Prep 1.36.1

[mediawiki.git] / RELEASE-NOTES-1.36

= MediaWiki 1.36 =

== MediaWiki 1.36.1 ==

This is a security and maintenance release of the MediaWiki 1.36 branch.

=== Changes since MediaWiki 1.36.0 ===
* (T283942) DatabaseInstaller.php: Only run core schema file if specified table
  doesn't already exist.
* (T247223) Optimise MessageCache::isMainCacheable() for the single-message
  case.
* (T283244) JavaScriptMinifer: Fix handling of "delete" as object property.
* (T284391) Fix SkinModule to correctly prepend remote path on document root
  installs.
* (T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
* (T278579) Don't send headers on ob_end_clean().
* (T285287) MultiHttpClient: Replace PHP version check with defined().
* (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging pages.

== MediaWiki 1.36.0 ==

=== Changes since MediaWiki 1.36.0-rc.0 ===
* (T248481) rdbms: Use server time in
  DatabaseMysqlBase::getLagFromPtHeartbeat().
* (T281549) WebInstaller: Don't show the announce-l subscribe checkbox for now.
* (T264214) Follow-ups for UserGroupManager.
* (T282280) resourceloader: Fix path-only URLs in wiki modules when script path
  is docroot.
* (T281972) UserIdentityValue: Introduce convenience static factory methods.
* (T230428) Make page_is_redirect and page_is_new unsigned.
* (T280292) Legacy feature should not load thumbnail style rules (only layout).
* (T283247) Freenode -> Libera per wikimedia moving from freenode to libera.
* (T280270) composer: Lock Parsoid version to specific 0.13.0 release.
* (T142663) Add extension.json merge strategy "provide_default".
* (T283540) HookContainer: Fix normalization of callback for static handler.
* (T283464) registration: Fix array order for array_replace_recursive merge
  strategy.
* (T283539) Interwiki: Fix calling "onInterwikiLoadPrefix" hook.
* (T282594) Timeless: Re-branch to 40eb3dad1for REL1_36.

== MediaWiki 1.36.0-rc.0 ==

== Upgrading notes for 1.36 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.27.

Some specific notes for MediaWiki 1.36 upgrades are below:
* MediaWiki 1.36 now requires the PHP internationalization extension (commonly
  referred to as Intl, ext-intl, or php-intl).
* The MediaWiki:Autoblock_whitelist block exemption control has been moved to
  MediaWiki:Block-autoblock-exemptionlist. If you use this feature, please move
  the MediaWiki:Autoblock_whitelist page.
* (T275334) $wgExtensionFunctions is sometimes used to change configuration
  settings. This is not safe; extension functions are run relatively late, some
  services are already initialized by that point and so they use the old
  configuration. Changes in 1.36 make this kind of breakage even more common.
  You can use the MediaWikiServices hook instead. (In the future there might be
  a dedicated hook for configuration changes.)

For notes on 1.35.x and older releases, see HISTORY.

=== Configuration changes for system administrators in 1.36 ===
The MediaWiki update script, maintenance/update.php, used to accept `--nopurge`
as an option to prevent clearing caches stored in the database during upgrade.
This is no longer encouraged, and the option has been removed.

==== New configuration ====
* (T256001) $wgManualRevertSearchRadius – This setting controls a new feature
  that marks edits as reverts if they restore the page to an exact previous
  state. This configuration variable sets the maximum number of revisions of a
  page that will be checked against every new edit. Set this to 0 to disable the
  feature entirely.
* (T244058) $wgOldRevisionParserCacheExpireTime — This setting was added to
  control caching of ParserOutput for old (non-current) revisions.
* (T265263) $wgRememberMe - This setting configures the "remember me" checkbox
  on account log-in systems via RememberMeAuthenticationRequest.
* (T157145) $wgSkinMetaTags – This setting lets sysadmins configure skins that
  support meta tags. These tags make sharing of MediaWiki pages on a variety of
  social platforms more contentful and thus useful.
* (T280944) $wgIncludejQueryMigrate - This setting lets sysadmins disable the
  jQuery Migrate plugin. It has been enabled by default since MediaWiki 1.27.
  In future releases it will be disabled by default.

==== Changed configuration ====
* $wgLogos – This setting selects the logo shown on the site. The default value
  for the site logo, which is shown in an install if you have not set one, will
  now be the new logo of MediaWiki.
* (T274695) $wgAjaxEditStash — This setting, to disable the edit stashing
  feature when users start writing an edit summary, has been deprecated. In
  future releases, this feature will always be enabled.
* $wgUploadStashScalerBaseUrl – This setting, to enable remote on-demand media
  scaling, was deprecated. Use the `thumbProxyUrl` setting in $wgLocalFileRepo
  instead.
* $wgSlaveLagWarning and $wgSlaveLagCritical – These settings have been renamed,
  to $wgDatabaseReplicaLagWarning & $wgDatabaseReplicaLagCritical respectively.
  The former configuration variable names are deprecated, but will be used as
  the fall back if they are still set, and remain temporarily available for
  extensions which try to read them.
* $wgWANObjectCaches - The "coalesceKeys" option was removed without deprecation
  and replaced by a new "coalesceScheme" option, set to "hash_stop" by default.
  If you use Dynomite, then set the new "coalesceKeys" option to "hash_tag". The
  "cluster" and "mcrouterAware" options were also removed without deprecation.
  Use "broadcastRoutingPrefix" instead.

