Separate right for foreign user js redirects
[lhc/web/wiklou.git] / RELEASE-NOTES-1.34
1 = MediaWiki 1.34 =
2
3 == MediaWiki 1.34.0-PRERELEASE ==
4
5 THIS IS NOT A RELEASE YET
6
7 MediaWiki 1.34 is an alpha-quality development branch, and is not recommended
8 for use in production.
9
10 == Upgrading notes for 1.34 ==
11 1.34 has several database changes since 1.33, and will not work without schema
12 updates. Note that due to changes to some very large tables like the revision
13 table, the schema update may take quite long (minutes on a medium sized site,
14 many hours on a large site).
15
16 Don't forget to always back up your database before upgrading!
17
18 See the file UPGRADE for more detailed upgrade instructions, including
19 important information when upgrading from versions prior to 1.11.
20
21 Some specific notes for MediaWiki 1.34 upgrades are below:
22
23 * …
24
25 For notes on 1.33.x and older releases, see HISTORY.
26
27 === Configuration changes for system administrators in 1.34 ===
28
29 ==== New configuration ====
30 * $wgAllowExternalReqID (T201409) - This configuration setting controls whether
31 Mediawiki accepts the request ID set by the incoming request via the
32 `X-Request-Id` header. If set to `true`, that value will be used throughout
33 the code as the request identificator. Otherwise, the sent header will be
34 ignored and the request ID will either be taken from Apache's mod_unique
35 module or will be generated by Mediawiki itself (depending on the set-up).
36 * $wgEnableSpecialMute (T218265) - This configuration controls whether
37 Special:Mute is available and whether to include a link to it on emails
38 originating from Special:Email.
39 * editmyuserjsredirect user right – users without this right now cannot edit JS
40 redirects in their userspace unless the target of the redirect is also in
41 their userspace. By default, this right is given to everyone.
42
43 ==== Changed configuration ====
44 * $wgUseCdn, $wgCdnServers, $wgCdnServersNoPurge, and $wgCdnMaxAge – These four
45 CDN-related config variables have been renamed from being specific to Squid –
46 they were previously $wgUseSquid, $wgSquidServers, $wgSquidServersNoPurge, and
47 $wgSquidMaxage respectively. This aligns them with the related existing
48 variable $wgCdnMaxageLagged. The previous configuration variable names are
49 deprecated, but will be used as the fall back if they are still set.
50 Note that wgSquidPurgeUseHostHeader has not been renamed, as it is deprecated.
51 * (T27707) File type checks for image uploads have been relaxed to allow files
52 containing some HTML markup in metadata. As a result, the $wgAllowTitlesInSVG
53 setting is no longer applied and is now always true. Note that MSIE 7 may
54 still be able to misinterpret certain malformed PNG files as HTML.
55 * Introduced $wgVerifyMimeTypeIE to allow disabling the MSIE 6/7 file type
56 detection heuristic on upload, which is more conservative than the checks
57 that were changed above.
58 * $wgSkipSkin — Setting this instead of $wgSkipSkins, deprecated in 1.23, is now
59 hard-deprecated.
60 * $wgLocalInterwiki — Setting this instead of $wgLocalInterwikis, deprecated in
61 1.23, is now hard-deprecated.
62 * $wgProfileOnly — Setting this, deprecated in 1.23, is now hard-deprecated.
63 Instead, set the log file in $wgDebugLogGroups['profileoutput'].
64 * …
65
66 ==== Removed configuration ====
67 * $wgWikiDiff2MovedParagraphDetectionCutoff — If you still want a custom change
68 size threshold, please specify in php.ini, using the configuration variable
69 wikidiff2.moved_paragraph_detection_cutoff.
70 * $wgDebugPrintHttpHeaders - The default of including HTTP headers in the
71 debug log channel is no longer configurable. The debug log itself remains
72 configurable via $wgDebugLogFile.
73
74 === New user-facing features in 1.34 ===
75 * Special:Mute has been added as a quick way for users to block unwanted emails
76 from other users originating from Special:EmailUser.
77
78 === New developer features in 1.34 ===
79 * The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
80 of headers in private wikis.
81 * Language::formatTimePeriod now supports the new 'avoidhours' option to output
82 strings like "5 days ago" instead of "5 days 13 hours ago".
