= MediaWiki 1.42 =

PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
PHP 8.2 workboard: https://phabricator.wikimedia.org/tag/php_8.2_support/
PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/
PHP 8.4 workboard: https://phabricator.wikimedia.org/tag/php_8.4_support/

== MediaWiki 1.42.6 ==

This is a security and maintenance release of the MediaWiki 1.42 branch.

=== Changes since MediaWiki 1.42.5 ===
* Localisation updates.
* (T376711) language: Use fallback chain to create NumberFormatter.
* (T385332) feeds: Fix str_replace() deprecation warnings on PHP 8.
* phpunit: Fix bootstrap script when no extensions are installed.
* (T380880) ExternalLinks: fix mailto: links reversal.
* (T379125) exception: Suppress dependency loop exception.
* (T381033) RateLimiter: Fix peek mode.
* (T387130, CVE-2025-32699) SECURITY: Update wikimedia/parsoid to 0.19.2.
* (T385519) Sanitizer::normalizeWhitespace warn on preg_replace error.
* (T387638) RevDelList: Ensure setVisibility always includes itemStatuses in
  value if applicable.
* (T388296) ImportImages: Exit with non-zero code if import fails.
* Request: Improve log message when headers already sent.
* (T388066) Avoid trying to load the session user in MW_NO_SESSION endpoints.
* (T388171) HttpError: Cast Message to string.
* (T384197) permissions: Avoid potential infinite loop if BlockDisablesLogin =
  true.
* (T388255) ApiLogin: Don't break BotPasswords if password or user is blank,
  just error.
* (T388924) MagicWord::replace*: Make sure we don't pass null into preg_match/
  preg_replace.
* (T388944) Html: Fix "substr(): Passing null to parameter #1 ($string) of type
  string is deprecated".
* (T388728, T385519) Sanitizer::normalizeSectionNameWhitespace: Apply same
  anti-null fix as 270499b.
* (T387690) upload: Suppress warnings from iconv().
* (T388733) Sanitizer::normalizeWhitespace: simplify redundant preg_replace.
* (T304474, CVE-2025-32696) SECURITY: Apply proper restrictions on file revert
  action.
* (T24521, T62109, T140010, CVE-2025-32697) SECURITY: PermissionManager:
  Differentiate between cascading protection of file content and file pages.
* initEditCount: Join from user to actor to revision.
* (T390063, T277675) ResourceLoader: update wikimedia/minify to 2.9.0.
* (T368921) ResourceLoader: Set "math=always" before Less.php 5.0 upgrade.
* (T384851) FileBackend: PHP Deprecated: strrpos(): Passing null to parameter #1
  ($haystack).
* In .htaccess deny files, use "Satisfy All".
* (T389028) block: Fix DBS::acquireTarget() race using GET_LOCK().
* RestrictionStore: Remove short-circuit mode when fetching cascading sources.
* (T385958, CVE-2025-32698) SECURITY: LogPager.php: Restriction enforcer
  functions do not correctly enforce suppression restrictions.
* (T387130, CVE-2025-32699) SECURITY: Potential javascript injection attack
  enabled by Unicode normalization in Action API.
* (T358689, CVE-2025-3469) SECURITY: i18n XSS vulnerability in
  HTMLMultiSelectField when sections are used.

== MediaWiki 1.42.5 ==

This is a maintenance release of the MediaWiki 1.42 branch.

=== Changes since MediaWiki 1.42.4 ===
* Localisation updates.
* (T382783) Update wikimedia/parsoid to 0.19.1.
* (T382590) PaserTestRunner: Avoid json_decode deprecation warning.
* (T375707) exception: Convert E_STRICT errors to E_USER_NOTICE.
* (T380755) session: Do not set session.use_trans_sid.
* (T382987) $wgDnsBlacklistUrls now defaults to an empty array. See the comment
  in the "Configuration changes for system administrators" section.
* (T382484) dumps: Use proc_close() to close proc_open() subprocess.
* (T375707) MWExceptionHandler: Add error suppression to constant( 'E_STRICT' ).
* (T384879) FormatMetadata: Prevent running preg_match() on null.
* (T384995) specialpage: Improve handling of invalid lang codes on login/signup.
* (T385055) resourceloader: Fix hash computation for virtual files with
  versionFilePath.
* (T385169) MultiUsernameFilter: Don't try to split ids if they're not a string.

== MediaWiki 1.42.4 ==

This is a maintenance release of the MediaWiki 1.42 branch.

=== Changes since MediaWiki 1.42.3 ===
* Localisation updates.
* (T370380) installer: Support MW_SKIP_EXTERNAL_DEPENDENCIES in update.php.
* (T372569) installer: Consistently use double quotes when outputting settings.
* (T368289) rdbms: Reduce log severity of "found writes pending".
* (T368289) rdbms: only mention write queries in "writes pending" warnings.
* (T349608) user: Add recursion guard to APCOND_BLOCKED check in
  UserGroupManager.
* (T377450) [DatabaseUpdater] Don't interact with updatelog on virtual domains.
* (T377916) specials: Avoid passing null to str_replace().
* (T378006, T372500) AutoLoader: Use require_once rather than require.
* (T378259) SpecialRenameUser: Fix warning display.
* (T378304) GlobalIdGenerator: Update str_getcsv() call for PHP 8.4.
* Upgrade php-session-serializer from 2.0.1 to 3.0.0.
* Upgrade xmp-reader from 0.9.1 to 0.9.2.
* (T376911) Upgrade AtEase from 2.1.0 to 3.0.0.
* (T374494) Add DumpableObjectsTest to the database test group.
* (T362829) Correct range error in regexp of formatmetadata.
* (T379656) RefreshLinksJob: Don't retry job if "Revision x is not current" is
  returned.
* (T381068) ButtonAuthenticationRequest: Add AllowDynamicProperties directive.

== MediaWiki 1.42.3 ==

This is a maintenance release of the MediaWiki 1.42 branch.

=== Changes since MediaWiki 1.42.2 ===
* Fix issue related to backport of AbuseFilter patch for T372998.

