Add support for Argon2 password hashing

[lhc/web/wiklou.git] / RELEASE-NOTES-1.33

diff --git a/RELEASE-NOTES-1.33 b/RELEASE-NOTES-1.33
index da87d1e..55787e7 100644 (file)
--- a/RELEASE-NOTES-1.33
+++ b/RELEASE-NOTES-1.33
@@ -50,6 +50,9 @@ production.
   pages.
 * (T214706) LinksUpdate::getAddedExternalLinks() and
   LinksUpdate::getRemovedExternalLinks() were introduced.
+* Argon2 password hashing is now available, can be enabled via
+  $wgPasswordDefault = 'argon2'. It's designed to resist timing attacks
+  (requires PHP 7.2+) and GPU hacking (7.3+).
 
 === External library changes in 1.33 ===
 
@@ -66,6 +69,7 @@ production.
   * The deprecated IPSet\IPSet alias was removed, Wikimedia\IPSet must be
     used instead.
 * Updated qunitjs from 2.6.2 to 2.9.1.
+* Updated jquery-client from 2.0.1 to 2.0.2.
 
 ==== Removed external libraries ====
 
@@ -228,6 +232,15 @@ because of Phabricator reports.
 * User::getGroupName() and ::getGroupMember(), both deprecated in 1.29, have
   been removed. Instead, please use UserGroupMembership::getGroupName() and
   UserGroupMembership::getGroupMemberName().
+* Backwards compatibility for setting wgSessionsInObjectCache to false or using
+  wgSessionHandler, both of which were deprecated in 1.27 with the introduction
+  of SessionManager, has been removed.
+* SessionManager::autoCreateUser, deprecated in 1.27, has been removed. Use
+  MediaWiki\Auth\AuthManager::autoCreateUser instead.
+* The mw.libs.jpegmeta property, deprecated in 1.31, was removed.
+  Use require( 'mediawiki.libs.jpegmeta' ) instead.
+* The mw.user.stickyRandomId() method, deprecated in 1.32, was removed.
+  Use mw.user.getPageviewToken() instead.
 
 === Deprecations in 1.33 ===
 * The configuration option $wgUseESI has been deprecated, and is expected
@@ -272,10 +285,11 @@ because of Phabricator reports.
   use the new extension registration key 'QUnitTestModule'.
 * (T213426) The jquery.throttle-debounce module has been deprecated. JavaScript
   code that needs this behaviour should use OO.ui.debounce/throttle.
+* The mw.language.specialCharacters property from the
+  'mediawiki.language.specialCharacters' module has been deprecated.
+  Use require( 'mediawiki.language.specialCharacters' ) instead.
 
 === Other changes in 1.33 ===
-* (T208871) The hard-coded Google search form on the database error page was
-  removed.
 * (T201747) Html::openElement() warns if given an element name with a space
   in it.