Release notes

MediaWiki 1.36

MediaWiki 1.36.1

This is a security and maintenance release of the MediaWiki 1.36 branch.

Changes since MediaWiki 1.36.0

• (T283942) DatabaseInstaller.php: Only run core schema file if specified table doesn't already exist.
• (T247223) Optimise MessageCache::isMainCacheable() for the single-message case.
• (T283244) JavaScriptMinifer: Fix handling of "delete" as object property.
• (T284391) Fix SkinModule to correctly prepend remote path on document root installs.
• (T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
• (T278579) Don't send headers on ob_end_clean().
• (T285287) MultiHttpClient: Replace PHP version check with defined().
• (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging pages.

MediaWiki 1.36.0

Changes since MediaWiki 1.36.0-rc.0

• (T248481) rdbms: Use server time in DatabaseMysqlBase::getLagFromPtHeartbeat().
• (T281549) WebInstaller: Don't show the announce-l subscribe checkbox for now.
• (T264214) Follow-ups for UserGroupManager.
• (T282280) resourceloader: Fix path-only URLs in wiki modules when script path is docroot.
• (T281972) UserIdentityValue: Introduce convenience static factory methods.
• (T230428) Make page_is_redirect and page_is_new unsigned.
• (T280292) Legacy feature should not load thumbnail style rules (only layout).
• (T283247) Freenode -> Libera per wikimedia moving from freenode to libera.
• (T280270) composer: Lock Parsoid version to specific 0.13.0 release.
• (T142663) Add extension.json merge strategy "provide_default".
• (T283540) HookContainer: Fix normalization of callback for static handler.
• (T283464) registration: Fix array order for array_replace_recursive merge strategy.
• (T283539) Interwiki: Fix calling "onInterwikiLoadPrefix" hook.
• (T282594) Timeless: Re-branch to 40eb3dad1for REL1_36.

MediaWiki 1.36.0-rc.0

Upgrading notes for 1.36

Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.27.

Some specific notes for MediaWiki 1.36 upgrades are below:

• MediaWiki 1.36 now requires the PHP internationalization extension (commonly referred to as Intl, ext-intl, or php-intl).
• The MediaWiki:Autoblock_whitelist block exemption control has been moved to MediaWiki:Block-autoblock-exemptionlist. If you use this feature, please move the MediaWiki:Autoblock_whitelist page.
• (T275334) $wgExtensionFunctions is sometimes used to change configuration settings. This is not safe; extension functions are run relatively late, some services are already initialized by that point and so they use the old configuration. Changes in 1.36 make this kind of breakage even more common. You can use the MediaWikiServices hook instead. (In the future there might be a dedicated hook for configuration changes.)

For notes on 1.35.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.36

The MediaWiki update script, maintenance/update.php, used to accept `--nopurge` as an option to prevent clearing caches stored in the database during upgrade. This is no longer encouraged, and the option has been removed.

New configuration

• (T256001) $wgManualRevertSearchRadius – This setting controls a new feature that marks edits as reverts if they restore the page to an exact previous state. This configuration variable sets the maximum number of revisions of a page that will be checked against every new edit. Set this to 0 to disable the feature entirely.
• (T244058) $wgOldRevisionParserCacheExpireTime — This setting was added to control caching of ParserOutput for old (non-current) revisions.
• (T265263) $wgRememberMe - This setting configures the "remember me" checkbox on account log-in systems via RememberMeAuthenticationRequest.
• (T157145) $wgSkinMetaTags – This setting lets sysadmins configure skins that support meta tags. These tags make sharing of MediaWiki pages on a variety of social platforms more contentful and thus useful.
• (T280944) $wgIncludejQueryMigrate - This setting lets sysadmins disable the jQuery Migrate plugin. It has been enabled by default since MediaWiki 1.27. In future releases it will be disabled by default.

Changed configuration

• $wgLogos – This setting selects the logo shown on the site. The default value for the site logo, which is shown in an install if you have not set one, will now be the new logo of MediaWiki.
• (T274695) $wgAjaxEditStash — This setting, to disable the edit stashing feature when users start writing an edit summary, has been deprecated. In future releases, this feature will always be enabled.
• $wgUploadStashScalerBaseUrl – This setting, to enable remote on-demand media scaling, was deprecated. Use the `thumbProxyUrl` setting in $wgLocalFileRepo instead.
• $wgSlaveLagWarning and $wgSlaveLagCritical – These settings have been renamed, to $wgDatabaseReplicaLagWarning & $wgDatabaseReplicaLagCritical respectively. The former configuration variable names are deprecated, but will be used as the fall back if they are still set, and remain temporarily available for extensions which try to read them.
• $wgWANObjectCaches - The "coalesceKeys" option was removed without deprecation and replaced by a new "coalesceScheme" option, set to "hash_stop" by default. If you use Dynomite, then set the new "coalesceKeys" option to "hash_tag". The "cluster" and "mcrouterAware" options were also removed without deprecation. Use "broadcastRoutingPrefix" instead.