== MediaWiki 1.42.2 ==

This is a security and maintenance release of the MediaWiki 1.42 branch.

=== Changes since MediaWiki 1.42.1 ===
* Localisation updates.
* Parser: Deprecate use of mOutput before initialization.
* (T365565) PrefixSearch: Make sure $prefix is a string.
* Clarify that $wgAllowCrossOrigin only applies to REST.
* composer.json: Add 5 more ext- to suggests.
* resources: Fix 404 Not Found for foreign Financial-Times/polyfill-library.
* ResourceLoader: Upgrade wikimedia/less.php to 4.4.1.
* SpecialExport: Prevent passing null to strtolower.

Additionally, some language support improvements which went out in 1.42.0 were
not noted; they are included here for completeness:

* (T343865) Added language support for Pu–Xian Min (Simplified Han script)
  (cpx-hans).
* (T343865) Added language support for Pu–Xian Min (Traditional Han script)
  (cpx-hant).
* (T284043) Added language support for Manchu (mnc).
* (T284043) Added language support for Manchu (Mongolian script) (mnc-mong).
* Added language converter for Central Moroccan Tamazigh (zgh).

== MediaWiki 1.42.1 ==

This is a maintenance release of the MediaWiki 1.42 branch.

=== Changes since MediaWiki 1.42.0 ===
* Localisation updates.
* Name the PagerTools array entries to allow hooks to unset them.

== MediaWiki 1.42.0 ==

=== Changes since MediaWiki 1.42.0-rc.0 ===
* Localisation updates.
* wrapOldPasswords: Improve progress output and decrease batch size.
* (T365060) Serialization test cases: fix filename after ParserOutput
  namespacing.
* Use virtual domain when running update maintenance scripts.
* (T361367) ApiFeedWatchlist: Fix handling of array parameters.
* (T366130) EncryptedPassword: Store default parameters as strings.

== MediaWiki 1.42.0-rc.0 ==

== Upgrading notes for 1.42 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.35.

Some specific notes for MediaWiki 1.42 upgrades are below:
* MediaWiki 1.42 requires PHP 8.1 or above (up from 7.4) (T359868).
* MediaWiki now requires Composer 2.x, and any related (vendor) files generated
  by Composer must be generated by Composer 2.x. Composer 1.x is mostly end of
  life by upstream, and using it will result in slower actions when downloading
  and installing packages. See the upstream blog post at
  https://blog.packagist.com/deprecating-composer-1-support/ for further
  information.

For notes on 1.41.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.42 ===
* Composer 1.x is no longer supported, and can no longer be used with MediaWiki.
* (T382987) The default value of 'http.dnsbl.sorbs.net.' in $wgDnsBlacklistUrls
  has been removed. This is because sorbs.net have stopped providing their
  services. This means that if you have $wgEnableDnsBlacklist set to true, it
  will no longer provide any value unless you add other servers to
  $wgDnsBlacklistUrls.

==== New configuration ====
* $wgMicroStashType: This setting allows for control of the object cache backend
  for the MicroStash service.
* $wgEditRecoveryExpiry: This setting sets the number of seconds for which to
  keep edit recovery data after each edit is stored.
* $wgDjvuUseBoxedCommand and $wgDjvuShell: The first is a temporary flag to
  control whether or not to use BoxedCommand when wrapping DejaVu rendering, and
  the second sets the command to call if so.
* $wgConditionalUserOptions: This setting makes it possible to define which user
  properties have defaults varying by user, without growing the user_properties
  table. The typical use-case is to enable a feature only for users created
  after a certain date when rolling out features on large wiki farms.
* $wgGrantRiskGroups: This setting controls the risk levels for each grant, used
  to indicate on various UIs which grants should be considered risky. (T290790)
* $wgTempAccountCreationThrottle: This setting is like AccountCreationThrottle,
  but to be used for managing temporary account creations.

==== Changed configuration ====
* $wgAutoCreateTempUser: This setting (in active development), which configures
  automatic 'temporary' user creation on page save, has had two changes:
  - it now supports multiple match patterns on the 'matchPattern' key; and
  - it now uses a different format for deciding how to label temporary accounts;
    if your wiki used temporary accounts before 1.42, you will need to override
    the configuration value to also match the old format of *$1.
* $wgLogActionsHandlers: This setting, which configures handlers for different
  log actions, is now ObjectFactory compatible.
* $wgBotPasswordsCluster and $wgBotPasswordsDatabase: These settings have been
  deprecated; use $wgVirtualDomainsMapping['virtual-botpasswords'] instead.
* $wgMainPageIsDomainRoot: This setting is no longer considered experimental.

==== Removed configuration ====
* $wgDisableCookieCheck: Removed without deprecation.
* $wgStatsCacheType: Removed without deprecation. Set $wgMicroStashType instead.
* $wgJobSerialCommitThreshold: Removed without deprecation. Any setups using
  this config will perform just fine, but might be less performant.
* $wgLogoHD: Deprecated since 1.35. Use $wgLogo instead.
* $wgContentHandlerTextFallback: Deprecated since 1.37. No longer customizable.
* $wgSquidPurgeUseHostHeader: Deprecated since 1.33. No longer customizable, and
  always true.
* $wgAllowImageTag: Deprecated since 1.35. Instead, you can register an
  extension tag named <img>.
* $wgMinimalPasswordLength and $wgMaximalPasswordLength: Deprecated since 1.26.
  Use $wgPasswordPolicy instead.
* $wgUseMediaWikiUIEverywhere: Experimental, removed without deprecation.
* $wgHTMLFormAllowTableFormat: Experimental, removed without deprecation.
* $wgOpenSearchTemplate: Deprecated since 1.25. Instead, you can use
  $wgOpenSearchTemplates['application/x-suggestions+json'].
* $wgUseSameSiteLegacyCookies: Removed without deprecation.

