In T400673#11066691, @Dreamy_Jazz wrote:

In T400673#11066686, @Daimona wrote:

I'm not sure if I follow: if a (lazy-loaded) variable was not computed, doesn't that mean that the user didn't see it? As a case in point, if you're on /test and a (lazy-loaded) protected variable was not computed, you can be sure that the user didn't get any information about it. (NB: this does not mean that the tested pattern doesn't use the variable: maybe it does, but we never got to actually computing it due to shortcircuiting. At any rate, the value of the variable did not influence the outcome).

In the examine view, the entire VariableHolder is dumped using ::dumpAllVars( ..., true) and has been doing that since before the security patches: https://gerrit.wikimedia.org/g/mediawiki/extensions/AbuseFilter/+/ec27766a500794b86f6019bcb4a27a6b3b8d1293/includes/View/AbuseFilterViewExamine.php#416

In any case, if you want to comment on any of the places I've left with ::dumpAllVars then feel free to comment on the patch I've uploaded for this task.

In T400673#11066686, @Daimona wrote:

I'm not sure if I follow: if a (lazy-loaded) variable was not computed, doesn't that mean that the user didn't see it? As a case in point, if you're on /test and a (lazy-loaded) protected variable was not computed, you can be sure that the user didn't get any information about it. (NB: this does not mean that the tested pattern doesn't use the variable: maybe it does, but we never got to actually computing it due to shortcircuiting. At any rate, the value of the variable did not influence the outcome).

In the examine view, the entire VariableHolder is dumped using ::dumpAllVars( ..., true) and has been doing that since before the security patches: https://gerrit.wikimedia.org/g/mediawiki/extensions/AbuseFilter/+/ec27766a500794b86f6019bcb4a27a6b3b8d1293/includes/View/AbuseFilterViewExamine.php#416

Change #1153950 abandoned by Bartosz Dziewoński:

[mediawiki/core@master] DoubleRedirectConstraint: show error when changing from one double redirect to a different double redirecy

https://gerrit.wikimedia.org/r/1153950

Test wiki on Patch demo by EBomani-WMF using patch(es) linked to this task was deleted:

In T400673#11066611, @Dreamy_Jazz wrote:

In T400673#11042544, @Daimona wrote:

I think omitting the $compute argument would fix this and give you a list of variables that are already set (either because they aren't lazy-loaded, or because the filter uses them).

In some places we do need to load the value of any lazily loaded protected variables, because when logging we only want to log that a value was viewed if it's not null.

I'm not sure if this feature is ready to be deployed, as users probably can't agree on the collation method (zh-cn users naturally use pinyin, but not sure about others). Nevertheless I have created a discussion on zhwiki to collect users' opinions (link).

Change #1176315 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] [WIP] Support JWT session cookies in CentralAuth

https://gerrit.wikimedia.org/r/1176315

Given Joy's POV, I am OK with enabling the support button for wishes under review . The wish should be marked for translation only after it's gone beyond the review state.

We should backport the above patch once we are happy with it and have merged it in the master branch. This is because the security fixes that cause the slowdowns will also be present on the release versions and we should avoid making the release versions slow too.

Change #1176311 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Add maint script to fix global edit count of renamed users

https://gerrit.wikimedia.org/r/1176311

Seems to be working:
Could not send confirmation email: Sendmail exited with non-zero exit code 74
Thanks a lot @jhathaway and @Scott_French for fixing the error reporting issue!

Change #1176308 merged by jenkins-bot:

[mediawiki/extensions/GlobalBlocking@REL1_43] GlobalBlockLookup: Don't call ContextSource::getUser unless safe

https://gerrit.wikimedia.org/r/1176308

Test wiki created on Patch demo using patch(es) linked to this task:
https://c7cbda7edc.demos.192.168.49.2.nip.io/w/

Test wiki created on Patch demo using patch(es) linked to this task:
https://854843f90f.demos.192.168.49.2.nip.io/w/

Change #1176307 merged by jenkins-bot:

[mediawiki/extensions/GlobalBlocking@REL1_44] GlobalBlockLookup: Don't call ContextSource::getUser unless safe

https://gerrit.wikimedia.org/r/1176307

Change #1176304 merged by jenkins-bot:

