MediaWiki Docker with Custom Extensions

This repository builds freilab/mediawiki with MediaWiki 1.43.11 LTS and custom extensions. Deployment configuration belongs in FREILab/manifests; the Dockerfile and image tests belong here.

PHP security release — 21 October 2026

The pinned upstream linux/amd64 base includes PHP 8.3.36, fixing CVE-2026-109618 and CVE-2026-109619. MediaWiki remains at the currently deployed 1.43.11 version. Custom extension commits are pinned to those read from the existing production image, avoiding unrelated authentication/extension upgrades during this PHP patch.

Build and test locally:

docker build --platform linux/amd64 --pull -t freilab/mediawiki:1.43.11-php8.3.36 .
sh tests/smoke.sh freilab/mediawiki:1.43.11-php8.3.36

The smoke test checks PHP's security floor, MediaWiki and extension versions, required PHP extensions, Apache configuration, and the PHP version actually served by Apache (apache2handler). It uses a disposable container without network access, production configuration, databases or volumes. Its temporary HTTP version endpoint is never added to the image or a live wiki.

CI builds and tests pull requests without registry credentials. On main, only after tests pass, it publishes the same tested image to Docker Hub as:

• freilab/mediawiki:1.43.11-php8.3.36
• freilab/mediawiki:latest (for existing consumers)

Deployment order

1. Review/merge this image change and wait for successful image publication.
2. Record the published image digest; update wiki-test/compose.yaml in FREILab/manifests to the release tag (preferably with that digest).
3. Deploy via Komodo, verifying PHP 8.3.36 and page rendering, login/auth, editing and uploads on the test wiki.
4. Promote the same tested digest to wiki/compose.yaml and deploy production. Preserve all existing images/configuration/database volumes.

The companion manifests change must not deploy before this release image exists. Publishing an image alone does not patch already-running containers; they must be recreated. Do not replace this source build with ad-hoc changes inside running containers.

This PHP-only change does not require new MediaWiki schema migrations. Back up before rollout and verify the existing schema is current. Do not automatically run migrations on every web-container start or roll back to vulnerable PHP on the public network if a compatibility problem arises.

Included Extensions

• PluggableAuth v7.0.0
  Provides a framework for authentication plugins.

• EasyVereinAuth
  Custom authentication extension for EasyVerein integration.

• ParserFunctions
  Adds advanced parser functions like #if, #switch, etc.

• Iframe
  Allows embedding external content via <iframe> tags.

License

This project uses open-source extensions. Please refer to each extension's repository for licensing details.