed $wgEnableSerializedMessages and $wgCheckSerialized. Similar
  functionality is now available via $wgLocalisationCacheConf.
* $wgMessageCache->addMessages() is deprecated. Messages added via this
  interface will not appear in Special:AllMessages.
* $wgRegisterInternalExternals can be used to record external links pointing
  to same server
* (bug 19907) $wgCrossSiteAJAXdomains and $wgCrossSiteAJAXdomainExceptions added
  to control which external domains may access the API via cross-site AJAX.
* $wgMaintenanceScripts for extensions to add their scripts to the default list
* $wgMemoryLimit has been added, default value '50M'
* $wgExtraRandompageSQL is deprecated, the SpecialRandomGetRandomTitle hook
  should be used instead
* (bug 20489) $wgIllegalFileChars added to override the default list of illegal
  characters in file names.
* (bug 19646) $wgImgAuthDetails added  to display reason access to uploaded file
  was denied to users(img_auth only)
* (bug 19646) $wgImgAuthPublicTest added to test to see if img_auth set up
  correctly (img_auth only)
* $wgUploadMaintenance added to disable file deletions and restorations during
  maintenance
* $wgCapitalLinkOverrides added to configure per-namespace capitalization
* (bug 21172) $wgSorbsUrl can now be an array with multiple DNSBL and renamed
  to $wgDnsBlacklistUrls (backward compatibility kept)
* $wgEnableHtmlDiff has been removed
* (bug 3340) $wgBlockCIDRLimit added (default: 16) to configure the low end of
  CIDR ranges for blocking
* $wgUseInstantCommons added for quick and easy enabling of Commons as a remote
  file repository
* $wgDBAhandler added to choose a DBA handler when using CACHE_DBA
* $wgPreviewOnOpenNamespaces for extensions that create namespaces that behave
  similarly to the category namespace.
* $wgEnableSorbs renamed to $wgDnsBlacklistUrls ($wgEnableSorbs kept for
  backward compatibility)
* $wgUploadNavigationUrl now also affects inline images that do not
  exist. In that case the URL will get (?|&)wpDestFile=<filename> appended to
  it as appropriate.
* If $wgLocaltimezone is null, use the server's timezone as the default for
  signatures. This was always the behavior documented in DefaultSettings.php
  but has not been the actual behavior for some time: instead, UTC was used
  by default.
* Added $wgExtensionAssetsPath, to decouple assets serving from $wgScriptPath.
  If not specified it will default to $wgScriptPath/extensions
* Added $wgCountTotalSearchHits to make search UI display total number of hits
  with some search engines.
* Added $wgAdvertisedFeedTypes to decide what feed types (RSS, Atom, both, or
  neither) MediaWiki advertises.  Default is array( 'atom' ), so RSS is no
  longer advertised by default (but it still works).
* Added $wgMemCachedTimeout, controls how long to wait for data from the
  memcached servers.
* New configuration variables $wgDebugTimestamps and $wgDebugPrintHttpHeaders
  for controlling debug output.
* New $wgBlockDisablesLogin when set to true disallows blocked users from
  logging in.
* (bug 8790) Metadata edition ($wgUseMetadataEdit) has been moved to a separate
  extension "MetadataEdit".

=== New features in 1.16 ===

* Add CSS defintion of the 'wikitable' class to shared.css
* (bug 17163) Added MediaWiki:Talkpageheader which will be displayed when
  viewing talk pages
* Superfluous border="0" removed from images
* Added new hook 'MessageCacheReplace' into MessageCache.php. For instance
  to allow extensions to update caches in similar way as MediaWiki invalidates
  a cached MonoBook sidebar
* Special:AllPages: Move hardcoded styles from code to CSS
* (bug 18529) New hook: SoftwareInfo for adding information about the software
  to Special:Version
* Added $wgExtPGAlteredFields to allow extensions to easily alter the data
  type of columns when using the Postgres backend.
* (bug 16950) Show move log when viewing/creating a deleted page
* (bug 18242) Show the Subversion revision number per extensions in
  Special:Version
* (bug 18420) Missing file revisions are handled gracefully now
* (bug 9219) Auth plugins can control editing RealName/Email/Nick preferences
* (bug 18466) Add note or warning when overruling a move (semi-)protection
* (bug 18342) insertTags works in edit summary box
* (bug 18411) The upload form also checks post_max_size
* Watchlist now has a specialized <div> tag that contains a unique class for
  each page
* Added Minguo calendar support for the Taiwan Chinese language
* Database: unionQueries function to be used for UNION sql construction, so
  it can be overloaded on DB abstraction level for DB specific functionality
* (bug 18849) Implement Japanese and North Korean calendars
* (bug 5755) Introduce {{CURRENTMONTH1}} and {{LOCALMONTH1}} to display the
  month number without the leading zero
* (bug 13456) categoriespagetext supports PLURAL
* (bug 18860) Blocks of IPs affecting registered users can now block email
* (bug 17093) Date and time are separate parameters in Special:BlockList
* (bug 11484) Added ISO speed rating to default collapsed EXIF metadata view
* (bug 14866) Messages 'recentchangeslinked-toolbox' and
  'recentchangeslinked-toolbox' were added to allow more fine grained
  customisation of the user interface
* DISPLAYTITLE now accepts a limited amount of wiki markup (the single-quote
  items)
* Special:Search now could search terms in all variant-forms. ONLY apply on
  wikis enabled LanguageConverter.
