RELEASE-NOTES-1.33

   1 == MediaWiki 1.33 ==
   2
   3 THIS IS NOT A RELEASE YET
   4
   5 MediaWiki 1.33 is an alpha-quality branch and is not recommended for use in
   6 production.
   7
   8 === Configuration changes in 1.33 ===
   9
  10 ==== New configuration ====
  11 * $wgEnablePartialBlocks – This enables the Partial Blocks feature, which gives
  12   accounts with block permissions the ability to block users, IPs, and IP ranges
  13   from editing specific pages, while allowing them to edit the rest of the wiki.
  14
  15 ==== Changed configuration ====
  16 * Some external link searches will not work correctly until update.php (or
  17   refreshExternallinksIndex.php) is run. These include searches for links using
  18   IP addresses, internationalized domain names, and possibly mailto links.
  19 * (T193868) $wgChangeTagsSchemaMigrationStage — This temporary setting, added in
  20   MediaWiki 1.32, now defaults to MIGRATION_NEW instead of MIGRATION_WRITE_BOTH.
  21 * Special:ActiveUsers will no longer filter out users who became inactive since
  22   the last time the active users query cache was updated.
  23 * If you ran migrateActors.php using an older version of MediaWiki and want to
  24   run your wiki with $wgActorTableSchemaMigrationStage SCHEMA_COMPAT_READ_OLD,
  25   note that log_search rows needed to find revision deletions by target user
  26   were incorrectly deleted. See T215464 for details.
  27
  28 ==== Removed configuration ====
  29 * (T199334) $wgTagStatisticsNewTable — This temporary setting, added in
  30   MediaWiki 1.32, has now been removed. When loading Special:Tags, MediaWiki
  31   will now always use the `change_tag_def` instead of the `change_tag` table.
  32 * MediaWiki now always tidies user output, and most related
  33   configuration has been removed. Thus $wgUseTidy, $wgTidyBin,
  34   $wgTidyConf, $wgTidyOpts, $wgTidyInternal, and $wgDebugTidy, all
  35   deprecated since 1.26, have now all been removed. The $wgTidyConfig
  36   setting remains only for Remex experimental features or debugging.
  37 * $wgEnableParserCache, deprecated since 1.26, was removed.
  38   If disabling the parser cache is still desirable,
  39   set `$wgParserCacheType = CACHE_NONE;` instead.
  40 * $wgCommentTableSchemaMigrationStage has been removed. Extension code finding
  41   it unset should treat it as being MIGRATION_NEW.
  42 * $wgAuth – This old setting, deprecated in 1.27, has been removed as part of
  43   the removal of AuthPlugin.
  44 * $wgSitesCacheFile has been removed. It was introduced in 1.25 to allow sites
  45   to configure a file in which to cache the SiteStore database table.
  46   This was never used. SiteStore already caches its information by default
  47   using BagOStuff (e.g. Memcached or APC).
  48 * $wgClockSkewFudge has been removed. It was used by User.php to minimize the
  49   chances of a user.user_touched database update to the "current" timestamp
  50   being before the value already there (e.g. due to clock skew between different
  51   servers). This is no longer a problem because the code now ensures the
  52   timestamp is always higher than the previous one. The writes are guarded with
  53   CAS logic (check and set), which prevents updates that would overlap.
  54
  55 === New features in 1.33 ===
  56 * (T96041) __EXPECTUNUSEDCATEGORY__ on a category page causes the category
  57   to be hidden on Special:UnusedCategories.
  58 * Add PasswordPolicy to check the password isn't in the large blacklist.
  59 * The AuthManagerLoginAuthenticateAudit hook has a new parameter for
  60   additional information about the authentication event.
  61 * TextContent::getText() was introduced as a replacement for
  62   Content::getNativeData() for text-based content models.
  63 * (T210814) SVGs are now by default displayed in wiki language on image
  64   pages.
  65 * (T214706) LinksUpdate::getAddedExternalLinks() and
  66   LinksUpdate::getRemovedExternalLinks() were introduced.
  67 * Argon2 password hashing is now available, can be enabled via
  68   $wgPasswordDefault = 'argon2'. It's designed to resist timing attacks
  69   (requires PHP 7.2+) and GPU hacking (7.3+).
