So we may want to 1. resolve T231755: Local language name should be translatable in translatewiki.net first; 2. migrate existing translations of languages to CLDR extension.

Can some other admin confirm that it is CC-BY-SA 4.0 (with share-alike), not CC-BY 4.0?

As I said above, the Grade A JavaScript requirement is already higher than ES8.

Note if you must use Python 3.13, you can create a Bookworm Kubernetes shell using toolforge webservice python3.11 shell (note you can no longer use Bastion for this since decommision of Grid Engine), and manually compile Python 3.13 there from source code. Several years ago I did this for 3.7 before it is available (T230961).

In T368113#10375890, @gerritbot wrote:

Change #1100125 had a related patch set uploaded (by Ladsgroup; author: Amir Sarabadani):

[mediawiki/core@master] [WIP] file: Basic support for writing to the new file tables

https://gerrit.wikimedia.org/r/1100125

We should still keeps the current revdel/suppression and deletion system functionally separate. For example:

1. Someone created an article for a BLP
2. A user added disparaging information to the article, it got revdeled
3. A user added PII to article, it got oversighted
4. Article is deleted for lack of notability
5. Article is recreated
6. Article is moved elsewhere; currently we do not move deleted revisions with it. (But we can let user choose whether to move the deleted revisions together with it? By doing so, user should know existence of deleted revisions beforehand.)
7. Older revision is restored, but we don't want revision hidden in step 2 and 3 to come back.

Note we may need a way to know whether a IP or account has legacy edits in any wiki, otherwise we can only say "Legacy IP edits may be made from this IP address."

There is one user in EFM (ProcBot II) and one in EFH (Queen of Hearts mobile) not meeting requirement described in https://foundation.wikimedia.org/wiki/Policy:Wikimedia_Access_to_Temporary_Account_IP_Addresses_Policy#Patrollers_and_other_users. Both are alternative accounts, but policy does not mention any current way to assign such access to alternative account (other than gaining them local admins - yeah, any crat can assign a brand-new user as sysop and it will get IP reveal access immediately by policy), not even with community approval.

checkuser-temporary-account and checkuser-temporary-account-no-preference can not be granted to other user groups until https://foundation.wikimedia.org/wiki/Policy:Wikimedia_Access_to_Temporary_Account_IP_Addresses_Policy, and there are no current way for user not meeting the requirement in policy to have access (even if approved by policy).

Note I will suggest user require both normal IP reveal right (checkuser-temporary-account+optin or checkuser-temporary-account-no-preference) and abusefilter-access-protected-vars to access protected variables, so Legal approval is not needed.

Cross-link T381722#10388748. Note edit filter helper is also given to users that is primarily editing other wikis (with advanced permissions), which may not necessary meet the edit count requirement of IP address reveal access.

Em, that is T380332: Add abusefilter-access-protected-vars to enwiki EFM/EFH

I think this is unready to merge. Since abusefilter-access-protected-vars is essentially another kind of IP reveal process, it is protected by https://foundation.wikimedia.org/wiki/Policy:Wikimedia_Access_to_Temporary_Account_IP_Addresses_Policy (and this is why check a preference to enable the feature). Abusefilter managers is not mentioned in policy and may be granted to users that otherwise has no IP reveal access. Therefore we need to check (if CheckUser is installed) whether the user has IP reveal access (and for user require an opt-in, choose to opt-in) in addition to abusefilter-access-protected-vars. Then the view agreement in AbuseFilter can be removed (see T381052: Investigate: Should we remove the preference check from AbuseFilter's protected variables implementation?).

$wgAllowImageTag no longer exists.

$wgAllowImageTag no longer exists.

I suppose similarly remove some fidelity from afl_timestamp (to the day or something).

This is still not enough - Take a popular non-protected enwiki articles, Tom Hardy, as example, it hits abuse filter 19 times: https://en.wikipedia.org/w/index.php?title=Special:AbuseLog&wpSearchTitle=Tom+Hardy so if a temp account edit it the relationship is still easy to find. In addition users can just browse abuse log page-by-page - it is ordered by afl_id - to find the connection.

testwiki and test2wiki also has it, and other may have once T50552: Make PageTriage wiki agnostic is resolved.

But editing it is better than remove and repost in most cases, for many reasons including you can only insert a comment at the end of current task.

The issue is "what was written at that very timestamp" can be confusing.

Note:
(1) The current task description says "Add an option to 'Block user from their meta talk page' (unchecked by default)" but Martin's comment says "global blocks would not apply to user talk edits at any wiki (unless specifically enabled)" which means we will add an opinion to also block user/ip from user talk page of all wikis (which is also the current situation). I think there are use case to allow user/ip to edit user talk page in every wiki and to disallow user/ip to edit user talk page in every wiki, but I am not sure what is the use case to allow user only to edit their non-Meta user talk page (though of course if we have the first two we can also achieve this one by also imposing a local block in Meta).
(2) Currently GlobalBlocking disable user's talk page and email access on wikis block is active, and provides no option to enable the access, not does the database dchema support such. So if we want to add such options we need to do a schema change. Though we will do a much breaking schema change when we introduce global multiblock (T375992#10187120).

So what is needed is a maintenance script to merge a change tag to another. (this may be a feature in core; it is not Wikimedia specific)

In T381187#10384951, @matmarex wrote:

I investigated, looked up this user in the ratelimit log channel and confirmed that the rate limits are working correctly, and this is not a bug. The IP that they are connecting from has a reduced limit for security reasons. As already suggested above, you can add them to the "confirmed" user group to let them bypass this limit.