=== New user-facing features in 1.42 ===
* (T308160) filter: is now allowed in inline CSS in wikitext

=== New developer features in 1.42 ===
* (T326466) MediaWikiIntegrationTestCase's database and set-up code now avoids
  using dynamic properties, which was causing deprecation warnings in PHP 8.2.
* (T13555) MediaWiki now includes styles that allow more accessible markup for
  section headings. MediaWiki's own HTML output will be changed in the future.
  More information: https://www.mediawiki.org/wiki/Heading_HTML_changes
* (T193472) PHP Notice and Warning errors that are silenced (e.g. by the "@"
  operator, error_reporting directive, or Wikimedia\AtEase) are now logged to
  a new "silenced-error" channel.
* (T347347) The CLI installer accepts a "--with-developmentsettings" argument
  to require the DevelopmentSettings.php file at install time.
* (T350054) MediaWiki's ResourceLoader has been updated to add basic support
  for code-splitting (aka "tree-shaking") when using the Codex component
  library. A ResourceLoader module can now specify a list of "codexComponents"
  in its module defintion and ensure that only the code for those components
  gets sent to the client. More information:
  https://www.mediawiki.org/wiki/Codex#Subset_of_components
* (T345185) The SessionProviderInterface now allows defining providers that
  are exempt from rights checks when auto creating users.

=== External library changes in 1.42 ===

==== New external libraries ====
* Added mediawiki/json-codec at v2.2.1.
* Added mck89/peast at v1.16.2.

==== Changed external libraries ====
* Updated OOUI from v0.48.1 to v0.49.1.
* Updated OOjs Router from 0.3.0 to 0.5.0.
* Updated codex, codex-design-tokens and codex-icons
  from v1.0.0 to v1.3.6.
* Updated Vue from v3.2.37-compat to v3.3.9.
* Updated composer/semver from 3.3.2 to 3.4.0.
* Updated guzzlehttp/guzzle from 7.5.3 to 7.7.1.
* Updated monolog/monolog from 2.2.0 to 2.9.2.
* Updated pear/mail from 1.5.1 to 1.6.0.
* Updated pear/mail_mime from 1.10.11 to 1.10.12.
* Updated pear/net_smtp from 1.10.1 to 1.11.1.
* Updated psr/http-message from 1.0.1 to 1.1.
* Updated symfony/polyfill-php80 from 1.28.0 to 1.29.0.
* Updated symfony/polyfill-php81 from 1.28.0 to 1.29.0.
* Updated symfony/polyfill-php82 from 1.28.0 to 1.29.0.
* Updated symfony/polyfill-php83 from 1.28.0 to 1.29.0.
* Updated symfony/yaml from 5.4.23 to 5.4.35.
* Updated wikimedia/at-ease from 2.1.0 to 3.0.0.
* Updated wikimedia/less.php from 4.1.1 to 4.2.1.
* Updated wikimedia/minify from 2.5.1 to 2.7.0.
* Updated wikimedia/php-session-serializer from 2.0.1 to 3.0.0.
* Updated wikimedia/relpath from 3.0.0 to 4.0.0.
* Updated wikimedia/remex-html from 4.0.1 to 4.1.0.
* Updated wikimedia/shellbox from 4.0.0 to 4.0.1.
* Updated wikimedia/xmp-reader from 0.9.1 to 0.9.2.

===== Changed development-only external libraries =====
* Updated QUnit from v2.19.4 to v2.20.0.
* Updated composer/spdx-licenses from 1.5.7 to 1.5.8.
* Updated doctrine/dbal from 3.4.2 to 3.7.2.
* Updated doctrine/sql-formatter from 1.1.1 to 1.1.3.
* Updated grunt-banana-checker from 0.11.0 to 0.11.1.
* Updated mediawiki/mediawiki-codesniffer from 42.0.0 to 43.0.0.
* Updated mediawiki/mediawiki-phan-config from 0.13.0 to 0.14.0.
* Updated php-parallel-lint/php-parallel-lint from 1.3.2 to 1.4.0.
* Updated phpunit/phpunit from 9.5.28 to 9.6.16.
* Updated psy/psysh from ^0.11.1 to ^0.12.3.
* Updated seld/jsonlint from 1.8.3 to 1.10.1.
* Updated wikimedia/testing-access-wrapper from 2.0.0 to 3.0.0.

=== Action API changes in 1.42 ===
* APIQueryTags now includes "software" in the "source" array for software
  generated tags. Reliance on the "extension" entries in this array is now
  deprecated, but they will remain for backwards compatibility.

=== Languages updated in 1.42 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T268143) Language variant conversion has been removed for Kazakh.
* (T352776) Updated autonym spelling for the Mon language (mnw).
* (T351874) Added language support for Komering (kge).
* (T351992) Added language support for Efik (efi).
* (T352954) Added language support for Rutul (rut).
* (T353058) Added language support for Arbëresh (aae).
* (T353307) Added language support for Guadeloupean Creole (gcf).
* (T353500) Added language support for Southeastern Kolami (nit).
* (T354519) Added language support for Tooro (ttj).
* (T354926) Added language support for Nyoro (nyo).
* (T356616) Added language support for Chinook Jargon (chn).
* (T357879) Added language support for Ibibio (ibb).