Removed configuration

• $wgUseTwoButtonsSearchForm — This setting, deprecated in 1.35, has been removed.
• $wgAllowImageMoving — This setting, deprecated in 1.35, has been removed. Use group permission settings instead. For example, to prevent sysops from moving files, set `$wgGroupPermissions['sysop']['movefile'] = false;`
• $wgExtNewTables, $wgExtNewFields, $wgExtNewIndexes, $wgExtPGNewFields, $wgExtPGAlteredFields, $wgExtModifiedFields — These settings were removed. They became obsolete after 1.17 overhauled the database updater, but were kept for backwards compatibility. The LoadExtensionSchemaUpdates hook should be used instead.
• $wgParserConf - This setting, deprecated in 1.35, has been removed. The last use of this setting was for pre-processor configuration, which was deprecated in 1.34 and removed in 1.35.
• $wgEnableRestAPI - This setting, ignored since 1.35, has been removed.
• $wgPagePropsHaveSortkey – This temporary setting has been removed, along with the schema change upgrade path it controlled. If your site is still using it, meaning you have not yet applied the `pp_sortkey` schema change from 1.24, you must now apply it before upgrading.
• The deprecated password policies PasswordCannotMatchBlacklist and PasswordNotInLargeBlacklist were removed. Please use PasswordCannotMatchDefaults and PasswordNotInCommonList respectively instead.

New user-facing features in 1.36

• The logo of MediaWiki has changed. This means that the "Powered By MediaWiki" button shown in the skin footer will be different.
• All HTML5 named entities are now accepted in wikitext.
• (T106263) The file description page's alternate sizes now include 2048px.

New developer features in 1.36

• Parser test files can now declare a dependency on a specific extension being loaded, not just on the presence of a certain extension tag hook. This is a better fit for extensions like TimedMediaHandler, which affect the output but don't register parser hooks. Use `extension:Foo` in the `!! hooks` section of your parser test file to declare a dependency on the `Foo` extension being loaded.
• To expose code previously present in SpecialBlock/SpecialUnblock to other parts of the code, or to extensions, the new BlockUser and UnblockUser command objects were added. Use the BlockUserFactory and UnblockUserFactory services to create them.
• The hook UsersPagerDoBatchLookupsHook takes now a \Wikimedia\Rdbms\IDatabase, instead of \Wikimedia\Rdbms\DBConnRef, as the first parameter.
• MediaHandlers can now customize the formatting of the metadata they emit by over-riding MediaHandler::formatTag( $key, $value ). The default for unknown tags is numeric formatting; non-EXIF tags which are non-numeric should always use this method to specify the desired formatting.
• The new 'title' type can be used to validate action API and REST API inputs.
• The new ArticleParserOptions hook allows customizing the parser options used to parse wikitext for an article, based on user preferences, title, etc.
• The new 'raw' type can be used to validate action API inputs. It bypasses the Unicode NFC normalization done on inputs of type 'string', so it more suitable when the input is binary or may contain deprecated Unicode sequences or characters (such as U+2001) that should be passed unmodified.
• (T260330) A new abstraction for running shell commands has been introduced, called BoxedCommand. A BoxedCommand object can be obtained with MediaWikiServices::getInstance()->getCommandFactory()->createBoxed().
• ResourceLoader modules can now mark themselves as ES6-only by setting `'es6' => true` in their module definition. ES6-only modules will not be executed in browsers that don't support ES6, such as IE11.

External library changes in 1.36

New external libraries

• Added wikimedia/minify 2.2.2.
• Added wikimedia/request-timeout 1.1.0.
• Added wikimedia/shellbox 1.0.4.
• Added WVUI 0.1.0.

Changed external libraries

• Updated composer/semver from 1.5.1 to 3.2.4.
• Updated guzzlehttp/guzzle from 6.5.4 to 7.2.0.
• Updated jQuery from v3.4.1 to v3.6.0.
• Updated jQuery Migrate from v3.1.0 to v3.3.2.
• Updated jquery.client from 2.0.2 to 3.0.0.
• Updated OOUI from 0.39.3 to 0.41.3.
• Updated pear/mail_mime from 1.10.8 to 1.10.9.
• Updated pear/net_smtp from 1.9.1 to 1.9.2.
• Updated pimple/pimple from 3.3.0 to 3.3.1.
• Updated wikimedia/at-ease from 2.0.0 to 2.1.0.
• Updated wikimedia/cldr-plural-rule-parser from 1.0.0 to 2.0.0.
• Updated wikimedia/common-passwords from 0.2.0 to 0.3.0.
• Updated wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1.
• Updated wikimedia/html-formatter from 1.0.2 to 3.0.1.
• Updated wikimedia/ip-set from 2.1.0 to 3.0.0.
• Updated wikimedia/ip-utils from 1.0.0 to 3.0.2.
• Updated wikimedia/less.php from 3.0.0 to 3.1.0.
• Updated wikimedia/object-factory from 2.1.0 to 3.0.0.
• Updated wikimedia/php-session-serializer from 1.0.7 to 2.0.0.
• Updated wikimedia/remex-html from 2.2.0 to 2.2.2.
• Updated wikimedia/utfnormal from 2.0.0 to 3.0.2.
• Updated wikimedia/wait-condition-loop from 1.0.1 to 2.0.1.
• Updated wikimedia/xmp-reader from 0.7.0 to 0.8.1.

