Release notes/1.40

= MediaWiki 1.40 =

Changes since MediaWiki 1.40.0-rc.0
Linker::makeBrokenImageLinkObj.
 * Localisation updates.
 * (T330464) Work around argument corruption bug in XMLReader::open.
 * build: Updating mediawiki/mediawiki-phan-config to 0.12.1.
 * Fix frame and frameless rdfa depending on file existing.
 * (T329214) Pass whether current rev of file exists to
 * (T334659) Handle thumb errors when !$enableLegacyMediaDOM.
 * A manualthumb that doesn't exist should be considered a thumb error.
 * (T313157) IndexPager: Also protect against $offset being 0.
 * (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.

Upgrading notes for 1.40
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the oldest supported upgrading version, MediaWiki 1.35.

Some specific notes for MediaWiki 1.40 upgrades are below: maintenance/run.php update not maintenance/update.php as before. * The Echo extension, which provides a system of user notifications. * The Linter extension, which warns about use of deprecated wikitext. * The LoginNotify extension, which warns users about failed attempted logins. * The Thanks extension, which lets users thank editors for edits. to rename users without installing an extension. The extension had already been bundled with MediaWiki since 1.18.
 * Maintenance scripts should now be executed using maintenance/run.php, e.g.
 * Four extensions have now been bundled with MediaWiki:
 * The Renameuser extension has been moved to MediaWiki core. It is now possible

For notes on 1.39.x and older releases, see HISTORY.

Configuration changes for system administrators in 1.40
support if available, unless $wgPasswordConfig['pbkdf2']['class'] is set in LocalSettings.php. OpenSSL is more efficient, so if that setting is present, you should remove it (or set it to 'Pbkdf2PasswordUsingOpenSSL' if possible). If users get an internal error when trying to log in, you can try setting it to 'Pbkdf2PasswordUsingHashExtension'. In particular, this would be necessary if existing PBKDF2 password hashes were computed using a hash algorithm other than "sha512" or "sha256" (the current and prior defaults). 'X-Content-Type-Options: nosniff' for the /images directory. This will instruct browsers to not apply content sniffing when accessing the files. MediaWiki before 1.40 shipped with a content sniffer which disallowed potentially dangerous files at upload time, but this protection has now been removed in favor of this 'X-Content-Type-Options: nosniff' header and the installer will return a warning when it is not in place. constant will not have any effect. Use of MW_USE_LEGACY_DEFAULT_SETTINGS had been deprecated since 1.39.
 * When computing PBKDF2 password hashes, MediaWiki now detects and uses OpenSSL
 * You should configure your webserver to return the http header
 * Support for MW_USE_LEGACY_DEFAULT_SETTINGS has been removed, setting this

New configuration
image thumbnails (or a placeholder in the absence of a thumbnail) will be displayed on Special:Search. client-side preferences for logged-out users. the migration stage for the new schema for the external links database table. Ignore it unless you have a large wiki farm with complex migration needs. the migration stage for the temporary comment database table, from revision. Ignore it unless you have a large wiki farm with complex migration needs. Special:Contribute is available, for where others don't work for the feature.
 * $wgThumbnailNamespaces - This setting lets you define the namespaces for which
 * $wgResourceLoaderClientPreferences – This experimental flag lets you enable
 * $wgExternalLinksSchemaMigrationStage – This temporary flag lets you control
 * $wgCommentTempTableSchemaMigrationStage – This temporary flag lets you control
 * $wgSpecialContributeSkinsEnabled – This setting lets you list skins on which

Changed configuration
password for wiki accounts, has been adjusted to raise the minimal password length from 1 to 8 characters. The initial limit of 1 has been in place since MediaWiki 1.26. If you wish to allow shorter passwords, you can over-ride it in your LocalSettings following the guidance on MediaWiki.org. usernames because of issues it causes in wikitext syntax. This can be adjusted by changing the value of $wgInvalidUsernameCharacters. the alternative modern HTML structure for media is now the default. You can disable it for now by over-riding this back to `true` in LocalSettings, but this configuration will be removed in future versions of MediaWiki. For more details, see the documentation at: https://www.mediawiki.org/wiki/Parsoid/Parser_Unification/Media_structure/FAQ allowed duration for users to set their temporary watchlist entries for expiry if that feature is enabled, has been increased from 6 months to 1 year.
 * $wgPasswordPolicies – This setting, which controls what makes for a valid
 * (T254045) New accounts can no longer use an equals sign (=) in their
 * (T314318) $wgParserEnableLegacyMediaDOM – This setting has been changed, so
 * $wgWatchlistExpiryMaxDuration – This setting, which controls the maximum

