== MediaWiki 1.41.1 ==

This is a security and maintenance release of the MediaWiki 1.41 branch.

=== Changes since MediaWiki 1.41.0 ===
* Localisation updates.
* CategoryViewer: Fix "count(): Argument #1 ($value) must be of type
  Countable|array, null given".
* (T353929) ActiveUsersPager: Count actions only once.
* composer: Use @php instead of php.
* (T334992) Headings in the license pickers should not be selected.
* (T326065) Indent JsonContent using tabs.
* Correct deprecation version of mediawiki.ui resource loader module.
* Resources.php: Replace short urls with full urls.
* (T354541) authmanager: Improve AuthenticationRequest docs.
* Tweak docs for UseLegacyMediaStyles.
* (T353870) Parse custom edit intro as content to enable language conversion.
* (T330428) ForeignResourceManager: Add trailing newline in validateLicense.
* ForeignResourceManager: Make it clearer what is being skipped for
  documentation-only.
* (T355017) Add missing space in Special:RecentChangesLinked.
* (T355003) composer.json Add ext-bcmath and ext-gmp to suggests.
* PHPVersionCheck: Update text to match currently supported upstream PHP
  versions (8.1+).
* (T354045) API: mark HTML output as non-cacheable.
* (T355530) filerepo: Fix img_major_mime for files with a non-standard
  extensions.
* (T355530) MimeAnalyzer: Add @since to isValidMajorMimeType.
* (T352554) ZhConverter: Fix language variant fallback chain.
* (T347541) Add 'maxlength' and 'minlength' support to HTMLTextAreaField.
* (T357668) Parser::getExternalLinkAttribs: Don't set rel attribute to null.
* LockManagerGroupIntegrationTest: Remove test depending on DBLockManager.
* (T357808) LinkRendererTest: Add missing import for LinkTarget.
* (T353305) ApiResetPassword: Allow both user and email parameters to be passed
  for reset.
* (T358949) updateCollation: Explicitly cast $scale to int.
* (T359055) api: Improve linking of language codes lists in top level i18n
  messages.
* (T359294) Make sure MovePage::isValidFileMove matches UploadBase::getTitle.
* (T230245) Respect $maxConcurrency when queuing async FileOps.
* (T352554) Follow-up "ZhConverter: Fix language variant fallback chain".
* (T359139) Restore ability to disable footer links with "-".
* Fix use of array keys in SessionManager::getVaryHeaders().
* (T292237, T317451) build: Restore Doxygen output for MediaWiki release tags.
* (T324903) HistoryPager: Add #[AllowDynamicProperties].
* (T360850) Update Apache config syntax in .htaccess files.
* Update wikimedia/parsoid to 0.18.2.
* docs: Remove use of $IP from mwdocgen.php.
* (T317451) build: Restore Doxygen output for MediaWiki release tags (take 3).
* docs: Set stable permalink on markdown files.
* (T360608) WebRequest: detectServer appends default ports that should be
  omitted.
* (T357019) allow maintenance/deleteBatch.php to accept page ID.
* (T355538 CVE-2024-PENDING) XSS in edit summary parser.
* (T357760, CVE-2024-PENDING) Denial of service vector via GET request to
  Special:MovePage on pages with thousands of subpages.

=== Changes since MediaWiki 1.41.0-rc.0 ===
* Localisation updates.
* Update wikimedia/parsoid to 0.18.0.
* (T351758) DEVELOPERS.md: reword WSL instructions to include best practices.
* (T350615) PoolCounterConnectionManager: Add support for ipv6.
* (T321234) Make MagicWordArray not fail on old revs with broken UTF-8.
* thumb: Fix "PHP Deprecated: strlen(): Passing null to parameter".
* (T344971) Maintenance: Fix RebuildTextIndex.
* (T327007) htmlform: Correct validation for file input field.