  70 * Special:CreateAccount now warns the user if their chosen username has to be
  71   normalized.
  72 * (T205040) Multilingual images are now be displayed in the current parse
  73   language where available.
  74
  75 === External library changes in 1.33 ===
  76
  77 ==== New external libraries ====
  78 * Added wikimedia/password-blacklist 0.1.4.
  79 * Added guzzlehttp/guzzle 6.3.3.
  80 * Added jakub-onderka/php-console-highlighter 0.3.2 explicitly (dev-only).
  81
  82 ==== Changed external libraries ====
  83 * Updated OOUI from v0.29.2 to v0.31.0.
  84 * Updated OOjs Router from pre-release to v0.2.0.
  85 * Updated moment from v2.19.3 to v2.24.0.
  86 * Updated wikimedia/xmp-reader from 0.6.0 to 0.6.2.
  87 * Updated wikimedia/scoped-callback from 2.0.0 to 3.0.0.
  88 * Updated wikimedia/ip-set from 1.2.0 to 2.0.1.
  89   * The deprecated IPSet\IPSet alias was removed, Wikimedia\IPSet must be
  90     used instead.
  91 * Updated qunitjs from 2.6.2 to 2.9.1.
  92 * Updated jquery-client from 2.0.1 to 2.0.2.
  93 * Updated psy/psysh from 0.9.6 to 0.9.9 (dev-only).
  94 * Updated nikic/php-parser from 3.1.3 to 3.1.5 (dev-only).
  95 * Updated pear/net_smtp from 1.8.0 to 1.8.1.
  96 * Updated cssjanus/cssjanus from 1.2.0 to 1.2.1.
  97 * Updated wikimedia/php-session-serializer from 1.0.6 to 1.0.7.
  98
  99 ==== Removed external libraries ====
 100
 101 === Bug fixes in 1.33 ===
 102 * (T164211) Special:UserRights could sometimes fail with a
 103   "conflict detected" error when there weren't any conflicts.
 104
 105 === Action API changes in 1.33 ===
 106 * (T198913) Added 'ApiOptions' hook.
 107 * The JSON formatversion=2 is no longer experimental.
 108 * Internal API errors (those with code beginning "internal_api_error") will
 109   include the exception class name in a data field named "errorclass".
 110   * Class names are not guaranteed to remain stable, and in particular database
 111     exceptions will now include the "Wikimedia\Rdbms\" prefix in the class name.
 112   * The code including an exception class name is deprecated. In the future,
 113     all internal errors will use code "internal_api_error".
 114 * (T212356) When using action=delete on pages with many revisions, the module
 115   may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
 116   deletion will be processed via the job queue.
 117 * action=setnotificationtimestamp will now update the watchlist asynchronously
 118   if entirewatchlist is set, so updates may not be visible immediately
 119 * Block info will be added to "blocked" errors from more modules.
 120 * (T216245) Autoblocks will now be spread by action=edit and action=move.
 121
 122 === Action API internal changes in 1.33 ===
 123 * A number of deprecated methods for API documentation, intended for overriding
 124   by extensions, are no longer called by MediaWiki, and will emit deprecation
 125   notices if your extension attempts to use them:
 126   * ApiBase::getDescription() (deprecated in 1.25)
 127   * ApiBase::getParamDescription() (deprecated in 1.25)
 128   * ApiBase::getExamples() (deprecated in 1.25)
 129   * ApiBase::getDescriptionMessage() (deprecated in 1.30)
 130   Additionally, the  'APIGetDescription' and 'APIGetParamDescription' hooks have
 131   been removed, as their only use was to let extensions override values returned
 132   by getDescription() and getParamDescription(), respectively.
 133 * API error codes may only contain ASCII letters, numbers, underscore, and
 134   hyphen. Methods such as ApiBase::dieWithError() and
 135   ApiMessageTrait::setApiCode() will throw an InvalidArgumentException if
 136   passed a bad code.
 137 * ApiBase::checkTitleUserPermissions() now takes an options array as its third
 138   parameter. Passing a User object or null is deprecated.
 139 * The api-feature-usage log channel now has log context. The text message is
 140   deprecated and will be removed in the future.
 141
 142 === Languages updated in 1.33 ===
 143 MediaWiki supports over 350 languages. Many localisations are updated regularly.
 144 Below only new and removed languages are listed, as well as changes to languages
 145 because of Phabricator reports.
