CVE-2025-67481 mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

[
  {
    "defaultStatus": "unaffected",
    "product": "MediaWiki",
    "programFiles": [
      "resources/src/mediawiki.jqueryMsg/mediawiki.jqueryMsg.js"
    ],
    "repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
    "vendor": "Wikimedia Foundation",
    "versions": [
      {
        "lessThan": "1.39.16, 1.43.6, 1.44.3, 1.45.1",
        "status": "affected",
        "version": "*",
        "versionType": "semver"
      }
    ]
  }
]