It needs to be reviewed. @labster

If it passes a Wikimedia security review it is exempt from us reviewing it.

The thing is, Wikimedia security process takes a long time. We got a first round of feedback by them, the points raised were fixed, and now we are about to finish a long code review process for one patch, just because there is not much people able and available to review ContentHandler related stuff.

I don't know when are we going to get another slot for security review, but I hope the fact that we adressed their concerns in the previous round is good enough. See https://phabricator.wikimedia.org/T115095

@John You have not made it clear if this can be installed or not, as it does not pass a Wikimedia Security review but it is ongoing.

If you want, I am happy running a controlled test only in espiral.org, assuming all responsibility for bugs, loss of data, etc. I don't think any of this will happy, but at least you know that I would not file bugs against Miraheze (but directly to the developers). I would also let you know when the extension has been used for a while without trouble.

@John So can I install it then?

Yes.

The newsletter extension went to major changes, after we shifted it to use ContentHandler, so it would be great if you can test and install the latest copy from master ie after https://github.com/wikimedia/mediawiki-extensions-Newsletter/commit/18a46ada9a3ea246b9c696762370c5bda474eb6b

@tonythomas01 Is said version still compatible with 1.27? If so, I see no reason why we can't.

In T934#17533, @John wrote:

@tonythomas01 Is said version still compatible with 1.27? If so, I see no reason why we can't.

it is! Please go for it :)