* Add autopromote condition APCOND_BLOCKED to autopromote blocked users to
  various user groups.
* Add $wgRevokePermissions as a means of restricting a group's rights. The
  syntax is identical to $wgGroupPermissions, but users in these groups will
  have these rights stripped from them.
* Added a PHP port of CDB (constant database), for improved local caching when
  the DBA extension is not available.
* Introduced a new system for localisation caching. The system is based around
  fast fetches of individual messages, minimising memory overhead and startup
  time in the typical case. The database backend will be used by default, but
  set $wgCacheDirectory to get a faster CDB-based implementation.
* Expanded the number of variables which can be set in the extension messages
  files.
* Added a feature to allow per-article process pool size control for the parsing
  task, to limit resource usage when the cache for a heavily-viewed article is
  invalidated. Requires an external daemon.
* (bug 19576) Moved the id attributes from the anchors accompanying section
  headers to the <span class="mw-headline"> elements within the section headers,
  removing the redundant anchor elements.
* Parser::setFunctionTagHook now can be used to add a new tag which is parsed at
  preprocesor level.
* Added $wgShowArchiveThumbnails, allowing sysadmins to disable thumbnail
  display for old versions of images.
* In watchlists and Special:RecentChanges, the difference in page size now
  appears in dark green if bytes were added and dark red if bytes were removed.
* Added FSRepo configuration properties thumbUrl and thumbDir, to allow the
  thumbnails to be stored in a separate location to the source images.
* If config/ directory is not executable, the command to make it executable
  now asks the user to cd to the correct directory
* Add experimental new external authentication framework, ExternalAuth
* (bug 18768) Remove AdminSettings requirements. Maintenance environment
  will still load it if it exists, but it's not required for anything
* (bug 19900) The "listgrouprights-key" message is now wrapped in a div with
  class "mw-listgrouprights-key"
* (bug 471) Allow RSS feeds for watchlist, using an opt-in security token
* (bug 10812) Interwiki links can have names and descriptions, fetched from
  message 'interwiki-desc-PREFIX', not really used anywhere yet though
* (bug 9691) Add type (signup or login) parameter to
  AuthPlugin::ModifyUITemplate()
* (bug 14454) "Member of group(s)" in Special:Preferences causes language
  difficulties
* (bug 16697) Unicode combining characters are difficult to edit in some
  browsers
* Parser test supports uploading results to remote CodeReview instance
* (bug 20013) Added CSS class "mw-version-ext-version" is wrapped on the
  extension version in Special:Version
* (bug 20014) Added CSS class "mw-listgrouprights-right-name" is wrapped on the
  right name in Special:ListGroupRights
* (bug 12920) New CoreParserFunction {{nse:...}} as an url-friendly equivalent
  to {{ns:...}}
* (bug 16322) Allow maintenance scripts to accept DB user/pass over input or
  params
* (bug 18566) Maintenance script to un/protect pages
* (bug 671) The HTML <abbr> tag is now permitted.
* RecentChanges now has a legend to explain what the Nmb! flags mean, and the
  flags have tooltips.
* (bug 15209) New hook BeforeInitialize called after everything has been setup
  but before Mediawiki::performRequestForTitle()
* wgMainPageTitle variable now available to JavaScript code to identify the main
  page link, so it doesn't have to be extracted from the link URLs.
* (bug 16836) Display preview of signature in user preferences and describe its
  use
* The default output format is now HTML 5 instead of XHTML 1.0 Transitional.
  This can be disabled by setting $wgHtml5 = false;.  Specific features enabled
  if HTML 5 is used:
** Some extra inputs will be autofocused, in supporting browsers.
** The summary attribute has been removed from tables of contents.  summary is
   obsolete in HTML 5 and wasn't useful here anyway.
** Unnecessary type="" attribute removed for CSS and JS.
** If $wgWellFormedXml is set to false, some bytes will be shaved off of HTML
   output by omitting some things like quotation marks where HTML 5 allows.
** (bug 16921) maxlength enabled for page move comments
* The description message in $wgExtensionCredits can be an array with parameters
* New hook SpecialRandomGetRandomTitle allows extensions to modify the selection
  criteria used by Special:Random and subclasses, or substitute a custom result,
  deprecating the $wgExtraRandompageSQL config variable
* (bug 20318) Distinct CSS classes for ISBN/RFC/PMID special links added
* (bug 20404) Custom fields in the user creation form template can now have
  detail labels in prefsectiontip divs.
* MakeSysop and MakeBot are now aliases for Special:UserRights
* IndexPager->mLimitsShown can now be an associative array of limit => text-to-
  display-in-limit-form.
* (bug 18880) LogEventsList::showLogExtract() can now take a string-by-reference
  and add its HTML to it, rather than having to go straight to $wgOut.
* Added $wgShowDBErrorBacktrace, to allow users to easily gather backtraces for
  database connection and query errors.