Note if this change is not backported to 1.43, we need to wait until 1.43 EOL in December 2025.

Alternatively for log-out user without JS we can show the absolute time instead.

In T381187#10384191, @stjn wrote:

The tags are wrong, but the task closure is also wrong: the problem isn’t that $wgRateLimits is configured a certain way, the problem is that they are getting triggered even though the user is clearly not in the wrong here. It is clearly some sort of bug. This should’ve been investigated further, not speedily denied.

Note also the cloud view of abuse_filter_log has been removed in T375751: Public wiki replicas contain abuse filter logs for filters that are private or protected.

In T365049#10384117, @STran wrote:

I wonder if it's possible to try and maintain both bits of the information even if they're no longer associable. eg. if a log reads: ~2024-7 triggered filter 3, performing the action "edit" on Main Page2. Actions taken: Disallow; Filter description: 3, it would be nice to be able to:

• search for ~2024-7 and see something like ~2024-7 triggered a filter
• search for 3 (the filter id) and see something like a user triggered filter 3, performing the action "edit" on Main Page2. Actions taken: Disallow; Filter description: 3

I think both provide valuable information - the first is the account's abuse history and the latter is the filter's history. Unfortunately, this is all stored on one row:

+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+
| afl_id | afl_global | afl_filter_id | afl_user | afl_user_text | afl_ip    | afl_action | afl_actions | afl_var_dump | afl_timestamp  | afl_namespace | afl_title  | afl_wiki | afl_deleted | afl_patrolled_by | afl_rev_id |
+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+
|      1 |          0 |             3 |        8 | ~2024-7       | 127.0.0.1 | edit       | disallow    | tt:8         | 20241205163742 |             0 | Main_Page2 | NULL     |           0 |                0 |       NULL |
+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+

so to do so, we'd probably have double up to make this happen eg.

+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+
| afl_id | afl_global | afl_filter_id | afl_user | afl_user_text | afl_ip    | afl_action | afl_actions | afl_var_dump | afl_timestamp  | afl_namespace | afl_title  | afl_wiki | afl_deleted | afl_patrolled_by | afl_rev_id |
+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+
|      1 |          0 |             3 |        8 | user          | 127.0.0.1 | edit       | disallow    | tt:8         | 20241205163742 |             0 | Main_Page2 | NULL     |           0 |                0 |       NULL |
+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+
|      1 |          0 |             3 |       -1 | ~2024-7       | 127.0.0.1 | edit       | disallow    | tt:8         | 20241205163742 |             0 | Main_Page2 | NULL     |           0 |                0 |       NULL |
+--------+------------+---------------+----------+---------------+-----------+------------+-------------+--------------+----------------+---------------+------------+----------+-------------+------------------+------------+

and would probably cause a bunch of downstream problems but it still might be worth considering. The alternative is as stated, to pick whichever one we think is more important and remove the other value after 90 days.

Anyway, stewards can create Flow boards anywhere.

So we may instead allow user to move Flow boards without flow-create-board right.

If you want to solve this user's problem, no setting need to be changed. A sysop assigning that user "confirmed" group is enough.

After T368204: Consider removing new-line insertion from JavaScriptMinifier Minifier adds no new lines. So this one T277675#10046960 should no longer causes problems. We should focus on when new lines are required but ignored by Minifier.

I changed it to ES9 since current check already rejected mainstream browser without ES8 (see T178356#8782595). It is just minifier does not have full support for ES8.

See also T309693: Remove rows about private filters from Special:AbuseFilter (and the API) if the user can't see private filters, although I support Matej's opinion that private filters should not be hidden and we would need a brand new feature to hide a filter from Special:AbuseFilter (different from private and protected ones).

Not likely a valid request

In T69936#10374326, @MGChecker wrote:

Doesn't this just boil down to making UltimateAuthority bypass abusefilter?

Em, such as this one (https://gerrit.wikimedia.org/r/1049531), but this is just an extension. And we need to fix core and other extensions that calls abusefilter.

In additional of the issues I described above, I do not believe the current way to detect system users (T212720#5661680) is a "cheap" one. Imagine if we need to filter out edits of system users from recent changes, we must query whether a user is system user one by one. In many cases, login credentials can be provided by an external system that may be another database (e.g. CentralAuth), or not MySQL at all. So it is not possible to join it with recent changes.

Becoming a system user does not mean anything in recent changes - recent changes do not provide ways to filter out edits/logs by system user.

Betawikis does not have CheckUser installed due to privacy concerns

1. We really need a way to bypass all abusefilters, at least in some specific maintanence scripts. e.g. T368275: Abusefilter prevented GrowthExperiments Migration script from running and more recent one, T378827#10366997. Note this right does not nees to be assigned explicitly, see T212268#7864059.
2. Someone made an extension to do so, so it would be useful for it to be built in AbuseFilter since it also has a real world use case.

Compare https://meta.wikimedia.org/wiki/Community_health_initiative/User_Mute_features#Notifications_Mute which says pings will still looks "successful" even the sender is muted by the receiver.

Not resolved. https://archive.is/i9eWv

Reopen. Wikifunction staffs can still add/remove sysops and crats to their own account, so it is still not the final state I proposed. Though I will not suggest to change the de facto (i.e. remove the ability) until Wikifunctions has crats elected by community.