==== Removed configuration ====
* $wgUseTwoButtonsSearchForm — This setting, deprecated in 1.35, has been
  removed.
* $wgAllowImageMoving — This setting, deprecated in 1.35, has been removed. Use
  group permission settings instead. For example, to prevent sysops from
  moving files, set `$wgGroupPermissions['sysop']['movefile'] = false;`
* $wgExtNewTables, $wgExtNewFields, $wgExtNewIndexes, $wgExtPGNewFields,
  $wgExtPGAlteredFields, $wgExtModifiedFields — These settings were removed.
  They became obsolete after 1.17 overhauled the database updater, but were kept
  for backwards compatibility. The LoadExtensionSchemaUpdates hook should be
  used instead.
* $wgParserConf - This setting, deprecated in 1.35, has been removed. The last
  use of this setting was for pre-processor configuration, which was deprecated
  in 1.34 and removed in 1.35.
* $wgEnableRestAPI - This setting, ignored since 1.35, has been removed.
* $wgPagePropsHaveSortkey – This temporary setting has been removed, along with
  the schema change upgrade path it controlled. If your site is still using it,
  meaning you have not yet applied the `pp_sortkey` schema change from 1.24, you
  must now apply it before upgrading.
* The deprecated password policies PasswordCannotMatchBlacklist and
  PasswordNotInLargeBlacklist were removed. Please use
  PasswordCannotMatchDefaults and PasswordNotInCommonList respectively instead.

=== New user-facing features in 1.36 ===
* The logo of MediaWiki has changed. This means that the "Powered By MediaWiki"
  button shown in the skin footer will be different.
* All HTML5 named entities are now accepted in wikitext.
* (T106263) The file description page's alternate sizes now include 2048px.

=== New developer features in 1.36 ===
* Parser test files can now declare a dependency on a specific extension being
  loaded, not just on the presence of a certain extension tag hook. This is a
  better fit for extensions like TimedMediaHandler, which affect the output but
  don't register parser hooks. Use `extension:Foo` in the `!! hooks` section of
  your parser test file to declare a dependency on the `Foo` extension being
  loaded.
* To expose code previously present in SpecialBlock/SpecialUnblock to other
  parts of the code, or to extensions, the new BlockUser and UnblockUser command
  objects were added. Use the BlockUserFactory and UnblockUserFactory services
  to create them.
* The hook UsersPagerDoBatchLookupsHook takes now a \Wikimedia\Rdbms\IDatabase,
  instead of \Wikimedia\Rdbms\DBConnRef, as the first parameter.
* MediaHandlers can now customize the formatting of the metadata they emit by
  over-riding MediaHandler::formatTag( $key, $value ). The default for unknown
  tags is numeric formatting; non-EXIF tags which are non-numeric should always
  use this method to specify the desired formatting.
* The new 'title' type can be used to validate action API and REST API inputs.
* The new ArticleParserOptions hook allows customizing the parser options used
  to parse wikitext for an article, based on user preferences, title, etc.
* The new 'raw' type can be used to validate action API inputs. It bypasses the
  Unicode NFC normalization done on inputs of type 'string', so it more suitable
  when the input is binary or may contain deprecated Unicode sequences or
  characters (such as U+2001) that should be passed unmodified.
* (T260330) A new abstraction for running shell commands has been introduced,
  called BoxedCommand. A BoxedCommand object can be obtained with
  MediaWikiServices::getInstance()->getCommandFactory()->createBoxed().
* ResourceLoader modules can now mark themselves as ES6-only by setting
  `'es6' => true` in their module definition. ES6-only modules will not be
  executed in browsers that don't support ES6, such as IE11.

=== External library changes in 1.36 ===

==== New external libraries ====
* Added wikimedia/minify 2.2.2.
* Added wikimedia/request-timeout 1.1.0.
* Added wikimedia/shellbox 1.0.4.
* Added WVUI 0.1.0.

==== Changed external libraries ====
* Updated composer/semver from 1.5.1 to 3.2.4.
* Updated guzzlehttp/guzzle from 6.5.4 to 7.2.0.
* Updated jQuery from v3.4.1 to v3.6.0.
* Updated jQuery Migrate from v3.1.0 to v3.3.2.
* Updated jquery.client from 2.0.2 to 3.0.0.
* Updated OOUI from 0.39.3 to 0.41.3.
* Updated pear/mail_mime from 1.10.8 to 1.10.9.
* Updated pear/net_smtp from 1.9.1 to 1.9.2.
* Updated pimple/pimple from 3.3.0 to 3.3.1.
* Updated wikimedia/at-ease from 2.0.0 to 2.1.0.
* Updated wikimedia/cldr-plural-rule-parser from 1.0.0 to 2.0.0.
* Updated wikimedia/common-passwords from 0.2.0 to 0.3.0.
* Updated wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1.
* Updated wikimedia/html-formatter from 1.0.2 to 3.0.1.
* Updated wikimedia/ip-set from 2.1.0 to 3.0.0.
* Updated wikimedia/ip-utils from 1.0.0 to 3.0.2.
* Updated wikimedia/less.php from 3.0.0 to 3.1.0.
* Updated wikimedia/object-factory from 2.1.0 to 3.0.0.
* Updated wikimedia/php-session-serializer from 1.0.7 to 2.0.0.
* Updated wikimedia/remex-html from 2.2.0 to 2.2.2.
* Updated wikimedia/utfnormal from 2.0.0 to 3.0.2.
* Updated wikimedia/wait-condition-loop from 1.0.1 to 2.0.1.
* Updated wikimedia/xmp-reader from 0.7.0 to 0.8.1.

===== Changed development-only external libraries =====
* Updated composer/spdx-licenses from 1.5.3 to 1.5.4.
* Updated doctrine/dbal from 2.10.2 to 3.0.0.
* Updated doctrine/sql-formatter from 1.1.0 to 1.1.1.
* Updated mediawiki/mediawiki-phan-config from 0.10.2 to 0.10.6.
* Updated monolog/monolog from 1.25.3 to 2.2.0.
* Updated nikic/php-parser from 4.4.0 to 4.10.2.
* Updated psy/psysh from 0.10.4 to 0.10.5.
* Updated seld/jsonlint from 1.7.1 to 1.8.3.
* Updated symfony/yaml from ~3.4|~4.3|~5.0.5 to ~3.4|~5.1.
* Updated wikimedia/testing-access-wrapper from 1.0.0 to 2.0.0.