Removed configuration
$wgShellboxUrls instead. removed. To inject WANObjectCache parameters, use $wgWANObjectCache instead. These variables were introduced for multi-DC wiki farms to add a separate memcached proxy for cross-DC relaying of purges but never used because WANObjectCache works based on route prefixes, which can be transparently handled by the main memcached proxy. extensions can place their parser test files in `tests/parser` instead. longer has any effect. If you run into difficulties, fix the names of miscased local files. for very old versions of Internet Explorer clients, was removed. These user agents aren't used in practice, and haven't been served JavaScript content for years.
 * $wgShellboxUrl – This setting, deprecated in 1.37, has now been removed; use
 * $wgMainWANCache and $wgWANObjectCaches – These never-used settings have been
 * $wgParserTestFiles – This setting, deprecated in 1.30, has now been removed;
 * (T231412) $wgAutoloadAttemptLowercase – This setting, deprecated in 1.35, no
 * (T309787) $wgVerifyMimeTypeIE – This setting, to provide extra security checks

New user-facing features in 1.40
This is controlled via the new onSearchResultProvideThumbnail hook. control whether to show more thumbnails (per $wgThumbnailNamespaces) specific slot can be retrieved using the action=raw&slot= query parameters. regardless of the tab on which they appear.
 * Special:Search can now show thumbnails for results for titles outside NS_FILE.
 * A new preference ('search-thumbnail-extra-namespaces') to allow users to
 * (T324910) On pages using multi-content revisions, the raw content of a
 * (T313804) The preferences page now provides a search bar to find preferences,

New developer features in 1.40
run on PHP 8.1 by default, up from PHP 7.4 now that that's EOL. added to references to stop them from being expanded when their object is passed to var_dump, to make its use for debugging more feasible. rather than the original format. Users can set `formatversion` to a different value if needed. messages to be received and displayed by BlockErrorFormatter. custom content on the signup page about the benefits of using an account. information about a page post restoration than the 'PageUndelete' hook passes. This provides similar functionality to the 'PageDeleteComplete' hook. page or action parameter set, e.g. Special:Contributions/JohnDoe. now check if composer dependencies are up-to-date, like update.php, using CheckComposerLockUpToDate. To disable this check, use MW_SKIP_EXTERNAL_DEPENDENCIES=1 environment flag when running PHPUnit. bot flag for log entries which are inserted to the recent changes.
 * The MediaWiki-Docker development environment is now configured to
 * Vue development mode is enabled by default in DevelopmentSettings.php
 * (T277618) The @noVarDump annotation from the DebugInfoTrait tool can now be
 * The ApiSandbox will now by default request responses in the latest API format,
 * A new hook, GetBlockErrorMessageKeyHook, allows extensions' block error
 * A new hook, SpecialCreateAccountBenefits, lets extensions and local code set
 * (T321412) A new 'PageUndeleteComplete' hook has been added for more thorough
 * The Linker::specialLink method can now link to a Special page's with a sub-
 * The PHPUnit entrypoints (tests/phpunit/phpunit.php and vendor/bin/phpunit)
 * ManualLogEntry::setForceBotFlag has been added to allow the forcing of the

New external libraries

 * Added codex-design-tokens at v0.6.2.
 * Added symfony/polyfill-php81 at v1.27.0.
 * Added wikimedia/bcp-47-code at v1.0.0.

New development-only external libraries

 * Added wikimedia/langconv at v0.4.2.

Changed external libraries

 * Updated OOUI from v0.44.3 to v0.46.3.
 * Updated codex, codex-search, and codex-icons from v0.2.2 to v0.6.2.
 * Updated cssjanus/cssjanus from 2.1.0 to 2.1.1.
 * Updated guzzlehttp/guzzle 7.4.5 to 7.5.0.
 * Updated justinrainbow/json-schema from 5.2.11 to 5.2.12.
 * Updated pear/mail from 1.4.1 to 1.5.0.
 * Updated pear/net_smtp from 0.10.0 to 0.10.1.
 * Updated psr/container from 1.1.1 to 1.1.2.
 * Updated symfony/polyfill-php80 from 1.26.0 to 1.27.0.
 * Updated symfony/yaml from 5.4.10 to 5.4.17.
 * Updated wikimedia/less.php from 3.1.0 to 4.0.0.
 * Updated wikimedia/object-factory from 4.0.0 to 5.0.1.
 * Updated wikimedia/parsoid from 0.16.0 to 0.17.0.
 * Updated wikimedia/remex-html from 3.0.2 to 3.0.3.
 * Updated wikimedia/shellbox from 3.0.0 to 4.0.0.
 * Updated wikimedia/timestamp from 4.0.0 to 4.1.0.
 * Updated wikimedia/xmp-reader from 0.8.4 to 0.9.1.

