Release notes

PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/ PHP 8.4 workboard: https://phabricator.wikimedia.org/tag/php_8.4_support/ PHP 8.5 workboard: https://phabricator.wikimedia.org/tag/php_8.5_support/

THIS IS NOT A RELEASE YET

MediaWiki 1.47 is an alpha-quality development branch, and is not recommended for use in production.

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.39.

Some specific notes for MediaWiki 1.47 upgrades are below:

• …

For notes on 1.46.x and older releases, see HISTORY.

• $wgGroupPermissions['*']['autocreateaccount'] now defaults to true. This matches the default for $wgGroupPermissions['*']['createaccount']. If you're using an extension that allows autocreation of local accounts, you wish to prevent it, and you've already set `$wgGroupPermissions['*']['createaccount'] = false`, set `$wgGroupPermissions['*']['autocreateaccount'] = false` too.
• …

• $wgRestModuleOverrides - (T422756) Defaults to `[]`, allows overriding the default behavior mode of REST modules. See MediaWiki\Rest\Module\ModuleMode for details on available modes.
• …

• …

• $wgThumbnailStepsRatio, a temporary config, has been removed.
• …

• (T196386) MediaWiki now disallows account creation if an account by that name has previously existed and has been renamed, to prevent impersonation and (if this feature is enabled on your wiki) taking over user Javascript and CSS pages redirected after the rename. Users with the 'createpreviouslyrenamedaccount' right (granted to the 'sysop' group by default) can override this in the account creation form. Renaming an existing account to a previously existing username displays a warning, which can also be overridden.
• (T424179) A new tag has been added called "Edited other user's CSS". It is automatically applied to edits to CSS pages in userspace that are not subpages of the user making the edit.
• …

• …

• (T389281) The Language and LocalisationCache classes now support using the Leximorph library. Language supports Leximorph for grammar, plural, gender, formality, and bidi transformations, which also affects parser functions that use these Language methods. LocalisationCache supports loading plural rules from Leximorph. When $wgUseLeximorph is enabled, these features use Leximorph's modular handlers instead of the legacy implementations and plural-rule files.
• Two new hooks, OutputTransformFirstStageHook and OutputTransformLastStageHook, provide a modern replacement for the ParserOutputPostCacheTransform hook, allowing DOM-based manipulation in the postprocessing phase.
• (T318376) The SkinTemplateNavigation::Universal hook now supports 'footer-info' and 'footer-places' keys for modifying footer menus, as an alternative to the SkinAddFooterLinks hook.
• Authentication providers can now check whether an authentication process is a login or a reauthentication, and what the security level is, by looking at the ElevatedSecurityAuthenticationRequest (or lack thereof). Reauthentication can be triggered via a new 'securityLevel' option to AuthManager::getAuthenticationRequests().
• (T422551) The REST API framework now supports audience designations on REST modules. See MediaWiki\Rest\Module\AudienceDesignation for details. Modules requiring a different behavior mode can use the new RestModuleOverrides configuration variable.
• (T412542) The UrlUtils class now has an option to allow any URL protocol: `UrlUtils::VALID_PROTOCOLS => UrlUtils::ALL_PROTOCOLS`.
• …

• Added symfony/polyfill-php86 at 1.37.0.
• Added symfony/mailer at 7.4.12.
• Added symfony/mime at 7.4.12.
• …

• Added fig/log-test at 1.2.1.
• …

• Updated psr/log from 1.1.4 to 3.0.2.
• Updated symfony/polyfill-php84 from 1.36.0 to 1.38.1.
• Updated symfony/polyfill-php85 from 1.36.0 to 1.38.1.
• Updated symfony/polyfill-php86 from 1.36.0 to 1.38.0.
• Updated symfony/yaml from 7.4.6 to 7.4.12.
• Updated wikimedia/json-codec from 4.0.0 to 5.0.0.
• Updated codex, codex-design-tokens and codex-icons from v2.5.1 to v2.6.0.
• Updated OOUI from v0.53.2 to v0.54.0
• …

• Updated composer/spdx-licenses from 1.5.9 to 1.6.0.
• Updated mediawiki/mediawiki-codesniffer from 50.0.0 to 51.0.0.
• …