* Show change block / unblock link on Special:Contributions if user is blocked
* Display note on Special:Contributions if the user is blocked, and provide an
  excerpt from the block log.
* (bug 19646) New hook: ImgAuthBeforeStream for tests and functionality before
  file is streamed to user, but only when using img_auth
* Note on non-existing user and user talk pages if user does not exist
* New hook ShowMissingArticle so extensions can modify the output for
  non-existent pages.
* Admins could disable some variants using $wgDisabledVariants now. ONLY apply
  on wikis enabled LanguageConverter.
* (bug 16310) Credits page now lists IP addresses rather than saying the number
  of anonymous users that edited the page
* New permission 'sendemail' added. Default right for all registered users. Can
  for example be used to prevent new accounts from sending spam.
* (bug 16979) Tracking categories for __INDEX__ and __NOINDEX__
* Two new hooks, ConfirmEmailComplete and InvalidateEmailComplete, which are
  called after a user's email has been successfully confirmed or invalidated.
* (bug 19741) Moved the XCF files out of the main MediaWiki distribution, for
  a smaller subversion checkout.
* (bug 13750) First letter capitalization can now be a per-namespace setting
* (bug 21073) "User does not exist" message no longer displayed on sub-sub-pages
  of existing users
* (bug 21095) Tracking categories produced by the parser (expensive parser
  function limit exceeded, __NOINDEX__ tracking, etc) can now be disabled by
  setting the  system message ([[MediaWiki:expensive-parserfunction-category]]
   etc) to "-".
* Added maintenance script sqlite.php for SQLite-specific maintenance tasks.
* Rewrote Special:Upload to allow easier extension.
* Upload errors that can be solved by changing the filename now do not require
  reuploading.
* Added $wgRateLimitsExcludedIPs, to allow specific IPs to be whitelisted from
  rate limits.
* (bug 21222) When $wgUseTeX is not enabled, <math> is no longer registered with
  the parser so extensions are free to implement their own <math> tag
* (bug 21047) Wrap 'cannotdelete' into a div with the generic 'error' class and
  an own 'mw-error-cannotdelete' class
* New hook AbortNewAccountAuto, called before account creation from AuthPlugin-
  or ExtUser-driven requests.
* (bug 3480) The warning saying that the page has a history when deleting it now
  contains the number of revisions in the history
* $wgStylePath and $wgLogo are now set in the default LocalSettings.php file.
* (bug 20186) Allow filtering history for revision deletion.
* New hook OtherBlockLogLink, called in Special:IPBlockList and Special:Block
  to show links to block logs of other blocking extensions, i.e. GlobalBlocking
* Added search capabilities to SQLite backend
* rebuildtextindex.php maintenance script now supports databases other than
  MySQL
* upgrade1_5.php now requires to be run --update option to prevent confusion
* (bug 17662) Customizable default preload/editintro for new sections in the
  respective addsection-preload and addsection-editintro messages
* Added maintenance script checkSyntax.php that checks for PHP syntax errors
  and common coding mistakes
* Updated Unicode normalization tables
* (bug 21604) Spellcheck attribute for editsummary
* New wgCategories JavaScript global variable for userscripts.
* (bug 20717) Added checkboxes to hide users with bot and/or sysop group
  membership in SpecialActiveusers
* Allow \pagecolor and \definecolor in texvc
* $wgTexvcBackgroundColor contains background color for texvc call
* (bug 21574) Redirects can now have "303 See Other" HTTP status
* EditPage refactored to allow extensions to derive new edit modes much easier.
* (bug 21826) Subsections of Special:Version now also have anchors
* (bug 19791) Add URL of file source as comment to thumbs (for ImageMagick)
* (bug 21946) Sorted wikitables do not properly handle minus signs
* (bug 18885) Red links for media files do not support shared repositories
* Added $wgFixArabicUnicode, to convert deprecated presentation forms in
  Arabic text to their modern equivalents, and $wgFixMalayalamUnicode, to
  convert ZWJ-based chillu sequences in Malayalam text to their Unicode 5.1
  equivalents.
* (bug 22051) Returing false in SpecialContributionsBeforeMainOutput hook now
  stops normal output
* Send new password e-mail in users preference language
* LanguageConverter now support nested using of manual convert syntax like
  "-{-{}-}-"
* Upload license preview now uses the API instead of action=ajax
* (bug 7346) Add <guid> to RSS to avoid duplicates
* (bug 19996) Added new hooks for Special:Search, which allow to further
  restrict/expand it.
* (bug 21936) When a revision has been patrolled, there's now a link back to the
  article
* (bug 22315) SpecialRecentChangesQuery hook now pass $query_options and checks
  the return value
* Separate unit test suites under t/ and tests/ were merged and moved to
  maintenance/tests/.
* importImages.php maintenance script can now use the original uploader and
comment from another wiki.