Changed development-only external libraries

 * Updated QUnit from 2.18.2 to 2.19.4.
 * Updated api-testing from 1.5.0 to 1.5.1.
 * Updated composer/spdx-licenses from 1.5.6 to 1.5.7.
 * Updated eslint-config-wikimedia from 0.22.1 to 0.24.0.
 * Updated giorgiosironi/eris from ^0.10.0 to ^0.13.0.
 * Updated grunt from 1.5.2 to 1.6.1.
 * Updated grunt-banana-checker from 0.9.0 to 0.10.0.
 * Updated grunt-eslint from 24.0.0 to 24.0.1.
 * Updated karma from 6.3.15 to 6.4.1.
 * Updated mediawiki/mediawiki-codesniffer from 38.0.0 to 41.0.0.
 * Updated mediawiki/mediawiki-phan-config from 0.11.1 to 0.12.1.
 * Updated php-parallel-lint/php-console-highlighter from 0.5 to 1.0.0.
 * Updated php-parallel-lint/php-parallel-lint from 1.3.1 to 1.3.2.
 * Updated phpunit/phpunit from 8.5.28 to 9.5.28.
 * Updated stylelint-config-wikimedia from 0.13.0 to 0.13.1.
 * Updated wikimedia/alea from 0.9.3 to 1.0.0.

Removed external libraries

 * jquery.throttle-debounce, deprecated since MediaWiki 1.33.
 * WVUI, deprecated since MediaWiki 1.39.

Action API changes in 1.40
you to check if the user can create an account. Some of the errors that have previously been returned by action=query&list=users&usprop=cancreate are now returned here.
 * New `cancreateaccount` parameter on action=query&meta=userinfo that allows

Languages updated in 1.40
MediaWiki supports over 400 languages. Many localisations are updated regularly. Below only new and removed languages are listed, as well as changes to languages because of Phabricator reports.


 * (T300378) Added language support for Toki Pona (tok).
 * (T320465) Added language support for Magahi (mag).
 * (T320912) Added language support for Arakanese (rki).
 * (T323971) Added language support for Khakas (kjh).
 * (T326526) Added language support for Igala (igl).
 * (T329476) Added language support for Kusaal (kus).
 * (T330266) Added language support for Southern Dagaare (dga).
 * (T331596) Added language support for Obolo (ann).
 * (T331597) Added language support for Nogai (nog).
 * (T331599) Added language support for Wolaytta (wal).
 * (T295637) Add no to fallback chain of nb and nn.