==== Removed external libraries ====
* The html5shiv library has been removed, as support for Internet Explorer 8 has
  been dropped.
* The wikimedia/avro suggested development-only library has been removed, as the
  support for logging in Avro format has been dropped.

=== Bug fixes in 1.36 ===
* (T190285) ApiEditPage module used to switch 'undo' and 'undoafter' parameters,
  if it founds you reversed them (based on assumption that higher revision ID
  indicates a later revision). The assumption is not always true, and is
  hindering proper edit undoing in some cases, hence the logic has been removed.
  Reversing the parameters will now lead to edit conflict or undefined behavior.
* (T263340) In history merging, pages with a content model that does not support
  redirects will now be recorded as deleted if no revision is being left in the
  source page (that's if all revisions of the page have been merged to another).

=== Action API changes in 1.36 ===
* (T269636) `Access-Control-Max-Age` was added to the default list of headers
  allowed for cross-origin API requests ($wgAllowedCorsHeaders).
* (T258108) Accounts with the 'bot' right no longer have pages automatically
  added to the watchlist when making API edits, regardless of their preferences.
  This is to reduce the size of the watchlist data in the database. To add API
  bot edits to the watchlist, explicitly set the 'watch' option.

=== Languages updated in 1.36 ===
MediaWiki supports over 350 languages. Many localisations are updated regularly.
Below only new and removed languages are listed, as well as changes to languages
because of Phabricator reports.

* (T258975) Added a Latin/Cyrillic script converter for the Talysh language.
* (T245359) Split Bali script locale from "ban" (Balinese) (ban-bali).
* (T264582) Added language support for Madurese (mad).
* (T259330) Added language support for Mara (mrh).
* (T263968) Added language support for Nias (nia).
* (T270365) Added language support for Tyap (kcg).
* (T276745) Added language support for Wayuu (guc).