Changed development-only external libraries

• Updated composer/spdx-licenses from 1.5.3 to 1.5.4.
• Updated doctrine/dbal from 2.10.2 to 3.0.0.
• Updated doctrine/sql-formatter from 1.1.0 to 1.1.1.
• Updated mediawiki/mediawiki-phan-config from 0.10.2 to 0.10.6.
• Updated monolog/monolog from 1.25.3 to 2.2.0.
• Updated nikic/php-parser from 4.4.0 to 4.10.2.
• Updated psy/psysh from 0.10.4 to 0.10.5.
• Updated seld/jsonlint from 1.7.1 to 1.8.3.
• Updated symfony/yaml from ~3.4|~4.3|~5.0.5 to ~3.4|~5.1.
• Updated wikimedia/testing-access-wrapper from 1.0.0 to 2.0.0.

Removed external libraries

• The html5shiv library has been removed, as support for Internet Explorer 8 has been dropped.
• The wikimedia/avro suggested development-only library has been removed, as the support for logging in Avro format has been dropped.

Bug fixes in 1.36

• (T190285) ApiEditPage module used to switch 'undo' and 'undoafter' parameters, if it founds you reversed them (based on assumption that higher revision ID indicates a later revision). The assumption is not always true, and is hindering proper edit undoing in some cases, hence the logic has been removed. Reversing the parameters will now lead to edit conflict or undefined behavior.
• (T263340) In history merging, pages with a content model that does not support redirects will now be recorded as deleted if no revision is being left in the source page (that's if all revisions of the page have been merged to another).

Action API changes in 1.36

• (T269636) `Access-Control-Max-Age` was added to the default list of headers allowed for cross-origin API requests ($wgAllowedCorsHeaders).
• (T258108) Accounts with the 'bot' right no longer have pages automatically added to the watchlist when making API edits, regardless of their preferences. This is to reduce the size of the watchlist data in the database. To add API bot edits to the watchlist, explicitly set the 'watch' option.

Languages updated in 1.36

MediaWiki supports over 350 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.

• (T258975) Added a Latin/Cyrillic script converter for the Talysh language.
• (T245359) Split Bali script locale from "ban" (Balinese) (ban-bali).
• (T264582) Added language support for Madurese (mad).
• (T259330) Added language support for Mara (mrh).
• (T263968) Added language support for Nias (nia).
• (T270365) Added language support for Tyap (kcg).
• (T276745) Added language support for Wayuu (guc).