Breaking changes in 1.40
return the current value. It simply sets the OutputPage::mEnableClientCache to true. Use OutputPage::disableClientCache to disable client side caching instead. without deprecation. - The internal protected method Skin::getFooterLinks was removed. It had no known usages. Different from SkinTemplate::getFooterLinks. - The internal public method Skin::getSiteFooterLinks was removed. It had no known usages. of the 'mediawiki.router' wrapper module. protected method of MediumSpecificBagOStuff. 1.39, have been removed. deprecation. have been removed. use MediaWikiServices::getInstance->getJobRunner instead. have been made private: Parser::$mLinkId, Parser::$mIncludeSizes, Parser::$mDoubleUnderscore, Parser::$mShowToc, Parser::$mRevisionId, Parser::$mRevisionTimestamp, Parser::$mRevisionUser, Parser::$mRevisionSize, Parser::$mInputSize, Parser::$mInParse, Parser::$mFirstCall, Parser::$mGeneratedPPNodeCount been removed. removed. have become private or internal without deprecation. This was deprecated in 1.30 and the corresponding $wgParserTestFiles configuration variable has also been removed in this release. Extensions can put parser test files in their `tests/parser` directory to have them automatically run. removed without deprecation. deprecation. Use PHPUnit @requires annotations instead. Use of other parameter types or omitting it was deprecated since 1.38. Use of other parameter types or omitting them was deprecated since 1.35. longer supported, it was deprecated since 1.32. Use CommentStore::insert instead. other types than a Language object, deprecated since 1.33 & emitting warnings since 1.38, now throws an exception. removed. have been removed. removed. Use the corresponding methods in Skin class. 1.38, have been removed. removed. JobQueueDB::getMasterDB, deprecated since 1.37, have been removed. its $article parameter; the behavior when doing so was previously undocumented. removed. removed without deprecation. have been removed. removed without deprecation. deprecation. Use ILBFactory::laggedReplicaUsed instead. have been removed without deprecation as they are unused. Use IDatabase::selectDomain instead. - BaseTemplateAfterPortlet, deprecated in 1.35 - BeforeParserFetchTemplateAndtitle, deprecated in 1.36 - BeforeParserrenderImageGallery, deprecated in 1.35 - InternalParseBeforeSanitize, deprecated in 1.35 - LinksUpdateConstructed, deprecated in 1.38 - LinksUpdateAfterInsert, deprecated in 1.38 - ParserSectionCreate, deprecated in 1.35 - ResourceLoaderTestModules, deprecated in 1.33 - SpecialMuteSubmit, deprecated in 1.35 - UserLoadFromDatabase, deprecated in 1.37 - UserSetCookies, deprecated in 1.27 the only argument. Passing an array was deprecated since 1.36. used, has been removed. Use SearchResultProvideThumbnailHook in the search namespace: MediaWiki\Search\Hook\SearchResultProvideThumbnailHook. (current PHP default) instead of 17. Extension tests may need to be adjusted accordingly; string representations of floating-point numbers in serialized or JSON-encoded data may change. LocalizedHttpException was removed without deprecation. been moved to LinkFilter with the same name. Use CSS box-sizing now. removed.
 * OutputPage::enableClientCache no longer accepts a parameter, nor does it
 * ResourceLoader::makeMessageSetScript, unused since 1.26, has been removed
 * Changes to skins:
 * The 'oojs-router' module has been removed without deprecation in favour
 * BagOStuff::makeKeyInternal, deprecated for public use in 1.36, is now a
 * WANObjectCache::reap and WANObjectCache::reapCheckKey, deprecated since
 * The EnqueueJob class, unused since 1.31, has been removed without
 * JobQueueGroup::singleton and ::destroySingletons, deprecated since 1.37,
 * JobRunner no longer supports manually calling the constructor,
 * JobRunner::setLogger, deprecated since 1.35, has been removed.
 * ContextSource::getStats, deprecated since 1.27, has been removed.
 * The following public properties of Parser, deprecated in 1.35,
 * The MWGrants class, deprecated since 1.38, has been removed.
 * PageProps::getInstance, deprecated since 1.38, has been removed.
 * Global functions wfReadOnly and wfReadOnlyReason, deprecated since 1.38, have
 * Global function wfQueriesMustScale, deprecated since 1.39, has been removed.