=== Breaking changes in 1.42 ===
* (T340802) ResourceLoader: The targets system is no longer active; all modules
  will load on all platforms even if they are marked as desktop- or mobile-only
  in the 'targets' field, which is no longer read. As part of this, the internal
  methods RL\Module::setTarget() & ::getTargets(), and OutputPage::setTarget(),
  have been removed.
* TitleArray, deprecated since 1.41, has been removed.
* UserRightsProxy, deprecated since 1.38, has been removed.
* SiteConfiguration::getConfig(), deprecated in 1.41, has been removed.
* UserLoginCompleteHook is always called with its $direct parameter set to
  boolean true. The false case has been removed.
* MagicWord::load() has been marked @internal, and may change in the future
  without further notice.
* All classes that implemented the IDBAccessObject interface and all interfaces
  that extended it, no longer do that. See https://w.wiki/9DAX for more info.
* The type of the last parameter of BeforeInitializeHook::onBeforeInitialize()
  and MediaWikiPerformActionHook::onMediaWikiPerformAction() changed from the
  MediaWiki class to the new ActionEntryPoint. Relevant methods are still
  available on the object.
* Classes that override Maintenance::finalSetup() must now declare the $settings
  parameter and pass it on when calling the parent implementation.
  MaintenanceRunner will always provide this parameter when calling
  finalSetup().
* WebResponse::disableForPostSend() is no longer static.
* MediaWiki's virtualrest internal library has been removed, in favor of just
  using other HTTP libraries: Guzzle, MultiHttpClient or MwHttpRequest.
* Several deprecated methods have been removed from the Content interface,
  in favor of the respective methods in ContentHandlers. Callers should
  use a more narrow interface like ContentRenderer or ContentTransformer
  when possible. The following methods have been removed from Content:
  - getParserOutput()
  - preSaveTransform()
  - preloadTransform()
  - prepareSave()
* User::blockedFor() and AbstractBlock::getReason(), deprecated in 1.35, have
  been removed. Use AbstractBlock::getReasonComment() instead.
* SerializedValueContainer::newUnified(), deprecated in 1.41 has been removed.
* Use of ActorMigration for any of the following tables, deprecated since 1.34,
  is no longer supported:
  - archive
  - image
  - oldimage
  - filearchive
  - recentchanges
  - logging
  - ipblocks
* ParserOutput::setFlag() and ::getFlag(), deprecated in 1.38, were removed. You
  should use ::setOutputFlag() and ::getOutputFlag() instead.
* ParserOutput::getCategories(), deprecated in 1.40, has been removed. You
  should use ::getCategoryNames() and ::getCategorySortKey() instead.
* ParserOutput::getTOCHTML(), deprecated in 1.40, has been removed. You should
  use ::getTOCData() instead.
* The parser does not substitute the default category sort key at parse time;
  this is substituted when the category links table is updated instead. As a
  result {{DEFAULTSORT}} will affect all the contents of the page (not just
  categories added after the location of {{DEFAULTSORT}} in the article) and
  ParserOutput::getCategorySortKey() will return the empty string (still
  meaning "use the default sort key") instead of the immediate value of
  {{DEFAULTSORT}}. ParserOutput::getCategorySortKey() will directly reflect the
  category link contents, instead of having post-processing done to it
  (character references decoded, new lines replaced, language conversion). That
  post-processing is now done when the category links table is updated, and so
  it consistently applies even when categories are added directly via API.
* PostgresUpdater::addPgEnumValue() unused everywhere, have been removed
  without deprecation. Use of ENUM is highly discouraged.
* ILoadBalancer::getAnyOpenConnection() has been removed without deprecation,
  use ::getConnection() instead.
* The unused method CommentStore::getFields() has been removed without
  depreaction.
* LanguageConverter's internal properties, all deprecated in 1.35 or 1.36, have
  now had their deprecated property accessors dropped:
  - mConvRuleTitle
  - mUserVariant
  - mHeaderVariant
  - mMaxDepth
  - mVarSeparatorPattern
  - mLangObj
  - mTablesLoaded
  - mTables
  - mVariants
  - mMainLanguageCode
  - mVariantFallbacks
  - mFlags
  - mVariantNames
  - mDescCodeSep
  - mDescVarSep
* OutputPage::addParserOutputText has been marked @internal since there are no
  known users of it. Its old behavior has been deprecated and will change
  in the future without further notice.
* A some methods of ConnectionManager and SessionConsistentConnectionManager,
  previously deprecated, have been removed:
  - ::releaseConnection(), deprecated in 1.38; do not use
  - ::getWriteConnectionRef(), deprecated in 1.39; use getWriteConnection()
