Hello, I'm writing to let everyone here know that the Score extension has been temporarily disabled. We do not have a timeline for re-enabling it yet, but a fix is in progress.

What this means for readers and editors

Any page that uses the <score> tag is affected. Where musical notation used to appear, you will now see the message "Musical scores are temporarily disabled." This applies to all score formats (LilyPond and ABC notation).

The underlying wikitext is not affected. Pages still save and edit normally. The source code for each score is preserved. The rendering is what is currently disabled.

What you can do

No action is needed from editors right now. Your score markup is intact.

If you are aware of articles where the missing scores are particularly disruptive to readers, feel free to note them here so we can prioritize.

A separate announcement will go out when the extension is re-enabled.

Thanks for your patience while we work on this.

Steps to replicate the issue (include links if applicable):

Go to a page that uses MediaWiki-extensions-Score (example)

What happens?:
You see a warning message: "Musical scores are temporarily disabled."

What should have happened instead?:
You should see a musical score.

Other information (browser name/version, screenshots, etc.):
No workaround exists. This is creating a significant regression on the Wikipedia pages

Related Objects

Mentioned Here: T385404: Deploy LilyPond 2.24 with Cairo support to shellbox containers
T427820: Migrate Shellbox image to Bookworm

Event Timeline

Huji created this task.Sun, Oct 18, 11:51 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSun, Oct 18, 11:51 PM

Since no workaround exists and this has a significant negative impact on the Wikipedia articles, marking it as highest priority.

Didn't mean to merge, only meant to connect

It is intentionally disabled for security reasons, not a Regression.

Noted. I also found this by @EMill-WMF just after creating this task.

Two questions:

How was this disabled? I don't see a corresponding change in https://phabricator.wikimedia.org/source/mediawiki-config/history/master/
Do such issues get communicated in some way so users become aware and not ask repetitive questions about it?

JJMC89 updated the task description. (Show Details)Mon, Oct 19, 12:09 AM

JJMC89 updated the task description. (Show Details)

JJMC89 added a subscriber: Jdrewniak.

Not sure, but if it helps with bug fixing, for some reason Special:Version on en Wikipedia is now reporting version 2.22.0 of LilyPond, which does not support the SVG rendering with libcairo that the Score extension relies on. LilyPond should be version 2.24.0 or later with libcairo compiled in; see T385404 and T427820.

Jonathanischoice added a project: Security.Mon, Oct 19, 12:11 AM

JJMC89 renamed this task from Score is disabled to Score is disabled (T441512).Mon, Oct 19, 12:11 AM

Jonathanischoice removed a project: Security.Mon, Oct 19, 12:12 AM

Bugreporter added a project: User-notice.Mon, Oct 19, 12:32 AM

In T441579#12446243, @Jonathanischoice wrote:

Not sure, but if it helps with bug fixing, for some reason Special:Version on en Wikipedia is now reporting version 2.22.0 of LilyPond, which does not support the SVG rendering with libcairo that the Score extension relies on. LilyPond should be version 2.24.0 or later with libcairo compiled in; see T385404 and T427820.

That comes from:

if ( $wmgUseScore ) {
	wfLoadExtension( 'Score' );
	$wgScoreSafeMode = false;
	$wgScoreUseSvg = true;

	if ( $wmgUseScoreShellbox && $wmgLocalServices['shellbox'] ) {
		// Route score to the Shellbox named "shellbox".
		$wgShellboxUrls['score'] = $wmgLocalServices['shellbox'];
		// $wgShellboxSecretKey set in PrivateSettings.php
		$wgScoreImageMagickConvert = '/usr/bin/convert';
	} else {
		# Emergency mode in which Score is disabled
		$wgScoreLilyPond = '/dev/null';
		$wgScoreDisableExec = true;
		$wgScoreLilyPondFakeVersion = '2.2.0';
	}

}

in CommonSettings.php.

I assume somewhere in PrivateSettings.php wmgUseScoreShellbox is being set to false.

There's no bug in the Score codebase here AFAICS.

mb subscribed.Mon, Oct 19, 4:14 AM

SomeRandomDeveloper subscribed.Mon, Oct 19, 6:34 AM

TheVoidwalker subscribed.Mon, Oct 19, 9:18 PM

In T441579#12446233, @Huji wrote:

Noted. I also found this by @EMill-WMF just after creating this task.

Two questions:

How was this disabled? I don't see a corresponding change in https://phabricator.wikimedia.org/source/mediawiki-config/history/master/

Do such issues get communicated in some way so users become aware and not ask repetitive questions about it?

Based on the above, I believe the answer to #1 above is: the change was made in PrivateSettings.php which is not git-tracked (for obvious reasons).

I would still appreciate a response to #2 above.

the change was made in PrivateSettings.php which is not git-tracked

PrivateSettings.php uses a git repo, albeit a private one.

Ahecht added a project: MediaWiki-extensions-Score.Tue, Oct 20, 5:02 PM

MBH subscribed.Tue, Oct 20, 5:09 PM

Chorchapu subscribed.Tue, Oct 20, 6:04 PM

NightWolf1223 subscribed.Tue, Oct 20, 6:30 PM

In T441579#12446230, @JJMC89 wrote:

It is intentionally disabled for security reasons, not a Regression.

Hi, could you please provide more information about the security issue, and point us at the related task (if public/possible). I'm a dev with Score codebase familiarity, and happy to help, but I'm not a WMF dev. For instance, if it's to do with Ghostscript or Imagemagick, I have a patch waiting for review on Gerrit that removes those as dependencies since they are no longer needed for SVG (and we don't need PNG fallback in 2026).

I cannot provide any details. The (private) security task is T441512.

Tol subscribed.Wed, Oct 21, 7:32 PM

Eyesnore subscribed.Thu, Oct 22, 12:49 AM

SunloungerFrog subscribed.Thu, Oct 22, 7:51 AM

Wargo subscribed.Thu, Oct 22, 3:24 PM

STei-WMF moved this task from To Triage to In current Tech/News draft on the User-notice board.Thu, Oct 22, 4:00 PM

null subscribed.Fri, Oct 23, 7:09 AM

FordPrefect42 subscribed.Fri, Oct 23, 7:38 AM

Pppery merged a task: T442286: score plugging don't work..Sat, Oct 24, 2:05 PM

Pppery added a subscriber: Mjchael.

Edderiofer subscribed.Sat, Oct 24, 6:23 PM