Change 890910 merged by jenkins-bot:

[mediawiki/core@master] qunit: Enable debug=2 by default for SpecialJavaScriptTest

https://gerrit.wikimedia.org/r/890910

Change 890909 merged by jenkins-bot:

[mediawiki/core@master] ResourceLoader: Fix mw.inspect tests to work on debug=2

https://gerrit.wikimedia.org/r/890909

Change 890910 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] qunit: Enable debug=2 by default for SpecialJavaScriptTest

https://gerrit.wikimedia.org/r/890910

Change 890909 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] ResourceLoader: Fix mw.inspect tests to work on debug=2

https://gerrit.wikimedia.org/r/890909

Declinded per T310243: Deprecate WVUI in favor of Codex and using Codex and Vue.js in gadgets is further discussed in T313945: [EPIC] Enable gadget and user-script developers to use Vue and Codex.

Codex never had a TypeaheadSuggestion component, this was about renaming the WVUI component, which isn't being done because it will be retired along with the rest of WVUI, so this should be declined not resolved

Closing this because:

Change 777482 merged by jenkins-bot:

[mediawiki/core@master] debug: Fix $wgDebugRawPage to work with PSR-3 debug logging

https://gerrit.wikimedia.org/r/777482

Change 777478 merged by jenkins-bot:

[mediawiki/core@master] WebRequest: Micro-optimise getIP

https://gerrit.wikimedia.org/r/777478

Change 777427 merged by jenkins-bot:

[mediawiki/extensions/Gadgets@master] GadgetRepo: Fix missing purging on delete and simplify hook handling

https://gerrit.wikimedia.org/r/777427

Change 777482 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] debug: Fix $wgDebugRawPage to work with PSR-3 debug logging

https://gerrit.wikimedia.org/r/777482

Another highlight may be WebRequest::getIP.

Change 777478 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] WebRequest: Optimise getIP

https://gerrit.wikimedia.org/r/777478

I'm working on a faster HookRunner for load.php (and possibly elsewhere opt-in) which is tracked at T274041: Reduce performance impact of HookRunner.php loading 500+ interfaces.

Change 777427 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/extensions/Gadgets@master] GadgetRepo: Fix missing purging on delete and simplify hook handling

https://gerrit.wikimedia.org/r/777427

Change 763402 merged by jenkins-bot:

[mediawiki/core@master] resourceloader: Pass exports parameter to package modules

https://gerrit.wikimedia.org/r/763402

Change 763402 had a related patch set uploaded (by Catrope; author: Catrope):

[mediawiki/core@master] resourceloader: Pass exports parameter to package modules

https://gerrit.wikimedia.org/r/763402

Thanks for working on this!

Anecdotally, I'm profiling debug=2 per T85805 on my local wiki (using mediawiki-docker-dev), and noticing something funny. Despite taking fewer requests and allowing better use of concurrency, debug=2 is slower than debug=1 on a simple dev wiki.

In T257734#7615302, @Catrope wrote:

Update: the documentation has been updated to discourage use of v-html; to remove v-html from code examples; to encourage use of v-i18n-html; and to document the latter better. See https://www.mediawiki.org/wiki/Manual:Coding_conventions/Vue#Template and https://www.mediawiki.org/wiki/Vue.js#Internationalization

Update: the documentation has been updated to discourage use of v-html; to remove v-html from code examples; to encourage use of v-i18n-html; and to document the latter better. See https://www.mediawiki.org/wiki/Manual:Coding_conventions/Vue#Template and https://www.mediawiki.org/wiki/Vue.js#Internationalization

Hey @Catrope (and your current director, @dr0ptp4kt, as recorded in Namely) -

Change 744073 merged by jenkins-bot:

[mediawiki/core@master] resourceloader: Implement debug=2 request splitting

https://gerrit.wikimedia.org/r/744073

Change 715296 abandoned by Krinkle:

[mediawiki/core@master] resourceloader: Always split requests in debug mode

Reason:

Obsoleted by https://gerrit.wikimedia.org/r/744073

https://gerrit.wikimedia.org/r/715296

Change 744072 merged by jenkins-bot:

[mediawiki/core@master] resourceloader: Allow debug=2 on JavaScriptTest, and misc whitespace

https://gerrit.wikimedia.org/r/744072

In T257734#7551885, @Catrope wrote:

We already have a lint rule prohibiting the use of v-html. We intend to write developer documentation about this too, in which we will tell people to avoid using v-html except when absolutely necessary (which requires an explicit <!-- eslint-disable-next-line vue/no-v-html --> comment to bypass the lint rule).

Change 721287 abandoned by Kosta Harlan:

[mediawiki/core@master] ResourceLoader: Add setting for controlling minification

Reason:

https://gerrit.wikimedia.org/r/744073

https://gerrit.wikimedia.org/r/721287

In T257734#7547334, @sbassett wrote:

1. p/javascript: The vast majority of the issues found by this rule set were for lower-risk prototype pollution and object injection via bracket notation. A few potentially insecure eval issues were found within packages/runtime-core/__tests__/hmr.spec.ts, packages/compiler-dom/src/transforms/stringifyStatic.ts and packages/compiler-core/src/validateExpression.ts along with some potental re-dos issues within packages/compiler-ssr/src/transforms/ssrTransformElement.ts and packages/compiler-core/src/validateExpression.ts. For now, I would rate these results as a medium risk. Please review this supplemental report of the findings for further details:

vue3-2021-semgrep-p-javascript.txt62 KBDownload

.

Security Review Summary - T288768 - 2021-12-06

Vielen Dank!

Change 744073 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] resourceloader: Implement debug=2 request splitting

https://gerrit.wikimedia.org/r/744073

Change 744072 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] resourceloader: Allow debug=2 on JavaScriptTest, and misc whitespace

https://gerrit.wikimedia.org/r/744072