  - ::getReadConnectionRef(), deprecated in 1.38; use getReadConnection()
  - ::getLazyWriteConnectionRef(), deprecated in 1.39; use getWriteConnection()
  - ::getLazyReadConnectionRef(), deprecated in 1.38; use getReadConnection()
* CoreParserFunctions::mwnamespace(), deprecated in 1.39, has been removed. Use
  CoreParserFunctions::namespace() instead.
* Processor:: and ExtensionProcessor::getExtraAutoloaderPaths(), deprecated in
  1.39, have been removed; use ::getExtractedAutoloadInfo() instead.
* MWExceptionHandler::rollbackMasterChangesAndLog(), deprecated in 1.37, has
  been removed. Use ::rollbackPrimaryChangesAndLog() instead.
* Passing a custom database connection to DatabaseBlockStore::insertBlock(),
  deprecated since 1.41, is no longer supported.
* LanguageConverterFactory::isTitleConversionDisabled(), deprecated in 1.36,
  has been removed. Use ::isLinkConversionDisabled() instead.
* MediaWikiIntegrationTestCase::$tablesUsed has been deprecated. The framework
  now detects these automatically.
* Passing an actor id to the constructor of UserIdentityValue, deprecated
  since 1.36, is no longer being supported.
* Support for setting dynamic property on StatusValue object has been removed.
  To pass your arbitrary data along the object, use StatusValue::statusData
  property (which is always declared).
* The global function wfReportTime(), deprecated since 1.40, has been removed.
* The skin template parameter 'reporttime', deprecated since 1.41, has been
  removed.
* WikiPage::getPageIsRedirectField(), deprecated since 1.41, has been removed.
* WikiPage::insertRedirect(), deprecated since 1.41, has been removed.
* Several methods in PageArchive, all deprecated in 1.38, have been removed:
  - ::listRevisions()
  - ::getRevisionRecordByTimestamp()
  - ::getArchivedRevisionRecord()
  - ::getPreviousRevisionRecord()
  - ::getLastRevisionId()
  - ::isDeleted()
  - ::getFileStatus()
  - ::getRevisionStatus()
* Database, DatabaseInstaller, DatabaseUpdater, DBPrimaryPos, ResultWrapper and
  SQLPlatform are no longer stable to extend. It is not possible to define
  database types in an extension.
* UserDef::PARAM_ALLOWED_USER_TYPES now differentiates between temporary account
  usernames and user accounts. Any endpoints that want temp users to be
  valid but were passing a name through will break. Temp users must now be
  explicitly allowed.
* The Hooks class, a legacy wrapper for HooksContainer, has been removed. All of
  its contents have been previously deprecated in 1.35 (or 1.41 for ::runner()):
  - ::register()
  - ::clear(),
  - ::isRegistered()
  - ::getHandlers()
  - ::run()
  - ::runWithoutAbort()
  - ::runner()
* Article::__get(), ::__set(), deprecated since 1.35, have been removed.
* Several API calls have been updated to return a 'temp' user flag:
  - ApiQueryImageInfo
  - ApiQueryLogEvents
  - ApiQueryRecentChanges
  - APIs extended from ApiQueryRevisionsBase
* Parser::getCustomDefaultSort() and ::setDefaultSort(), deprecated since 1.38,
  have been removed.
* UserOptionsLookup::getDefaultOptions() and ::getDefaultOption() now accept a
  UserIdentity, to take conditional defaults for user properties into account.
  When run on a wiki where conditional defaults are used, calling those methods
  without the UserIdentity might produce unexpected results.
* Installer-related classes have been namespaced without having aliases added.
  The following have been moved to MediaWiki\Installer:
  - CliInstaller
  - DatabaseInstaller
  - InstallDocFormatter
  - Installer
  - InstallerOverrides
  - InstallerSessionProvider
  - LocalSettingsGenerator
  - MysqlInstaller
  - PostgresInstaller
  - PostgresUpdater
  - SqliteInstaller
  - SqliteUpdater
  - WebInstaller
  - WebInstallerComplete
  - WebInstallerCopying
  - WebInstallerDBConnect
  - WebInstallerDBSettings
  - WebInstallerDocument
  - WebInstallerExistingWikis
  - WebInstallerInstall
  - WebInstallerLanguage
  - WebInstallerName
  - WebInstallerOptions
  - WebInstallerOutput
  - WebInstallerPage
  - WebInstallerReleaseNotes
  - WebInstallerRestart
  - WebInstallerUpgrade
  - WebInstallerUpgradeDoc
  - WebInstallerWelcome
* The file mediawiki.ui/variables.less, deprecated since 1.41, has been
  removed in favor of mediawiki.skin.variables.less.
* The file mediawiki.ui/utilities.less, with its three layout CSS classes, has
  been removed.
* The module `jquery.cookie` (deprecated as of 1.41) has been removed. Please
  use `mediawiki.cookie` instead
* The no-op module `es6-polyfills` (deprecated as of 1.41) has been removed.
* Log formatters (as defined in $wgLogActionsHandlers) are now created by
  ObjectFactory, which means their constructors must be public. Legacy log
  formatters using callbacks instead of class names are no longer supported.
