== MediaWiki 1.37.2 ==

This is a security and maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.1 ===
* (T298261) Fix support for Composer 2.2.
* (T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
* Update doctrine/dbal (3.0.0 => 3.1.5).
* (T296898) Add entry point name to disabled Session exception if possible.
* (T298564) MemcachedClient: Add support for IPv6.
* (T297543, CVE-2022-28202) SECURITY: properly escape output used within galleries and
  Special:RevisionDelete.
* (T289956) WatchAction: Fix bug that prevents showing proper success
  message in the noscript fallback mode.
* (T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
* (T283275) Fix PHP 8.0 failure of RefreshSecondaryDataUpdateTest.
* (T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
* (T275673) objectcache: Avoid getCurrentTime() call in MapCacheLRU::has().
* (T275673) objectcache: split up MapCacheLRU::getAge() to avoid conditional
  overhead.
* Fix the json schema and the extension processor for Parsoid extension modules.
* (T299696) update.php: Avoid passing null to substr.
* (T195807, T256401) Fix signature of DatabasePostgres::buildGroupConcatField.
* In PHP 8.1 don't throw exceptions from mysqli.
* (T289926) SiteConfiguration: Don't pass null to str_replace().
* (T264735) Fix deprecation warning from CURLPIPE_HTTP1.
* (T260735) Stop using is_resource() where possible.
* (T289879) Apply ReturnTypeWillChange to various implementations of built in
  interfaces.
* (T299312) Implement __serialize/__unserialize for PHP 8.1 support.
* ExtensionRegistry: Add process cache for lazy attributes.
* (T301041) ApiPageSet: Add "missing": true to missing revisions.
* Allow ParsoidModules extension schema to register services.
* (T300462) SpecialUndelete: Do not show empty comments as deleted.
* (T297708) Allow setting max execution time to several special pages.
* (T205349) LinkCache: Try invalidating cache before throwing.
* (T302540) composer.json: Add ext-calendar to require.
* (T302540) composer.json: Add ext-simplexml to require-dev.
* (T302540) composer.json: Add various PHP extensions to suggests.
* Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
* (T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
* (T293576) listFiles: Display file name instead of version.
* (T303871) Fix @since of Title::getId().
* (T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
* wrapOldPasswords: add \n to two output calls.
* (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion loop
  if it points to a local interwiki.
* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file
  uploads with actor as a condition can result in a DoS.
* (T297754, CVE-2022-28204) Special:WhatLinksHere can result in a DoS when a page is
  used on a extremely large number of other pages.

== MediaWiki 1.37.1 ==

This is a security and maintenance release of the MediaWiki 1.37 branch.

=== Changes since MediaWiki 1.37.0 ===
* (T296112) Allow inserting new sections named '0'.
* Fix path for ZhConversion.php.
* nukeNS: don't run purgeRedundantText() after every change.
* (T286779, T297031) installer: Fix Postgres mistakes in using changeField
  method.
* (T225888) RollbackAction: fix missing pagetitle.
* (T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in
  undo actions.
* (T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
* (T34716, T297416) SECURITY: Require 'read' right for most actions.
* (T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook when
  changing content model.

== MediaWiki 1.37.0 ==

=== Changes since MediaWiki 1.37.0-rc.2 ===
* Remove justinrainbow/json-schema from vendor.
* Updated pear/mail_mime from 1.10.9 to 1.10.11.
* Update deprecated Guzzle Psr7 function calls.
* (T281972) UserIdentityValue: Correct @since tags.
* Updated wikimedia/parsoid from v0.14.0-a19 to v0.14.0.
* Localisation updates.
* Tweak error message for missing composer dependencies.

== MediaWiki 1.36.2 ==

This is a security and maintenance release of the MediaWiki 1.36 branch.

=== Changes since MediaWiki 1.36.1 ===
* Don't access MWServices prematurely in Maintenence.php.
* (T283394) Mark ApiClientLogin/ApiLogin as requiring write mode.
* Installer: Fix foundation.wikimedia.org link in config-pingback-help.
* (T283273) Make postgres IRC channel point to libera.chat.
* composer.json: Promote and pin monolog/monolog to require from require-dev.
* (T287526) JavaScriptMinifer: Recognize `...` as a single token.
* (T287526) Update wikimedia/minify to 2.2.4.
* (T289108) ExtensionProcessor: Remove loaderScripts from extension.json
  schemas.
* (T281549) Installer: Fix mediawiki-announce auto subscription code.
* FormatJson: Optimize encode() for supported PHP versions.
* (T290398) renameRestrictions.php: Update protected_titles as well.
* (T290489) objectcache: Fix PHP warning for ReplicatedBagOStuff::setMulti.
* $wgMimeTypeBlacklist - This configuration array now prohibits the RFC 4329
  form of JavaScript, 'application/javascript', as well as previous MIME types.
* (T51097, T290273) resourceloader: Call getStyleFiles from
  FileModule::getFileHashes.
* (T277788) parser: Avoid calling ParserOptions::getOption() too many times.
* (T291244) Unserialize objects in ParserCache->mExtensionData as objects.
* MysqlUpdater: Add updatelog entries for dropDefault.
* (T290776) Fix $phase check in OutputHandler.
* The wikimedia/parsoid library has been upgraded from v0.13.0 to v0.13.1.
* (T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
* (T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
  table scan.
* (T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
  Special:Contributions.