=== Breaking changes in 1.36 ===
* Grade C (non-JavaScript) support for Internet Explorer 8 has been dropped.
* (T249459) wfIsBadImage(), deprecated in 1.34, has been removed.
* (T176526) EditPage::getContextTitle() will now throw an exception if a context
  title was not set using setContextTitle(). Previously, this mis-use would only
  cause a deprecation warning to be emitted.
* The DeferredStringifier class, deprecated since 1.31, was removed.
* Multiple methods that fell back to the $wgUser global variable were
  individually hard deprecated previously. The following have now been removed:
  - ApiTestCase::doLogin
  - Article::doDeleteArticle
  - Article::doDeleteArticleReal
  - Article::getComment
  - Article::getCreator
  - Article::getUser
  - Article::getUserText
  - Article::insertProtectNullRevision
  - File::delete
  - File::recordUpload
  - ForeignDBFile::delete
  - ForeignDBFile::recordUpload
  - LocalFile::delete
  - LocalFile::deleteOld
  - LocalFile::recordUpload
  - PageArchive::undelete
  - RecentChange::markPatrolled
  - Title::getUserPermissionsErrors
  - Title::quickUserCan
  - Title::userCan
  - WebRequest::getLimitOffset
  - WikiPage::doDeleteArticle
  - WikiPage::insertProtectNullRevision
* The SpecialPageFactory class, deprecated in 1.32, has been removed. Use the
  SpecialPageFactory service instead.
* Multiple methods previously had optional User parameters, with fallbacks
  to the $wgUser global variable. Not passing a User to those methods was
  previously hard deprecated, and support for not passing a User has now
  been removed:
   - ArchivedFile::userCan
   - File::userCan
   - FileDeleteForm::__construct
   - FileDeleteForm::doDelete
   - LocalFileDeleteBatch::__construct
   - LogEventsList::getExcludeClause (only needed for the 'user' audience)
   - LogEventsList::userCan
   - LogEventsList::userCanBitfield
   - LogEventsList::userCanViewLogType
   - LogPage::addEntry (also accepts user id instead)
   - OldLocalFile::userCan
   - PatrolLog::record
   - Title::getNotificationTimestamp (though the entire method is deprecated)
   - WikiPage::getComment (only needed for the FOR_THIS_USER audience)
   - WikiPage::getCreator (only needed for the FOR_THIS_USER audience)
   - WikiPage::getUser (only needed for the FOR_THIS_USER audience)
   - WikiPage::getUserText (only needed for the FOR_THIS_USER audience)
* The following hooks have been removed:
   - APIQueryInfoTokens
   - APIQueryRecentChangesTokens
   - APIQueryRevisionsTokens
   - APIQueryUsersTokens
   - ApiTokensGetTokenTypes
* LogEventsList::typeAction previously accepted an optional right parameter, and
  checked if the context user ($wgUser) had that right. Passing a right was hard
  deprecated in 1.35, and support for passing a right has now been removed.
* WikiPage::doDeleteArticleReal previously accepted an optional user as its
  fifth parameter, and fell back to $wgUser if not user was provided. The
  signature changed to have the user as the second parameter, and the old
  signature was hard deprecated in 1.35. Support for the old signature has now
  been removed.
* User::addNewUserLogEntry, deprecated since 1.27, was removed.
* As part of refactoring the EditPage class, EditPage::setPreloadedContent,
  which had no known callers was removed entirely. Additionally, the following
  public methods were made private:
  - ::extractSectionTitle
  - ::getSummaryInputWidget
  - ::noSuchSectionPage
  - ::initialiseForm
* EditPage::matchSpamRegex and ::matchSummarySpamRegex, deprecated in 1.35,
  were removed. Use the SpamChecker service instead.
* The global function `wfWaitForSlaves`, deprecated in 1.27 and hard-deprecated
  in 1.35, has been removed. Use LBFactory::waitForReplication() instead.
* Calling Action::factory() with null as the first parameter, rather than a
  string, was deprecated in 1.35 and support was now removed.
* Calling Action::factory() with an object that wasn't an Article as the second
  parameter was deprecated in 1.35 and support was now removed.
* The global variable $wgMemc, deprecated since 1.35, has been removed. Usage
  should generally be migrated to WANObjectCache, or if you really need the
  internal object, use ObjectCache::getLocalClusterInstance instead.
* The preprocessDump.php maintenance script was removed.
* CategoryFinder, which was deprecated in 1.31 and hard-deprecated in 1.35,
  has been removed.
* GenderCache::singleton(), which was deprecated in 1.28 and hard-deprecated
  in 1.35, has been removed.
* Sanitizer::escapeId(), deprecated in 1.30, has been removed.
* Direct invocation of Parser::__construct() (instead of via a ParserFactory)
  now throws an exception; support has also been removed for several
  deprecated variants on the arguments passed to Parser::__construct.
  Direct invocation of Parser::__construct was deprecated in 1.34.
* Parser::setFunctionTagHook(), deprecated in 1.35, has been removed.
* The following properties of Parser, deprecated in 1.35, have been made
  private:
  - $mTagHooks - use Parser::getTags()
  - $mFunctionHooks - use Parser::getFunctionHooks()
  - $mOutput - use Parser::getOutput()
  - $mPreprocessor - use Parser::getPreprocessor()
* The ParserBeforeTidy hook, deprecated in 1.35, has been removed.
* The ParserBeforeTidy, ParserBeforeStrip, and ParserAfterStrip hooks,
  deprecated in 1.35, have been removed.
* All methods of MWTidy except for MW::tidy() have been removed. These were each
  either marked as @internal or deprecated in 1.35.
* (T248062) Mixins `.background-image-svg()` and `.background-image-svg-quick()`
  (provided by mediawiki.mixins.less), which have been deprecated since 1.35,
  have now been removed. MediaWiki no longer supports any browser which would
  require this SVG-fallback PNG support, so you can simply use the regular CSS
  `background-image:` declaration instead.
* The ResourceLoader module `mediawiki.legacy.oldshared` and its file
  'oldshared.css', deprecated since 1.35 has been removed (T248357).
* `ResourceLoader::__construct` now requires a Config parameter. The optional
  nature of this parameter was deprecated in 1.34.
* The LinkBegin and LinkEnd hooks, deprecated in 1.28, have been removed. You
  can instead use the HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd
  hooks, respectively.
* The EmailUser hook passes its fifth param, $error, by reference, to allow
  hook handlers to add error messages, indicate that they have sent the email
  instead of core, etc. Setting the parameter to something other than a
  Status object, true, false, an empty string, an array, or a MessageSpecifier,
  object, which had been deprecated in 1.29, is no longer supported, and now
  results in an MWException being thrown.
* Skin::getDynamicStylesheetQuery(), deprecated in 1.32, has been removed. You
  should use action=raw&ctype=text/css directly.
* Skin::makeI18nUrl(), deprecated in 1.35, has been removed.
* The following User methods, deprecated and moved to BlockManager in 1.34, were
  removed:
  - ::isDnsBlacklisted
  - ::inDnsBlacklist
  - ::isLocallyBlockedProxy
  - ::trackBlockWithCookie
* Support for v1 of the parser tests file format has been removed; it was
  deprecated in 1.35. (T174199)
* SpecialUnblockUser::processUIUnblock() now returns a Status object instead of
  an array of messages or a boolean value. This function was also marked as
  @internal and is no longer safe to call it publicly.
* mw.Title.getDotExtension() from the 'mediawiki.Title' module was removed
  without deprecation. You should use mw.Title.getExtension() and prepend the
  dot if need be.
* Profiler::getTemplated and Profiler::setTemplated, deprecated in 1.34, have
  been removed.
* DatabaseMysqlBase now requires MySQL version 5.6.4+ when "lagDetectionMethod"
  is set to "pt-heartbeat".
* Removed HookContainer::getOriginalHooksForTest() without deprecation. This
  method was introduced in 1.35 for internal use, and appears unused outside of
  MediaWiki core.
* ParserCache::__construct() now requires three parameters.
* Message->getFormat(), deprecated in 1.29, has been removed.
