Todos

• Discourse SSO: meta/addons/DiscourseSsoConsumer.yml stands at enabled: false. Every tag the project publishes requires PluggableAuth: ~6.3, 5.0.2 and the newest, 6.0.0, alike, while MEDIAWIKI_EXT_BRANCH resolves PluggableAuth to REL1_46, which carries 7.5.0; 6.0.0 additionally declares php >= 8.4 against the image’s 8.3.35. update.monitored stays on, so re-enable the addon and restore the services.discourse.enabled and services.sso.enabled gate once a release declares PluggableAuth 7.

• MediaWiki runs in no-JavaScript mode for every browser. ResourceLoader’s isCompatible() in the startup module probes new Function('async (a = 0,) => a'), and the CSP from meta/csp.yml grants no unsafe-eval in script-src, so the probe fails, <html> keeps client-nojs and no module loads (measured on 1.46.2: typeof mw is undefined, no page error). Lost: search suggestions, the appearance menu with the night mode switch, collapsible menus and OOUI widgets, mw.Api, and under litellm VisualEditor with the AI assistant. Options: grant unsafe-eval for script-src in meta/csp.yml, or ask upstream for a compatibility probe without new Function.

• tasks/03_install.yml passes the database password and the administrator password as positional arguments to files/install/or_update.sh, which forwards them in argv again (lines 22 -p"$DB_PASSWORD", 40 --dbpass, 45 --pass); the deploy log prints the script line at -vv. Options: hand both through the task’s environment: and container run -e NAME, and use install.php --passfile for the administrator.

• Visitors can create accounts and edit pages: Special:CreateAccount serves #wpCreateaccount and action=edit serves an editable #wpTextbox1 without a session (MediaWiki defaults $wgGroupPermissions['*']['createaccount'] and ['edit'], not overridden in templates/LocalSettings.php.j2). Options: set both to false, at least while sso is on, and grant edit to user.