83
84 === External library changes in 1.34 ===
85
86 ==== New external libraries ====
87 * …
88
89 ==== Changed external libraries ====
90 * Updated Mustache from 1.0.0 to v3.0.1.
91 * Updated OOUI from v0.31.3 to v0.33.2.
92 * Updated composer/semver from 1.4.2 to 1.5.0.
93 * Updated composer/spdx-licenses from 1.4.0 to 1.5.1 (dev-only).
94 * Updated mediawiki/codesniffer from 25.0.0 to 26.0.0 (dev-only).
95 * Updated cssjanus/cssjanus from 1.2.1 to 1.3.0.
96 * Updated wikimedia/at-ease from 1.2.0 to 2.0.0.
97 * Updated wikimedia/remex-html from 2.0.1 to 2.0.3.
98 * Updated monolog/monolog from 1.22.1 to 1.24.0 (dev-only).
99 * Updated wikimedia/object-factory from 1.0.0 to 2.1.0.
100 * Updated wikimedia/timestamp from 2.2.0 to 3.0.0.
101 * Updated wikimedia/xmp-reader from 0.6.2 to 0.6.3.
102 * Updated mediawiki/mediawiki-phan-config from 0.6.0 to 0.6.1 (dev-only).
103 * …
104
105 ==== Removed external libraries ====
106 * The jquery.async module, deprecated in 1.33, was removed.
107 * …
108
109 === Bug fixes in 1.34 ===
110 * (T222529) If a log entry or page revision is recorded in the database with an
111 empty username, attempting to display it will log an error and return a "no
112 username available" to the user instead of silently displaying nothing or
113 invalid links.
114
115 === Action API changes in 1.34 ===
116 * The 'recenteditcount' response property from action=query list=allusers,
117 deprecated in 1.25, has been removed.
118
119 === Action API internal changes in 1.34 ===
120 * …
121
122 === Languages updated in 1.34 ===
123 MediaWiki supports over 350 languages. Many localisations are updated regularly.
124 Below only new and removed languages are listed, as well as changes to languages
125 because of Phabricator reports.
126
127 * (T152908) Added language support for N'Ko (nqo).
128
129 === Breaking changes in 1.34 ===
130 * The global functions wfSuppressWarnings and wfRestoreWarnings, deprecated in
131 1.26, have been removed. Use Wikimedia\AtEase\AtEase::suppressWarnings() and
132 Wikimedia\AtEase\AtEase::restoreWarnings() directly.
133 * Preferences class, deprecated in 1.31, has been removed.
134 * The following parts of code, deprecated in 1.32, were removed in favor of
135 built-in PHP functions:
136 * CryptRand class
137 * CryptRand service
138 * Functions of the MWCryptRand class: singleton(), wasStrong() and generate().
139 * Language::setCode, deprecated in 1.32, was removed. Use Language::factory to
140 create a new Language object with a different language code.
141 * MWNamespace::clearCaches() has been removed. So has the $rebuild parameter
142 to MWNamespace::getCanonicalNamespaces(), which was deprecated since 1.31.
143 Instead, reset services, such as by calling $this->overrideMwServices() (if
144 your test extends MediaWikiTestCase). Services will generally not pick up
145 configuration changes from after they were created, so you must reset
146 services after any configuration change. Even if your code works now, it is
147 likely to break in future versions as more code is moved to services.
148 * The ill-defined "DatabaseOraclePostInit" hook has been removed.
149 * PreferencesFormLegacy and PreferencesForm classes, deprecated in 1.32, have
150 been removed.
151 * ObjectFactory class, deprecated in 1.31, has been removed.
152 * HWLDFWordAccumudlator class, deprecated in 1.28, has been removed.
153 * XMPInfo, XMPReader and XMPValidate, deprecated in 1.32, have been removed.
154 * The RedirectSpecialPage::execute method could sometimes return a Title object.
155 This behavior was removed, and the method now matches the parent signature
156 (SpecialPage::execute) which is to return HTML string or void.
157 To obtain the destination title, use RedirectSpecialPage::getRedirect.
158 * The 'recenteditcount' response property from action API action=query
159 list=allusers, deprecated in 1.25, has been removed.