* Support for passing Article to ParserCache::get, deprecated in 1.35, has been
  removed.
* ParserCache::singleton(), deprecated in 1.30, has been removed.
* DatabaseBlock::deleteIfExpired and ::fromMaster, deprecated in 1.35, have been
  removed.
* Some deprecated AbstractBlock methods have been removed:
  - ::prevents, deprecated in 1.33
  - ::shouldTrackWithCookie, deprecated in 1.34
  - ::getBlocker, deprecated in 1.35
  - ::setBlocker, deprecated in 1.35
  - ::getBlockErrorParams, deprecated in 1.35
* Multiple DatabaseBlock methods dealing with cookies, deprecated in 1.34,
  have been removed:
  - ::setCookie
  - ::clearCookie
  - ::getCookieValue
  - ::getIdFromCookieValue
  - ::shouldTrackWithCookie
* The public static callback function SpecialUnblock::processUIUnblock has been
  removed. This method was for internal use only, and appears unused outside of
  MediaWiki core.
* ChangeTags::truncateTagDescription, deprecated in 1.35, has been removed.
* Deprecated null fallbacks in PasswordReset constructor have been removed.
* User::isEveryoneAllowed and User::getAllRights, deprecated in 1.34, has been
  removed.
* The following methods of the UserGroupMembership class, deprecated in 1.35,
  has been removed:
  - ::initFromRow
  - ::newFromRow - use UserGroupManager::newGroupMembershipFromRow
  - ::selectFields - use UserGroupManager::getQueryInfo
  - ::delete - use UserGroupManager::removeUserFromGroup
  - ::insert - use UserGroupManager::addUserToGroup
  - ::purgeExpired - use UserGroupManager::purgeExpired
  - ::getMembershipsForUser - use UserGroupManager::getUserGroupMemberships
  - ::getMembership - use UserGroupManager::getUserGroupMemberships
* The public static callback function SpecialBlock::validateTargetField has been
  removed. This method was for internal use only, and appears unused outside of
  MediaWiki core.
* The public static callback function SpecialUploadStash::tryClearStashedUploads
  has been removed. This method was for internal use only, and appears unused
  outside of MediaWiki core.
* SpecialComparePages::showDiff() ::revOrTitle(), ::checkExistingTitle(), and
  ::checkExistingRevision() were marked as @internal to allow for breaking
  changes. They are no longer safe to call. The methods were unused outside of
  MediaWiki core.
* Each special page within core now uses service injection via it constructor.
  When extending these special pages, a call to the grandparent constructor
  (`SpecialPage::__construct()`) in the sub-class would now break the derived
  special page, as the fallback code in the parent constructor cannot set the
  services as needed. Be sure to call the parent constructor when extending
  core special pages. Extending core's special pages is not part of the stable
  interface, and should generally be avoided.
* Language::getExtraUserToggles and ::viewPrevNext, deprecated in 1.34, have
  been removed.
* StreamFile::send404Message and ::parseRange, deprecated in 1.34, have been
  removed.
* SVGMetadataExtractor class, deprecated in 1.34, has been removed.
* ProcessCacheLRU class, deprecated in 1.32, has been removed.
* wfForeignMemcKey(), deprecated in 1.35, has been removed.
* LoadBalancer::safeWaitForMasterPos(), deprecated in 1.34, has been removed.
* JobQueue::factory() now requires its `idGenerator` option. The optional
  nature of this option was deprecated in 1.35.
* ApiFeedRecentChanges::getFeedObject has been changed to private, and appears
  unused outside of MediaWiki core.
* Skin::subPageSubtitle() has been changed to private method. Callers should
  use Skin::prepareSubtitle().
* RevisionDeleter::checkRevisionExistence was removed without deprecation.
  It had no known callers.
* wfForeignMemcKey() and wfMemcKey(), deprecated in 1.35, have been removed.
* MediaWiki now also requires the php-intl extension.
* BotPassword::save() now returns a Status object for the result rather than
  a bool.
* The methods in CoreTagHooks have been marked @internal and type hints have
  been added. The methods appeared to be unused outside of MediaWiki core.
* SquidPurgeClient and SquidPurgeClientPool, deprecated since 1.35, have been
  removed.
* Several methods on WikiPage will now throw an exception when called on a
  WikiPage instance that where constructed on a title that does not refer to a
  proper page (but rather a special page or interwiki link). The behavior was
  previously undefined and could in some cases lead to data corruption. Affected
  methods are: getId(), insertOn(), newPageUpdater(), doUpdateRestrictions(),
  doDeleteArticleReal(), doRollback(), and doEditContent().
* The ParserTestRunner no longer invokes the ParserTestTables hook. Instead, it
  clones all database tables before running tests, like MediaWikiIntegrationTest
  does. If an extension was mis-using the hook to *exclude* tables from the
  clone, that will no longer occur, and tests may fail.
* The following classes, which were only loaded for tests and had no uses found
  in public MediaWiki-related git, were removed:
   - MockWebRequest
   - UserWrapper
* Passing Title as a second parameter to RevisionStore::getPreviousRevision and
  getNextRevision, hard deprecated since 1.31, was prohibited.
* (T275619) Maintenance::hasOption and Maintenance::getOption now behave as
  documented and are not altered by previous calls to these methods.
* The internal class FirejailCommand was removed.
* Command::execute() now returns a Shellbox\Command\UnboxedResult instead of a
  MediaWiki\Shell\Result. Any type hints should be updated.
* WikiPage::$mIsRedirect was removed.
* ObjectCache::detectLocalServerCache(), deprecated in 1.35, was removed.
* The following functions from the Title class have been removed:
   - countRevisionsBetween
   - getAuthorsBetween
* The PageProps class was converted to a service. PageProps::overrideInstance
  was removed, and MediaWikiServices::redefineService should be used
  instead.
* Support for creating a MediaWikiTitleCodec object without the InterwikiLookup
  and NamespaceInfo services, deprecated in 1.34, was removed. Note that the
  MediaWikiTitleCodec class is not @newable or @stable to create, and should
  be retrieved from MediaWikiServices instead.
* The $wgContLang variable, deprecated in 1.32, was removed. You can instead use
  MediaWikiServices::getInstance()->getContentLanguage().
* User::clearAllNotifications(), hard deprecated in 1.35, was removed. Use
  WatchlistManager::clearAllUserNotifications() instead.
* DatabaseBlock::getBlocker can return any UserIdentity instance, not just User.
* MediaWiki::triggerJobs(), deprecated in 1.34, was removed.
* The following Article methods, deprecated in 1.35, were removed:
  - checkFlags
  - checkTouched
  - clearPreparedEdit
  - doDeleteUpdates
  - doEditUpdates
  - doPurge
  - doViewUpdates
  - exists
  - followRedirect
  - getAutoDeleteReason
  - getCategories
  - getContentHandler
  - getContentModel
  - getContributors
  - getDeletionUpdates
  - getHiddenCategories
  - getId
  - getLatest
  - getLinksTimestamp
  - getMinorEdit
  - getOldestRevision
  - getRedirectTarget
  - getRedirectURL
  - getRevision
  - getTouched
  - getUndoContent
  - hasViewableContent
  - insertOn
  - insertRedirect
  - insertRedirectEntry
  - isCountable
  - isRedirect
  - loadFromRow
  - loadPageData
  - lockAndGetLatest
  - makeParserOptions
  - pageDataFromId
  - pageDataFromTitle
  - prepareContentForEdit
  - protectDescription
  - protectDescriptionLog
  - replaceSectionAtRev
  - replaceSectionContent
  - setTimestamp
  - shouldCheckParserCache
  - supportsSections
  - triggerOpportunisticLinksUpdate
  - updateCategoryCounts
  - updateIfNewerOn
  - updateRedirectOn
  - updateRevisionOn
  - doUpdateRestrictions
  - updateRestrictions
  - doRollback
  - commitRollback
  - generateReason
* The monolog-based logging system has dropped the Avro format. Because of this,
  the AvroFormatter class and the AvroValidator utility class have been removed
  without deprecation.
* AbstractBlock::$mReason, deprecated in 1.34, was removed.
  Use AbstractBlock::getReasonComment and AbstractBlock::setReason instead.

