Weblate - Package Updates

[Package Updates]

[1.40.0]

• Upgrade git to latest version

[Package Updates]

[1.41.0]

• Update weblate to 5.17.1
• Full Changelog
• Image URLs in Markdown are now escaped before rendering (GHSA-5cmv-3rc4-7279).
• Tightened Weblate's REST API input validation to prevent translation enumeration (GHSA-gcg5-86jr-f7jg).
• Project backup imports now revalidate component repository URLs before restoring from backup (CVE 2026-41654 / GHSA-cwcx-382v-8m9g).
• Add-ons that opt in to manual triggering can now be run from add-on management and the Add-ons.
• Admins can now clean up blocked or abusive users by reverting edits, rejecting pending suggestions, and deleting comments across project or site-wide scopes.
• Admin user management can now find users by audit log IP address.
• Added LTEngine machine translation service.
• Password changes now regenerate personal API keys by default (CVE 2026-41519 / GHSA-6j8j-4qp3-36p2).
• VCS_RESTRICT_PRIVATE and WEBHOOK_RESTRICT_PRIVATE now reject URLs whose hostnames cannot be resolved during validation unless the host is explicitly allowed.
• Uploads now enforce TRANSLATION_UPLOAD_MAX_SIZE, COMPONENT_ZIP_UPLOAD_MAX_SIZE, and PROJECT_BACKUP_UPLOAD_MAX_SIZE before parsing. Component ZIP imports and project backup restores now share stricter ZIP archive safety checks, including total uncompressed data limits for project backup imports.

[Package Updates]

[1.41.1]

• Do not re-create admin, if admin was deleted

[Package Updates]

[1.42.0]

• Update weblate to 2026.5
• Full Changelog
• Added MDX files support for translating Markdown text while preserving JSX syntax, with File format parameters shared with Markdown files for line wrapping, code blocks, front matter, and placeholder handling.
• Added extended LLM translation context for automatic suggestions, covering string context, explanations, secondary-language translations, plurals, failing checks, and placeholders.
• CSV and XLSX downloads in Downloading translations now export plural strings as separate plural-form rows that can be imported back.
• Hardened search previews and Automatic suggestions suggestion origins against XSS, and stopped exposing database error details in upload failures.
• Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and URL health-check redirects now reject internal or non-public targets by default.
• Per-project access tokens expiring today now remain valid until the end of the day.
• The dos-eol flag is no longer supported. Use the dos_eol File format parameters instead.
• The set_language_team project attribute has been replaced with the po_set_language_team file format parameter at the component level; see File format parameters.
• Weblate now uses calendar versioning for releases, see Release cycle.
• The upgrading policy was changed, and upgrades are only supported from the current or previous calendar year.

[Package Updates]

[1.43.0]

• Update weblate to 2026.6
• Full Changelog
• Announcements can now also be managed via the Weblate's REST API for specific project languages.
• Team memberships can now be limited to selected languages for per-user translation permissions.
• Added cost estimates to translation reports.
• Added Workspaces to group related projects, with workspace project listings, workspace-scoped teams and project creation permissions, inherited workspace, project, and category defaults for selected component settings, and billing details when available.
• Outbound URL validation now rejects additional non-public targets (GHSA-vmfc-9982-2m45).
• Project-language Announcements no longer appear across the whole project.
• Gitea and Forgejo pull requests no longer reconfigure existing fork remotes to point to the source repository.
• Gettext POT update add-ons now rescan translations after committing updated POT and PO files.
• Git repositories now update branches correctly when the remote also has a tag with the same name.
• There is a change in INSTALLED_APPS; weblate.workspaces should be added.

[Package Updates]

[1.44.0]

• Update weblate to 2026.6.1
• Full Changelog
• Language-wide Announcements no longer break language overview pages.