Breaking changes in 1.36

• Grade C (non-JavaScript) support for Internet Explorer 8 has been dropped.
• (T249459) wfIsBadImage(), deprecated in 1.34, has been removed.
• (T176526) EditPage::getContextTitle() will now throw an exception if a context title was not set using setContextTitle(). Previously, this mis-use would only cause a deprecation warning to be emitted.
• The DeferredStringifier class, deprecated since 1.31, was removed.
• Multiple methods that fell back to the $wgUser global variable were individually hard deprecated previously. The following have now been removed: - ApiTestCase::doLogin - Article::doDeleteArticle - Article::doDeleteArticleReal - Article::getComment - Article::getCreator - Article::getUser - Article::getUserText - Article::insertProtectNullRevision - File::delete - File::recordUpload - ForeignDBFile::delete - ForeignDBFile::recordUpload - LocalFile::delete - LocalFile::deleteOld - LocalFile::recordUpload - PageArchive::undelete - RecentChange::markPatrolled - Title::getUserPermissionsErrors - Title::quickUserCan - Title::userCan - WebRequest::getLimitOffset - WikiPage::doDeleteArticle - WikiPage::insertProtectNullRevision
• The SpecialPageFactory class, deprecated in 1.32, has been removed. Use the SpecialPageFactory service instead.
• Multiple methods previously had optional User parameters, with fallbacks to the $wgUser global variable. Not passing a User to those methods was previously hard deprecated, and support for not passing a User has now been removed: - ArchivedFile::userCan - File::userCan - FileDeleteForm::__construct - FileDeleteForm::doDelete - LocalFileDeleteBatch::__construct - LogEventsList::getExcludeClause (only needed for the 'user' audience) - LogEventsList::userCan - LogEventsList::userCanBitfield - LogEventsList::userCanViewLogType - LogPage::addEntry (also accepts user id instead) - OldLocalFile::userCan - PatrolLog::record - Title::getNotificationTimestamp (though the entire method is deprecated) - WikiPage::getComment (only needed for the FOR_THIS_USER audience) - WikiPage::getCreator (only needed for the FOR_THIS_USER audience) - WikiPage::getUser (only needed for the FOR_THIS_USER audience) - WikiPage::getUserText (only needed for the FOR_THIS_USER audience)
• The following hooks have been removed: - APIQueryInfoTokens - APIQueryRecentChangesTokens - APIQueryRevisionsTokens - APIQueryUsersTokens - ApiTokensGetTokenTypes
• LogEventsList::typeAction previously accepted an optional right parameter, and checked if the context user ($wgUser) had that right. Passing a right was hard deprecated in 1.35, and support for passing a right has now been removed.
• WikiPage::doDeleteArticleReal previously accepted an optional user as its fifth parameter, and fell back to $wgUser if not user was provided. The signature changed to have the user as the second parameter, and the old signature was hard deprecated in 1.35. Support for the old signature has now been removed.
• User::addNewUserLogEntry, deprecated since 1.27, was removed.
• As part of refactoring the EditPage class, EditPage::setPreloadedContent, which had no known callers was removed entirely. Additionally, the following public methods were made private: - ::extractSectionTitle - ::getSummaryInputWidget - ::noSuchSectionPage - ::initialiseForm
• EditPage::matchSpamRegex and ::matchSummarySpamRegex, deprecated in 1.35, were removed. Use the SpamChecker service instead.
• The global function `wfWaitForSlaves`, deprecated in 1.27 and hard-deprecated in 1.35, has been removed. Use LBFactory::waitForReplication() instead.
• Calling Action::factory() with null as the first parameter, rather than a string, was deprecated in 1.35 and support was now removed.
• Calling Action::factory() with an object that wasn't an Article as the second parameter was deprecated in 1.35 and support was now removed.
• The global variable $wgMemc, deprecated since 1.35, has been removed. Usage should generally be migrated to WANObjectCache, or if you really need the internal object, use ObjectCache::getLocalClusterInstance instead.
• The preprocessDump.php maintenance script was removed.
• CategoryFinder, which was deprecated in 1.31 and hard-deprecated in 1.35, has been removed.
• GenderCache::singleton(), which was deprecated in 1.28 and hard-deprecated in 1.35, has been removed.
• Sanitizer::escapeId(), deprecated in 1.30, has been removed.
• Direct invocation of Parser::__construct() (instead of via a ParserFactory) now throws an exception; support has also been removed for several deprecated variants on the arguments passed to Parser::__construct. Direct invocation of Parser::__construct was deprecated in 1.34.
• Parser::setFunctionTagHook(), deprecated in 1.35, has been removed.
• The following properties of Parser, deprecated in 1.35, have been made private: - $mTagHooks - use Parser::getTags() - $mFunctionHooks - use Parser::getFunctionHooks() - $mOutput - use Parser::getOutput() - $mPreprocessor - use Parser::getPreprocessor()
• The ParserBeforeTidy hook, deprecated in 1.35, has been removed.
• The ParserBeforeTidy, ParserBeforeStrip, and ParserAfterStrip hooks, deprecated in 1.35, have been removed.
• All methods of MWTidy except for MW::tidy() have been removed. These were each either marked as @internal or deprecated in 1.35.
• (T248062) Mixins `.background-image-svg()` and `.background-image-svg-quick()` (provided by mediawiki.mixins.less), which have been deprecated since 1.35, have now been removed. MediaWiki no longer supports any browser which would require this SVG-fallback PNG support, so you can simply use the regular CSS `background-image:` declaration instead.
• The ResourceLoader module `mediawiki.legacy.oldshared` and its file 'oldshared.css', deprecated since 1.35 has been removed (T248357).
• `ResourceLoader::__construct` now requires a Config parameter. The optional nature of this parameter was deprecated in 1.34.
• The LinkBegin and LinkEnd hooks, deprecated in 1.28, have been removed. You can instead use the HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd hooks, respectively.
• The EmailUser hook passes its fifth param, $error, by reference, to allow hook handlers to add error messages, indicate that they have sent the email instead of core, etc. Setting the parameter to something other than a Status object, true, false, an empty string, an array, or a MessageSpecifier, object, which had been deprecated in 1.29, is no longer supported, and now results in an MWException being thrown.
• Skin::getDynamicStylesheetQuery(), deprecated in 1.32, has been removed. You should use action=raw&ctype=text/css directly.
• Skin::makeI18nUrl(), deprecated in 1.35, has been removed.
• The following User methods, deprecated and moved to BlockManager in 1.34, were removed: - ::isDnsBlacklisted - ::inDnsBlacklist - ::isLocallyBlockedProxy - ::trackBlockWithCookie
• Support for v1 of the parser tests file format has been removed; it was deprecated in 1.35. (T174199)
• SpecialUnblockUser::processUIUnblock() now returns a Status object instead of an array of messages or a boolean value. This function was also marked as @internal and is no longer safe to call it publicly.
• mw.Title.getDotExtension() from the 'mediawiki.Title' module was removed without deprecation. You should use mw.Title.getExtension() and prepend the dot if need be.
• Profiler::getTemplated and Profiler::setTemplated, deprecated in 1.34, have been removed.
• DatabaseMysqlBase now requires MySQL version 5.6.4+ when "lagDetectionMethod" is set to "pt-heartbeat".
• Removed HookContainer::getOriginalHooksForTest() without deprecation. This method was introduced in 1.35 for internal use, and appears unused outside of MediaWiki core.
• ParserCache::__construct() now requires three parameters.
• Message->getFormat(), deprecated in 1.29, has been removed.