=== Deprecations in 1.36 ===
* (T278026) The DB_MASTER constant has been deprecated in favour of DB_PRIMARY.
* (T245963) User::getGrantName() is now hard deprecated and will be removed in
  a subsequent release. Use MWGrants::grantName() instead.
* wfIncrStats() is now deprecated. Use MediaWikiServices::getInstance()
  ->getStatsdDataFactory()->updateCount() instead.
* WikiPage::doEditContent() is now deprecated. Use
  WikiPage::doUserEditContent() instead. Note that doEditContent() was also
  deprecated in 1.32 for unrelated reasons and doUserEditContent() is
  deprecated for other reasons, however, using doUserEditContent() is
  recommended over using doEditContent().
* WikiPage::doUserEditContent() is now deprecated. Use
  PageUpdater::saveRevision instead. Note that the new method expects callers
  to take care of checking EDIT_MINOR against the minoredit right, and to apply
  the autopatrol right as appropriate.
* LocalFile::recordUpload2, soft deprecated in 1.35, now emits deprecation
  warnings. Use ::recordUpload3 instead.
* Constructing a new instance of the ParserOptions class without providing
  a User object, which falls back to the global $wgUser, is now deprecated.
* The User class, which was marked as @newable in 1.35, is no longer newable,
  meaning that it is no longer safe to manually call the constructor via
  `new User`. Instead, use the UserFactory service. Additionally, the
  following static constructor methods were deprecated in favor of using the
  UserFactory service:
   - User::newFromName
   - User::newFromId
   - User::newFromActorId
   - User::newFromIdentity
   - User::newFromAnyId
   - User::newFromConfirmationCode
* The following User methods have been hard deprecated in favor of the new
  UserEditTracker service:
   - User::getFirstEditTimestamp
   - User::getLatestEditTimestamp
* The confusingly-named User->isLoggedIn() method has been deprecated in favour
  of the method it wraps, User->isRegistered().
* Use of the `preprocessor=Preprocessor_DOM` option in parser test files has
  been deprecated. Preprocessor_DOM was removed in 1.35.
* ParserOptions::setTidy() has been deprecated. It has had no effect since
  1.35.
* Sanitizer::escapeIdReferenceList() has been deprecated; it will eventually
  be made private to the class, as it appears to have no uses outside the
  Sanitizer class.
* Sanitizer::hackDocType() is deprecated; it will eventually be made private.
* Skin::getIndicatorsHTML() is deprecated. The functionality can be retained
  by reimplementing the method using the raw indicators data from
  OutputPage::getIndicators.
* Skin::makeVariablesScript() has been deprecated. Use
  ResourceLoader::makeInlineScript() instead.
* SpecialPageFactory::getRestrictedPages() has been deprecated.
  Use SpecialPageFactory::getUsablePages() instead.
* Title::nameOf() is deprecated; use Title::newFromID()->getPrefixedDBkey()
  instead.
* DatabaseBlock::insert, DatabaseBlock::update, DatabaseBlock::purgeExpired and
  DatabaseBlock::delete are deprecated. Use DatabaseBlockStore::insertBlock,
  DatabaseBlockStore::updateBlock, DatabaseBlockStore::purgeExpiredBlocks and
  DatabaseBlockStore::deleteBlock instead.
* SpecialBlock::getTargetAndType and AbstractBlock::parseTarget are deprecated.
  Call BlockUtils::parseBlockTarget instead.
* SpecialUnblock::processUnblock was deprecated - use UnblockUserFactory
  service instead.
* Deprecated MediaWikiIntegrationtestCase::removeTemporaryHook() in favor of
  MediaWikiIntegrationtestCase::clearHook().
* Skin::getSearchLink(), also exposed as 'searchaction' option in SkinTemplate,
  has been deprecated. Use Title or SpecialPage methods directly.
* Skin::getAllowedSkins and ::getSkinNames have been deprecated. Use their
  respective equivalents in SkinFactory instead.
* The RollbackComplete hook has been deprecated, use the PageSaveComplete hook
  instead.
* Skin::makeUrl() has been deprecated. Title methods should be used instead.
* Skin::privacyLink(), Skin::disclaimerLink() and Skin::aboutLink() have been
  deprecated. Please use Skin::footerLink() instead.
* Skin::getLogo() has been deprecated. Use ResourceLoaderSkinModule instead.
* The module `mediawiki.toc.styles` has been replaced by
  ResourceLoaderSkinModule. If you are having problems styling table of contents
  ensure you have an updated skin.
* Skin::mainPageLink() has been deprecated. Use LinkRenderer service instead.
* BaseTemplate::getToolbox() method has been hard deprecated. The toolbox data
  is now available in a sidebar data array which you can get from any class
  that's extending QuickTemplate class.
* Constructing a DefaultPreferencesFactory, LinkHolderArray or PasswordReset
  without a $hookContainer parameter is deprecated.
* Autopromote class, soft deprecated since 1.35, now emits deprecation warnings.
  Use UserGroupManager instead.
* SpecialBlock::canBlockEmail has been deprecated. Please use
  BlockPermissionChecker::checkEmailPermissions instead.
* SpecialBlock::checkUnblockSelf has been deprecated. Please use
  BlockPermissionChecker::checkBlockPermissions instead.
* SpecialBlock::parseExpiryInput was deprecated - use
  BlockUser::parseExpiryInput instead.
* SpecialBlock::validateTarget has been deprecated, use BlockUtils instead.
* SpecialBlock::validateTargetField has been deprecated for external use,
  use BlockUtils instead.
* SpecialPage::getLanguageConverter has been deprecated, use
  LanguageConverterFactory::getLanguageConverter() directly.
* ParserCache::getKey has been deprecated. Use ParserCache::getMetadata and
  ParserCache::makeParserOutputKey instead.
* The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4,
  was removed. MediaWiki support for PHPUnit 4 ended with the removal of HHVM
  support.
* The PHPUnit6And8Compat class, used to provide compatibility with PHPUnit 6,
  was removed without deprecation. This class was introduced during the
  upgrade to PHPUnit 8, but never used.
* MediaWikiIntegrationTestCase::assertType, hard-deprecated in 1.35 due to
  incompatibility with PHPUnit 8, was removed.
* ParserCache::getETag has been deprecated, instead build suitable etag
  explicitly.
* The following functions from the Language class have been hard deprecated