* The old aliases for the namespaced ResourceLoader classes, deprecated since
  they were moved in MediaWiki 1.39, have now been dropped:
  - ResourceLoader – use MediaWiki\ResourceLoader\ResourceLoader
  - ResourceLoaderCircularDependencyError
    – use MediaWiki\ResourceLoader\CircularDependencyError
  - ResourceLoaderClientHtml – use MediaWiki\ResourceLoader\ClientHtml
  - ResourceLoaderCodexModule – use MediaWiki\ResourceLoader\CodexModule
  - ResourceLoaderContext – use MediaWiki\ResourceLoader\Context
  - ResourceLoaderFileModule – use MediaWiki\ResourceLoader\FileModule
  - ResourceLoaderFilePath – use MediaWiki\ResourceLoader\FilePath
  - ResourceLoaderForeignApiModule
    – use MediaWiki\ResourceLoader\ForeignApiModule
  - ResourceLoaderImage – use MediaWiki\ResourceLoader\Image
  - ResourceLoaderImageModule – use MediaWiki\ResourceLoader\ImageModule
  - ResourceLoaderLessVarFileModule
    – use MediaWiki\ResourceLoader\LessVarFileModule
  - ResourceLoaderModule – use MediaWiki\ResourceLoader\Module
  - ResourceLoaderMwUrlModule – use MediaWiki\ResourceLoader\MwUrlModule
  - ResourceLoaderOOUIFileModule – use MediaWiki\ResourceLoader\OOUIFileModule
  - ResourceLoaderOOUIIconPackModule
    – use MediaWiki\ResourceLoader\OOUIIconPackModule
  - ResourceLoaderOOUIImageModule
    – use MediaWiki\ResourceLoader\OOUIImageModule
  - ResourceLoaderOOUIModule – use MediaWiki\ResourceLoader\OOUIModule
  - ResourceLoaderSiteModule – use MediaWiki\ResourceLoader\SiteModule
  - ResourceLoaderSiteStylesModule
    – use MediaWiki\ResourceLoader\SiteStylesModule
  - ResourceLoaderSkinModule – use MediaWiki\ResourceLoader\SkinModule
  - ResourceLoaderStartUpModule – use MediaWiki\ResourceLoader\StartUpModule
  - ResourceLoaderUserModule – use MediaWiki\ResourceLoader\UserModule
  - ResourceLoaderUserOptionsModule
    – use MediaWiki\ResourceLoader\UserOptionsModule
  - ResourceLoaderUserStylesModule
    – use MediaWiki\ResourceLoader\UserStylesModule
  - ResourceLoaderWikiModule – use MediaWiki\ResourceLoader\WikiModule
  - DerivativeResourceLoaderContext
    – use MediaWiki\ResourceLoader\DerivativeContext
  - MessageBlobStore – use MediaWiki\ResourceLoader\MessageBlobStore
  - VueComponentParser – use MediaWiki\ResourceLoader\VueComponentParser
* (T318989) Skin::lastModified, deprecated since 1.40, has been removed.
* Composer 1.x is no longer supported, and can no longer be used with MediaWiki.
* Title::GAID_FOR_UPDATE, deprecated in 1.34, has been removed. Instead, your
  code should use IDBAccessObject::READ_LATEST.
* Six private Title class members, deprecated in 1.37, are now fully private;
  use their corresponding accessor methods:
   - $mTextform   -> getText()
   - $mUrlform    -> getPartialURL()
   - $mDbkeyform  -> getDBkey()
   - $mNamespace  -> getNamespace()
   - $mInterwiki  -> getInterwiki()
   - $mFragment   -> getFragment()
* Skin::bottomScripts, deprecated since 1.37, has been removed.
* Fallback index and options have been removed from
  DBAccessObjectUtils::getDBOptions() without deprecation.
* The deprecated class aliases for now-namespaced or renamed PHP classes that
  were added in or before 1.39 LTS have now been removed:
   - Blob -> Wikimedia\Rdbms\Blob
   - Block -> MediaWiki\Block\DatabaseBlock
   - DBAccessError -> Wikimedia\Rdbms\DBAccessError
   - DBConnectionError -> Wikimedia\Rdbms\DBConnectionError
   - DBError -> Wikimedia\Rdbms\DBError
   - DBExpectedError -> Wikimedia\Rdbms\DBExpectedError
   - DBQueryError -> Wikimedia\Rdbms\DBQueryError
   - DBReadOnlyError -> Wikimedia\Rdbms\DBReadOnlyError
   - DBReplicationWaitError -> Wikimedia\Rdbms\DBReplicationWaitError
   - DBTransactionError -> Wikimedia\Rdbms\DBTransactionError
   - DBTransactionSizeError -> Wikimedia\Rdbms\DBTransactionSizeError
   - DBUnexpectedError -> Wikimedia\Rdbms\DBUnexpectedError
   - DatabaseMysqlBase -> Wikimedia\Rdbms\DatabaseMySQL
   - DatabaseMysqli -> Wikimedia\Rdbms\DatabaseMySQL
   - EasyDeflate -> Deflate
   - Field -> Wikimedia\Rdbms\Field
   - IMaintainableDatabase -> Wikimedia\Rdbms\IMaintainableDatabase
   - LinksDeletionUpdate -> MediaWiki\Deferred\LinksUpdate\LinksDeletionUpdate
   - LinksUpdate -> MediaWiki\Deferred\LinksUpdate\LinksUpdate
   - LoadBalancer -> Wikimedia\Rdbms\LoadBalancer
   - LoadBalancerSingle -> Wikimedia\Rdbms\LoadBalancerSingle
   - RCFeedEngine -> FormattedRCFeed
   - RandomPage -> MediaWiki\Specials\SpecialRandomPage
* The return value of IDatabase::upsert(), deprecated since 1.33, has been
  removed.
* Instancing MediaWiki\Specials\SpecialRandomPage without injected services has
  been removed.
* SpecialPage::listed() and ::setListed(), deprecated since 1.35, have both been
  removed. Use ::isListed() to read, and over-ride by implementing isListed() or
  by sub-classing UnlistedSpecialPage.
* BlockListPager::getTotalAutoblocks() was removed.