• Support for passing Article to ParserCache::get, deprecated in 1.35, has been removed.
• ParserCache::singleton(), deprecated in 1.30, has been removed.
• DatabaseBlock::deleteIfExpired and ::fromMaster, deprecated in 1.35, have been removed.
• Some deprecated AbstractBlock methods have been removed: - ::prevents, deprecated in 1.33 - ::shouldTrackWithCookie, deprecated in 1.34 - ::getBlocker, deprecated in 1.35 - ::setBlocker, deprecated in 1.35 - ::getBlockErrorParams, deprecated in 1.35
• Multiple DatabaseBlock methods dealing with cookies, deprecated in 1.34, have been removed: - ::setCookie - ::clearCookie - ::getCookieValue - ::getIdFromCookieValue - ::shouldTrackWithCookie
• The public static callback function SpecialUnblock::processUIUnblock has been removed. This method was for internal use only, and appears unused outside of MediaWiki core.
• ChangeTags::truncateTagDescription, deprecated in 1.35, has been removed.
• Deprecated null fallbacks in PasswordReset constructor have been removed.
• User::isEveryoneAllowed and User::getAllRights, deprecated in 1.34, has been removed.
• The following methods of the UserGroupMembership class, deprecated in 1.35, has been removed: - ::initFromRow - ::newFromRow - use UserGroupManager::newGroupMembershipFromRow - ::selectFields - use UserGroupManager::getQueryInfo - ::delete - use UserGroupManager::removeUserFromGroup - ::insert - use UserGroupManager::addUserToGroup - ::purgeExpired - use UserGroupManager::purgeExpired - ::getMembershipsForUser - use UserGroupManager::getUserGroupMemberships - ::getMembership - use UserGroupManager::getUserGroupMemberships
• The public static callback function SpecialBlock::validateTargetField has been removed. This method was for internal use only, and appears unused outside of MediaWiki core.
• The public static callback function SpecialUploadStash::tryClearStashedUploads has been removed. This method was for internal use only, and appears unused outside of MediaWiki core.
• SpecialComparePages::showDiff() ::revOrTitle(), ::checkExistingTitle(), and  ::checkExistingRevision() were marked as @internal to allow for breaking changes. They are no longer safe to call. The methods were unused outside of MediaWiki core.
• Each special page within core now uses service injection via it constructor. When extending these special pages, a call to the grandparent constructor (`SpecialPage::__construct()`) in the sub-class would now break the derived special page, as the fallback code in the parent constructor cannot set the services as needed. Be sure to call the parent constructor when extending core special pages. Extending core's special pages is not part of the stable interface, and should generally be avoided.
• Language::getExtraUserToggles and ::viewPrevNext, deprecated in 1.34, have been removed.
• StreamFile::send404Message and ::parseRange, deprecated in 1.34, have been removed.
• SVGMetadataExtractor class, deprecated in 1.34, has been removed.
• ProcessCacheLRU class, deprecated in 1.32, has been removed.
• wfForeignMemcKey(), deprecated in 1.35, has been removed.
• LoadBalancer::safeWaitForMasterPos(), deprecated in 1.34, has been removed.
• JobQueue::factory() now requires its `idGenerator` option. The optional nature of this option was deprecated in 1.35.
• ApiFeedRecentChanges::getFeedObject has been changed to private, and appears unused outside of MediaWiki core.
• Skin::subPageSubtitle() has been changed to private method. Callers should use Skin::prepareSubtitle().
• RevisionDeleter::checkRevisionExistence was removed without deprecation. It had no known callers.
• wfForeignMemcKey() and wfMemcKey(), deprecated in 1.35, have been removed.
• MediaWiki now also requires the php-intl extension.
• BotPassword::save() now returns a Status object for the result rather than a bool.
• The methods in CoreTagHooks have been marked @internal and type hints have been added. The methods appeared to be unused outside of MediaWiki core.
• SquidPurgeClient and SquidPurgeClientPool, deprecated since 1.35, have been removed.
• Several methods on WikiPage will now throw an exception when called on a WikiPage instance that where constructed on a title that does not refer to a proper page (but rather a special page or interwiki link). The behavior was previously undefined and could in some cases lead to data corruption. Affected methods are: getId(), insertOn(), newPageUpdater(), doUpdateRestrictions(), doDeleteArticleReal(), doRollback(), and doEditContent().
• The ParserTestRunner no longer invokes the ParserTestTables hook. Instead, it clones all database tables before running tests, like MediaWikiIntegrationTest does. If an extension was mis-using the hook to *exclude* tables from the clone, that will no longer occur, and tests may fail.
• The following classes, which were only loaded for tests and had no uses found in public MediaWiki-related git, were removed: - MockWebRequest - UserWrapper
• Passing Title as a second parameter to RevisionStore::getPreviousRevision and getNextRevision, hard deprecated since 1.31, was prohibited.
• (T275619) Maintenance::hasOption and Maintenance::getOption now behave as documented and are not altered by previous calls to these methods.
• The internal class FirejailCommand was removed.
• Command::execute() now returns a Shellbox\Command\UnboxedResult instead of a MediaWiki\Shell\Result. Any type hints should be updated.
• WikiPage::$mIsRedirect was removed.
• ObjectCache::detectLocalServerCache(), deprecated in 1.35, was removed.
• The following functions from the Title class have been removed: - countRevisionsBetween - getAuthorsBetween
• The PageProps class was converted to a service. PageProps::overrideInstance was removed, and MediaWikiServices::redefineService should be used instead.
• Support for creating a MediaWikiTitleCodec object without the InterwikiLookup and NamespaceInfo services, deprecated in 1.34, was removed. Note that the MediaWikiTitleCodec class is not @newable or @stable to create, and should be retrieved from MediaWikiServices instead.
• The $wgContLang variable, deprecated in 1.32, was removed. You can instead use MediaWikiServices::getInstance()->getContentLanguage().
• User::clearAllNotifications(), hard deprecated in 1.35, was removed. Use WatchlistManager::clearAllUserNotifications() instead.
• DatabaseBlock::getBlocker can return any UserIdentity instance, not just User.
• MediaWiki::triggerJobs(), deprecated in 1.34, was removed.
• The following Article methods, deprecated in 1.35, were removed: - checkFlags - checkTouched - clearPreparedEdit - doDeleteUpdates - doEditUpdates - doPurge - doViewUpdates - exists - followRedirect - getAutoDeleteReason - getCategories - getContentHandler - getContentModel - getContributors - getDeletionUpdates - getHiddenCategories - getId - getLatest - getLinksTimestamp - getMinorEdit - getOldestRevision - getRedirectTarget - getRedirectURL - getRevision - getTouched - getUndoContent - hasViewableContent - insertOn - insertRedirect - insertRedirectEntry - isCountable - isRedirect - loadFromRow - loadPageData - lockAndGetLatest - makeParserOptions - pageDataFromId - pageDataFromTitle - prepareContentForEdit - protectDescription - protectDescriptionLog - replaceSectionAtRev - replaceSectionContent - setTimestamp - shouldCheckParserCache - supportsSections - triggerOpportunisticLinksUpdate - updateCategoryCounts - updateIfNewerOn - updateRedirectOn - updateRevisionOn - doUpdateRestrictions - updateRestrictions - doRollback - commitRollback - generateReason
• The monolog-based logging system has dropped the Avro format. Because of this, the AvroFormatter class and the AvroValidator utility class have been removed without deprecation.
• AbstractBlock::$mReason, deprecated in 1.34, was removed. Use AbstractBlock::getReasonComment and AbstractBlock::setReason instead.