[mediawiki/core@REL1_44] maintenance: Fix paging in findMissingFiles.php

https://gerrit.wikimedia.org/r/1176304

Change #1176305 merged by jenkins-bot:

[mediawiki/core@REL1_43] maintenance: Fix paging in findMissingFiles.php

https://gerrit.wikimedia.org/r/1176305

Change #1176290 merged by jenkins-bot:

[wikimedia/fundraising/crm@master] Restore UID in query comments

https://gerrit.wikimedia.org/r/1176290

Having looked at several other examples of these errors, there are a lot which are not caused by GlobalBlocking code. Therefore, I will filter these logs to exclude those which do not include GlobalBlocking in the stack trace.

Done, with the 'possible' settings included.

Mentioned in SAL (#wikimedia-operations) [2025-08-06T19:30:19Z] <swfrench@deploy1003> Finished scap sync-world: No-op deployment to configure PHP 8.3 image builds - T399884 (duration: 19m 22s)

Change #1176308 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/GlobalBlocking@REL1_43] GlobalBlockLookup: Don't call ContextSource::getUser unless safe

https://gerrit.wikimedia.org/r/1176308

Change #1176307 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/GlobalBlocking@REL1_44] GlobalBlockLookup: Don't call ContextSource::getUser unless safe

https://gerrit.wikimedia.org/r/1176307

https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1175580
https://integration.wikimedia.org/ci/job/wmf-quibble-selenium-php81/32089/console

14:56:52 [Chrome 120.0.0.0 linux #0-1] » /tests/selenium/specs/ipcontributions.js
14:56:52 [Chrome 120.0.0.0 linux #0-1] IPInfo on Special:IPContributions
14:56:52 [Chrome 120.0.0.0 linux #0-1]    ✓ should not be shown to users without necessary permissions
14:56:52 [Chrome 120.0.0.0 linux #0-1]    ✖ should show an error for IPs without edits after accepting agreement
14:56:52 [Chrome 120.0.0.0 linux #0-1]    ✓ should show geo data for IP with edits
14:56:52 [Chrome 120.0.0.0 linux #0-1]
14:56:52 [Chrome 120.0.0.0 linux #0-1] 2 passing (24.2s)
14:56:52 [Chrome 120.0.0.0 linux #0-1] 1 failing
14:56:52 [Chrome 120.0.0.0 linux #0-1]
14:56:52 [Chrome 120.0.0.0 linux #0-1] 1) IPInfo on Special:IPContributions should show an error for IPs without edits after accepting agreement
14:56:52 [Chrome 120.0.0.0 linux #0-1] element ("button[name=submit-agreement]") still not displayed after 5000ms
14:56:52 [Chrome 120.0.0.0 linux #0-1] Error: element ("button[name=submit-agreement]") still not displayed after 5000ms
14:56:52 [Chrome 120.0.0.0 linux #0-1]     at async IPContributionsWithIPInfoPage.acceptAgreement (/workspace/src/extensions/IPInfo/tests/selenium/pageobjects/IPContributionsWithIPInfoPage.js:44:3)
14:56:52 [Chrome 120.0.0.0 linux #0-1]     at async Context.<anonymous> (/workspace/src/extensions/IPInfo/tests/selenium/specs/ipcontributions.js:76:3)

Test wiki created on Patch demo by EBomani-WMF using patch(es) linked to this task:
https://staging-patchdemo.wmcloud.org/wikis/1f22897e55/w/

@Jgreen yes please enable on staging

Mentioned in SAL (#wikimedia-operations) [2025-08-06T19:11:32Z] <swfrench@deploy1003> Started scap sync-world: No-op deployment to configure PHP 8.3 image builds - T399884

Change #1176305 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/core@REL1_43] maintenance: Fix paging in findMissingFiles.php

https://gerrit.wikimedia.org/r/1176305

make-container-image: add mediawiki publish-83 flavour

Add PatchDemo bot to Catalyst wiki creation flow.

I tried making the code change and it's just getting us an opaque error message back from Gravy's API. Have asked them for more info about how to make it work.

Change #1176292 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] selenium: Skip flaky test

https://gerrit.wikimedia.org/r/1176292