 146
 147 * (T203908) Added language support for Eastern Pwo (kjp).
 148 * (T213717) Fixed a translation error on Goan Konkani (gom-deva) translations
 149   for NS_TEMPLATE.
 150 * (T212221) Added $digitTransformTable for Santali (sat).
 151 * (T216479) Added language support for Saisiyat (xsy).
 152
 153 === Breaking changes in 1.33 ===
 154 * The parameteter $lang in DifferenceEngine::setTextLanguage must be of type
 155   Language. Other types are deprecated since 1.32.
 156 * Skin::doEditSectionLink requires type Language for the parameter $lang.
 157   The parameters $tooltip and $lang are mandatory. Omitting the parameters is
 158   deprecated since 1.32.
 159 * Language::truncate(), deprecated in 1.31, has been removed.
 160 * UtfNormal, deprecated in 1.25, was removed. Use UtfNormal\Validator directly
 161   instead.
 162 * (T197179) In OOUI HTMLForm fields, the parameters 'notice', 'notice-messages',
 163   and 'notice-message', which were deprecated in 1.32, were removed. Instead,
 164   use 'help', 'help-message', and 'help-messages'.
 165 * (T197179) HTMLFormField::getNotices(), deprecated in 1.32, was removed.
 166 * The "Parsoid v1" compatibility mappings in ParsoidVirtualRESTService and
 167   RestbaseVirtualRESTService, deprecated since 1.26, have been removed.
 168   Use the RESTBase v1 or Parsoid v3 API instead.
 169 * ParserOptions defaults 'tidy' to true now, since the untidy modes of the
 170   parser are being deprecated and ParserOptions::getCanonicalOverrides()
 171   has always been true at any rate.
 172 * Support for disabling tidy and external tidy implementations has been removed.
 173   This was deprecated in 1.32. The pure PHP Remex tidy implementation is now
 174   used and no configuration is necessary.
 175 * A number of deprecated methods for API documentation, intended for overriding
 176   by extensions, are no longer called by MediaWiki, and will emit deprecation
 177   notices if your extension attempts to use them:
 178   * ApiBase::getDescription() (deprecated in 1.25)
 179   * ApiBase::getParamDescription() (deprecated in 1.25)
 180   * ApiBase::getExamples() (deprecated in 1.25)
 181   * ApiBase::getDescriptionMessage() (deprecated in 1.30)
 182   Additionally, the  'APIGetDescription' and 'APIGetParamDescription' hooks have
 183   been removed, as their only use was to let extensions override values returned
 184   by getDescription() and getParamDescription(), respectively.
 185 * The authentication hooks 'AbortAutoAccount' 'AbortNewAccount', 'AbortLogin',
 186   'LoginUserMigrated', 'UserCreateForm', and 'UserLoginForm', all deprecated by
 187   the creation of AuthManager in 1.27, have been removed. This also means that
 188   the FakeAuthTemplate and LoginForm classes are removed, that FakeAuthTemplate
 189   is no longer passed into LoginSignupSpecialPage->getFieldDefinitions(), and
 190   that LoginSignupSpecialPage->getBCFieldDefinitions() is removed.
 191 * The 'jquery.localize' module, deprecated in 1.32, has been removed. Instead,
 192   use 'jquery.i18n'.
 193 * The hooks LanguageGetSpecialPageAliases and LanguageGetMagic, deprecated since
 194   1.16, have now been removed. Instead, use $specialPageAliases or $magicWords
 195   respectively in a $wgExtensionMessagesFiles file.
 196 * The following methods of the Preferences class, deprecated in 1.31, have been
 197   removed:
 198   * getSaveBlacklist()
 199   * loadPreferenceValues()
 200   * getOptionFromUser()
 201   * profilePreferences()
 202   * skinPreferences()
 203   * filesPreferences()
 204   * datetimePreferences()
 205   * renderingPreferences()
 206   * editingPreferences()
 207   * rcPreferences()
 208   * watchlistPreferences()
 209   * searchPreferences()
 210   * miscPreferences()
 211   * generateSkinOptions()
 212   * getDateOptions()
 213   * getImageSizes()
 214   * getThumbSizes()
 215   * validateSignature()
 216   * cleanSignature()
 217   * getTimezoneOptions()
 218   * filterIntval()
 219   * filterTimezoneInput()
 220   * getTimeZoneList()
 221 * mw.util.jsMessage(), deprecated in 1.20, was removed. Use mw.notify instead.
