This got deployed.

It was pointed out the solution only works for renames after 2014. Special:log/renameuser goes back earlier than that, but its hard to use as its not unified, and log_title becomes messed up by later renames.

Leaving this open for now, well we figure out if we have to do anything related to mediawiki security release for this task.

A similar patch should be made in either Renameuser or AntiSpoof for normal non-CA renames since most people don't use CA. I'm removing this as a security release blocker since this doesn't affect any tarball bundled functionality.

This doesn't work: https://meta.wikimedia.org/w/api.php?action=antispoof&username=%20Akuski&format=json

In T196386#4699616, @Ladsgroup wrote:

This doesn't work: https://meta.wikimedia.org/w/api.php?action=antispoof&username=%20Akuski&format=json

Correction: It works but only for registering new users and not any other anti-spoof functionality.

Proposed patches (I will submit to Gerrit instead if this task becomes public):

This will also fix T364330 and T321482.

In T196386#11815156, @matmarex wrote:

I've been working on a patch, but I wonder, perhaps it could be submitted publicly to Gerrit. This task has been open for 8 years now, with a workaround patch merged in CentralAuth (439496), and has been discussed in other public tasks (e.g. T321482).

Could we make this task public as well? (CC @sbassett)

Yeah, I think that's fine. I'll go ahead and make this public.

Change #1271055 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] Prevent username registration if the username previously existed

https://gerrit.wikimedia.org/r/1271055

Change #1271058 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Prevent username registration if the username previously existed (v2)

https://gerrit.wikimedia.org/r/1271058

Change #1271055 merged by jenkins-bot:

[mediawiki/core@master] Prevent username registration if the username previously existed

https://gerrit.wikimedia.org/r/1271055

Change #1271058 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Prevent username registration if the username previously existed (v2)

https://gerrit.wikimedia.org/r/1271058

@Nemoralis hello, I am responding to the usernotice tag :)
How should this update be worded for Tech News?

I'm not sure if User-notice in Tech News is necessary here, as this is not a significant change for Wikimedia wikis – reusing previously renamed usernames was already disallowed since @Bawolff's first patch on this task in 2018 (T196386#4410039). My changes only improve the error messages you get if you try, and clarify the interface for overriding this limitation (available to sysops, account creators, stewards etc.). I'd be happy to write one if you think it's valuable (@Nemoralis @STei-WMF).

Maybe I should add a release note for MediaWiki 1.47 though, since this will be something new for third-party users (assuming they don't use CentralAuth).

I should also grant the new right to override this to some of the groups which currently have the override-antispoof right (local and global).

Change #1285444 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] RenameUser: Treat "previously-renamed-account" as a warning, not error

https://gerrit.wikimedia.org/r/1285444

Change #1285445 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] Add release note about account creation with renamed usernames

https://gerrit.wikimedia.org/r/1285445

Change #1285448 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[operations/mediawiki-config@master] Grant 'createpreviouslyrenamedaccount' to account creators and sysop-likes

https://gerrit.wikimedia.org/r/1285448

I'll schedule the config changes for Monday (and also backports of the patches, to avoid confusing appearance of user rights): https://wikitech.wikimedia.org/wiki/Deployments#deploycal-item-20260511T1300

Change #1285460 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@wmf/1.47.0-wmf.1] Prevent username registration if the username previously existed

https://gerrit.wikimedia.org/r/1285460

Change #1285461 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@wmf/1.47.0-wmf.1] Prevent username registration if the username previously existed (v2)

https://gerrit.wikimedia.org/r/1285461

Change #1285460 merged by jenkins-bot:

[mediawiki/core@wmf/1.47.0-wmf.1] Prevent username registration if the username previously existed

https://gerrit.wikimedia.org/r/1285460

Change #1285461 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.47.0-wmf.1] Prevent username registration if the username previously existed (v2)

https://gerrit.wikimedia.org/r/1285461

Mentioned in SAL (#wikimedia-operations) [2026-05-11T13:38:44Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1285460|Prevent username registration if the username previously existed (T196386)]], [[gerrit:1285461|Prevent username registration if the username previously existed (v2) (T196386)]], [[gerrit:1285462|API: Introduce list=globalusers (T261752)]], [[gerrit:1285761|list=globalusers: Avoid querying group permissions with empty group list (T

Mentioned in SAL (#wikimedia-operations) [2026-05-11T14:04:32Z] <lucaswerkmeister-wmde@deploy1003> matmarex, lucaswerkmeister-wmde: Backport for [[gerrit:1285460|Prevent username registration if the username previously existed (T196386)]], [[gerrit:1285461|Prevent username registration if the username previously existed (v2) (T196386)]], [[gerrit:1285462|API: Introduce list=globalusers (T261752)]], [[gerrit:1285761|list=globalusers: Avoid querying group permissions with empty group

Mentioned in SAL (#wikimedia-operations) [2026-05-11T14:18:07Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1285460|Prevent username registration if the username previously existed (T196386)]], [[gerrit:1285461|Prevent username registration if the username previously existed (v2) (T196386)]], [[gerrit:1285462|API: Introduce list=globalusers (T261752)]], [[gerrit:1285761|list=globalusers: Avoid querying group permissions with empty group list (

Change #1285448 merged by jenkins-bot:

[operations/mediawiki-config@master] Grant 'createpreviouslyrenamedaccount' to account creators and sysop-likes

https://gerrit.wikimedia.org/r/1285448

Mentioned in SAL (#wikimedia-operations) [2026-05-11T14:20:38Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1285448|Grant 'createpreviouslyrenamedaccount' to account creators and sysop-likes (T196386)]], [[gerrit:1278704|WikiLambdaApi: update stream configuration (T415254)]], [[gerrit:1285352|WikiLambdaApi instrument: Sets the custom schemaID (T415254)]], [[gerrit:1285406|editSaves: getExperiment returns a promise now (T425785)]]

Mentioned in SAL (#wikimedia-operations) [2026-05-11T14:26:18Z] <lucaswerkmeister-wmde@deploy1003> lucaswerkmeister-wmde, jforrester, matmarex, sfaci: Backport for [[gerrit:1285448|Grant 'createpreviouslyrenamedaccount' to account creators and sysop-likes (T196386)]], [[gerrit:1278704|WikiLambdaApi: update stream configuration (T415254)]], [[gerrit:1285352|WikiLambdaApi instrument: Sets the custom schemaID (T415254)]], [[gerrit:1285406|editSaves: getExperiment returns a promise now

Mentioned in SAL (#wikimedia-operations) [2026-05-11T14:39:28Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1285448|Grant 'createpreviouslyrenamedaccount' to account creators and sysop-likes (T196386)]], [[gerrit:1278704|WikiLambdaApi: update stream configuration (T415254)]], [[gerrit:1285352|WikiLambdaApi instrument: Sets the custom schemaID (T415254)]], [[gerrit:1285406|editSaves: getExperiment returns a promise now (T425785)]] (duration: 18

Updated global groups too: https://meta.wikimedia.org/wiki/Special:Log?type=gblrights&user=Bartosz+Dziewoński+(WMF)&wpdate=2026-05-11&subtype=groupprms&limit=3

@matmarex I will skip this then. Thanks for explaining!

Change #1285444 merged by jenkins-bot:

[mediawiki/core@master] RenameUser: Treat "previously-renamed-account" as a warning, not error

https://gerrit.wikimedia.org/r/1285444

Change #1285445 merged by jenkins-bot:

[mediawiki/core@master] Add release note about account creation with renamed usernames

https://gerrit.wikimedia.org/r/1285445