Noted. I also found this by @EMill-WMF just after creating this task.

Two questions:

1. How was this disabled? I don't see a corresponding change in https://phabricator.wikimedia.org/source/mediawiki-config/history/master/
2. Do such issues get communicated in some way so users become aware and not ask repetitive questions about it?

Not sure, but if it helps with bug fixing, for some reason Special:Version on en Wikipedia is now reporting version 2.22.0 of LilyPond, which does not support the SVG rendering with libcairo that the Score extension relies on. LilyPond should be version 2.24.0 or later with libcairo compiled in; see T385404 and T427820.

In T441579#12446243, @Jonathanischoice wrote:

Not sure, but if it helps with bug fixing, for some reason Special:Version on en Wikipedia is now reporting version 2.22.0 of LilyPond, which does not support the SVG rendering with libcairo that the Score extension relies on. LilyPond should be version 2.24.0 or later with libcairo compiled in; see T385404 and T427820.

That comes from:

if ( $wmgUseScore ) {
	wfLoadExtension( 'Score' );
	$wgScoreSafeMode = false;
	$wgScoreUseSvg = true;

	if ( $wmgUseScoreShellbox && $wmgLocalServices['shellbox'] ) {
		// Route score to the Shellbox named "shellbox".
		$wgShellboxUrls['score'] = $wmgLocalServices['shellbox'];
		// $wgShellboxSecretKey set in PrivateSettings.php
		$wgScoreImageMagickConvert = '/usr/bin/convert';
	} else {
		# Emergency mode in which Score is disabled
		$wgScoreLilyPond = '/dev/null';
		$wgScoreDisableExec = true;
		$wgScoreLilyPondFakeVersion = '2.2.0';
	}

}

in CommonSettings.php.

I assume somewhere in PrivateSettings.php wmgUseScoreShellbox is being set to false.

There's no bug in the Score codebase here AFAICS.

In T441579#12446233, @Huji wrote:

Noted. I also found this by @EMill-WMF just after creating this task.

Two questions:

1. How was this disabled? I don't see a corresponding change in https://phabricator.wikimedia.org/source/mediawiki-config/history/master/
2. Do such issues get communicated in some way so users become aware and not ask repetitive questions about it?

Based on the above, I believe the answer to #1 above is: the change was made in PrivateSettings.php which is not git-tracked (for obvious reasons).

I would still appreciate a response to #2 above.

the change was made in PrivateSettings.php which is not git-tracked

PrivateSettings.php uses a git repo, albeit a private one.

In T441579#12446230, @JJMC89 wrote:

It is intentionally disabled for security reasons, not a Regression.

Hi, could you please provide more information about the security issue, and point us at the related task (if public/possible). I'm a dev with Score codebase familiarity, and happy to help, but I'm not a WMF dev. For instance, if it's to do with Ghostscript or Imagemagick, I have a patch waiting for review on Gerrit that removes those as dependencies since they are no longer needed for SVG (and we don't need PNG fallback in 2026).

I cannot provide any details. The (private) security task is T441512.

In T441579#12469952, @Jonathanischoice wrote:

This is an URGENT PROBLEM and cannot lounge around for weeks or years like the Graph/Chart extension debacle, or the 13 YEARS it took to get SVG rendering working, only just deployed in July 2026, three years after I wrote the patch for it. PLEASE can this get some attention from the Reader Experience Team who are allegedly in charge of the codebase.

WMF has been working on it already, but reacting to PHP2Shell was prioritised last week for obvious reasons. I'm sure they'll pick up and finish the work on Score soon.

We need a quick solution.
If anyone make a little edit, Even if there are no musical notes in the chapter, all images from the score plugin disappear from the entire page. I haven't dared to make any corrections for quite some time. Continuing work on projects like "Children want to sing" is out of the question.
The graphics should be stored in a separate cache and only replaced when the source code is changed, similar to how it's done in Typo3.

Ok….. Everyone working in Internet security and running the servers, has had a REAL bad week with lots of overtime and next week isn’t looking much better (this should be clear to anyone keeping up with the news). Get some perspective and wait your turn, seriously…..

There is a suggestion to change the error message to link to more details, like this task or enwiki thread.

We (Product Safety and Integrity) are working on the private task mentioned above and hope to have an update soon. I appreciate your patience and am sorry I can’t provide more info right now.

@Princessp2008: Could you please not edit the direct quote in the task description? The quote is correct as is,