  and will be removed in a subsequent release:
   - findVariantLink
   - convertTitle
   - updateConversionTable
   - commafy
* The following functions from the Title class have been hard deprecated:
   - getPreviousRevisionID
   - getNextRevisionID
   - getEarliestRevTime
* The following functions from the User class have been hard deprecated:
   - getDefaultOptions
   - getDefaultOption
* The mw.language.commafy client-side method has been deprecated, to match
  the deprecation of Language::commafy. Use mw.language.convertNumber
  instead.
* The "es6-promise" module has been deprecated. Use "es6-polyfills" instead.
* Title::isDeleted() and Title::isDeletedQuick() have been deprecated. Please
  use Title::getDeletedEditsCount() and Title::hasDeletedEdits() instead.
* Article::getContentObject, soft-deprecated since 1.32, was hard-deprecated.
* WikiRevision::importUpload, soft-deprecated since 1.31, was hard-deprecated.
* Html::infoBox() has been deprecated. There's no replacement.
* Message::toString() without a $format parameter, soft-deprecated since 1.28,
  was hard-deprecated. Use explicit formatting methods instead, such as
  Message::text() and Message::escaped().
* BagOStuff::makeKeyInternal() usage outside of BagOStuff has been deprecated.
* BagOStuff::setDebug() is deprecated and calls to it are ignored. Debug logs
  are now unconditionally enabled.
* The following global functions have been hard deprecated:
   - wfAppendToArrayIfNotDefault
   - wfAcceptToPrefs
   - wfClearOutputBuffers
   - wfConfiguredReadOnlyReason
   - wfDebugMem
   - wfGetPrecompiledData
   - wfNegotiateType
* BeforeParserFetchTemplateAndtitleHook has been deprecated; replace
  with the new BeforeParserFetchTemplateRevisionRecord hook. (The
  similar ParserFetchTemplateHook was deprecated in 1.35; the new hook
  replaces both.)
* The InterwikiLoadPrefix hook has been deprecated; it is not compatible
  with future wikitext parsers (which need to enumerate all interwiki
  prefixes). In test cases please use $wgInterwikiCache instead.
* WikiPage instances should no longer be constructed for titles that do not
  represent editable pages (e.g. special pages). WikiPages were always
  documented to represent "MediaWiki article and history".
* Skin::getSkinStylePath() has been deprecated. Please replace usages with
  the direct path to the resources.
* The second argument of EnhancedChangesList::getDiffHistLinks, $query, has
  been deprecated.
* The ParserTestTables hook has been deprecated; it is no longer necessary
  after a ParserTestRunner refactoring.
* The following classes have been hard deprecated: CachedAction,
  SpecialCachedPage, CacheHelper, ICacheHelper. They were unused in MediaWiki
  ecosystem, so no replacement was provided.
* The ProtectionForm::buildForm hook has been deprecated. Please use the
  ProtectionFormAddFormFields hook instead.
* RevisionStore::newMutableRevisionFromArray has been hard deprecated. Instead,
  MutableRevisionRecord should be constructed directly via constructor.
* UserIdentity::getActorId() is deprecated. The actor ID should not be exposed
  to application logic. Storage layer code should use the ActorNormalization
  service for normalizing and denormalizing user names.
* Constructing a UserIdentityValue with an actor ID as the third parameter is
  deprecated. The parameter should be omitted. Storage layer code should use
  the ActorNormalization service for normalizing and denormalizing user names.
* Command::cgroup() is deprecated and no longer functional. $wgShellCgroup is
  now implemented as an Executor option.
* Command::restrict() is deprecated. Instead use the new separate accessors.
* MWTidy::tidy() is deprecated. Use MediaWikiServices::getTidy()-tidy() instead.
* TidyDriverBase::supportsValidate() is deprecated; it has always returned
  false since 1.33.
* WatchedItem::getUser hard-deprecated in favor of ::getUserIdentity.
* WatchedItemStoreInterface::enqueueWatchlistExpiryJob was hard deprecated in
  favor of the new method maybeEnqueueWatchlistExpiryJob that takes care of
  relevant configuration checks.
* LogEntry::getPerformer() and its implementations have been hard-deprecated, in
  favor of ::getPerformerIdentity().
* AuthManager::singleton(), deprecated in 1.35, is hard deprecated. Use
  MediaWikiServices::getAuthManager() instead.
* User::clearNotification(), deprecated in 1.35, is hard deprecated. Use
  WatchlistManager::clearTitleUserNotification() instead.
* Passing string to DatabaseBlock::setBlocker was deprecated. Only UserIdentity
  is now allowed.
* DatabaseBlock constructor 'byText' option was deprecated in favour of 'by'
  option, which now accepts UserIdentity. Passing user ID is deprecated.
* Parser::getUser was deprecated. Use Parser::getUserIdentity instead.
* DatabaseBlock::isWhitelistedFromAutoblocks was deprecated. Use
  DatabaseBlock::isExemptedFromAutoblocks instead.
* User::isIPRange(), deprecated in 1.35, is hard deprecated.
  Use the UserNameUtils service or IPUtils directly.
* BaseTemplate::getFooterIcons(), deprecated in 1.35, is hard deprecated. Read
  footer icons from template data requested via $this->get('footericons').
* `box-shadow()` LESS mixin from mediawiki.mixins is deprecated due to updated
  basic browser support. Use unprefixed property `box-shadow:` instead.
* MergeHistory::checkPermissions was deprecated. Use ::probablyCanMerge or
  ::authorizeMerge instead.
* User::isValidUserName(), deprecated in 1.35, is hard deprecated.
  Use the UserNameUtils service instead.
* The TitleArrayFromResult hook has been deprecated.
* The EditPageBeforeEditToolbar hook has been deprecated; it has become
  defunct after the classic edit toolbar was removed. Use one of the many
  other EditPage hooks instead.
* Deprecated the class name MediaWiki\User\WatchlistNotificationManager; use
  MediaWiki\Watchlist\WatchlistManager instead. Deprecated the method
  MediaWikiServices->getWatchlistNotificationManager(); use
  MediaWikiServices->getWatchlistManager() instead.
* The "ArticleEditUpdatesDeleteFromRecentchanges" hook, deprecated in 1.35, has
  been removed. Other hooks like "RecentChange_save" can be used instead.

