MediaWiki 1.37

Translate this page

If using PHP 8, it is recommended to use MediaWiki 1.38.4 or higher. PHP 8 is not in use by Wikimedia wikis, and thus gets less testing, but other groups do use MediaWiki with PHP 8 without issue. If you encounter any bugs when using MediaWiki with PHP 8, please report them. See task T248925 for more information.

Warning:

MediaWiki 1.37.0 contains a very severe security issue. Please upgrade to 1.37.1 or later. See 2021-12 security release/FAQ for more information.

MediaWiki 1.37 is an obsolete release of MediaWiki. Consult the RELEASE NOTES file for the full list of changes. It was deployed on Wikimedia Foundation wikis through incremental "wmf"-branches starting in April 2021. The 1.37.0 stable release came out on November 18, 2021. Checkout the REL1_37 branch in Git to follow this release. The 1.37 branch, with the version 1.37.6, reached its end-of-life on 30 November 2022.

New features

New wikipage.indicator hook for JavaScript (change 721324).
MediaWiki now has limited support for JPEG2000 files.

Action API changes

(T280806) The API methods for fetching tokens which were deprecated in MediaWiki 1.24 have been removed. action=query&meta=tokens&type= should be used instead. Please note, some token types no longer exist, and you should just use type=csrf for those instead.
- action=query&prop=info&intoken -> action=query&meta=tokens&type=csrf
- action=tokens&type= -> action=query&meta=tokens&type=
- action=query&list=recentchanges&rctoken -> action=query&meta=tokens&type=csrf
- action=query&prop=revisions&rvtoken=rollback -> action=query&meta=tokens&type=rollback
- action=query&meta=userinfo&uiprop=preferencestoken -> action=query&meta=tokens&type=csrf
- action=query&list=users&ustoken=userrights -> action=query&meta=tokens&type=userrights

Configuration changes

(T242768) The PasswordCannotMatchUsername password policy has been removed, please use PasswordCannotBeSubstringInUsername instead. If you have not customised your password policies, there will be nothing to do here.

New configuration

$wgBrowserFormatDetection - This setting allows the enabling or disabling of automatic detection of possible phone numbers in a webpage in iOS Safari.
$wgParserEnableLegacyMediaDOM - This setting defaults to true, and enables the legacy media HTML structure in the output from the Parser. The alternative modern HTML structure for media is described at https://www.mediawiki.org/wiki/Parsing/Media_structure. In a future release of MediaWiki, this option will default to false, so it's a good idea to test this setting on your wiki early and report any issues.

Changed configuration

$wgContentHandlerTextFallback - This migration setting, which defines how to react if a plain text version of a non-text Content object is requested using ContentHandler::getContentText(), is deprecated.
$wgActions – This setting lets sysadmins override which actions can be used. It has been re-worked to support injecting dependencies into Action sub-classes as part of wider work on dependency injection. Previously, $wgActions was an array where the keys were the names of actions, and the values had the following impacts (for a given key 'Foo'):
- `true`: use the class 'FooAction' unless for a specific page WikiPage::getActionOverrides() wants to override that action
- a string: use the class with that name, and do not allow over-riding on a per-page basis
- `false`: the action is disabled
- a callable: use the Action instance returned by invoking that callback, and do not allow overriding on a per-page basis
- an object: use that specific Action instance, and do not allow overriding on a per-page basis.

As part of T253078, values can now be arrays that are not callables, which are treated as ObjectFactory specs, allowing for services to be injected. Additionally, the distinction between values that allow per-page overrides and those that do not be removed - all actions can now be overridden on a per-page basis using WikiPage::getActionOverrides().

$wgShellboxUrl – This setting, new in 1.36 to configure the novel Shellbox encapsulation system, is now deprecated; use $wgShellboxUrls as a mapping of service => URL instead.
$wgIncludejQueryMigrate – This setting, introduced in 1.29 to on whether to provide a migration layer for jQuery, has now switched its default value from true to false. This may break gadgets that depended on methods that were removed in jQuery 3 in 2017. See T280944 for more information.
A number of settings have been renamed. The former configuration variable names are deprecated, but will be used as the fallback if they are still set, and remain temporarily available for extensions which might try to read them:
- $wgFileBlacklist is now $wgProhibitedFileExtensions
- $wgMimeTypeBlacklist is now $wgMimeTypeExclusions
- $wgEnableUserEmailBlacklist is now $wgEnableUserEmailMuteList
- $wgShortPagesNamespaceBlacklist is now $wgShortPagesNamespaceExclusions
- $wgMimeTypeExclusions - As well as being renamed, this configuration array now also prohibits the RFC 4329 form of JavaScript, 'application/javascript', as well as previous MIME types.
$wgFragmentMode - This setting, which determines the encoding of section IDs, has now switched its default value from legacy-first to html5-first: both the HTML5 anchor and the legacy percent-encoding-style anchor will still be generated for section titles, but references to them will use the HTML5 version, resulting in human-readable fragments.

Removed configuration

$wgLegacyJavaScriptGlobals , deprecated in 1.36.
(T274695) $wgAjaxEditStash , deprecated in 1.36.
$wgShowDBErrorBacktrace , deprecated and non-functional since 1.32.
$wgShowSQLErrors , deprecated and non-functional since 1.32.
$wgLangObjCacheSize , without deprecation; the LanguageFactory service now always retains at most 10 objects in its LRU-cache.
$wgDjvuToXML , without deprecation; the tool it enables is obsolete and abandoned upstream. Use $wgDjvuDump to use that tool instead.