5.0.3 and friends minor release, plus security advisories from 5.0.2

data/versions.json

@@ -79,7 +79,12 @@
                 {
                     "name": "5.0.3",
                     "releaseDate": "6 October 2025",
-                    "version": 2025041403,
+                    "version": 2025041403
+                },
+                {
+                    "name": "5.0.4",
+                    "releaseDate": "8 December 2025",
+                    "version": 2025041404,
                     "releaseNoteUrl": false
                 }
             ]
@@ -147,7 +152,12 @@
                 {
                     "name": "4.5.7",
                     "releaseDate": "6 October 2025",
-                    "version": 2024100707,
+                    "version": 2024100707
+                },
+                {
+                    "name": "4.5.8",
+                    "releaseDate": "8 December 2025",
+                    "version": 2024100708,
                     "releaseNoteUrl": false
                 }
             ]
@@ -220,7 +230,12 @@
                 {
                     "name": "4.4.11",
                     "releaseDate": "6 October 2025",
-                    "version": 2024042211,
+                    "version": 2024042211
+                },
+                {
+                    "name": "4.4.12",
+                    "releaseDate": "8 December 2025",
+                    "version": 2024042212,
                     "releaseNoteUrl": false
                 }
             ]
@@ -494,7 +509,12 @@
                 {
                     "name": "4.1.21",
                     "releaseDate": "6 October 2025",
-                    "version": 2022112821,
+                    "version": 2022112821
+                },
+                {
+                    "name": "4.1.22",
+                    "releaseDate": "8 December 2025",
+                    "version": 2022112822,
                     "releaseNoteUrl": false
                 }
             ]

general/releases.md

@@ -19,7 +19,7 @@ The most recent [long-term support release (LTS)](https://en.wikipedia.org/wiki/
 
 <SupportedReleases />
 
-![Release graph summarising the currently supported Moodle releases in a visual form](_releases/5002_release_graph.png)
+![Release graph summarising the currently supported Moodle releases in a visual form](_releases/5003_release_graph.png)
 
 <details>
     <summary>Release graph key</summary>

general/releases/4.1/4.1.20.md

@@ -20,5 +20,9 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-25-0037](https://moodle.org/mod/forum/discuss.php?d=469490) - Unnecessary CSRF token (sesskey) requirement in some LMS BigBlueButton playback functionality could leak user's sesskey to external BBB service
+- [MSA-25-0038](https://moodle.org/mod/forum/discuss.php?d=469491) - Course Logs report did not respect Separate Groups mode
+- [MSA-25-0039](https://moodle.org/mod/forum/discuss.php?d=469492) - Feedback activity results did not always respect Separate Groups mode
+- [MSA-25-0040](https://moodle.org/mod/forum/discuss.php?d=469493) - Capabilities and callback that control access to profiles not working in some web services
+<!-- cspell:enable -->

general/releases/4.1/4.1.21.md

@@ -0,0 +1,22 @@
+---
+title: Moodle 4.1.21
+tags:
+  - Release notes
+  - Moodle 4.1
+sidebar_position: 21
+moodleVersion: 4.1.21
+description: The release notes for Moodle version 4.1.21.
+---
+
+import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
+
+<ReleaseNoteIntro releaseName={frontMatter.moodleVersion} />
+
+## General fixes and improvements
+<!-- cspell:disable -->
+- [MDL-86495](https://tracker.moodle.org/browse/MDL-86495) - Improve error handling for geoPlugin API now the service is no longer available for free use
+<!-- cspell:enable -->
+
+## Security fixes
+
+A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.