* Support for Turck MMCache was removed
* (bug 14592) Warn users when they try to move their user page that their
  account will not be renamed
* Show block log on non-existing user (talk) pages of currently blocked users

=== Bug fixes in 1.16 ===

* (bug 18031) Make namespace selector on Special:Export remember the previous
  selection
* The svn-version version numbers on Special:Version have been removed
* (bug 17374) Special:Export no longer exports two copies of the same page
* (bug 18190) Proper parsing in MediaWiki:Sharedupload message
* (bug 17617) HTML cleanup for ImagePage
* (bug 17964) namespaceDupes.php no longer fails on an empty interwiki table
* Improved error handling for image moving
* (bug 17974) On Special:SpecialPages, restricted special pages are now marked
  with <strong> tags, helps with text-based browsers
* (bug 18259) Special:DeletedContributions now also uses
  MediaWiki:Sp-contributions-logs for the link to Special:Log
* Don't add empty title="" attributes to links to anchors on the current page
* (bug 18291) rebuildrecentchanges.php failed to add deletion log entries
* (bug 18304) rebuildrecentchanges.php got size changes wrong
* (bug 18170) Fixed a PHP warning in Parser::preSaveTransform() in PHP 5.3
* (bug 18289) Database connection error page now returns correct HTML
* "successbox", "errorbox" and related CSS classes are now available in all
  skins
* (bug 18316) Removed superfluous name="fulltext" from Special:Search
* (bug 18331) MediaWiki:Undelete-revision can now have wikitext
* The "noautoblock" flag is no longer displayed in the block log when blocking
  an IP address
* (bug 18009) $wgHooks and $wgExtensionFunctions now support closures
* (bug 17948) Maintenance scripts now exit(0) or exit(1) as appropriate
* (bug 18377) Time in Enhanced ChangesList lacking localisation
* (bug 12998) Allow <sup>, <sub>, etc. in DISPLAYTITLE
* (bug 1553) Lowercase navigation headings in German
* (bug 7830) Pending transactions failed to commit on loginToUse() error
* (bug 11613) session.save_handler being over-ridden
* (bug 11381) session.save_handler being set twice (causes error)
* (bug 17835) ForeignAPIRepo throwing error on first page load for file
* (bug 18115) ForeignAPIRepo cache isn't working
* Fixed a bug caused by LanguageConverter.php, which brings an abnormal '}-'
  after some parsed math syntax.
* (bug 18441) rebuildrecentchanges.inc no longer ignores $wgLogRestrictions
* (bug 18317) Bolded selections in 1 | 3 | etc days on RecentChanges now use
  <strong> instead of hardcoded styles
* (bug 18449) Fixed items number per column on category pages when the total is
  divisible by 3
* (bug 18121) maintenance/deleteArchivedRevisions.php no longer deletes
  revisions when --delete is not passed
* (bug 13172) GPS coordinates in image Exif data are now actually displayed
* Overhaul of preferences system, includes the following bug fixes:
** (bug 5363) Changes to default preferences now impact registered users.
** (bug 14806) Hook to enable putting preferences in existing tabs.
** (bug 17191) Registration date now listed on preferences page.
** The user_properties table (now used for storing preferences) has been added
   to $wgSharedTables.
** Note that this change will break some extensions which have not been adapted
   for it.
* (bug 17020) Adding fallback encodings for Traditional and Simplified Chinese
  languages while the text is typed as URLs.
* (bug 17614) Prev / Next links are not shown if all results are shown
* (bug 18207) Strange spacing before [[irc:...]] links
* Removed float from the user login form in RTL interface - caused display
  problems in FF2
* (bug 15008) Redirect images are now subject to Bad image list rules
* (bug 6802) profileinfo.php now also work on other database servers than MySQL
* (bug 16925) Diffs no longer fail when $wgExternalDiffEngine is set to
  'wikidiff' or 'wikidiff2' but extension is not installed
* (bug 18326) Chmod errors in file repos have been hidden
* (bug 18718) Comma after a } create a error in IE
* (bug 18716) Removed redundant class in Modern skin CSS for category links and
  tweaked spacing.
* (bug 18656) Use proper directory separators in wfMkdirParents()
* (bug 18549) Make Special:Blockip respect $wgEnableUserEmail and
  $wgSysopEmailBans
* (bug 16912) Tooltips on images with link= disappear
* (bug 18389) Localise numbers in EXIF data
* (bug 18522) Wrap MediaWiki:Protect-cascadeon in a div for identification
* (bug 18438) Tweak HTML for preview bar for consistency and accessibility
* (bug 18432) Updated documentation for dumpBackup.php
* Fix array logic in Sanitizer::removeHTMLtags so that it doesn't strip good
  tags that were redundantly defined.
* (bug 14118) SpecialPage::getTitleFor does not return a localised name
* (bug 18698) Renaming non entry point maintenance scripts from .inc.php to
  .inc
* Deprecated methods Title::getInterwikiLink, Title::userCanCreate(),
  Title::userCanEdit() and Title::userCanMove() have been removed
* Only show upload links on file description if $wgEnableUploads = true
  and user can upload
* Don't say "You need to log in to upload/move", because it's possible that
  uploading/moving is disabled for registered users as well (e.g. only sysops)
* (bug 18943) Handle invalid titles gracefully at Special:Mostlinked
* (bug 8873) Enable variant conversion in text on 'alt' and 'title' attributes
* (bug 10837) Introducing the StubUserVariant class to determine the variant
  variable instead of using this to overrule the user language preference.
