* Argon2 password hashing is now available, can be enabled via
$wgPasswordDefault = 'argon2'. It's designed to resist timing attacks
(requires PHP 7.2+) and GPU hacking (7.3+).
+* Special:CreateAccount now warns the user if their chosen username has to be
+ normalized.
=== External library changes in 1.33 ===
* Added jakub-onderka/php-console-highlighter 0.3.2 explicitly (dev-only).
==== Changed external libraries ====
-* Updated OOUI from v0.29.2 to v0.30.3.
+* Updated OOUI from v0.29.2 to v0.30.4.
* Updated OOjs Router from pre-release to v0.2.0.
* Updated moment from v2.19.3 to v2.24.0.
* Updated wikimedia/xmp-reader from 0.6.0 to 0.6.2.
* The transitional wrapper classes AuthPluginPrimaryAuthenticationProvider,
AuthManagerAuthPlugin, and AuthManagerAuthPluginUser.
* The $wgAuth configuration setting and its use in Setup.php and unit tests
+* (T217772) The 'wgAvailableSkins' mw.config key in JavaScript, was removed.
+* Language::markNoConversion, deprecated in 1.32, has been removed. Use
+ LanguageConverter::markNoConversion instead.
=== Deprecations in 1.33 ===
* The configuration option $wgUseESI has been deprecated, and is expected
check block behaviour.
* The api-feature-usage log channel now has log context. The text message is
deprecated and will be removed in the future.
-* The "stream" request option in MultiHttpClient has been deprecated.
- Use the new "sink" option instead.
=== Other changes in 1.33 ===
* (T201747) Html::openElement() warns if given an element name with a space