Deprecations in 1.36

• (T278026) The DB_MASTER constant has been deprecated in favour of DB_PRIMARY.
• (T245963) User::getGrantName() is now hard deprecated and will be removed in a subsequent release. Use MWGrants::grantName() instead.
• wfIncrStats() is now deprecated. Use MediaWikiServices::getInstance() ->getStatsdDataFactory()->updateCount() instead.
• WikiPage::doEditContent() is now deprecated. Use WikiPage::doUserEditContent() instead. Note that doEditContent() was also deprecated in 1.32 for unrelated reasons and doUserEditContent() is deprecated for other reasons, however, using doUserEditContent() is recommended over using doEditContent().
• WikiPage::doUserEditContent() is now deprecated. Use PageUpdater::saveRevision instead. Note that the new method expects callers to take care of checking EDIT_MINOR against the minoredit right, and to apply the autopatrol right as appropriate.
• LocalFile::recordUpload2, soft deprecated in 1.35, now emits deprecation warnings. Use ::recordUpload3 instead.
• Constructing a new instance of the ParserOptions class without providing a User object, which falls back to the global $wgUser, is now deprecated.
• The User class, which was marked as @newable in 1.35, is no longer newable, meaning that it is no longer safe to manually call the constructor via `new User`. Instead, use the UserFactory service. Additionally, the following static constructor methods were deprecated in favor of using the UserFactory service: - User::newFromName - User::newFromId - User::newFromActorId - User::newFromIdentity - User::newFromAnyId - User::newFromConfirmationCode
• The following User methods have been hard deprecated in favor of the new UserEditTracker service: - User::getFirstEditTimestamp - User::getLatestEditTimestamp
• The confusingly-named User->isLoggedIn() method has been deprecated in favour of the method it wraps, User->isRegistered().
• Use of the `preprocessor=Preprocessor_DOM` option in parser test files has been deprecated. Preprocessor_DOM was removed in 1.35.
• ParserOptions::setTidy() has been deprecated. It has had no effect since 1.35.
• Sanitizer::escapeIdReferenceList() has been deprecated; it will eventually be made private to the class, as it appears to have no uses outside the Sanitizer class.
• Sanitizer::hackDocType() is deprecated; it will eventually be made private.
• Skin::getIndicatorsHTML() is deprecated. The functionality can be retained by reimplementing the method using the raw indicators data from OutputPage::getIndicators.
• Skin::makeVariablesScript() has been deprecated. Use ResourceLoader::makeInlineScript() instead.
• SpecialPageFactory::getRestrictedPages() has been deprecated. Use SpecialPageFactory::getUsablePages() instead.
• Title::nameOf() is deprecated; use Title::newFromID()->getPrefixedDBkey() instead.
• DatabaseBlock::insert, DatabaseBlock::update, DatabaseBlock::purgeExpired and DatabaseBlock::delete are deprecated. Use DatabaseBlockStore::insertBlock, DatabaseBlockStore::updateBlock, DatabaseBlockStore::purgeExpiredBlocks and DatabaseBlockStore::deleteBlock instead.
• SpecialBlock::getTargetAndType and AbstractBlock::parseTarget are deprecated. Call BlockUtils::parseBlockTarget instead.
• SpecialUnblock::processUnblock was deprecated - use UnblockUserFactory service instead.
• Deprecated MediaWikiIntegrationtestCase::removeTemporaryHook() in favor of MediaWikiIntegrationtestCase::clearHook().
• Skin::getSearchLink(), also exposed as 'searchaction' option in SkinTemplate, has been deprecated. Use Title or SpecialPage methods directly.
• Skin::getAllowedSkins and ::getSkinNames have been deprecated. Use their respective equivalents in SkinFactory instead.
• The RollbackComplete hook has been deprecated, use the PageSaveComplete hook instead.
• Skin::makeUrl() has been deprecated. Title methods should be used instead.
• Skin::privacyLink(), Skin::disclaimerLink() and Skin::aboutLink() have been deprecated. Please use Skin::footerLink() instead.
• Skin::getLogo() has been deprecated. Use ResourceLoaderSkinModule instead.
• The module `mediawiki.toc.styles` has been replaced by ResourceLoaderSkinModule. If you are having problems styling table of contents ensure you have an updated skin.
• Skin::mainPageLink() has been deprecated. Use LinkRenderer service instead.
• BaseTemplate::getToolbox() method has been hard deprecated. The toolbox data is now available in a sidebar data array which you can get from any class that's extending QuickTemplate class.
• Constructing a DefaultPreferencesFactory, LinkHolderArray or PasswordReset without a $hookContainer parameter is deprecated.
• Autopromote class, soft deprecated since 1.35, now emits deprecation warnings. Use UserGroupManager instead.
• SpecialBlock::canBlockEmail has been deprecated. Please use BlockPermissionChecker::checkEmailPermissions instead.
• SpecialBlock::checkUnblockSelf has been deprecated. Please use BlockPermissionChecker::checkBlockPermissions instead.
• SpecialBlock::parseExpiryInput was deprecated - use BlockUser::parseExpiryInput instead.
• SpecialBlock::validateTarget has been deprecated, use BlockUtils instead.
• SpecialBlock::validateTargetField has been deprecated for external use, use BlockUtils instead.
• SpecialPage::getLanguageConverter has been deprecated, use LanguageConverterFactory::getLanguageConverter() directly.
• ParserCache::getKey has been deprecated. Use ParserCache::getMetadata and ParserCache::makeParserOutputKey instead.
• The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4, was removed. MediaWiki support for PHPUnit 4 ended with the removal of HHVM support.
• The PHPUnit6And8Compat class, used to provide compatibility with PHPUnit 6, was removed without deprecation. This class was introduced during the upgrade to PHPUnit 8, but never used.
• MediaWikiIntegrationTestCase::assertType, hard-deprecated in 1.35 due to incompatibility with PHPUnit 8, was removed.
• ParserCache::getETag has been deprecated, instead build suitable etag explicitly.