[Package Updates]

[1.45.0]

• Update weblate to 2026.7
• Full Changelog
• Added Safe MDX, Source string length, and Accelerator key quality checks for MDX files JSX expressions, source length limits, and accelerator key consistency.
• Added Mistral machinery integration for Mistral LLM automatic suggestions.
• Project level backups backups can now be created and downloaded via the Weblate's REST API.
• Added an option to capitalize the text in status badge widgets.
• Regular expression and Placeholders now enforce regular expression timeouts when evaluating source-string flags (GHSA-r52j-4vjp-q949).
• Restricted component changes are no longer exposed through nested project, component, or translation API change endpoints (GHSA-92m8-wv36-prmx).
• ZIP downloads, including App store metadata files translation bundles, no longer follow child symbolic links outside the downloaded tree (GHSA-xwj4-fp82-r2rj).
• Teams enforcing two-factor authentication now also withhold site-wide permissions from human members without 2FA configured (GHSA-x86c-ff69-cr2m).
• DeepL now handles DeepL API versions internally, uses v3 for glossary management and language discovery, and no longer supports DeepL API v1.
• Fedora Messaging topics now include category path segments, and broker settings are stored as an AMQP URL with existing host and SSL settings migrated automatically.

[Package Updates]

[1.46.0]

• Update weblate to 2026.7.1
• Full Changelog
• Added INTERNAL_BOT_EMAIL_TEMPLATE to customize internal bot e-mail addresses.
• Filtered translation and zen navigation now reuse a stable session result list, keeping positions and counts stable after translated strings leave the filter.
• Component priority icons are no longer shown on translation listings.
• Punctuation spacing no longer flags Markdown image markers as French punctuation and now shows which punctuation marks triggered the check.
• Fedora Messaging received several reliability fixes.
• Anonymous user permission caches are now isolated between requests.
• Accepting a project invitation now automatically adds the project to the user's watched projects.
• Dismissing a failing check no longer shows a JSON parsing error in the translation editor.
• Anonymous and internal bot accounts can no longer be edited through generic user management.
• Azure AI Translator settings now reject malformed region names before validating service connectivity.

[Package Updates]

[1.47.0]

• Update weblate to 2026.8
• Full Changelog
• Added a Show all columns in lists using horizontal scrolling preference to keep all listing columns visible on narrow screens instead of hiding them.
• Workspaces now provide aggregate translation statistics and historical metrics, a permission-filtered My workspaces list, archive downloads, search and replace, upload guidance, workspace translation memory management, and removal of empty workspaces not associated with billing.
• Added project-level translation metrics in JSON, CSV, and OpenMetrics formats.
• Added API endpoints for listing, adding, accepting, rejecting, and voting on translation suggestions.
• Disabling password authentication from site-wide user management now regenerates the user's personal API key by default.
• Protected outbound HTTP and Git connections now bind to validated public addresses; protected Git operations fail closed when clients cannot enforce that binding (GHSA-45m9-pf98-8jmq).
• Self-service REST API e-mail changes are now restricted to verified addresses (GHSA-x84p-6892-473c).
• Project backup imports now validate restored data before creating project state, skip repository-linked components the importer cannot access, and no longer load archive-supplied Mercurial configuration or shared-repository indirection (GHSA-f66g-8pcg-jm8r, GHSA-327h-qqgm-qv55).
• django-compressor is no longer used, and the COMPRESS_* settings have been removed.
• The top-level languages field on user REST API responses has been removed; use profile.languages instead. See User profile.

[Package Updates]

[1.48.0]

• Update weblate to 2026.8.1
• Full Changelog
• Project and component APIs now expose all user-configurable settings, including access control and translation-memory settings. See Weblate's REST API.
• Added the metrics command for retrieving server metrics locally in JSON, CSV, or OpenMetrics format.
• Task progress now requires authentication and works for aggregate automatic translation operations.
• Component creation through the REST API now returns the background task URL in the response when creation work is queued.
• Large language model machine translation services no longer fail when the optional persona and style settings are absent from the stored configuration, as happens when the service is installed through the REST API.
• import_json now preserves the component source language for newly imported components from JSON exports.
• Repository actions now require permission on every component sharing the affected repository, including linked components in other projects.
• Legal document confirmation now explicitly covers the linked privacy policy. See Legal module.
• Add-on change history now retains only explicitly public configuration values and marks changed credential fields as redacted.
• Translator work reports with metrics can now be displayed and downloaded as HTML.