160 * SearchEngine::userNamespaces(), SearchEngine::namespacesAsText(),
161 SearchEngine::create(), SearchEngine::getSearchTypes() and
162 SearchEngine::getNearMatch(), methods deprecated in 1.27, have been removed.
163 * FileRepo::streamFile(), deprecated in 1.26, has been removed.
164 * User::randomPassword() method, deprecated in 1.27, have been removed.
165 * MWNamespace::canTalk(), deprecated in 1.30, have been removed.
166 * Parser class property $mUniqPrefix, deprecated in 1.26, has been removed.
167 * wfArrayFilter() and wfArrayFilterByKey(), deprecated in 1.32, have been
168 removed.
169 * wfMakeUrlIndexes() function, deprecated in 1.33, have been removed.
170 * Method signatures in WatchedItemQueryServiceExtension have changed from taking
171 User objects to taking UserIdentity objects. Extensions implementing this
172 interface need to be changed accordingly.
173 * User::getGroupPage() and ::makeGroupLinkHTML(), deprecated in 1.29, have been
174 removed. Use UserGroupMembership::getGroupPage and ::getLink instead.
175 * User::makeGroupLinkWiki(), deprecated in 1.29, has been removed. Use
176 UserGroupMembership::getLink() instead.
177 * SavepointPostgres, deprecated in 1.31, has been removed.
178 * OutputPage::enableSectionEditLinks(), OutputPage::sectionEditLinksEnabled(),
179 ParserOptions::getEditSection(), ParserOptions::setEditSection(), and
180 ParserOutput::getEditSectionTokens, ::getTOCEnabled, ::setEditSectionTokens,
181 and ::setTOCEnabled, deprecated in 1.31, have been removed.
182 * EditPage::safeUnicodeInput() and ::safeUnicodeOutput(), deprecated in 1.30,
183 have been removed.
184 * Four methods in OutputPage, deprecated in 1.32, have been removed. You should
185 use OutputPage::showFatalError or throw a FatalError instead. The methods are
186 ::showFileCopyError(), ::showFileRenameError(), ::showFileDeleteError(), and
187 ::showFileNotFoundError().
188 * ApiBase::truncateArray(), deprecated in 1.32, has been removed.
189 * IcuCollation::getICUVersion(), deprecated in 1.32, has been removed. Use PHP's
190 INTL_ICU_VERSION constant directly.
191 * HTMLForm::setSubmitProgressive(), deprecated in 1.32, has been removed.
192 * ResourceLoaderStartUpModules::getStartupModules() and ::getLegacyModules(),
193 both deprecated in 1.32, have been removed.
194 * BaseTemplate::msgHtml() and QuickTemplate::msgHtml(), deprecated in 1.32, have
195 been removed. Use ->msg() or ->getMsg() instead.
196 * WatchAction::getUnwatchToken(), deprecated in 1.32, has been removed. Instead,
197 use WatchAction::getWatchToken() with action 'unwatch' directly.
198 * Language::initEncoding(), ::recodeForEdit(), and recodeInput(), deprecated in
199 1.28, have been removed.
200 * PageArchive::getTextFromRow(), ::listAllPages(), and ::getLastRevisionText(),
201 deprecated in 1.32, have been removed.
202 * OutputPage::getModuleScripts(), ParserOutput::getModuleScripts(), deprecated
203 in 1.33, have been removed.
204 * User::getPasswordValidity(), deprecated in 1.33, has been removed.
205 * ApiQueryBase::prepareUrlQuerySearchString(), deprecated in 1.33, has been
206 removed.
207 * ChangeTags::purgeTagUsageCache(), deprecated in 1.33, has been removed.
208 * JobQueueGroup::pushLazyJobs(), deprecated in 1.33, has been removed.
209 * MediaWikiTestCase::stashMwGlobals(), deprecated in 1.32, has been removed.
210 * SearchEngine::transformSearchTerm(), deprecated in 1.32, has been removed.
211 * The Block typehint only refers to blocks stored in the database. It should be
212 updated to AbstractBlock in cases where any type of block could be expected.
213 * FileRepoStatus, deprecated in 1.25, has been removed.
214 * The LegacyHookPreAuthenticationProvider class, deprecated since its creation
215 in 1.27, has been removed.
216 * IP::isValidBlock(), deprecated in 1.30, has been removed.
217 * WikiPage::prepareContentForEdit now doesn't accept an integer for $revision,
218 was deprecated in 1.25.