* (bug 19014) If user had deletedhistory right, but not undeleted right, then
  show "view" instead of "view/restore" on logs.
* (bug 19017) TOC level calculation error in an odd case
* (bug 18999) CSS update for RTL interwiki links
* (bug 18925) history.js removes class names of list elements on initialization
* Multiple whitespace in TOC anchors is now stripped, for consistency with the
  link from the edit comment
* (bug 19112) Preferences now respects $wgUseExternalEditor
* (bug 18173) MediaWiki now fails when unable to determine a client IP
* (bug 19170) Special:Version should follow the content language direction
* (bug 19160) maintenance/purgeOldText.inc is now compatible with PostgreSQL
* Fixed performance regression in "bad image list" feature
* Show user preference 'Use live preview' if $wgLivePreview is enabled only
* (bug 17014) Blocked users can no longer use Special:UserRights unless they
  can add/remove *all* groups (have 'userrights' permission).
* (bug 19294) Always show Sp-contributions-footer(-anon)
* Attempts to restrict reading of pages while anonymous viewing is allowed
  via extensions not using the userCan hook and via $wgRevokePermissions now
  work.
* (bug 8445) Multiple-character search terms are now handled properly for
  Chinese
* (bug 19450) Use formatNum for "Number of edits" in Special:Preferences
* (bug 11242) Check for MySQL storage engines during installation now checks
  whether the engines are actually available
* (bug 19390) Omit the "printable version" link on the printable version
* (bug 18394) img_auth.php now respects userCan
* (bug 19509) Uploading to a file named '0' previously treated it as null input
   and attempted to upload with the source name. Now warns about not having an
   extension (since 0.ext is perfectly valid)
* (bug 19468) Enotif preferences are now only displayed when they are turned on
* (bug 19442) Show/hide options on watchlist only work once
* (bug 19602) PubMed Magic links now use updated NIH url
* (bug 19637) externallinks have links to self
* Don't load Opera 9.5 RTL fixes for Opera 9.6
* Remove five-year-old KHTMLFixes.css, which is unlikely to be relevant anymore
  and was causing problems.
* Removed repetition of URIs in the title attributes of external links.
* (bug 19693) User name is now escaped in "Contributions for ..." link on
  Special:BlockIP
* (bug 19571) Override buildConcat for SQLite.
* Log in and log out links no longer return to page view when clicked from
  history view, edit page, or something similar
* (bug 19513) RTL fixes for new Search UI
* (bug 16497) Special:Allmessages is paginated
* (bug 18708) CSS plainlinks class now available to all skins
* (bug 19590) Database error messages no longer have "MySQL" hardcoded as the
  database type
* (bug 19759) successbox on Special:Preferences now correctly aligned on
  standard, nostalgia and cologneblue skin
* (bug 19814) interwiki links from file links ([[File:Foo.jpg|link=de:Test]])
  are no longer recorded in the pagelinks table
* (bug 19784) date option "ISO 8601" produced illegal id
* (bug 19761) Removed autogenerated <meta keywords> tag with link data.
  Keyword set was not useful, and is ignored by modern search engines anyway.
* (bug 19827) Special:SpecialPages title is "Upload file
* (bug 19355) Added .xhtml, .xht to upload file extension blacklist
* (bug 19287) Workaround for lag on history page in Firefox 3.5
* (bug 19564) Updated docs/hooks.txt
* (bug 18751) Fix for buggage in profiling setup for some extensions on PHP 5.1
* (bug 17139) ts_resortTable inconsistent trimming makes date sorting fragile
* (bug 19445) Change oldimage table to use ON UPDATE CASCADE for FK to image
  table.
* (bug 14080) Short notation links to subpages didn't work in edit summaries
* (bug 17374) Special:Export no longer exports multiple copies of pages
* (bug 19818) Edits to user CSS/JS subpages can now be marked as patrolled by
  users who can't edit them
* (bug 19839) Comments in log items are no more double escaped
* (bug 18161) Fix inconsistent separators in watchlist link toolbars with
  "enhanced recent changes"
* (bug 16877) Moving a page over a redirect no longer leaves an orphan entry in
  the recentchanges table
* (bug 16009) Limit selection forms based on Pager now links to the correct page
  when using long urls
* The display of the language list on the preferences is more comply with the
  BCP 47 standards.
* (bug 19849) Custom X-Vary-Options header now disabled unless $wgUseXVO is set
* (bug 19301) Duplicate entries in $wgAddGroups, $wgRemoveGroups,
  $wgGroupsAddToSelf and $wgGroupsRemoveFromSelf are no more displayed on
  Special:ListGroupRights
* (bug 18799) Special:Userlogin now handles correctly the returnto parameter
  to not link back to Special:Userlogout when user's language isn't the same as
  content's language
* (bug 19479) Show proper error message when unable to connect to PostgreSQL
  database with username/password in MediaWiki's setup
* (bugs 18407, 18409) Special:Upload is now listed on Special:Specialpages only
  if uploads are enabled and the user can access it
* (bug 17988) Spaces before [[Category:]] links are no longer ignored
* (bug 19957) All known-failing tests now marked disabled; added --run-disabled
  option to parser test suite to run disabled tests if desired.