 222 * (T61113) User::EDIT_TOKEN_SUFFIX was removed. It was deprecated since 1.27.
 223 * The 'mediawiki.api' module aliases, deprecated in 1.32, have been removed.
 224   Specifically: mediawiki.api.category, mediawiki.api.edit,
 225   mediawiki.api.login, mediawiki.api.options, mediawiki.api.parse,
 226   mediawiki.api.upload, mediawiki.api.user, mediawiki.api.watch,
 227   mediawiki.api.messages, and mediawiki.api.rollback.
 228 * The 'jquery.byteLimit' module alias for 'jquery.lengthLimit',
 229   deprecated in 1.31, was removed.
 230 * Revision::fetchRevision(), deprecated in 1.28, was removed.
 231 * Class SquidUpdate, deprecated in 1.27, was removed.
 232 * Title->getSquidURLs(), deprecated in 1.27, was removed. Instead, use
 233   Title->getCdnUrls().
 234 * Title::escapeFragmentForURL(), deprecated in 1.30, was removed. Use
 235   Sanitizer::escapeIdForLink() or escapeIdForExternalInterwiki() instead.
 236 * Title->canTalk(), deprecated in 1.30, was removed. Instead, use
 237   Title->canHaveTalkPage().
 238 * Title's methods for site and user page related to CSS and JS, deprecated in
 239   1.31, were removed:
 240   * Title->isCssOrJsPage() — Use Title->isSiteConfigPage()
 241   * Title->isCssJsSubpage() – Use Title->isUserConfigPage()
 242   * Title->getSkinFromCssJsSubpage() – Use Title->getSkinFromConfigSubpage()
 243   * Title->isCssSubpage() – Use Title->isUserCssConfigPage()
 244   * Title->isJsSubpage() – Use Title->isUserJsConfigPage()
 245 * SiteSQLStore, deprecated in 1.27 and whose only method, ::newInstance(),
 246   would return the global SiteStore instance, has been removed. You can get to
 247   this via MediaWiki\MediaWikiServices::getInstance()->getSiteStore() directly.
 248 * Linker::formatSize, deprecated in 1.28, has been removed (with DummyLinker's).
 249   Instead, use Language->formatSize() with the relevant Language object.
 250 * Linker::formatTemplates, deprecated in 1.28, has been removed (along with the
 251   version in DummyLinker). You can use TemplatesOnThisPageFormatter directly.
 252 * EventRelayerGroup::singleton(), deprecated in 1.27, has been removed. You can
 253   use MediaWikiServices::getInstance()->getEventRelayerGroup() directly.
 254 * LinkCache->addLink(), deprecated in 1.27, has been removed. It is thought to
 255   be unused, and is distinct from OutputPage->addLink(), which remains.
 256 * JsonContent->getJsonData(), deprecated in 1.25, has been removed. Instead, use
 257   JsonContent->getData().
 258 * MWExceptionHandler::getLogId(), deprecated in 1.27, has been removed, as the
 259   exception ID is the same as the request ID, from WebRequest::getRequestId().
 260 * SearchEngine::getNearMatchResultSet(), deprecated in 1.27, has been removed.
 261   You can use SearchEngine::getNearMatcher() instead.
 262 * EmailNotification::updateWatchlistTimestamp, deprecated in 1.27, has been
 263   removed. Instead, use WatchedItemStore::updateNotificationTimestamp directly.
 264 * User::getGroupName() and ::getGroupMember(), both deprecated in 1.29, have
 265   been removed. Instead, please use UserGroupMembership::getGroupName() and
 266   UserGroupMembership::getGroupMemberName().
 267 * Backwards compatibility for setting wgSessionsInObjectCache to false or using
 268   wgSessionHandler, both of which were deprecated in 1.27 with the introduction
 269   of SessionManager, has been removed.
 270 * SessionManager::autoCreateUser, deprecated in 1.27, has been removed. Use
 271   MediaWiki\Auth\AuthManager::autoCreateUser instead.
 272 * The mw.libs.jpegmeta property, deprecated in 1.31, was removed.
