janI wrote:
As you can read below, mediawiki has just released a security release. We are currently not hit by the issues noted in the mail. However I would like to ask the community if we should upgrade or wait for a later release ?
Security issues are one of the few cases where we prefer that all conversations happen in private (infrastructure-private, that you CCed, seems right).
I realize that we are not affected by the vulnerabilities, so discussing this in public wouldn't pose risks in this case, but still with all security releases the project will simply take Infra's advice.
And thank you for following Mediawiki's security announcements! Regards, Andrea.
