Merge branch 'wikimedia-REL1_45' into REL1_45

Author: MacFan4000

RELEASE-NOTES-1.45

@@ -6,6 +6,131 @@ PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/
 PHP 8.4 workboard: https://phabricator.wikimedia.org/tag/php_8.4_support/
 PHP 8.5 workboard: https://phabricator.wikimedia.org/tag/php_8.5_support/
 
+== MediaWiki 1.45.4 ==
+
+THIS IS NOT A RELEASE YET
+
+=== Changes since 1.45.3 ===
+* Localisation updates.
+
+== MediaWiki 1.45.3 ==
+
+This is a maintenance release of the MediaWiki 1.45 branch.
+
+=== Changes since 1.45.2 ===
+* Fixed backport issues.
+
+== MediaWiki 1.45.2 ==
+
+This is a security and maintenance release of the MediaWiki 1.45 branch.
+
+=== Changes since 1.45.1 ===
+* Localisation updates.
+* (T386108) Upgrade pear/pear-core-minimal to v1.10.17.
+* (T412194) Upgrading justinrainbow/json-schema (5.3.0 => 5.3.1).
+* (T411213) Upgrade wikimedia/less.php from 5.2.2 to 5.5.0.
+* (T413538) MultiHttpClient: Remove curl_close() call.
+* (T413565) Search: Replace deprecated SplObjectStorage methods.
+* Mime: Change mime type video/x-matroska to video/matroska.
+* (T413625) LinksMigration: Correctly filter for equal namespaces.
+* (T413582) ShellboxClientFactory: Handle $service being null in getUrl().
+* (T413672) EtcdConfigTest: Add return value for some MultiHttpClient mocks.
+* (T413675) DBConnRefTest: Add a temporary variable for return value in
+  testRoleExceptions.
+* (T413580) LanguageCodeTest: Remove unnecessary null assertion.
+* Allow wikimedia/testing-access-wrapper ^4.0.0.
+* Logging: Handle possible null as type for LogPage.
+* (T411019) Logging: Set default for log type on dropdown via LogEventsList.
+* (T413690) libs: Fix closure detection in MemoizedCallable.
+* (T413923) Don't use null offsets in BlockManager::getUniqueBlocks.
+* SiteConfiguration: Optimize processSetting for default-only case.
+* SiteConfiguration: Use \array_key_exists().
+* SiteConfiguration: Use use function syntax.
+* Config: Use use function array_key_exists some more.
+* (T413924, T413925) tests: PHP 8.5 compatibility in AuthManager tests.
+* (T413573) [php8.4] Use DOMCompat::innerHTML() instead of Element::nodeValue.
+* Update documentation from which versions you can upgrade.
+* (T413673) tests: Fix PHP8.5 error when casting float(INF) as integer.
+* (T414355) Fix PHP 8.5 deprecation warnings in IcuCollation.
+* (T414351) Avoid coercing NAN/INF/-INF to string.
+* (T404636) tests: Hide deprecation warning for PHPSessionHandler.
+* (T414323) tests: Use setAttributeForTest() correctly.
+* (T413674) ParamValidator: Suppress cast warning in IntegerDef.
+* (T413577) Parser: Ignore long user provided int in
+  Sanitizer::decodeCharReferences.
+* (T413576) Rdbms: Get strings from SQLPlatform::getDatabaseAndTableIdentifier.
+* (T413579) Site: Handle non-stored Site objects in SiteList.
+* (T413920) tests: Mock some functions in OutputPageTest.
+* (T413926) Do not attempt to get handler for unknown file types.
+* (T413919) tests: Use real TitleFormatter in LinkBatchTest.
+* (T413930) User: Add fallback 'default' to User::getDatePreference.
+* (T413934) JobQueueGroup: avoid PHP 8.5 deprecation from null array offsets.
+* (T413922) Rdbms: Handle null from DatabaseDomain::getDatabase in
+  LBFactoryMulti.
+* (T413901) Media: Remove deprecated imagedestroy.
+* rdbms::assertTransactionRoundStage: Show transaction name if available.
+* (T414350) Language: Handle NAN coercion to string in formatting numbers.
+* (T413931) tests: Set module name in ApiBaseTest::doGetParameterFromSettings.