219 * The jquery.byteLength module, deprecated in 1.31, was removed.
220 Use the mediawiki.String module instead.
221 * mw.language.specialCharacters, deprecated in 1.33, has been removed.
222 Use require( 'mediawiki.language.specialCharacters' ) instead.
223 * EditPage::submit(), deprecated in 1.29, has been removed. Use $this->edit()
224 directly.
225 * HTMLForm::getErrors(), deprecated in 1.28, has been removed. Use
226 getErrorsOrWarnings() instead.
227 * SpecialPage::getTitle(), deprecated in 1.23, has been removed. Use
228 SpecialPage::getPageTitle() instead.
229 * jquery.ui.effect-bounce, jquery.ui.effect-explode, jquery.ui.effect-fold
230 jquery.ui.effect-pulsate, jquery.ui.effect-slide, jquery.ui.effect-transfer,
231 which are no longer used, have now been removed.
232 * SpecialEmailUser::validateTarget(), ::getTarget() without a sender/user
233 specified, deprecated in 1.30, have been removed.
234 * BufferingStatsdDataFactory::getBuffer(), deprecated in 1.30, has been removed.
235 * The constant DB_SLAVE, deprecated in 1.28, has been removed. Use DB_REPLICA.
236 * The constants NS_IMAGE and NS_IMAGE_TALK, deprecated in 1.14, have been
237 removed. Use NS_FILE and NS_FILE_TALK respectively.
238 * Replacer, DoubleReplacer, HashtableReplacer and RegexlikeReplacer
239 (deprecated in 1.32) have been removed. Closures should be used instead.
240 * OutputPage::addWikiText(), ::addWikiTextWithTitle(), ::addWikiTextTitleTidy(),
241 ::addWikiTextTidy(), ::addWikiTextTitle(), deprecated in 1.32, have been
242 removed.
243 * The $wgUseKeyHeader configuration option and the OutputPage::getKeyHeader()
244 method, deprecated in 1.32, have been removed.
245 * WebInstallerOutput::addWikiText(), deprecated in 1.32, has been removed.
246 * Parser::fetchFile(), deprecated in 1.32, has been removed. Use the method
247 Parser::fetchFileAndTitle() instead.
248 * The global function wfBCP47, deprecated in 1.31, has been removed.
249 * wfCountDown() function, deprecated in 1.31, has been removed. Use
250 \Maintenance::countDown() method instead.
251 * OutputPage::wrapWikiMsg() no longer accepts an options parameter. This was
252 deprecated since 1.20.
253 * Skin::outputPage() no longer accepts a context. This was deprecated in 1.20.
254 * Linker::link() no longer accepts a string for the query array, as was
255 deprecated in 1.20.
256 * PrefixSearch::titleSearch(), deprecated in 1.23, has been removed. Use the
257 SearchEngine::defaultPrefixSearch or ::completionSearch() methods instead.
258 * The UserRights hook, deprecated in 1.26, has been removed. Instead, use the
259 UserGroupsChanged hook.
260 * Skin::getDefaultInstance(), deprecated in 1.27, has been removed. Get the
261 instance from MediaWikiServices instead.
262 * The UserLoadFromSession hook, deprecated in 1.27, has been removed.
263 * The wfResetSessionID global function, deprecated in 1.27, has been removed.
264 Use MediaWiki\Session\SessionManager instead.
265 * The wfGetLBFactory global function, deprecated in 1.27, has been removed.
266 Use MediaWikiServices::getInstance()->getDBLoadBalancerFactory().
267 * The internal method OutputPage->addScriptFile() will no longer silently drop
268 calls that use an invalid path (i.e., something other than an absolute path,
269 protocol-relative URL, or full scheme URL), and will instead pass them to the
270 client where they will likely 404. This usage was deprecated in 1.24.
271 * Database::reportConnectionError, deprecated in 1.32, has been removed.
272 * APIEditBeforeSave hook, deprecated in 1.28, has been removed. Please see
273 EditFilterMergedContent hook for an alternative way to use this feature.
274 * API module methods getDescription(), getParamDescription(), & getExamples(),
275 all deprecated in 1.25 and ignored, have been removed.
276 * The API module method getDescriptionMessage(), deprecated in 1.30, has been
277 removed.
