Prep 1.35.8

reedy · reedy · commit 19c5cf34a22f · 2022-09-29T19:09:13.000+01:00
Change-Id: I3743c0289da96a83dcfcf51389f2316752b6656d
diff --git a/RELEASE-NOTES-1.35 b/RELEASE-NOTES-1.35
@@ -12,6 +12,8 @@ PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
 
 == MediaWiki 1.35.8 ==
 
+This is a security and maintenance release of the MediaWiki 1.35 branch.
+
 === Changes since MediaWiki 1.35.7 ===
 * Localisation updates.
 * (T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
@@ -83,6 +85,10 @@ PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
 * (T317750) session: Fix broken SessionTest case due to PHPUnit dependency
   change.
 * (T318460) SpecialChangeEmail: Set default for returntoquery.
+* (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
+  in an IP range check on Special:Contributions.
+* (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
+  of hidden users.
 
 == MediaWiki 1.35.7 ==
 
diff --git a/includes/Defines.php b/includes/Defines.php
@@ -37,7 +37,7 @@
  *
  * @since 1.35
  */
-define( 'MW_VERSION', '1.35.7' );
+define( 'MW_VERSION', '1.35.8' );
 
 # Obsolete aliases
 