* (bug 16311) Make recent change flags (n/m/b) <abbr>s instead of <span>s
* (bug 15680) Split the edit tip message of user CSS/JS subpage into
  "usercssyoucanpreview" and "userjsyoucanpreview" respectively.
* (bug 12110) Split the rights for editing users' CSS/JS subpage from
  "editusercssjs" into "editusercss" and "edituserjs" respectively.
* (bug 19394) RecentChanges feed URLs for log items with no revisions
  (eg Newuser, Userrights) are no longer broken
* (bug 17395) Remote file descriptions use user language ($wgLang), not wiki
  language ($wgContLang)
* (bug 11867) Lock error on redirect table when running orphans.php
* (bug 18930) initStats.php now refreshes active users count
* (bug 18699) Using the nosummary URL option no longer triggers the "You have
  not provided a summary" warning for those who activated it in their
  preferences
* (bug 18855) commandLine.inc and Maintenance.php are now properly included
  using the full path
* (bug 18497) Fixed broken style sheets in Opera fullscreen mode
* (bug 16084) Default memory limit has be increased to 50M, see $wgMemoryLimit
* (bug 17864/19519) Added proper input normalization in Special:UserRights
* (bug 20086) Add Hook to add extra statistics at the end of Special:Statistics
* (bug 19289) importDump.php can now handle bzip2 and 7zip
* (bug 20131) Fixed a PHP notice for users having the "rollback" right on
  Special:RecentChangesLinked
* Do not transform EXIF fields with pure text to avoid results like
  foo,bar@example,com
* (bug 20176) Fix login/logout links in skin CologneBlue
* (bug 20203) "Powered by Mediawiki" now has height/width on image tag
* (bug 20273) Fix broken output when no pages are found in the content
  namespaces
* (bug 20265) Make AncientPages and UnusedFiles work on SQLite
* Fixed XSS vulnerability for Internet Explorer clients (only pre-release
  versions of MediaWiki were affected).
* (bug 14817) Moving a page to a subpage of itself moves it twice
* (bug 20289) $wgMaximumMovedPages should only count pages actually moved
* (bug 15248) Non-breaking spaces and certain other Unicode space characters
  are now normalized to ordinary spaces in titles; if your wiki has existing
  titles with such characters, run cleanupTitles.php and/or cleanupImages.php
* (bug 11143) Links containing invalid UTF-8 percent-code sequences are now
  cleanly disabled instead of breaking parsing entirely on PHP 5.2.
* (bug 20296) Fixed an PHP warning in Language::getMagic() in PHP 5.3
* (bug 20358) Unprotect tab was missing accesskey; now same as protect tab.
* (bug 20317) Cleaned up default main page link accesskey settings
* (bug 20362) Special:Statistics now produces valid HTML when view counters are
  enabled
* (bug 19857) maintenance/deleteRevision.php on last revision no longer breaks
  target page
* (bug 20365) Page name with c/g/h/j/s/u + x are now correctly handled in
  Special:MovePage with Esperanto as content language
* (bug 20364) Fixed regression in GIF metadata loading
* (bug 20299) MediaWiki:Move-subpages and MediaWiki:Move-talk-subpages can now
  use wikitext
* (bug 15475) DatabaseBase::setFlag(), DatabaseBase::clearFlag() and
  DatabaseBase::getFlag() now have documentation
* (bug 19966) MediaWiki:License-header is now used for the licensing header in
  the file description page instead of MediaWiki:License
* (bug 20380) Links to history/deleted edits at the top of
  Special:RevisionDelete are no more displayed when doing log suppression
* (bug 8143) Localised parser function names are now correctly case insensitive
  if they contain non-ASCII characters
* (bug 19055) maintenance/rebuildrecentchanges.php now purges
  Special:Recentchanges's RSS and Atom feed cache
* The installer will now try to bypass PHP's max_execution_time
* (bug 20260) SQLite no longer tries to automatically create the database at
  execution time, this now happens only at install time; if it is not available
  at script execution, it now throws an exception
* Fixed EditFilterMerged hook so the hookError parameter serves a purpose
  (analogous to EditFilter hook)
* (bug 2257) Tag extensions can expand template parameters provided to the tag,
  by using a new parameter added to the recursiveTagParse function
* (bug 14900) __INDEX__ and __NOINDEX__ no longer override site config set in
  $wgArticleRobotPolicies.
* (bug 20466) Hidden categories are no more displayed when printing
* (bug 20446) When changing user rights with User@remotewiki and remotewiki is
  the local wiki, the user is now treated as the local user
* (bug 20494) OutputPage::getArticleBodyOnly() no longer requires an useless
  argument
* (bug 20136) Protection form JavaScript now synchronizes the expiry boxes on
  any change, in addition to onkeyup.
* Don't link to "edit this page" on MediaWiki:Noarticletext if user is not
  allowed to create page. Done via new message
  MediaWiki:Noarticletext-nopermission
* Improved compatibility between the Vector skin and addPortletLink() from
  wikibits.js: empty portlets are now present but hidden, adding an element to a
  portlet unhides it
* (bug 19531) addPortletLink() now wraps inserted labels in a <span> element to
  be compatible with the CSS for the Vector skin
* (bug 20578) Wrong localized image metadata - duplicated string?