• The following functions from the Language class have been hard deprecated and will be removed in a subsequent release: - findVariantLink - convertTitle - updateConversionTable - commafy
• The following functions from the Title class have been hard deprecated: - getPreviousRevisionID - getNextRevisionID - getEarliestRevTime
• The following functions from the User class have been hard deprecated: - getDefaultOptions - getDefaultOption
• The mw.language.commafy client-side method has been deprecated, to match the deprecation of Language::commafy. Use mw.language.convertNumber instead.
• The "es6-promise" module has been deprecated. Use "es6-polyfills" instead.
• Title::isDeleted() and Title::isDeletedQuick() have been deprecated. Please use Title::getDeletedEditsCount() and Title::hasDeletedEdits() instead.
• Article::getContentObject, soft-deprecated since 1.32, was hard-deprecated.
• WikiRevision::importUpload, soft-deprecated since 1.31, was hard-deprecated.
• Html::infoBox() has been deprecated. There's no replacement.
• Message::toString() without a $format parameter, soft-deprecated since 1.28, was hard-deprecated. Use explicit formatting methods instead, such as Message::text() and Message::escaped().
• BagOStuff::makeKeyInternal() usage outside of BagOStuff has been deprecated.
• BagOStuff::setDebug() is deprecated and calls to it are ignored. Debug logs are now unconditionally enabled.
• The following global functions have been hard deprecated: - wfAppendToArrayIfNotDefault - wfAcceptToPrefs - wfClearOutputBuffers - wfConfiguredReadOnlyReason - wfDebugMem - wfGetPrecompiledData - wfNegotiateType
• BeforeParserFetchTemplateAndtitleHook has been deprecated; replace with the new BeforeParserFetchTemplateRevisionRecord hook. (The similar ParserFetchTemplateHook was deprecated in 1.35; the new hook replaces both.)
• The InterwikiLoadPrefix hook has been deprecated; it is not compatible with future wikitext parsers (which need to enumerate all interwiki prefixes). In test cases please use $wgInterwikiCache instead.
• WikiPage instances should no longer be constructed for titles that do not represent editable pages (e.g. special pages). WikiPages were always documented to represent "MediaWiki article and history".
• Skin::getSkinStylePath() has been deprecated. Please replace usages with the direct path to the resources.
• The second argument of EnhancedChangesList::getDiffHistLinks, $query, has been deprecated.
• The ParserTestTables hook has been deprecated; it is no longer necessary after a ParserTestRunner refactoring.
• The following classes have been hard deprecated: CachedAction, SpecialCachedPage, CacheHelper, ICacheHelper. They were unused in MediaWiki ecosystem, so no replacement was provided.
• The ProtectionForm::buildForm hook has been deprecated. Please use the ProtectionFormAddFormFields hook instead.
• RevisionStore::newMutableRevisionFromArray has been hard deprecated. Instead, MutableRevisionRecord should be constructed directly via constructor.
• UserIdentity::getActorId() is deprecated. The actor ID should not be exposed to application logic. Storage layer code should use the ActorNormalization service for normalizing and denormalizing user names.
• Constructing a UserIdentityValue with an actor ID as the third parameter is deprecated. The parameter should be omitted. Storage layer code should use the ActorNormalization service for normalizing and denormalizing user names.
• Command::cgroup() is deprecated and no longer functional. $wgShellCgroup is now implemented as an Executor option.
• Command::restrict() is deprecated. Instead use the new separate accessors.
• MWTidy::tidy() is deprecated. Use MediaWikiServices::getTidy()-tidy() instead.
• TidyDriverBase::supportsValidate() is deprecated; it has always returned false since 1.33.
• WatchedItem::getUser hard-deprecated in favor of ::getUserIdentity.
• WatchedItemStoreInterface::enqueueWatchlistExpiryJob was hard deprecated in favor of the new method maybeEnqueueWatchlistExpiryJob that takes care of relevant configuration checks.
• LogEntry::getPerformer() and its implementations have been hard-deprecated, in favor of ::getPerformerIdentity().
• AuthManager::singleton(), deprecated in 1.35, is hard deprecated. Use MediaWikiServices::getAuthManager() instead.
• User::clearNotification(), deprecated in 1.35, is hard deprecated. Use WatchlistManager::clearTitleUserNotification() instead.
• Passing string to DatabaseBlock::setBlocker was deprecated. Only UserIdentity is now allowed.
• DatabaseBlock constructor 'byText' option was deprecated in favour of 'by' option, which now accepts UserIdentity. Passing user ID is deprecated.
• Parser::getUser was deprecated. Use Parser::getUserIdentity instead.
• DatabaseBlock::isWhitelistedFromAutoblocks was deprecated. Use DatabaseBlock::isExemptedFromAutoblocks instead.
• User::isIPRange(), deprecated in 1.35, is hard deprecated. Use the UserNameUtils service or IPUtils directly.
• BaseTemplate::getFooterIcons(), deprecated in 1.35, is hard deprecated. Read footer icons from template data requested via $this->get('footericons').
• `box-shadow()` LESS mixin from mediawiki.mixins is deprecated due to updated basic browser support. Use unprefixed property `box-shadow:` instead.
• MergeHistory::checkPermissions was deprecated. Use ::probablyCanMerge or  ::authorizeMerge instead.
• User::isValidUserName(), deprecated in 1.35, is hard deprecated. Use the UserNameUtils service instead.
• The TitleArrayFromResult hook has been deprecated.
• The EditPageBeforeEditToolbar hook has been deprecated; it has become defunct after the classic edit toolbar was removed. Use one of the many other EditPage hooks instead.
• Deprecated the class name MediaWiki\User\WatchlistNotificationManager; use MediaWiki\Watchlist\WatchlistManager instead. Deprecated the method MediaWikiServices->getWatchlistNotificationManager(); use MediaWikiServices->getWatchlistManager() instead.
• The "ArticleEditUpdatesDeleteFromRecentchanges" hook, deprecated in 1.35, has been removed. Other hooks like "RecentChange_save" can be used instead.