• Removed pear/mail, pear/mail_mime and pear/net_smtp (and their abandoned transitive dependency pear/net_socket), replaced by symfony/mailer and symfony/mime.
• …

• …

• php response format has been removed.
• When encountering a 'reauthenticate' error, clients must start a new authentication process by passing the "operation" value included in the error into meta=authmanagerinfo&amirequestsfor=login as 'amireauthenticate', and then passing the received requests to action=clientlogin and following the normal login process.
• The action=logout API has a new 'global' optional parameter. When set to truish, the user will be logged out on all devices, not just the current one. Unlike the old behavior, global logout can be performed via an authentication type where "log out on the current device" doesn't make sense (e.g. OAuth).
• (T426802) prop=imageinfo now includes timestamp, user, size, and comment fields for file revisions where the file blob is missing from storage, alongside the existing "filemissing" flag.
• …

• …

MediaWiki supports over 350 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

• …

• It is no longer possible to pass null to the $output parameter of FeedUtils::checkFeedOutput. This behaviour was deprecated in 1.46.
• ChannelFeed::outHeader(), ::outItem(), ::outFooter(), ::httpHeaders() and  ::outXmlHeader() have been removed. Use/override ::outputHeader(),  ::outputItem(), ::outputFooter(), ::sendHttpHeaders() and ::outputXmlHeader() instead.
• ResourceLoader::makeConfigSetScript, deprecated in 1.44, has been removed. Use package files instead or return mw.config.set() combined with RL\Context::encodeJson, if available. Otherwise, use FormatJson::encode.
• IDatabase::lockIsFree, deprecated in 1.46, was removed. For non-blocking locks, use IDatabase::lock with timeout 0 instead.
• BaseSearchResultSet::next() and ::rewind(), deprecated since 1.32 have now been removed. Use ::extractResults() or a foreach loop instead.
• The ParsoidService class, deprecated since 1.39, has been removed. Use the relevant MediaWikiServices access points instead.
• The method Action::getArticle is now final. Overriding of this method fails now.
• LockManager::doLockByType and LockManager::doUnlockByType must be implemented by subclasses. LockManager::doLock and LockManager::doUnlock no longer must be implemented.
• The SpecialPage root and intermediate classes are now marked as abstract: - SpecialPage - ContributionsSpecialPage - IncludableSpecialPage - UnlistedSpecialPage Instantiate a subclass instead.
• It is no longer possible to call File::getShortDesc, File::getLongDesc, File::getDescriptionText, File::getDimensionsString, MediaHandler::getGeneralShortDesc or MediaHandler::getGeneralLongDesc without specifying a language, deprecated in 1.46.
• The unused method SpecialVersion::getVersionLinked, deprecated in 1.46, has been removed.
• The ConditionalDefaultOptionsAddCondition hook, deprecated in 1.46, has been removed. There is no replacement.
• The ability to construct a HTMLFormField without a parent, deprecated in 1.40, has been removed.
• The EditFilter hook, deprecated in 1.46, has been removed. Use EditFilterMergedContent or MultiContentSave instead.
• The protected static method UserMailer::sendWithPear() has been removed following the migration from PEAR Mail to symfony/mailer.
• …

• (T166010) All PHP code in MediaWiki is slowly being moved to be in a class namespace as appropriate, so that we can use PSR-4 auto-loading, which will speed up general code loading of MediaWiki. The old global namespace class names are being left behind as deprecated aliases.

 In this release of MediaWiki, XXX classes now have a namespace and XXX do
 not yet (XXX% done, up from 99% in MediaWiki 1.46.0). The following have newly
 been moved:
 - Wikimedia:
   - Cookie
   - CookieJar
   - Deflate
   - DnsSrvDiscoverer
   - MWCryptHash
   - RiffExtractor
   - UDPTransport
   - XhprofData
 - Wikimedia\Iterators:
   - IteratorDecorator
   - MappedIterator
   - NotRecursiveIterator
 - Wikimedia\ObjectCache:
   - MemoizedCallable
 - …