 * Global function wfLogProfilingData, deprecated since 1.38, has been removed.
 * The HTMLCacheUpdate class, deprecated since 1.34, has been removed.
 * Linker::normaliseSpecialPage, deprecated since 1.35, has been removed.
 * MWTimestamp::getHumanTimestamp, deprecated since 1.26, has been removed.
 * Collation::singleton and ::factory, deprecated since 1.37, have been
 * SpecialVersion::listToText and SpecialVersion::arrayToString
 * The 'ParserTestFiles' key in the schema for extension.json has been removed.
 * DBLockManager, MySqlLockManager, and PostgreSqlLockManager have been
 * MediaWikiTestCaseTrait::checkPHPExtension has been removed without
 * EditPage::getCopywarn, deprecated since 1.38, has been removed.
 * EditPage::getCopyrightWarning now requires a MessageLocalizer parameter.
 * Action constructor now requires Article and IContextSource parameters.
 * Article::viewRedirect, deprecated since 1.30, has been removed.
 * Title::getNotificationTimestamp, deprecated since 1.35, has been removed.
 * WikiRevision::$fileIsTemp property, deprecated since 1.29, has been removed.
 * Use of CommentStore::insertWithTempTable with 'img_description' is no
 * Return values in the parameter $pageLang of the PageContentLanguage hook with
 * FormatMetadata::flattenArrayContentLang, deprecated since 1.36, has been
 * WikiRevision::downloadSource and ::importUpload, deprecated since 1.31,
 * DataUpdate::runUpdates, deprecated since 1.28, has been removed.
 * CdnCacheUpdate::newFromTitles, deprecated since 1.35, has been removed.
 * HtmlFileCacheUpdate::newFromTitles, deprecated since 1.37, has been
 * BaseTemplate::renderAfterPortlet and ::getAfterPortlet, has been removed.
 * DifferenceEngine::textDiff, deprecated since 1.32, has been removed.
 * Skin::getSearchPageTitle and Skin::setSearchPageTitle, deprecated since
 * DifferenceEngine::getDiffBodyCacheKey, deprecated since 1.31, has been
 * ForeignDBViaLBRepo::getMasterDB, LocalRepo::getMasterDB, and
 * Clarified that the InitializeArticleMaybeRedirect hook should not change
 * IDatabase::ping's $rtt parameter was removed without deprecation.
 * IDatabase::setBigSelects, unused, was removed without deprecation.
 * IDatabase::attributesFromType, unused, was removed without deprecation.
 * IMaintainableDatabase::deadlockLoop was removed without deprecation.
 * DatabasePostgres::remappedTableName, deprecated since 1.37, has been
 * ILBFactory::getChronologyProtectorClientId and ::commitAll, unused, were
 * LoadBalancer::haveIndex and ::isNonZeroLoad, deprecated in 1.34,
 * LoadBalancer::getLazyConnectionRef, deprecated in 1.38, has been removed.
 * ILBFactory::forEachLB, deprecated in 1.39, has been removed.
 * LoadBalancer::getTransactionRoundStage and ::commitAll, unused, were
 * ILoadBalancer::getLaggedReplicaMode, unused, was removed without
 * Optional parameters of ILoadBalancer::waitForPrimaryPos, $pos and $timeout
 * LoadMonitorMysql was removed without deprecation. Use LoadMonitor instead.
 * IDatabase::selectDB, deprecated since 1.32, has been removed.
 * The following deprecated hooks have been removed:
 * RemexDriver::__construct now only accepts a ServiceOptions instance as
 * TidyDriverBase::supportsValidate, deprecated since 1.36, has been removed.
 * RevDelList::reloadFromMaster, deprecated since 1.37, has been removed.
 * ExternalStoreDB::getMaster, deprecated since 1.37, has been removed.
 * DeletePage::deletionWasScheduled, deprecated since 1.38, has been removed.
 * The SearchResultProvideThumbnailHook (which was unstable) and now no longer
 * Command::cgroup, deprecated since 1.36, has been removed.
 * When running tests, the serialize_precision INI setting is now set to -1
 * WikiRevision::$sha1base36 is now private.
 * IcuCollation::getUnicodeVersionForICU was removed without deprecation.
 * LinkFilter::supportsIDN was removed without deprecation.
 * The ability to pass null for the errorData parameter of HttpException and
 * ApiQueryExtLinksUsage::getProtocolPrefix and ::prepareProtocols have
 * .box-sizing Less mixin, deprecated since 1.37, has been removed.
 * MimeAnalyzer::getIEMimeTypes and IEContentAnalyzer were removed.
 * Language::commafy and mw.language.commafy, deprecated since 1.36, has been
 * BagOStuff::decr, deprecated since 1.28, has been removed.
 * BagOStuff::incr, deprecated since 1.28, has been removed.