+* (T414336) Disable process timeout for Composer phpunit script.
+* (T413575) libs>XhprofData: Handle use of NULLs as array keys for PHP8.5.
+* (T406744) tests: remove setAccessible() call on Reflection objects.
+* tests: Change DomDocument return type in SpecialCreateAccountTest.
+* (T415443) Upgrading mck89/peast (v1.16.3 => v1.17.4).
+* (T413918) tests: Mock value for RangeChronologicalPager::getTimestampField.
+* (T413921) LinksUpdate: Handle nullable el_to_path column in
+  ExternalLinksUpdate.
+* (T413926) Upload: Do not attempt to get handler for unknown file types.
+* File: Ensure mime type is set for LocalFile::getMimeType.
+* (T413917) Specials: Use empty string as missing type on
+  Special:RevisionDelete.
+* (T415723) Updated phpunit/phpunit from 9.6.21 to 9.6.33.
+* Update phpunit/phpunit from 9.6.33 to 9.6.34.
+* Update wikimedia/parsoid to 0.22.1.
+* (T414599) migrateLinksTable: Handle constant namespace values in mapping.
+* VueComponentParser: use Parsoid DOM compatibility methods.
+* FileRepo: Add 'userAgent' option in ForeignAPIRepo for wgForeignFileRepos.
+* [tests] Add forward-compatibility alias for JsonDeserializableSubClass.
+* (T367584) JsonCodec/ParserCache: Forward-compatibility test cases.
+* (T413545) Update wikimedia/parsoid to 0.22.2.
+* (T417390) mediawiki.util: Don't throw in addSubtitle if the skin lacks a
+  subtitle.
+* (T414884) PostgresInstaller: Handle null password in openConnectionToAnyDB.
+* Forward compatibility with ParserOutput::getTitle().
+* Upgrade wikimedia/css-sanitizer from 6.1.0 to 6.2.1.
+* (T414805, T418745, T418346) WebPHandler: Allow the original being served on
+  the web.
+* (T411013) mediawiki.util: Add adjustThumbWidthForSteps for step sizing in JS.
+* (T411013) mediawiki.util,FileRepo: Improve adjustThumbWidthForSteps test
+  coverage.
+* (T411125) Round to original file width if there is no steep between that &
+  requested.
+* (T411125) File: Allow scaling up vectorized images to larger sizes.
+* (T360589, T415598) Move handling of ThumbnailSteps to media handlers.
+* (T416518) Disable Composer audit.block-insecure option.
+* (T419183) ParserOutputFlags: add HAS_SLOT_HEADERS.
+* (T419479) sql: Mark pl_target_id as non-nullable in abstract schema.
+* (T329183, T417691) Clarify documentation for action=query&list=tags.
+* (T391524) EditPage: Handle MWException when serializing the preloaded
+  content.
+* (T417819) ParserOutputFlags: Back-port new flags added in 1.46 for
+  forward compat.
+* (T384147, CVE-2026-34092) SECURITY: Block UI elements in 'tools'-sidebar
+  shows presence of an autoblocked IP.
+* (T410429, CVE-2026-34088) SECURITY: RecentChanges entries expose suppressed
+  content via generated log page html.
+* (T411305, CVE-2026-34091) SECURITY: User localization leaked by AbuseFilter
+  + EventStream.
+* (T411366, CVE-2026-34090) SECURITY: Suggested investigations: Handle
+  suppressed usernames.
+* (T414547, CVE-2026-34093) SECURITY: Special:UserRights allows viewing user
+  rights from private wiki.
+* (T416090, CVE-2026-34094) SECURITY: Customized help link for page protection
+  indicator is relative to subpage name, because the link target is missing the
+  "/wiki/" prefix.
+* (T419192, CVE-2026-34095) SECURITY: action=raw with Special:Mypage subpage
+  title responds with "Content-Type) SECURITY: text/html" on
+  ctype=text/javascript request.
+
 == MediaWiki 1.45.1 ==
 
 This is a security and maintenance release of the MediaWiki 1.45 branch.