 273   Use require( 'mediawiki.libs.jpegmeta' ) instead.
 274 * The mw.user.stickyRandomId() method, deprecated in 1.32, was removed.
 275   Use mw.user.getPageviewToken() instead.
 276 * Removed deprecated class property WikiRevision::$importer.
 277 * ResourceLoaderFileModule::readStyleFiles() now requires its $context
 278   parameter.
 279 * The ChangeList::insertArticleLink() method, that was deprecated in 1.27, has
 280   been removed.
 281 * MessageBlobStore::__construct() now requires its $rl parameter.
 282 * Second parameter to Sanitizer::escapeIdReferenceList() (deprecated in 1.31)
 283   has been removed.
 284 * The 'jquery.xmldom' module has been removed.
 285 * The 'jquery.mockjax' module has been removed.
 286 * The 'jquery.hidpi' module, deprecated in 1.32, has been removed.
 287 * AuthPlugin and related code, deprecated in 1.27, has been removed. Extensions
 288   should instead use AuthManager. The following no longer exist:
 289   * The AuthPlugin class itself and the related AuthPluginUser class and i18n
 290   * The AuthPluginSetup and AuthPluginAutoCreate hooks
 291   * The transitional wrapper classes AuthPluginPrimaryAuthenticationProvider,
 292     AuthManagerAuthPlugin, and AuthManagerAuthPluginUser.
 293   * The $wgAuth configuration setting and its use in Setup.php and unit tests
 294 * (T217772) The 'wgAvailableSkins' mw.config key in JavaScript, was removed.
 295 * Language::markNoConversion, deprecated in 1.32, has been removed. Use
 296   LanguageConverter::markNoConversion instead.
 297 * BagOStuff::modifySimpleRelayEvent() method has been removed.
 298 * ParserOutput::getLegacyOptions, deprecated in 1.30, has been removed.
 299   Use ParserOutput::allCacheVaryingOptions instead.
 300 * CdnCacheUpdate::newSimplePurge, deprecated in 1.27, has been removed.
 301   Use CdnCacheUpdate::newFromTitles() instead.
 302
 303 === Deprecations in 1.33 ===
 304 * The configuration option $wgUseESI has been deprecated, and is expected
 305   to be removed in a future release.
 306 * The configuration option $wgSquidPurgeUseHostHeader has been deprecated,
 307   and is expected to be removed in a future release.
 308 * The configuration options $wgFixArabicUnicode and $wgFixMalayalamUnicode,
 309   introduced in MW 1.17, have been deprecated.  These fixes will always be
 310   applied for Arabic and Malayalam in the future.  Please enable these on
 311   your local wiki (if you have them explicitly set to false) and run
 312   maintenance/cleanupTitles.php to fix any existing page titles.
 313 * The LegacyHookPreAuthenticationProvider class, deprecated since its creation
 314   in 1.27 as part of the AuthManager re-write, now emits deprecation warnings.
 315   This will help identify the issue if you added it to $wgAuthManagerConfig.
 316 * wfSplitWikiId() is now deprecated. Cache key generation should have the wiki
 317   domain ID as a key component and use makeGlobalKey().
 318 * (T202094) Title::getUserCaseDBKey() is deprecated; instead, please use
 319   Title::getDBKey(), which doesn't vary case.
 320 * User::getPasswordValidity() is now deprecated. User::checkPasswordValidity()
 321   returns the same information in a more useful format.
 322 * For Linker::generateTOC() and Linker::tocList(), passing strings or booleans
 323   as the $lang parameter was deprecated. The same applies to DummyLinker.
 324 * The PasswordPolicy 'PasswordCannotBePopular' has been deprecated. To
 325   follow best practices, it is reccommended to use 'PasswordNotInLargeBlacklist'
 326   instead which blacklists 100,000 commonly used passwords.
 327 * (T208862) Action::requiresUnblock() is now called from
 328   Title::getUserPermissionsErrors() and Title::userCan(). Previously, the method
 329   was only called in Action::checkCanExecute(). Actions should ensure that their
 330   requiresUnblock() returns the proper result (the default is `true`).
 331 * (T211608) The MediaWiki\Services namespace has been renamed to
 332   Wikimedia\Services. The old name is still supported, but deprecated.
 333 * (T155582) Content::getNativeData has been deprecated. Please use model-
 334   specific getters, such as TextContent::getText().