Deprecations in 1.40
- The public Skin::footerLink is deprecated. Use SkinComponentMenuLink::getTemplateData instead. It now emits deprecation warnings. - The protected Skin::lastModified is deprecated, and marked for @internal use and now emits deprecation warnings. HookContainer::register or HookContainer::scopedRegister should be used instead. During initialization, SettingsBuilder::registerHookHandlers can be used. For backwards compatibility, $wgHooks is replaced by a fake array that calls methods on HookContainer. $wgHooks can still be used as a configuration variable, only dynamic manipulation is deprecated. ParserOptions::{get,set}MaxTemplateDepth have been deprecated and marked for @internal use only. and ::getCategorySortKey instead. ::{get,set}TOCData instead. Use TransactionProfiler::silenceForScope instead. deprecations warnings: - ::areCascadeProtectionSourcesLoaded - ::areRestrictionsCascading - ::areRestrictionsLoaded - ::getAllRestrictions - ::getCascadeProtectionSources - ::getFilteredRestrictionTypes - ::getRestrictionExpiry - ::getRestrictionTypes - ::getRestrictions - ::isCascadeProtected - ::isProtected - ::isSemiProtected - ::loadRestrictionsFromRows and the old name is now deprecated. emit deprecation warnings. deprecation warnings. Use LinkBatchFactory instead. If you need the "generic" full file path, with $1 not replaced by anything, call $site->getPath( MediaWikiSite::PATH_FILE ) directly. getReadConnectionRef and getWriteConnectionRef are deprecated; the ConnectionManager methods they override had been deprecated already. warnings. deprecated. Use built-in ArrayObject directly instead. Parser::getTargetLanguage instead. warnings. access. This use was deprecated in 1.38. deprecated in 1.37, now emit deprecation warnings. now emits deprecation warnings. ::getJsonMessagesFileName, deprecated in 1.34, now emit deprecation warnings. Language::getMessagesFor, ::getMessageFor and ::getMessageKeysFor, deprecated in 1.35, now emit deprecation warnings. deprecation warnings. Inject a HookContainer instead. ::groupHasPermission, deprecated in 1.34, now emit deprecation warnings. ::groupHasPermission, deprecated in 1.36, now emit deprecation warnings. UserGroupMembership::getGroupName in 1.38 missed a release note. Use Language::getGroupMemberName or ::getGroupName instead. deprecation warnings. in favor of MediaWikiServices::getInstance->getTitleMatcher. User::getGlobalBlock. Use User::getBlock instead. Use GetUserBlock hook instead. GlobalBlocks are now added into CompositeBlocks via the GetUserBlock hook. notices. Please use LanguageCode::isWellFormedLanguageTag instead. now emit deprecation warnings. ::getFallbacksFor, deprecated in 1.35, now emit deprecation warnings. ::isKnownLanguageTag, deprecated in 1.34, now emit deprecation warnings. ::convert, ::convertNamespace, ::convertHtml, ::convertCategoryKey, ::getVariants, ::hasVariants, ::hasVariant, ::getDefaultVariant, ::getURLVariant, ::getExtraHashOptions, ::getConvRuleTitle, deprecated in 1.35, now emit deprecation warnings. deprecation warnings. entry point should be used instead. deprecated in 1.34, now emit deprecation warnings. media files' pages, have been renamed to getFileNameWithoutExtension and getFileNameTextWithoutExtension respectively. The old names are deprecated. Command::allowPaths/disallowPaths instead. it is deprecated to not include the "parent" field as one of the parameters. or as base classes. ::fetchRowCount or ::acquireRowLocks instead. warnings. deprecation warnings. IndexPager::buildPrevNextNavigation, deprecated in 1.39, now emit deprecation warnings. deprecation warnings. also renamed), and the old class names are now deprecated: - MostimagesPage -> MediaWiki\Specials\SpecialMostImages  - MovePageForm -> MediaWiki\Specials\SpecialMovePage  - UserrightsPage -> MediaWiki\Specials\SpecialUserRights  - WantedFilesPage -> MediaWiki\Specials\SpecialWantedFiles  - WantedPagesPage -> MediaWiki\Specials\SpecialWantedPages  - DerivativeRequest -> MediaWiki\Request\DerivativeRequest  - FauxRequest -> MediaWiki\Request\FauxRequest  - FauxRequestUpload -> MediaWiki\Request\FauxRequestUpload  - PathRouter -> MediaWiki\Request\PathRouter  - WebRequestUpload -> MediaWiki\Request\WebRequestUpload  - HeaderCallback -> MediaWiki\Request\HeaderCallback  - FauxResponse -> MediaWiki\Request\FauxResponse  - WebResponse -> MediaWiki\Request\WebResponse  - ForeignResourceManager ->    MediaWiki\ResourceLoader\ForeignResourceManager  - DummyLinker -> MediaWiki\Linker\DummyLinker - Linker -> MediaWiki\Linker\Linker - PageProps -> MediaWiki\Page\PageProps - MagicWord -> MediaWiki\Parser\MagicWord - MagicWordArray -> MediaWiki\Parser\MagicWordArray - MagicWordFactory -> MediaWiki\Parser\MagicWordFactory - RawMessage -> MediaWiki\Language\RawMessage - ActorMigration -> MediaWiki\User\ActorMigration - ActorMigrationBase -> MediaWiki\User\ActorMigrationBase - CategoriesRdf -> MediaWiki\Category\CategoriesRdf - Category -> MediaWiki\Category\Category - CategoryViewer -> MediaWiki\Category\CategoryViewer - TrackingCategories -> MediaWiki\Category\TrackingCategories - EditPage -> MediaWiki\EditPage\EditPage - TemplatesOnThisPageFormatter -> MediaWiki\EditPage\TemplatesOnThisPageFormatter - ContentSecurityPolicy -> MediaWiki\Request\ContentSecurityPolicy - FormOptions -> MediaWiki\Html\FormOptions - Html -> MediaWiki\Html\Html - HtmlHelper -> MediaWiki\Html\HtmlHelper - TemplateParser -> MediaWiki\Html\TemplateParser - FormOptions -> MediaWiki\Html\FormOptions - WikiMap -> MediaWiki\WikiMap\WikiMap - WikiReference -> MediaWiki\WikiMap\WikiReference - MediaWiki\BadFileLookup -> MediaWiki\Page\File\BadFileLookup - FileDeleteForm -> MediaWiki\Page\File\FileDeleteForm - MergeHistory -> MediaWiki\Page\MergeHistory - MovePage -> MediaWiki\Page\MovePage - ProtectionForm -> MediaWiki\Page\ProtectionForm - LinkFilter -> MediaWiki\ExternalLinks\LinkFilter - TitleArray -> MediaWiki\Title\TitleArray - TitleArrayFromResult -> MediaWiki\Title\TitleArrayFromResult - TitleFactory -> MediaWiki\Title\TitleFactory - Title -> MediaWiki\Title\Title - ForkController -> MediaWiki\Maintenance\ForkController - OrderedStreamingForkController -> MediaWiki\Maintenance\OrderedStreamingForkController - AtomFeed -> MediaWiki\Feed\AtomFeed - ChannelFeed -> MediaWiki\Feed\ChannelFeed - FeedItem -> MediaWiki\Feed\FeedItem - FeedUtils -> MediaWiki\Feed\FeedUtils - RSSFeed -> MediaWiki\Feed\RSSFeed - DeprecatedGlobal -> MediaWiki\StubObject\DeprecatedGlobal - StubGlobalUser -> MediaWiki\StubObject\StubGlobalUser - StubObject -> MediaWiki\StubObject\StubObject - StubUserLang -> MediaWiki\StubObject\StubUserLang now take an optional RevisionRecord parameter. without replacement.
 * Changes to skins:
 * Manipulating $wgHooks after initialization is deprecated.
 * ParserOptions::{get,set}ExternalLinkTarget and
 * ParserOutput::getCategories has been deprecated; use ::getCategoryNames
 * ParserOutput::{get,set}TOCHTML has been deprecated; use
 * TransactionProfiler::setSilenced is deprecated.
 * The following methods in the Title class, deprecated since 1.37, emits
 * The class Pbkdf2Password was renamed to Pbkdf2PasswordUsingHashExtension,
 * WikiPage::factory, ::newFromID and ::newFromRow, deprecated in 1.36, now
 * Manually constructing a LinkBatch object, deprecated in 1.35, now emits
 * Calling MediaWikiSite::getFileUrl without a $path argument is deprecated.
 * In SessionConsistentConnectionManager, the methods
 * Database::wasErrorReissuable is deprecated.
 * MimeAnalyzer::isPHPImageType was not used and will now emit deprecation
 * GenericArrayObject, originally developed for Wikibase and SiteList, has been
 * Parser::getFunctionLang has been deprecated; use
 * MagicWordArray::getVariableRegex, deprecated in 1.36, now emits deprecation
 * AbstractBlock::getId now emits deprecation warnings in case of cross-wiki
 * CommentStore::getStore, deprecated in 1.31, now emits deprecation warnings.
 * BacklinkCache::get, ::getLinks and ::getCascadeProtectedLinks,
 * LanguageConverterFactory::isTitleConversionDisabled, deprecated in 1.36,
 * Language::getFileName, ::getMessagesFileName and
 * Language::getLocalisationCache, deprecated in 1.34, also
 * User::incEditCount, deprecated in 1.37, now emits deprecation warnings.
 * User::idFromName, deprecated in 1.37, now emits deprecation warnings.
 * The ability to override and use User::$mRights, deprecated in 1.34, now emits
 * IndexPager::getHookContainer is deprecated and emits deprecation warnings.
 * User::getGroupPermissions, ::getGroupsWithPermission and
 * PermissionManager::getGroupPermissions, ::getGroupsWithPermission and
 * Global function wfShowingResults is deprecated and emits deprecation warnings.
 * UserGroupMembership::getGroupMemberName is deprecated, the deprecation of
 * AbstractBlock::getPermissionsError, deprecated in 1.35, now emits
 * SearchEngine::getNearMatcher and ::getDefaultMatcher have been deprecated
 * SearchNearMatcher class has been deprecated in 1.40 in favor of TitleMatcher.
 * The following functions are deprecated: User::isBlockedGlobally and
 * The UserIsBlockedGlobally hook is deprecated.
 * The SystemBlock type global-block is deprecated.
 * Language::isWellFormedLanguageTag, deprecated in 1.39, now emits deprecation
 * Language::fetchLanguageNames and ::fetchLanguageName, deprecated in 1.34,
 * Language::getFallbackFor, ::getFallbacksIncludingSiteLanguage and
 * Language::isSupportedLanguage, ::isValidCode, ::isValidBuiltInCode and
 * Language::getConverter, ::autoConvert, ::autoConvertToAllVariants,
 * Language::factory and ::getParentLanguage, deprecated in 1.35, now emit
 * Executing maintenance scripts directly is deprecated. The maintenance/run.php
 * MWHttpRequest::factory, deprecated in 1.34, now emits deprecation warnings.
 * Job::factory is deprecated, use JobFactory::newJob instead.
 * Http::request, ::get, ::post, ::userAgent and ::isValidURI,
 * Title.js's confusingly-named getName and getNameText methods, for using
 * Command::whitelistPaths should now emit deprecation warnings. Make use of
 * When manually creating an HTMLFormField (i.e. not via HTMLForm::factory),
 * The MWException class is deprecated. Use native exceptions, either directly
 * SelectQueryBuilder::lockForUpdate is deprecated. Use ::forUpdate with
 * ArticleUndelete hook is deprecated. Use PageUndeleteComplete hook instead.
 * The global function wfReportTime is now deprecated.
 * PrevNextNavigationRenderer, deprecated in 1.39, now emits deprecation
 * PagerNavigationBuilder::setMakeLinkCallback, deprecated in 1.39, now emits
 * IndexPager::getPagingLinks, IndexPager::getLimitLinks and
 * Overriding the method IndexPager::makeLink, deprecated in 1.39, now emits
 * The following class names were namespaced (and, for the special pages,
 * ContentHandler::getParserOutputForIndexing and ::getDataForSearchIndex
 * The SearchDataForIndex hook is deprecated in favor of SearchDataForIndex2
 * IDatabase::lastQuery and IReadableDatabase::lastQuery are deprecated without