278 * The JavaScript global variable wgLoadScript has been removed. Use
279 mw.util.wikiScript( 'load' ) instead.
280 * ResourceLoader no longer creates the 'mw.legacy' placeholder object. It has
281 been unused since 1.16 and was deprecated in 1.22. To deprecate a property
282 in JavaScript, use mw.log.deprecate() instead.
283 * The 'user.groups' module, deprecated in 1.28, was removed.
284 Use the 'user' module instead.
285 * The ability to override User::$mRights has been removed. Use
286 PermissionManager::addTemporaryUserRights() instead.
287 * Previously, when iterating ResultWrapper with foreach() or a similar
288 construct, the range of the index was 1..numRows. This has been fixed to be
289 0..(numRows-1).
290 * The ChangePasswordForm hook, deprecated in 1.27, has been removed. Use the
291 AuthChangeFormFields hook or security levels instead.
292 * WikiMap::getWikiIdFromDomain(), deprecated in 1.33, has been removed.
293 Use WikiMap::getWikiIdFromDbDomain() instead.
294 * The config variables $wgHtml5, $wgJsMimeType, and $wgXhtmlDefaultNamespace,
295 which were deprecated and ignored by core since 1.22, are no longer set to any
296 value, and SkinTemplate no longer emits a 'jsmimetype' key. Any extensions not
297 updated since 2013 to cope with this deprecation may now break.
298 * (T222637) Passing ResourceLoaderModule objects to ResourceLoader::register()
299 or $wgResourceModules is no longer supported.
300 Use the 'class' or 'factory' option of the array format instead.
301 * The parameter $lang of the functions generateTOC and tocList in Linker and
302 DummyLinker must be in type Language when present. Other types are
303 deprecated since 1.33.
304 * …
305
306 === Deprecations in 1.34 ===
307 * The MWNamespace class is deprecated. Use NamespaceInfo.
308 * ExtensionRegistry->load() is deprecated, as it breaks dependency checking.
309 Instead, use ->queue().
310 * User::isBlocked() is deprecated since it does not tell you if the user is
311 blocked from editing a particular page. Use User::getBlock() or
312 PermissionManager::isBlockedFrom() or PermissionManager::userCan() instead.
313 * User::isLocallyBlockedProxy and User::inDnsBlacklist are deprecated and moved
314 to the BlockManager as private helper methods.
315 * User::isDnsBlacklisted is deprecated. Use BlockManager::isDnsBlacklisted
316 instead.
317 * The Config argument to ChangesListSpecialPage::checkStructuredFilterUiEnabled
318 is deprecated. Pass only the User argument.
319 * WatchedItem::getUser is deprecated. Use getUserIdentity.
320 * Passing a Title as the first parameter to the getTimestampById method of
321 RevisionStore is deprecated. Omit it, passing only the remaining parameters.
322 * Title::getPreviousRevisionId and Title::getNextRevisionId are deprecated. Use
323 RevisionLookup::getPreviousRevision and RevisionLookup::getNextRevision.
324 * The Title parameter to RevisionLookup::getPreviousRevision and
325 RevisionLookup::getNextRevision is deprecated and should be omitted.
326 * MWHttpRequest::factory is deprecated. Use HttpRequestFactory.
327 * The Http class is deprecated. For the request, get, and post methods, use
328 HttpRequestFactory. For isValidURI, use MWHttpRequest::isValidURI. For
329 getProxy, use (string)$wgHTTPProxy. For createMultiClient, construct a
330 MultiHttpClient directly.
331 * Http::$httpEngine is deprecated and has no replacement. The default 'guzzle'
332 engine will eventually be made the only engine for HTTP requests.
333 * RepoGroup::singleton(), RepoGroup::destroySingleton(),
334 RepoGroup::setSingleton(), wfFindFile(), and wfLocalFile() are all
335 deprecated. Use MediaWikiServices instead.
336 * The getSubjectPage, getTalkPage, and getOtherPage of Title are deprecated.
337 Use NamespaceInfo's getSubjectPage, getTalkPage, and getAssociatedPage.
338 * MWMessagePack class, no longer used, has been deprecated in 1.34.
339 * The Block class is separated into DatabaseBlock (for blocks stored in the
340 database), and SystemBlock (for temporary blocks created by the system).