general/releases/4.4/4.4.10.md

@@ -20,5 +20,9 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-25-0037](https://moodle.org/mod/forum/discuss.php?d=469490) - Unnecessary CSRF token (sesskey) requirement in some LMS BigBlueButton playback functionality could leak user's sesskey to external BBB service
+- [MSA-25-0038](https://moodle.org/mod/forum/discuss.php?d=469491) - Course Logs report did not respect Separate Groups mode
+- [MSA-25-0039](https://moodle.org/mod/forum/discuss.php?d=469492) - Feedback activity results did not always respect Separate Groups mode
+- [MSA-25-0040](https://moodle.org/mod/forum/discuss.php?d=469493) - Capabilities and callback that control access to profiles not working in some web services
+<!-- cspell:enable -->

general/releases/4.4/4.4.11.md

@@ -0,0 +1,22 @@
+---
+title: Moodle 4.4.11
+tags:
+  - Release notes
+  - Moodle 4.4
+sidebar_position: 11
+moodleVersion: 4.4.11
+description: The release notes for Moodle version 4.4.11.
+---
+
+import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
+
+<ReleaseNoteIntro releaseName={frontMatter.moodleVersion} />
+
+## General fixes and improvements
+<!-- cspell:disable -->
+- [MDL-86495](https://tracker.moodle.org/browse/MDL-86495) - Improve error handling for geoPlugin API now the service is no longer available for free use
+<!-- cspell:enable -->
+
+## Security fixes
+
+A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.

general/releases/4.5/4.5.6.md

@@ -83,5 +83,9 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-25-0037](https://moodle.org/mod/forum/discuss.php?d=469490) - Unnecessary CSRF token (sesskey) requirement in some LMS BigBlueButton playback functionality could leak user's sesskey to external BBB service
+- [MSA-25-0038](https://moodle.org/mod/forum/discuss.php?d=469491) - Course Logs report did not respect Separate Groups mode
+- [MSA-25-0039](https://moodle.org/mod/forum/discuss.php?d=469492) - Feedback activity results did not always respect Separate Groups mode
+- [MSA-25-0040](https://moodle.org/mod/forum/discuss.php?d=469493) - Capabilities and callback that control access to profiles not working in some web services
+<!-- cspell:enable -->