* (bug 20556) Stub threshold's "other" <input> in Special:Preferences now has a
  correct type="text" parameter
* (bug 482) Don't include TOC in the printable version if it has been hidden
* Adjust the time according to the user configuration on Special:Revisiondelete
* (bug 20624) Installation no longer allows "qqq" as the chosen language
* (bug 20634) The installer-created database user will now have all rights on
  the database so that upgrades will go more smoothly.
* (bug 18180) Special:Export ignores limit, dir, offset parameters
* User::getBlockedStatus() works for all kinds of user objects and doesn't
  assume the user object is equal to the current-user object ($wgUser)
* (bug 20517) Cancel link from edit page now returns to the old version when
  editing an old version
* (bug 16902) Installer no longer shows warnings when exec() has been disabled
  by disable_functions
* (bug 20726) Title::getLatestRevID's documentation now says that the function
  returns false if the page doesn't exist
* (bug 20751) ForeignApiRepo now urldecodes filenames when saving to local cache
* (bug 20730) Fix to Special:Version ViewVC link for branch checkouts
* (bug 20353) wfShellExec() was adding extra quotes on Windows Vista, causing
  command line scripts to fail
* (bug 20702) Parser functions can now be used correctly in
  MediaWiki:Missing-article
* (bug 14117) "redirected from" is now also shown on foreign file redirects
* (bug 17747) Only display thumbnail column in file history if the image can
  be rendered.
* (bug 3421) Live preview no longer breaks user CSS/JS previews
* (bug 11264) The file logo on a file description page for documents (PDF, ...)
  now links to the file rather than the file description page
* Password fields built with HTMLForm now still have the type="password"
  attribute if $wgHtml5=false.
* (bug 20836) Preload now works for MediaWiki namespace
* (bug 20885) Search box no longer suggests unavailable special pages
* (bug 20948) "Create this page" on Special:Search is no longer displayed when
  searching for special pages
* (bug 20524) Hideuser: Show nice error when trying to block hidden user without
  hideuser right
* (bug 21026) Fixed file redirects on shared repos on non-English client wikis
* (bug 21030) Fixed schema choices from being overwritten by defining unique
  field names per driver.
* (bug 21115) wgCanonicalSpecialPageName javascript variable is now always
  false on non-special pages
* (bug 21113) "Other statistics" header on Special:Statistics is no more
  displayed when there isn't any entry in it
* (bug 21114) Special:Contributions no longer shows diff links for new
  revisions
* (bug 21116) MediaWiki:Templatesused, MediaWiki:Templatesusedpreview and
  MediaWiki:Templatesusedsection now support plural
* (bug 21079) There is no more line wrapping between label and field in
  Special:Log
* (bug 20256) Fixed SQL errors on Special:Recentchanges and
  Special:Recentchangeslinked on SQLite backend
* (bug 20880) Fixed updater failure on SQLite backend
* (bug 21182) Fixed invalid HTML in Special:Listgrouprights
* (bug 20242) Installer no longer promts for user credentials for SQLite
  databases
* (bug 20911) Installer failed to create a SQLite database
* (bug 20847) Deprecated deprecated akeytt() removed in wikibits.js leaving
  dummy
* (bug 21161) Changing $wgCacheEpoch now always invalidates file cache
* (bug 20268) Fixed row count estimation on SQLite backend
* (bug 20275) Fixed LIKE queries on SQLite backend
* (bug 21234) Moving subpages of titles containing \\ now works properly
* (bug 21006) maintenance/updateArticleCount.php now works again on PostgreSQL
* (bug 19319) Add activeusers-intro message at top of SpecialActiveUsers page
* (bug 21255) Fixed hostname construction for DNSBL checking
* (bug 18019) Users are now warned when moving a file to a name in use on a
  shared repository and only users with the 'reupload-shared' permission can
  complete the move.
* (bug 18909) Add missing Postgres INSERT SELECT wrapper
* User::isValidPassword now only returns boolean results,
  User::getPasswordValidity can be used to get an error message string
* The error message shown in Special:ChangePassword now parses wiki markup
* (bug 19859) Removed experimental HTMLDiff feature
* Removed section edit links in edit conflict form
* Allow SpecialActiveusers to work on non-MySQL databases
* (bug 6579) Fixed protecting images from uploading only
* (bug 18609) Search index was empty for some pages
* (bug 13453) rebuildrecentchanges maintenance script works on PG again
* (bug 16583) Reduce false positives when checking for PHP (on upload, etc.)
* (bug 20112) Bitrotted tests in the t/ directory were failing.
* (bug 21470) MediaWiki:Sp-contributions-explain is now wrapped in a <p> with
  id "mw-sp-contributions-explain"
* (bug 19159) Fixed \overleftrightarrow in texvc
* (bug 19391) Fix caching for Recent ChangesFeed.
* (bug 21455) Fixed "Watch this page" checkbox appearing on some special pages
  even to non-logged in users
* (bug 21551) Rewrote the Squid purge HTTP client to provide a more robust and
  general implementation of HTTP, allowing it to purge non-Squid caches such as
  Varnish.
* Fixed corruption of long UDP debug log messages by using socket_sendto()
  instead of fsockopen() with fwrite().