Other changes in 1.36

• The 'tidy' key in ParserOptions (used in the parser cache) has been removed. It has had no effect since 1.35.
• A future release of MediaWiki will make `{{=}}` a built-in parser function, for use when automatically escaping the `=` character in template arguments. A tracking category and parser warning have been added to this release when `{{=}}` is used and it expands to something other than `=`.
• The implementation of TestFileReader::read has been changed to use Parsoid's parser test file parser. This should be compatible with existing code, but it only supports version 2 of the test file specification and may be more strict when parsing invalid input, including duplicate tests.
• BeforeParserFetchTemplateRevisionRecord, a new hook, unifies and replaces the old BeforeParserFetchTemplateAndtitleHook and ParserFetchTemplateHook.
• The SkinLessImportPaths attribute was added, allowing skins to add a directory to the import path for LESS stylesheets. Skins can use this to provide a custom version of mediawiki.skin.variables.less, setting skin-specific values for certain LESS variables.
• The interaction between ContentHandler::getParserOutputForIndexing() and ContentHandler::getDataForSearchIndex() has been clarified (the latter should only be called with the result of the former). Extensions may override getParserOutputForIndexing() to skip generating HTML, which may improve indexing performance. (The default implementation still generates HTML, and getDataForSearchIndex() implementations can still rely on it if they do not over-ride getParserOutputForIndexing().)
• Article::fetchContentObject, ::mContentObject, ::mContentLoaded,  ::mRevIdFetched, all deprecated since 1.32, were removed.
• Article::mParserOptions and ::setParserOptions were removed.
• Article and ImagePage::getEmptyPageParserOutput, unused, were removed.
• ParserCache's default serialization format was changed from PHP serialization to JSON serialization. In case some installed extension do not support JSON yet, $wgParserCacheUseJson can be used to revert back to PHP serialization.
• PermissionManager::groupHasPermission, ::getGroupPermissions and  ::getGroupsWithPermission were deprecated, use GroupPermissionsLookup service instead.
• WatchedItemStoreInterface now accepts PageIdentity where it accepted LinkTarget, calling with LinkTarget was deprecated.
• 'movable' attribute has been added to the 'namespaces' property of extension.json schema. Extensions that define namespaces can set it to `false` to disallow moving pages in the specified namespace. Extensions should either use this or NamespaceIsMovableHook, but not both. The hook overrides the attribute.

Compatibility

MediaWiki 1.36 requires PHP 7.3.19 or later and the following PHP extensions:

• ctype
• dom
• fileinfo
• iconv
• intl
• json
• mbstring
• xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used, but support for them is somewhat less mature.

The supported versions are:

• MySQL 5.5.8 or later
• PostgreSQL 9.4 or later
• SQLite 3.8.0 or later

Online documentation

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

      https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

Mailing list

A mailing list is available for MediaWiki user support and discussion:

      https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

      https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help

There's usually someone online in #mediawiki on irc.libera.chat.