general/releases/4.5/4.5.7.md

@@ -0,0 +1,64 @@
+---
+title: Moodle 4.5.7
+tags:
+  - Release notes
+  - Moodle 4.5
+sidebar_position: 7
+moodleVersion: 4.5.7
+description: The release notes for Moodle version 4.5.7
+---
+
+import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
+
+<ReleaseNoteIntro releaseName={frontMatter.moodleVersion} />
+
+## General fixes and improvements
+<!-- cspell:disable -->
+- [MDL-58001](https://tracker.moodle.org/browse/MDL-58001) - Error uploading feedback file in assignment grader when grade type is set to "none"
+- [MDL-85546](https://tracker.moodle.org/browse/MDL-85546) - MFA should not be triggered when using "Log in as"
+- [MDL-84491](https://tracker.moodle.org/browse/MDL-84491) - Redis: session_set_save_handler should not be initialised every time
+- [MDL-85018](https://tracker.moodle.org/browse/MDL-85018) - Duplicate quiz containing a multianswer question gives dml_missing_record_exception
+- [MDL-83256](https://tracker.moodle.org/browse/MDL-83256) - When a teacher exports participants list, it doesn't include custom profile fields
+- [MDL-80447](https://tracker.moodle.org/browse/MDL-80447) - Use more restricted scope for Google OAuth app verification to comply with Google's access restriction requirements
+- [MDL-85166](https://tracker.moodle.org/browse/MDL-85166) - Question category move does not update questionscontextid in question_set_references, breaking backup/restore
+- [MDL-86495](https://tracker.moodle.org/browse/MDL-86495) - Improve error handling for geoPlugin API now the service is no longer available for free use
+- [MDL-73671](https://tracker.moodle.org/browse/MDL-73671) - Course Reset does not update the Forum "Due date" or "Cut-off date"
+- [MDL-83991](https://tracker.moodle.org/browse/MDL-83991) - Tag related SQL queries are running very slow due to large amount of data in tag_instance table
+- [MDL-85684](https://tracker.moodle.org/browse/MDL-85684) - Assignment notifications contain poorly formatted assignment/course names
+- [MDL-86330](https://tracker.moodle.org/browse/MDL-86330) - Courses appear in course overview block with a delay
+- [MDL-85229](https://tracker.moodle.org/browse/MDL-85229) - URL description still displaying when "Display URL description" is unchecked
+- [MDL-84815](https://tracker.moodle.org/browse/MDL-84815) - Checkboxes missing in add users to a group search options
+- [MDL-71786](https://tracker.moodle.org/browse/MDL-71786) - Course Reset does not update "Remind me to grade by" date on assignments
+- [MDL-86667](https://tracker.moodle.org/browse/MDL-86667) - Usability issues in the site registration form
+- [MDL-86294](https://tracker.moodle.org/browse/MDL-86294) - Document missing dboptions in config-dist.php
+- [MDL-85266](https://tracker.moodle.org/browse/MDL-85266) - Cannot remove bulk uploaded users from selected bulk user actions
+- [MDL-84739](https://tracker.moodle.org/browse/MDL-84739) - Rubric creation icons are over sized and affect the layout
+- [MDL-80611](https://tracker.moodle.org/browse/MDL-80611) - Help links get accidentally translated and become broken
+- [MDL-72956](https://tracker.moodle.org/browse/MDL-72956) - Multiple concurrent feedback submissions cause an error
+<!-- cspell:enable -->
+
+## Accessibility improvements
+<!-- cspell:disable -->
+- [MDL-81455](https://tracker.moodle.org/browse/MDL-81455) - Welcome message on login should not replace contents of page header
+- [MDL-72511](https://tracker.moodle.org/browse/MDL-72511) - Calendar arrows need aria-hidden="true"
+- [MDL-86599](https://tracker.moodle.org/browse/MDL-86599) - The Submission status/Feedback tables do not have a caption in Assignment
+- [MDL-86512](https://tracker.moodle.org/browse/MDL-86512) - Better convey the purpose of select checkboxes within the assignment submissions table
+- [MDL-86511](https://tracker.moodle.org/browse/MDL-86511) - TinyMCE fails to insert a hyperlink from the insert a link modal when keyboard used to enter the link
+- [MDL-86501](https://tracker.moodle.org/browse/MDL-86501) - ARIA label on icon element instead of anchor in date_time_selector
+- [MDL-86499](https://tracker.moodle.org/browse/MDL-86499) - Table sort icons should be decorative
+- [MDL-86498](https://tracker.moodle.org/browse/MDL-86498) - Empty links on the badge overview page
+- [MDL-86490](https://tracker.moodle.org/browse/MDL-86490) - The icon in the \core\output\core_renderer::action_icon() should be decorative
+- [MDL-86489](https://tracker.moodle.org/browse/MDL-86489) - The required icon on feedback questions should be marked as decorative
+- [MDL-86488](https://tracker.moodle.org/browse/MDL-86488) - Accessibility issues on the \core\output\action_menu component when rendered as a kebab menu button
+- [MDL-86479](https://tracker.moodle.org/browse/MDL-86479) - Accessibility issues on the course index options menu button
+- [MDL-86202](https://tracker.moodle.org/browse/MDL-86202) - Inconsistent heading hierarchy (H1, H3, H2) in Lesson
+<!-- cspell:enable -->
+
+## Security improvements
+<!-- cspell:disable -->
+- [MDL-84504](https://tracker.moodle.org/browse/MDL-84504) - Enabling maintenance mode via CLI is not recorded in the config log
+<!-- cspell:enable -->
+
+## Security fixes
+
+A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.

general/releases/5.0/5.0.2.md

@@ -99,5 +99,9 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-25-0037](https://moodle.org/mod/forum/discuss.php?d=469490) - Unnecessary CSRF token (sesskey) requirement in some LMS BigBlueButton playback functionality could leak user's sesskey to external BBB service
+- [MSA-25-0038](https://moodle.org/mod/forum/discuss.php?d=469491) - Course Logs report did not respect Separate Groups mode
+- [MSA-25-0039](https://moodle.org/mod/forum/discuss.php?d=469492) - Feedback activity results did not always respect Separate Groups mode
+- [MSA-25-0040](https://moodle.org/mod/forum/discuss.php?d=469493) - Capabilities and callback that control access to profiles not working in some web services
+<!-- cspell:enable -->