* (bug 16884) Fixed feed links in sidebar not complying with URL parameters
  of the displayed page
* (bug 21403) memcached class renamed to MWMemecached to avoid conflict with
  PHP's memcached extension
* (bug 21650) Both calls to SkinTemplateTabs hook are now compatible
* (bug 21672) Add missing Accept-Language to both Vary and XVO headers
* (bug 21679) "Edit block reasons" link at the bottom of Special:Blockip is now
  only displayed to the users that have "editinterface" right
* (bug 21740) Attempting to protect a page that doesn't exist (salting) returns
  "unknown error"
* (bug 18762) both redirects and links get fixed one after another if
  redirects-only switch is not present
* (bug 20159) thumbnails rerendered if older than $wgThumbnailEpoch
* Fixed a bug which in some situations causes the job queue to grow forever,
  due to an infinite loop of job requeues.
* (bug 21523) File that can have multiple pages (djvu, pdf, ...) no longer have
  the page selector when they have only one page
* (bug 21559) "logempty" message is now wrapped in a div with class
  "mw-warning-logempty" when used in log extract
* (bug 20549) Parser tests were broken on SQLite backend
* (bug 21776) Interwiki urls like http://en.wikibooks.org/wiki/cs: should give
  a redirect instead of a baderror.
* (bug 21803) Special:MyContributions now keeps the query string parameters
* Redirecting special pages now keep query string parameters set to "0" (e.g.
  for namespace)
* (bug 20765) Special:ListGroupRights no longer misses addables and removables
  groups if there are duplicate entries
* (bug 21814) Message shown when rolling back an edit with a deleted username
  now shows '(username deleted)' instead of broken user tool links
* (bug 21536) Fixed JavaScript error on Special:Search caused by an incorrect ID
* (bug 21535) RecentChanges RSS feed now always recognises the namespace filter,
  previously it sometimes didn't due to caching.
* (bug 20388) ProfilerSimpleText no longer outputs comment on action=raw
* refreshLinks.php now purges orphaned redirect table rows
* (bug 2971) Swap links of hist & diff location on Special:Contributions for
  consistency with RC/WL
* (bug 21986) Special page names are now capitalized by content language
* If two log types have the same description, they're now both displayed in the
  type selector on Special:Log
* (bug 20115) Special:Userlogin title says "Log in / create account" even if the
  user can't create an account
* (bug 2658) Don't attempt to set the TZ environment variable.
* (bug 9794) User rights log entries for foreign user now links to the foreign
  user's page if possible
* (bug 14717) Don't load nonexistent CSS fix files for non-Monobook skins
* (bug 22034) Use wfClientAcceptsGzip() in wfGzipHandler instead of
  reimplementing it.
* (bug 19226) First line renders differently on many UI messages.
* (bug 21303) Comments are no longer stripped from MediaWiki:Common.js and
  skin-specific JS pages
* (bug 5061) Use the more precise thumbcaption thumbimage and thumbinner classes
  for image divs.
* (bug 22096) IE50Fixes.css and IE55Fixes.css have been dropped from the
  Monobook and Chick skins
* Fixed bug involving unclosed "-{" markup in the language converter
* (bug 21870) No longer include Google logo from an external server on wiki
  error.
* (bug 22181) Do not truncate if the ellipsis actually make the string longer
* (bug 16039) Text disappearing after a bad image
* (bug 18784) Internal links like [[File:Foo|caption]] should read 'caption',
  not 'File:Foo' when Foo is not an image
* (bug 21518) Special:UserRights no longer displays the user name box for users
  that can only change their rights
* (bug 21593) Special:UserRights now lists automatic groups membership
* (bug 22364) Setting $wgUseExternalEditor to false no longer hides the reupload
  link from file pages
* Fix bug introduced in MediaWiki 1.12: The author field in
  $wgExtensionCredits is no longer sorted with sort() but rather used
  as it appears in extensions as was the case before r30117 where it
  was unintentionally sorted along with other fields.
* (bug 19334) Textarea no longer jumps when editing longer articles in IE8
* Truncate summary of page moves in revision comment field to avoid broken
  multibyte characters
* (bug 22540) ForeignApiRepos no longer try to store thumbnails that don't exist
* (bug 22551) Special:Resetpass now has a "Cancel" button that sends the user to
  the page set in the &returnto parameter.
* (bug 19194) Search box in Modern skin doesn't focus with Safari/Chrome
* (bug 17790) Users instantly logged off on HughesNet
* (bug 21549) Make foreign key constraints DEFERRABLE INITIALLY DEFERRED
  when using Postgres as the database backend.

== API changes in 1.16 ==

* Added uiprop=changeablegroups to meta=userinfo
* Added usprop=gender to list=users
* (bug 18311) action=purge now works for images too
* Add parentid to prop=revisions output
* (bug 17832) action=delete returns 'unknownerror' instead of 'permissiondenied'
  when the user is blocked
* (bug 18546) Added timestamp of new revision to action=edit output
* (bug 18554) Also list hidden revisions in list=usercontribs for privileged
  users
* (bug 13049) "API must be accessed from the primary script entry point" error
* (bug 1