=== Other changes in 1.36 ===
* The 'tidy' key in ParserOptions (used in the parser cache) has been removed.
  It has had no effect since 1.35.
* A future release of MediaWiki will make `{{=}}` a built-in parser function,
  for use when automatically escaping the `=` character in template arguments.
  A tracking category and parser warning have been added to this release when
  `{{=}}` is used and it expands to something other than `=`.
* The implementation of TestFileReader::read has been changed to use Parsoid's
  parser test file parser. This should be compatible with existing code, but it
  only supports version 2 of the test file specification and may be more strict
  when parsing invalid input, including duplicate tests.
* BeforeParserFetchTemplateRevisionRecord, a new hook, unifies and replaces the
  old BeforeParserFetchTemplateAndtitleHook and ParserFetchTemplateHook.
* The SkinLessImportPaths attribute was added, allowing skins to add a directory
  to the import path for LESS stylesheets. Skins can use this to provide a
  custom version of mediawiki.skin.variables.less, setting skin-specific values
  for certain LESS variables.
* The interaction between ContentHandler::getParserOutputForIndexing() and
  ContentHandler::getDataForSearchIndex() has been clarified (the latter should
  only be called with the result of the former). Extensions may override
  getParserOutputForIndexing() to skip generating HTML, which may improve
  indexing performance. (The default implementation still generates HTML, and
  getDataForSearchIndex() implementations can still rely on it if they do not
  over-ride getParserOutputForIndexing().)
* Article::fetchContentObject, ::mContentObject, ::mContentLoaded,
  ::mRevIdFetched, all deprecated since 1.32, were removed.
* Article::mParserOptions and ::setParserOptions were removed.
* Article and ImagePage::getEmptyPageParserOutput, unused, were removed.
* ParserCache's default serialization format was changed from PHP serialization
  to JSON serialization. In case some installed extension do not support JSON
  yet, $wgParserCacheUseJson can be used to revert back to PHP serialization.
* PermissionManager::groupHasPermission, ::getGroupPermissions and
  ::getGroupsWithPermission were deprecated, use GroupPermissionsLookup
  service instead.
* WatchedItemStoreInterface now accepts PageIdentity where it accepted
  LinkTarget, calling with LinkTarget was deprecated.
* 'movable' attribute has been added to the 'namespaces' property of
  extension.json schema. Extensions that define namespaces can set it to
  `false` to disallow moving pages in the specified namespace. Extensions
  should either use this or NamespaceIsMovableHook, but not both. The hook
  overrides the attribute.

== Compatibility ==

MediaWiki 1.36 requires PHP 7.3.19 or later and the following PHP extensions:

* ctype
* dom
* fileinfo
* iconv
* intl
* json
* mbstring
* xml

MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
but support for them is somewhat less mature.

The supported versions are:

* MySQL 5.5.8 or later
* PostgreSQL 9.4 or later
* SQLite 3.8.0 or later

== Online documentation ==
Documentation for both end-users and site administrators is available on
MediaWiki.org, and is covered under the GNU Free Documentation License (except
for pages that explicitly state that their contents are in the public domain):

       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

== Mailing list ==
A mailing list is available for MediaWiki user support and discussion:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.

== IRC help ==
There's usually someone online in #mediawiki on irc.libera.chat.