Backporting fixes

Bugs are found in MediaWiki all the time. Some of these bugs are pretty high priority for the Wikimedia Foundation (e.g. security-related or they break functionality needed by the Wikimedia community) and need special care to ensure all of the right users get the fix in the appropriate amount of time. There are three main classes of backports:

1. Those that are security related and thus need to be disseminated as widely as possible as quickly as possible;
2. Those that need to be applied to any stable or released (and supported) version of MediaWiki
3. And those that need to be applied to the Wikimedia Foundation server cluster that hosts the wikis for Wikimedia projects.

Security-related backports

To report a security issue, follow the instructions on the Reporting security bugs page. Reports are handled according to the process outlined there.

Backports to stable/supported release

Not strictly in this order:

1. A bug is found that is causing problems to users of released versions of MediaWiki, and a task is created in Phabricator.
2. A fix for the bug is developed, tested, and approved for, and merged into, the development version of MediaWiki.
3. Someone proposes that the fix be backported to one or more stable versions by adding the appropriate MW release project(s), e.g. #MW-1.26-release, to the Phabricator task
4. The WMF Release Engineering Team determines if the bug is important enough to backport the fix. If not, the project(s) are removed.

   This decision is based on criteria such as: number of users affected, severity of the issue, and complexity of the fix.

5. The fix is applied to the stable version of MediaWiki (i.e. cherry-picked) with additional tests there and approved by a Release Engineering Team member or anyone else with +2 rights. See Gerrit/Advanced usage#Submitting a change to a branch for review ("backporting") for more on how to submit the change to the stable branch.

   The RELEASE-NOTES file should be updated for any backports. The RELEASE-NOTES file may cause problems for cherry picking in Git, so you may be asked to update the RELEASE-NOTES file if you are involved in the backport.

6. New tarball releases of MediaWiki are created and announced in accordance with the release policy.

Backports to WMF cluster

Please use the backport deploy process.