Other changes in 1.40
logs a warning. Since 1.31, it would mark the change as manually patrolled, but would not log it as such in patrol log and would still require 'autopatrol' right (not 'patrol'). Generally, whether a change should become autopatrolled, is usually determined before it's inserted in the database. was marked internally with ...; in version 1.39 this was changed to an empty tag . In 1.40 this has been changed a final time to use an empty tag for future Parsoid compatibility (see Parser::TOC_PLACEHOLDER). This may affect you if stale content is left in the ParserCache or if your skin did manual ToC replacement without using the recommended Parser::replaceTableOfContentsMarker function. SkinCodexThemes attribute in their skin.json file. and 'showflags' options have slight differences in their output. These options are not much used outside core, but third parties may need to update parser tests.
 * Calling RecentChange::doMarkPatrolled with $auto = true has no effect and
 * In versions of MediaWiki before 1.39, the table of contents location
 * Skins can now choose which Codex theme should be loaded by setting the
 * The parser test framework has been updated, and the 'pst', 'ill', 'cat'
 * (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.

Compatibility
MediaWiki 1.40 requires PHP 7.4.3 or later and the following PHP extensions:


 * ctype
 * dom
 * fileinfo
 * iconv
 * intl
 * json
 * mbstring
 * xml

MariaDB is the recommended database software. MySQL, PostgreSQL, or SQLite can be used instead, but support for them is somewhat less mature.

The supported versions are:


 * MariaDB 10.3 or higher
 * MySQL 5.7.0 or higher
 * PostgreSQL 10 or later
 * SQLite 3.8.0 or later

Online documentation
Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):

https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation

Mailing list
A mailing list is available for MediaWiki user support and discussion:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're going to run a public MediaWiki, so you can be notified of security fixes.

IRC help
There's usually someone online in #mediawiki on irc.libera.chat.