341 SystemBlock should be used when creating any temporary blocks. Block is
342 a deprecated alias for DatabaseBlock.
343 * Parser::$mConf is deprecated. It will be removed entirely in a later version.
344 Some context can be found at T224165.
345 * Constructing Parser directly is deprecated. Obtain one from ParserFactory.
346 * Title::moveSubpages is deprecated. Use MovePage::moveSubpages or
347 MovePage::moveSubpagesIfAllowed.
348 * The MWNamespace class is deprecated. Use MediaWikiServices::getNamespaceInfo.
349 * (T62260) Hard deprecate Language::getExtraUserToggles() method.
350 * Language::viewPrevNext function is deprecated, use
351 PrevNextNavigationRenderer::buildPrevNextNavigation instead
352 * User::trackBlockWithCookie and DatabaseBlock::clearCookie are deprecated. Use
353 BlockManager::trackBlockWithCookie and BlockManager::clearCookie instead.
354 * DatabaseBlock::setCookie, DatabaseBlock::getCookieValue,
355 DatabaseBlock::getIdFromCookieValue and AbstractBlock::shouldTrackWithCookie
356 are moved to internal helper methods for BlockManager::trackBlockWithCookie.
357 * ResourceLoaderContext::getConfig and ResourceLoaderContext::getLogger have
358 been deprecated. Inside ResourceLoaderModule subclasses, use the local methods
359 instead. Elsewhere, use the methods from the ResourceLoader class.
360 * The Preprocessor_DOM implementation has been deprecated. It will be
361 removed in a future release. Use the Preprocessor_Hash implementation
362 instead.
363 * Sanitizer::attributeWhitelist() and Sanitizer::setupAttributeWhitelist()
364 have been deprecated; they will be made private in the future.
365 * SearchResult::termMatches() method is deprecated. It was unreliable because
366 only populated by few search engine implementations. Use
367 SqlSearchResult::getTermMatches() if really needed.
368 * SearchResult::getTextSnippet( $terms ) the $terms param is being deprecated
369 and should no longer be passed. Search engine implemenations should be
370 responsible for carrying relevant information needed for highlighting with
371 their own SearchResultSet/SearchResult sub-classes.
372 * SearchEngine::$searchTerms protected field is deprecated. Moved to
373 SearchDatabase.
374 * The use of the $terms param in the ShowSearchHit and ShowSearchHitTitle
375 hooks is highly discouraged as it's only populated by SearchDatabase search
376 engines.
377 * Skin::escapeSearchLink() is deprecated. Use Skin::getSearchLink() or the skin
378 template option 'searchaction' instead.
379 * LoadBalancer::haveIndex() and LoadBalancer::isNonZeroLoad() have
380 been deprecated.
381 * User::getRights() and User::$mRights have been deprecated. Use
382 PermissionManager::getUserPermissions() instead.
383 * The LocalisationCacheRecache hook no longer allows purging of message blobs
384 to be prevented. Modifying the $purgeBlobs parameter now has no effect.
385
386 === Other changes in 1.34 ===
387 * …
388
389 == Compatibility ==
390 MediaWiki 1.34 requires PHP 7.0.13 or later. Although HHVM 3.18.5 or later is
391 supported, it is generally advised to use PHP 7.0.13 or later for long term
392 support.
393
394 MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
395 but support for them is somewhat less mature. There is experimental support for
396 Oracle and Microsoft SQL Server.
397
398 The supported versions are:
399
400 * MySQL 5.5.8 or later
401 * PostgreSQL 9.2 or later
402 * SQLite 3.8.0 or later
403 * Oracle 9.0.1 or later
404 * Microsoft SQL Server 2005 (9.00.1399)
405
406 == Online documentation ==
407 Documentation for both end-users and site administrators is available on
408 MediaWiki.org, and is covered under the GNU Free Documentation License (except
409 for pages that explicitly state that their contents are in the public domain):
410
411 https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation
412
413 == Mailing list ==
414 A mailing list is available for MediaWiki user support and discussion:
415
416 https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
417
418 A low-traffic announcements-only list is also available:
419
420 https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce
421
422 It's highly recommended that you sign up for one of these lists if you're
423 going to run a public MediaWiki, so you can be notified of security fixes.
424
425 == IRC help ==
426 There's usually someone online in #mediawiki on irc.freenode.net.