UPGRADE

@@ -18,7 +18,7 @@ Important: Upgrading from releases older than two LTS release is not supported a
 If you want to upgrade from an old version, please upgrade to a more recent LTS version first,
 then to this version.
 
-Currently any upgrade from any version older than 1.35 will fail.
+Currently any upgrade from any version older than 1.38 will fail.
 
 === Consult the release notes ===
 

composer.json

@@ -35,10 +35,10 @@
 		"ext-xml": "*",
 		"ext-xmlreader": "*",
 		"guzzlehttp/guzzle": "7.10.0",
-		"justinrainbow/json-schema": "5.3.0",
+		"justinrainbow/json-schema": "5.3.1",
 		"lcobucci/jwt": "4.1.5",
 		"liuggio/statsd-php-client": "1.0.18",
-		"mck89/peast": "1.17.2",
+		"mck89/peast": "1.17.4",
 		"monolog/monolog": "2.9.3",
 		"oojs/oojs-ui": "0.53.0",
 		"pear/mail": "2.0.0",
@@ -64,15 +64,15 @@
 		"wikimedia/common-passwords": "0.5.1",
 		"wikimedia/composer-merge-plugin": "2.1.0",
 		"wikimedia/cssjanus": "2.3.0",
-		"wikimedia/css-sanitizer": "6.1.0",
+		"wikimedia/css-sanitizer": "6.2.1",
 		"wikimedia/html-formatter": "4.1.0",
 		"wikimedia/ip-utils": "5.0.0",
 		"wikimedia/json-codec": "4.0.0",
-		"wikimedia/less.php": "5.2.2",
+		"wikimedia/less.php": "5.5.0",
 		"wikimedia/minify": "2.9.0",
 		"wikimedia/normalized-exception": "2.1.1",
 		"wikimedia/object-factory": "5.0.1",
-		"wikimedia/parsoid": "0.22.0",
+		"wikimedia/parsoid": "0.22.3",
 		"wikimedia/php-session-serializer": "3.0.2",
 		"wikimedia/purtle": "2.0.0",
 		"wikimedia/relpath": "4.0.2",
@@ -103,12 +103,12 @@
 		"nikic/php-parser": "^5.5.0",
 		"php-parallel-lint/php-console-highlighter": "1.0.0",
 		"php-parallel-lint/php-parallel-lint": "1.4.0",
-		"phpunit/phpunit": "9.6.21",
-		"psy/psysh": "^0.12.3",
+		"phpunit/phpunit": "9.6.34",
+		"psy/psysh": "^0.12.19",
 		"seld/jsonlint": "1.11.0",
 		"wikimedia/alea": "1.0.0",
 		"wikimedia/langconv": "^0.5.0",
-		"wikimedia/testing-access-wrapper": "^3.0.0",
+		"wikimedia/testing-access-wrapper": "^3.0.0 || ^4.0.0",
 		"wmde/hamcrest-html-matchers": "^1.0.0"
 	},
 	"replace": {
@@ -182,7 +182,10 @@
 			"@lint",
 			"@phpcs"
 		],
-		"phpunit": "phpunit",
+		"phpunit": [
+			"Composer\\Config::disableProcessTimeout",
+			"phpunit"
+		],
 		"phpunit:unit": "@phpunit --colors=always --testsuite=core:unit,extensions:unit",
 		"phpunit:coverage": "@phpunit --testsuite=core:unit --exclude-group Dump,Broken",
 		"phpunit:coverage-edit": "MediaWiki\\Composer\\ComposerPhpunitXmlCoverageEdit::onEvent",
@@ -215,6 +218,9 @@
 			"wikimedia/composer-merge-plugin": true,
 			"composer/installers": true,
 			"dealerdirect/phpcodesniffer-composer-installer": true
+		},
+		"audit": {
+			"block-insecure": false
 		}
 	},
 	"extra": {

docker-compose.yml

@@ -6,7 +6,7 @@
 # DEVELOPERS.md
 services:
   mediawiki:
-    image: docker-registry.wikimedia.org/dev/bookworm-php83-fpm:1.0.0
+    image: docker-registry.wikimedia.org/dev/bookworm-php83-fpm:1.0.0-s1
     user: "${MW_DOCKER_UID}:${MW_DOCKER_GID}"
     volumes:
       - ./:/var/www/html/w:cached

extensions

@@ -20,7 +20,7 @@
  *
  * @since 1.35 (also backported to 1.33.3 and 1.34.1)
  */
-define( 'MW_VERSION', '1.45.1' );
+define( 'MW_VERSION', '1.45.3' );
 