=== Deprecations in 1.42 ===
* (T273239) wfGetDB(), deprecated in 1.39, now emits deprecation warnings. Most
  code can migrate to MediaWikiServices::getInstance()->getConnectionProvider()
  ->getReplicaDatabase() or …->getPrimaryDatabase() as appropriate.
* (T166010) All PHP code in MediaWiki is slowly being moved to be in a class
  namespace as appropriate, so that we can use PSR-4 auto-loading, which will
  speed up general code loading of MediaWiki. The old global namespace class
  names are being left behind as deprecated aliases.
  In this release of MediaWiki, 1868 classes now have a namespace and 821 do
  not yet (69% done, up from 63% in MediaWiki 1.41.0). The following have newly
  been moved:
  - MediaWiki\Cache:
    - BacklinkCache
    - FileCacheBase
    - GenderCache
    - HTMLCacheUpdater (and fix case for consistency with HTMLFileCache)
    - LinkBatch
    - LinkCache
    - UserCache
  - MediaWiki\Context:
    - ContextSource
    - DerivativeContextSource
    - IContextSource
    - MutableContext
    - RequestContext
  - MediaWiki\Deferred:
    - AtomicSectionUpdate
    - AutoCommitUpdate
    - CdnCacheUpdate
    - DataUpdate
    - DeferrableCallback
    - DeferrableUpdate
    - DeferredUpdates
    - DeferredUpdatesScope
    - DeferredUpdatesScopeMediaWikiStack
    - DeferredUpdatesScopeStack
    - EnqueueableDataUpdate
    - HtmlFileCacheUpdate
    - JobQueueEnqueueUpdate
    - MWCallableUpdate
    - MergeableUpdate
    - MessageCacheUpdate
    - SearchUpdate
    - SendPasswordResetEmailUpdate
    - SiteStatsUpdate
    - TransactionRoundAwareUpdate
    - TransactionRoundDefiningUpdate
    - UserEditCountInfo
    - UserEditCountUpdate
  - MediaWiki\HTMLForm:
    - CodexHTMLForm
    - CollapsibleFieldsetLayout
    - HTMLForm
    - HTMLFormActionFieldLayout
    - HTMLFormElement
    - HTMLFormField
    - HTMLFormFieldLayout
    - HTMLFormFieldRequiredOptionsException
    - HTMLNestedFilterable
    - OOUIHTMLForm
    - VFormHTMLForm
    - MediaWiki\HTMLForm\Field:
      - HTMLApiField
      - HTMLAutoCompleteSelectField
      - HTMLButtonField
      - HTMLCheckField
      - HTMLCheckMatrix
      - HTMLComboboxField
      - HTMLDateTimeField
      - HTMLEditTools
      - HTMLExpiryField
      - HTMLFileField
      - HTMLFloatField
      - HTMLFormFieldCloner
      - HTMLFormFieldWithButton
      - HTMLHiddenField
      - HTMLInfoField
      - HTMLIntField
      - HTMLMultiSelectField
      - HTMLNamespacesMultiselectField
      - HTMLRadioField
      - HTMLRestrictionsField
      - HTMLSelectAndOtherField
      - HTMLSelectField
      - HTMLSelectLanguageField
      - HTMLSelectLimitField
      - HTMLSelectNamespace
      - HTMLSelectNamespaceWithButton
      - HTMLSelectOrOtherField
      - HTMLSizeFilterField
      - HTMLSubmitField
      - HTMLTagFilter
      - HTMLTagMultiselectField
      - HTMLTextAreaField
      - HTMLTextField
      - HTMLTextFieldWithButton
      - HTMLTimezoneField
      - HTMLTitleTextField
      - HTMLTitlesMultiselectField
      - HTMLToggleSwitchField
      - HTMLUserTextField
      - HTMLUsersMultiselectField
  - MediaWiki\Installer:
    - DatabaseUpdater
    - MysqlUpdater
  - MediaWiki\LinkedData:
    - PageDataRequestHandler
  - MediaWiki\Maintenance:
    - Version
  - MediaWiki\Message:
    - Message
  - MediaWiki\Parser:
    - Parser
    - ParserOutput
  - MediaWiki\PoolCounter:
    - PoolCounter
    - PoolCounterNull
    - PoolCounterRedis
    - PoolCounterWork
    - PoolCounterWorkViaCallback
    - PoolWorkArticleView
    - PoolWorkArticleViewCurrent
    - PoolWorkArticleViewOld
  - MediaWiki\Site:
    - CachingSiteStore
    - DBSiteStore
    - HashSiteStore
    - MediaWikiSite
    - Site
    - SiteExporter
    - SiteImporter
    - SiteList
    - SiteLookup
    - SiteStore
  - (T352284) MediaWiki\User\Options:
    - DefaultOptionsLookup
    - UserOptionsLookup
    - UserOptionsManager
    - StaticUserOptionsLookup
* Some hook classes have been moved from the generic MediaWiki\Hooks namespace
  to live closer to the code which uses them:
  - MediaWiki\Output\Hook:
    - AfterBuildFeedLinksHook
    - AfterFinalPageOutputHook
    - BeforePageDisplayHook
    - BeforePageRedirectHook
    - GetCacheVaryCookiesHook
    - LanguageLinksHook
    - MakeGlobalVariablesScriptHook
    - OutputPageAfterGetHeadLinksArrayHook
    - OutputPageBeforeHTMLHook
    - OutputPageBodyAttributesHook
    - OutputPageCheckLastModifiedHook
    - OutputPageMakeCategoryLinksHook
    - OutputPageParserOutputHook
* API modules using ApiBase::requirePostedParameters() must also override
  mustBePosted() to return true.
* Overriding MWException::getHTML(), ::getText(), ::getPageTitle(), and
  ::reportHTML() in order to display custom exception messages is now
  deprecated. Provide the error message when constructing the Exception,
  or if you need a whole custom error page, use ErrorPageError instead.
* Using `new ImportReporter( … )` or `new ApiImportReporter( … )` without
  the $context parameter is now deprecated.
* Using `WikiImporterFactory::getWikiImporter()` without the $performer
  parameter is now deprecated.
* BlockManager::getUserBlock() was deprecated. Instead use
  BlockManager::getBlock(), which expects the caller to do ipblock-exempt
  checking.
* The `composer phpunit:entrypoint` entrypoint has been deprecated, along with
  bootstrap.integration.php and suite.xml. Run tests with `composer phpunit`
  instead, or simply `vendor/bin/phpunit`, which use bootstrap.php and
  phpunit.xml.dist.
* The global variable $wgCommandLineMode is deprecated. In most cases checks
  for `$wgCommandLineMode` can be replaced with `MW_ENTRY_POINT === 'cli'`.
* The global function wfUnpack is deprecated and emits deprecation
  warnings. Use StringUtils::unpack instead.
* BagOStuff::setNewPreparedValues() now emits deprecation warnings.
* SpecialEmailUser::getTarget() has been deprecated.
* User::isBlocked(), ::isBlockedFromCreateAccount() and ::isBlockedFrom() now
  emit deprecation warnings. They were deprecated since 1.34, 1.37 and 1.33
  respectively.
* DatabaseBlock::newFromID() was deprecated and will emit deprecation warnings.
  Instead use DatabaseBlockStore::newFromID().
* DatabaseBlock::getAutoblockExpiry() was deprecated without replacement.
* MagicWord::getId() has been deprecated.
* MagicWordFactory::getSubstIDs() has been deprecated.
* Status::setMessageLocalizer is deprecated. Callers that want to control the
  localization of the Status object should obtain a StatusFormatter from
  the StatusFormatterFactory.
* Html::buttonAttributes() and Html::getTextInputAttributes() methods
  no longer do anything and have been deprecated.
* DatabaseBlock::doAutoblock and ::updateTimestamp are now deprecated, use
  DatabaseBlockStore::doAutoblock and ::updateTimestamp instead.
* The MediaWiki class has been deprecated. Type hints in hooks should be
  changed to refer to MediaWikiEntryPoint instead. Note that extensions should
  not define their own entry points and should not interfere with the state of
  MediaWikiEntryPoint instances.
* Various methods in ObjectCache have been deprecated and their equivalent made