 335 * The class WebInstallerOutput is now marked as @private.
 336 * (T209699) The jquery.async module has been deprecated. JavaScript code that
 337   needs asynchronous behaviour should use Promises.
 338 * Password::equals() is deprecated, use verify().
 339 * BaseTemplate::msgWiki() and QuickTemplate::msgWiki() will be removed. Use
 340   other means to fetch a properly escaped message string or Message object.
 341 * (T126091) The 'ResourceLoaderTestModules' hook, which lets you declare QUnit
 342   testing code for your JavaScript modules, is deprecated. Instead, you can now
 343   use the new extension registration key 'QUnitTestModule'.
 344 * (T213426) The jquery.throttle-debounce module has been deprecated. JavaScript
 345   code that needs this behaviour should use OO.ui.debounce/throttle.
 346 * The mw.language.specialCharacters property from the
 347   'mediawiki.language.specialCharacters' module has been deprecated.
 348   Use require( 'mediawiki.language.specialCharacters' ) instead.
 349 * ChangeTags::purgeTagUsageCache() has been deprecated, and is expected to be
 350   removed in a future release.
 351 * Passing a User object or null as the third parameter to
 352   ApiBase::checkTitleUserPermissions() has been deprecated. Pass an array
 353   [ 'user' => $user ] instead.
 354 * (T211578) Block::prevents is deprecated. Use Block::isEmailBlocked,
 355   Block::isCreateAccountBlocked and Block::isUsertalkEditAllowed to get and set
 356   block properties; use Block::appliesToRight and Block::appliesToUsertalk to
 357   check block behaviour.
 358 * The api-feature-usage log channel now has log context. The text message is
 359   deprecated and will be removed in the future.
 360 * The FileBasedSiteLookup class has been deprecated. For a cacheable SiteLookup
 361   implementation, use CachingSiteStore instead.
 362
 363 === Other changes in 1.33 ===
 364 * (T201747) Html::openElement() warns if given an element name with a space
 365   in it.
 366 * The implementation of buildStringCast() in Wikimedia\Rdbms\Database has
 367   changed to explicitly cast. Subclasses relying on the base-class
 368   implementation should check whether they need to override it now.
 369 * BagOStuff::add is now abstract and must explicitly be defined in subclasses.
 370
 371 == Compatibility ==
 372 MediaWiki 1.33 requires PHP 7.0.13 or later. Although HHVM 3.18.5 or later is
 373 supported, it is generally advised to use PHP 7.0.13 or later for long term
 374 support.
 375
 376 MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
 377 but support for them is somewhat less mature. There is experimental support for
 378 Oracle and Microsoft SQL Server.
 379
 380 The supported versions are:
 381
 382 * MySQL 5.5.8 or later
 383 * PostgreSQL 9.2 or later
 384 * SQLite 3.8.0 or later
 385 * Oracle 9.0.1 or later
 386 * Microsoft SQL Server 2005 (9.00.1399)
 387
 388 == Upgrading ==
 389 1.33 has several database changes since 1.32, and will not work without schema
 390 updates. Note that due to changes to some very large tables like the revision
 391 table, the schema update may take quite long (minutes on a medium sized site,
 392 many hours on a large site).
 393
 394 Don't forget to always back up your database before upgrading!
 395
 396 See the file UPGRADE for more detailed upgrade instructions, including
 397 important information when upgrading from versions prior to 1.11.
 398
 399 For notes on 1.32.x and older releases, see HISTORY.
 400
 401 == Online documentation ==
 402 Documentation for both end-users and site administrators is available on
 403 MediaWiki.org, and is covered under the GNU Free Documentation License (except
 404 for pages that explicitly state that their contents are in the public domain):
 405
 406        https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation
 407
 408 == Mailing list ==
 409 A mailing list is available for MediaWiki user support and discussion:
 410
 411        https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
 412
 413 A low-traffic announcements-only list is also available:
 414
 415        https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce
 416
 417 It's highly recommended that you sign up for one of these lists if you're
 418 going to run a public MediaWiki, so you can be notified of security fixes.
 419
 420 == IRC help ==
 421 There's usually someone online in #mediawiki on irc.freenode.net.