• The PatrolLog::record method is deprecated and will trigger deprecation warnings. Use PatrolManager::createPatrolLog instead.
• Title::canUseNoindex() is deprecated with warnings. Please use NamespaceInfo::canUseNoindex() instead.
• The MarkPatrolledComplete hook has been deprecated and will trigger deprecation warnings. Use the MarkPatrolledAudit hook instead.
• FileBackendStore::memCache is now deprecated. Instead, subclasses should use FileBackendStore::wanStatCache.
• FileBackendStore::cheapCache is now deprecated. Instead, subclasses should use FileBackendStore::procFileStatCache.
• FileBackendStore::expensiveCache is now deprecated. Instead, subclasses should use FileBackendStore::procFileDataCache.
• FSFile::extensionFromPath() has been deprecated. Use the older FileBackend::extensionFromPath() instead.
• Calling FileBackend::extensionFromPath() with a $case parameter is deprecated and will default to lowercase in the future.
• ResourceLoader::inDebugMode is now deprecated and emits deprecation warnings.
• QuickTemplate::msg() and QuickTemplate::haveMsg() got deprecated and shouldn't be used any more.
• The EditPageBeforeConflictDiff hook has been deprecated and will trigger deprecation warnings.
• The global variable $wgLang has been deprecated. Use an available ContextSource instead, falling back to RequestContext::getMain(). As MediaWiki Core no longer reads from $wgLang, writing to $wgLang in extensions will no longer affect core.
• Supplying the $request parameter to EditPage::importFormData() has been deprecated and emits deprecation warnings. The method will use the request from the context stored in the Article passed to the EditPage constructor instead. To use a different request, provide the Article with an appropriate context before instantiating EditPage.
• Skin::mapInterwikiToLanguage has been deprecated. Use the InterlanguageLinkCodeMap config setting directly.
• Parser::statelessFetchTemplate() and ::statelessFetchRevisionRecord() have been deprecated. Use ParserOptions::getTemplateCallback() to get the original handler.
• Parser::getExternalLinkRel() has been deprecated. Use LinkRenderer.
• Title::hasSourceText(), ::getDefaultMessageText() and  ::getDefaultSystemMessage() have been deprecated. Use ShadowPageLoader.
• Passing $revision as a string to LintErrorChecker::check() and ::checkSome() is deprecated and will trigger deprecation warnings. Use MutableRevisionRecord::newFromContent() to pass a WikitextContent constructed with your string.
• A non-empty $query parameter to Linker::makeBrokenImageLinkObj() and Linker::getUploadUrl() has been deprecated and will trigger deprecation warnings. There appear to be few users of these methods and no users of this parameter since around MW 1.21 when they were removed from Skin.
• Linker::makeBrokenImageLinkObj() used to wfWarn if the first argument was not a LinkTarget. This has been changed to a deprecation warning. In a future release this will be a type hint on the argument.
• The ParserOptionsRegister hook has been deprecated and replaced by ParserOptionsDefaults.
• MediaWikiIntegrationTestCase::assertSelect() has been deprecated, use MediaWikiIntegrationTestCase::newSelectQueryBuilder() instead.
• MediaWikiIntegrationTestCase::assertArraySubmapSame() has been deprecated, use MediaWikiTestCaseTrait::assertArrayContains() instead.
• MediaTransformOutput::streamFile(), deprecated since 1.26, now emits deprecation warnings. Use streamFileWithStatus() instead.
• LocalFile::lock() and LocalFile::unlock(), deprecated since 1.38, now emit deprecation warnings. Use acquireFileLock() and releaseFileLock() instead. LocalFileLockError is deprecated along with these methods.
• …

• …

MediaWiki 1.47 requires PHP 8.3.0 or later and the following PHP extensions:

• ctype
• dom
• fileinfo
• iconv
• intl
• mbstring
• xml

MariaDB is the recommended database software. MySQL, PostgreSQL, or SQLite can be used instead, but support for them is somewhat less mature.

The supported versions are:

• MariaDB 10.3 or higher
• MySQL 5.7.0 or higher
• PostgreSQL 10 or later
• SQLite 3.8.0 or later

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

 <https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation>

A mailing list is available for MediaWiki user support and discussion:

 <https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/>

A low-traffic announcements-only list is also available:

 <https://lists.wikimedia.org/postorius/lists/mediawiki-announce.lists.wikimedia.org/>

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

There's usually someone online in #mediawiki on irc.libera.chat.