=== Changes since MediaWiki 1.40.0 ===
* Localisation updates.
* (T333050, CVE-2023-PENDING) SECURITY: Fix infinite loop for self-redirects
  with variants conversion.
* docs: Fix a few typos in MainConfigSchema.
* (T290464) Add DiscussionTools bundling to release notes.
* (T309714) mime: Add support for 'font/sfnt' mime type.
* (T341434) WikiImporter: Improve error message output.
* (T341737) ApiBase: Cast $id to string in filterIDs.
* (T286291, T296188) Merge zh and zh-tw namespace translations back to zh-hans,
  zh-hant, zh-hk respectively.
* (T337875) WRStats: Round up SequenceSpec::hardExpiry to the nearest integer.
* (T237898) installer: Check MariaDB version in updater/installer.
* (T342632) ApiComparePages: Add help url.
* (T326182, T324903) EditPage: Add #[AllowDynamicProperties].
* (T342351) rdbms: Fix postgres db function call.
* (T343675) user: Use {@} to escape annotation when writting about annotation.
* (T343797) LanguageWa: Fix double timezone adjustment.
* (T343669) skins: Avoid function call on array.
* (T326454) Update pear/mail to 1.5.1.
* (T343622) docs: Set the <comment> tag back to optional.
* (T330528) Upgrade wikimedia/html-formatter from 3.0.1 to 4.0.3.
* Updated jQuery from v3.6.1 to v3.7.1.
* (T337463) wdio-mediawiki: await saveScreenshot.
* (T208477) $wgPrivilegedGroups – Users belonging in some of the listed groups
  will be audited more aggressively.
* doc: Improve description of "type" in extension.schema.v2.json.
* Added PrivilegedGroups attribute for extension.json / skin.json, which lets
  you add any new user groups you define to wgPrivilegedGroups (see above).
* (T288624) MultiHttpClient: Unset $this->cmh after closing it.
* (T345039) Do not run SkinAfterBottomScripts hook twice unconditionally.
* (T265734) API Help: Note that parameters may be inherited from other context.
* (T285545) i18n: Split apihelp for standard dir parameter.
* (T285545) i18n: Split apihelp for redirects/linkshere/transcludedin/fileusage
  show.
* (T285545) i18n: Split apihelp for parameter list=deletedrevs&drprop=.
* (T285545) i18n: Split apihelp for parameter list=allpages&apprexpiry=.
* (T285545) i18n: Split apihelp for parameter action=opensearch&redirects=.
* (T285545) i18n: Split apihelp for parameter action=managetags&operation=.
* (T285545) api: Add message for list=watchlist&wlprop=expiry.
* (T334011) ApiComparePages: expose 'difftype' param if wikidiff2 is installed.
* (T342633) api: Add message for action=compare&prop=timestamp.
* API: revids=… does not necessarily return the queried revisions.
* (T235207) Get correct main page in API call examples.
* doc: Make extension.schema.v2.json a valid JSON schema.
* (T326696) Add since tag to UserOptionsManager::MAX_BYTES_OPTION_VALUE.
* updateSpecialPages.php: Avoid implicit float conversion on modulo.
* (T347227) ImportReporter: Make callback functions public.
* (T346898) importDump: Unconditionally call $importer->setUsernamePrefix().
* doc: Improve description of type in extension.schema.v1.json.
* (T340217, CVE-2023-PENDING) SECURITY: Vector 2022: Numerous unescaped messages
  leading to potential XSS.
* (T340220, CVE-2023-PENDING) SECURITY: Vector 2022: vector-intro-page message is
  assumed to yield a valid title.
* (T340221, CVE-2023-PENDING) SECURITY: XSS via 'youhavenewmessagesmanyusers' and
  'youhavenewmessages' messages.
* (T341529, CVE-2023-PENDING) SECURITY: diff-multi-sameuser ("X intermediate
  revisions by the same user not shown") ignores username suppression.
* (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted
  XML file to Special:Upload (non standard configuration).