  available in ObjectCacheFactory, use them instead:
  - ::getInstance() -> ObjectCacheFactory::getInstance()
  - ::newFromParams() -> ObjectCacheFactory::newFromParams()
  - ::newAnything() -> ObjectCacheFactory::newInstance(
         ObjectCache::getAnythingId() )
  - ::getLocalServerInstance() -> ObjectCacheFactory::getLocalServerInstance()
  - ::clear() -> ObjectCacheFactory::clear()
  - In addition, the ObjectCache::$instances member has been deprecated as well.
* Vuex has been deprecated in favor of its successor, Pinia. Though deprecated,
  Vuex 4 will remain accessible for the foreseeable future. Pinia should be used
  for new projects.
* Linker::makeHeadline() has been deprecated.
* SerializedValueContainer::isUnified() has been deprecated and now emits
  deprecation warnings since 1.42.
* Linker::generateTOC(), Linker::tocIndent(), Linker::tocUnindent(),
  Linker::tocLine(), Linker::tocLineEnd(), Linker::tocList() are deprecated.
* Title::getBrokenLinksFrom() has been deprecated.
* LogFormatter subclasses now emit deprecation warnings unless they are
  constructed using LogFormatterFactory.
* ReplicatedBagOStuff has been deprecated since 1.42.
* The third argument to ContentRenderer::getParserOutput() now accepts a
  RevisionRecord or WikiRevision; passing an integer revision id has been
  deprecated and emits a warning.
* Passing a null value to ParserOutput::setPageProperty() has been deprecated
  and emits a warning; pass an empty string or use `::unsetPageProperty()`
  instead.
* Passing a non-string value to ParserOutput::setPageProperty() has been
  deprecated; use ::setNumericPageProperty() instead.
* Passing a non-scalar value to ParserOutput::setPageProperty() will emit
  a warning (it has never worked).
* ParserOutput::setLanguageLinks() has been deprecated.
* ParserOutput::getTimestamp() and ::setTimestamp() have been deprecated; use
  ::getRevisionTimestamp() and ::setRevisionTimestamp() instead.
* ParserOutput::setText() has been deprecated; use ::setRawText() instead which
  matches the name of the corresponding getter, ParserOutput::getRawText().
* ParserOutput::addTemplate() will emit a deprecation warning if it is called
  with a non-local title, such as an interwiki link. In a future release it will
  throw InvalidArgumentException.
* The use of dynamic properties of Parser has been deprecated and will emit
  deprecation warnings.
* The following deprecated public properties of Parser will emit deprecation
  warnings:
  - Parser::$ot, deprecated since 1.35
  - Parser::$mTitle, deprecated since 1.35
  - Parser::$mOptions, deprecated since 1.35
* The following deprecated public properties of Parser are now marked
  for internal use only:
  - Parser::$mPPNodeCount, deprecated since 1.35
  - Parser::$mHighestExpansionDepth, deprecated since 1.35
* ApiQueryBlockInfoTrait::addBlockInfoToQuery() will emit deprecation warnings
  and will soon stop working due to schema changes. Instead use
  addDeletedUserFilter() or getBlockDetailsForRows().
* UploadBase::getImageInfo was deprecated, subclasses of ApiUpload can use
  ApiUpload::getUploadImageInfo() instead.
* DatabaseBlockStore::updateTimestamp() is now internal and should not be
  called.
* The LocalisationCache helper class GlobalDependency has been deprecated,
  use MainConfigDependency instead.
* The module `mediawiki.icon` has been deprecated. Use the Codex mixin instead
  (T351681).
* ConfigRepository::class and MediaWikiServices::getConfigRepository() have been
  deprecated, they are unused.
* Passing a WikiPage to PageEditStash::parseAndCache() has been deprecated.
  Use PageUpdater instance.
* SpecialBlock::getSuggestedDurations() has been deprecated, use
  Language::getBlockDurations() instead.
* MediaWikiServices::getBlockErrorFormatter() has been deprecated, use
  MediaWikiServices::getFormatterFactory()->getBlockErrorFormatter() instead.
* DummyLinker has been deprecated. The DummyLinker parameter to the
  'ImageBeforeProduceHTML' hook will become null in the future.
* Database::listViews() has been deprecated. This was previously used to filter
  views out of the return value of Database::listTables(). Now listTables()
  will not include views. MediaWiki does not use views.
* (T207621) UserMailer::rfc822Phrase(), deprecated since 1.38, now emits
  deprecation warnings.
* TempUserConfig::getMatchPattern() has been deprecated, use getMatchPatterns()
  instead.
* (T230025) Title::purgeSquid(), deprecated in 1.35, now emits warnings.
* Title::getCdnUrls(), deprecated in 1.35, now emits warnings.
* The rarely-used convenience method Xml::wrapClass() is now deprecated. Instead
  you can use Xml::tags('span', ['class'=>'foo'], 'bar').
* WebRequest::getCrossSiteCookie() has been deprecated due to the removal of
  $wgUseSameSiteLegacyCookies. It will emit deprecation warnings. Use
  WebRequest::getCookie().
* Using the array_merge_recursive merge strategy in extension.json and skin.json
  now emits deprecation warnings.
* DBAccessObjectUtils::getDBFromIndex() is now deprecated, use
  ::getDBFromRecency() instead.
* Many Xml methods that are specific to HTML but not XML are deprecated:
  - Xml::buildForm
  - Xml::buildTable
  - Xml::buildTableRow
  - Xml::check
  - Xml::checkLabel
  - Xml::dateMenu
  - Xml::fieldset
  - Xml::input
  - Xml::inputLabel
  - Xml::inputLabelSep
  - Xml::label
  - Xml::languageSelector
  - Xml::listDropdown
  - Xml::listDropdownOptions
  - Xml::listDropdownOptionsOoui
  - Xml::monthSelector
  - Xml::option
  - Xml::password
  - Xml::radio
  - Xml::radioLabel
  - Xml::span
  - Xml::submitButton
  - Xml::textarea
  - Xml::attrib (only for use in HTML, not XML contexts)
* IMaintainableDatabase::truncate() has been deprecated. Use truncateTable()
  instead.
* TextConflictHelper->incrementStatsByUserEdits() is now deprecated. The action
  this function previously handled should be moved into incrementConflictStats()
  and incrementResolvedStats().
* SQLPlatform::getQueryVerb() is now deprecated.

=== Other changes in 1.42 ===
* Gallery: Image captions are no longer wrapped in <p> tags. Skins that
  customize rendering for galleries may need to tweak their CSS.
* Scripts under maintenance/dev/, for quickly setup a local MediaWiki for
  development purposes, have been removed, see DEVELOPERS.md for alternatives.

== Compatibility ==

MediaWiki 1.42 requires PHP 8.1.0 or later and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

MariaDB is the recommended database software. MySQL, PostgreSQL, or SQLite can
be used instead, but support for them is somewhat less mature.

The supported versions are:

* MariaDB 10.3 or higher
* MySQL 5.7.0 or higher
* PostgreSQL 10 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

  https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

  https://lists.wikimedia.org/postorius/lists/mediawiki-l.lists.wikimedia.org/

A low-traffic announcements-only list is also available:

  https://lists.wikimedia.org/postorius/lists/mediawiki-announce.lists.wikimedia.org/

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.