 /** @{
  * Obsolete IDatabase::makeList() constants

includes/Defines.php

@@ -5,11 +5,12 @@
 
 use MediaWiki\Config\ServiceOptions;
 use MediaWiki\Html\HtmlHelper;
+use MediaWiki\MediaWikiServices;
 use MediaWiki\OutputTransform\ContentTextTransformStage;
 use MediaWiki\Parser\Parser;
 use MediaWiki\Parser\ParserOptions;
 use MediaWiki\Parser\ParserOutput;
-use MediaWiki\Parser\Parsoid\ParsoidParser;
+use MediaWiki\Title\Title;
 use MediaWiki\Utils\UrlUtils;
 use Psr\Log\LoggerInterface;
 use Wikimedia\RemexHtml\Serializer\SerializerNode;
@@ -98,11 +99,14 @@ protected function transformText( string $text, ParserOutput $po, ?ParserOptions
 				}
 			}
 		}
-		$title = $po->getExtensionData( ParsoidParser::PARSOID_TITLE_KEY );
-		if ( !$title ) {
+		$title = $po->getTitle();
+		if ( $title === null ) {
 			// We don't think this should ever trigger, but being conservative
 			$this->logger->error( __METHOD__ . ": Missing title information in ParserOutput" );
+			$title = Title::newMainPage();
 		}
+		$titleFormatter = MediaWikiServices::getInstance()->getTitleFormatter();
+		$title = $titleFormatter->getPrefixedDBkey( $title );
 		$pageFragmentPrefix = "./" . $title . "#";
 		foreach ( $po->getIndicators() as $name => $html ) {
 			$po->setIndicator(

includes/OutputTransform/Stages/ExtractBody.php

@@ -10,7 +10,6 @@
 use MediaWiki\Page\PageReferenceValue;
 use MediaWiki\Parser\ParserOptions;
 use MediaWiki\Parser\ParserOutput;
-use MediaWiki\Parser\Parsoid\ParsoidParser;
 use MediaWiki\Title\TitleFactory;
 use Psr\Log\LoggerInterface;
 use Wikimedia\Bcp47Code\Bcp47Code;
@@ -146,18 +145,13 @@ private function localizeI18n(
 	 * @return PageReference
 	 */
 	private function getPageReference( ParserOutput $po ): PageReference {
-		$titleDbKey = $po->getExtensionData( ParsoidParser::PARSOID_TITLE_KEY );
-		if ( !$titleDbKey ) {
-			// We don't think this should ever trigger, but being conservative
-			$this->logger->error( __METHOD__ . ": Missing title information in ParserOutput" );
-			$titleDbKey = 'Special:BadTitle/Localization';
-		}
-		// TODO split PARSOID_TITLE_KEY into ns + title & use PageReferenceValue directly
-		$pageRef = $this->titleFactory->newFromDBkey( $titleDbKey );
-		if ( !$pageRef ) {
+		$title = $po->getTitle();
+		if ( $title === null ) {
 			$this->logger->error( __METHOD__ . ": Bad title information in ParserOutput" );
-			$pageRef = PageReferenceValue::localReference( NS_SPECIAL, 'BadTitle/Localization' );
+			return PageReferenceValue::localReference( NS_SPECIAL, 'BadTitle/Localization' );
 		}
-		return $pageRef;
+		return PageReferenceValue::localReference(
+			$title->getNamespace(), $title->getDBkey()
+		);
 	}
 }

includes/OutputTransform/Stages/ParsoidLocalization.php

@@ -80,6 +80,11 @@ public function getHeader( $key ) {
 		return $this->headers[$key] ?? null;
 	}
 
+	/** @return string[] All set headers */
+	public function getHeaders(): array {
+		return $this->headers ?? [];
+	}
+
 	/**
 	 * Get the HTTP response code, null if not set
 	 *