Weblate - Package Updates

[Package Updates]

[1.42.0]

• Update weblate to 2026.5
• Full Changelog
• Added MDX files support for translating Markdown text while preserving JSX syntax, with File format parameters shared with Markdown files for line wrapping, code blocks, front matter, and placeholder handling.
• Added extended LLM translation context for automatic suggestions, covering string context, explanations, secondary-language translations, plurals, failing checks, and placeholders.
• CSV and XLSX downloads in Downloading translations now export plural strings as separate plural-form rows that can be imported back.
• Hardened search previews and Automatic suggestions suggestion origins against XSS, and stopped exposing database error details in upload failures.
• Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and URL health-check redirects now reject internal or non-public targets by default.
• Per-project access tokens expiring today now remain valid until the end of the day.
• The dos-eol flag is no longer supported. Use the dos_eol File format parameters instead.
• The set_language_team project attribute has been replaced with the po_set_language_team file format parameter at the component level; see File format parameters.
• Weblate now uses calendar versioning for releases, see Release cycle.
• The upgrading policy was changed, and upgrades are only supported from the current or previous calendar year.

[Package Updates]

[1.43.0]

• Update weblate to 2026.6
• Full Changelog
• Announcements can now also be managed via the Weblate's REST API for specific project languages.
• Team memberships can now be limited to selected languages for per-user translation permissions.
• Added cost estimates to translation reports.
• Added Workspaces to group related projects, with workspace project listings, workspace-scoped teams and project creation permissions, inherited workspace, project, and category defaults for selected component settings, and billing details when available.
• Outbound URL validation now rejects additional non-public targets (GHSA-vmfc-9982-2m45).
• Project-language Announcements no longer appear across the whole project.
• Gitea and Forgejo pull requests no longer reconfigure existing fork remotes to point to the source repository.
• Gettext POT update add-ons now rescan translations after committing updated POT and PO files.
• Git repositories now update branches correctly when the remote also has a tag with the same name.
• There is a change in INSTALLED_APPS; weblate.workspaces should be added.

[Package Updates]

[1.44.0]

• Update weblate to 2026.6.1
• Full Changelog
• Language-wide Announcements no longer break language overview pages.

[Package Updates]

[1.45.0]

• Update weblate to 2026.7
• Full Changelog
• Added Safe MDX, Source string length, and Accelerator key quality checks for MDX files JSX expressions, source length limits, and accelerator key consistency.
• Added Mistral machinery integration for Mistral LLM automatic suggestions.
• Project level backups backups can now be created and downloaded via the Weblate's REST API.
• Added an option to capitalize the text in status badge widgets.
• Regular expression and Placeholders now enforce regular expression timeouts when evaluating source-string flags (GHSA-r52j-4vjp-q949).
• Restricted component changes are no longer exposed through nested project, component, or translation API change endpoints (GHSA-92m8-wv36-prmx).
• ZIP downloads, including App store metadata files translation bundles, no longer follow child symbolic links outside the downloaded tree (GHSA-xwj4-fp82-r2rj).
• Teams enforcing two-factor authentication now also withhold site-wide permissions from human members without 2FA configured (GHSA-x86c-ff69-cr2m).
• DeepL now handles DeepL API versions internally, uses v3 for glossary management and language discovery, and no longer supports DeepL API v1.
• Fedora Messaging topics now include category path segments, and broker settings are stored as an AMQP URL with existing host and SSL settings migrated automatically.

[Package Updates]

[1.46.0]

• Update weblate to 2026.7.1
• Full Changelog
• Added INTERNAL_BOT_EMAIL_TEMPLATE to customize internal bot e-mail addresses.
• Filtered translation and zen navigation now reuse a stable session result list, keeping positions and counts stable after translated strings leave the filter.
• Component priority icons are no longer shown on translation listings.
• Punctuation spacing no longer flags Markdown image markers as French punctuation and now shows which punctuation marks triggered the check.
• Fedora Messaging received several reliability fixes.
• Anonymous user permission caches are now isolated between requests.
• Accepting a project invitation now automatically adds the project to the user's watched projects.
• Dismissing a failing check no longer shows a JSON parsing error in the translation editor.
• Anonymous and internal bot accounts can no longer be edited through generic user management.
• Azure AI Translator settings now reject malformed region names before validating service connectivity.

[Package Updates]

[1.47.0]

• Update weblate to 2026.8
• Full Changelog
• Added a Show all columns in lists using horizontal scrolling preference to keep all listing columns visible on narrow screens instead of hiding them.
• Workspaces now provide aggregate translation statistics and historical metrics, a permission-filtered My workspaces list, archive downloads, search and replace, upload guidance, workspace translation memory management, and removal of empty workspaces not associated with billing.
• Added project-level translation metrics in JSON, CSV, and OpenMetrics formats.
• Added API endpoints for listing, adding, accepting, rejecting, and voting on translation suggestions.
• Disabling password authentication from site-wide user management now regenerates the user's personal API key by default.
• Protected outbound HTTP and Git connections now bind to validated public addresses; protected Git operations fail closed when clients cannot enforce that binding (GHSA-45m9-pf98-8jmq).
• Self-service REST API e-mail changes are now restricted to verified addresses (GHSA-x84p-6892-473c).
• Project backup imports now validate restored data before creating project state, skip repository-linked components the importer cannot access, and no longer load archive-supplied Mercurial configuration or shared-repository indirection (GHSA-f66g-8pcg-jm8r, GHSA-327h-qqgm-qv55).
• django-compressor is no longer used, and the COMPRESS_* settings have been removed.
• The top-level languages field on user REST API responses has been removed; use profile.languages instead. See User profile.

[Package Updates]

[1.48.0]

• Update weblate to 2026.8.1
• Full Changelog
• Project and component APIs now expose all user-configurable settings, including access control and translation-memory settings. See Weblate's REST API.
• Added the metrics command for retrieving server metrics locally in JSON, CSV, or OpenMetrics format.
• Task progress now requires authentication and works for aggregate automatic translation operations.
• Component creation through the REST API now returns the background task URL in the response when creation work is queued.
• Large language model machine translation services no longer fail when the optional persona and style settings are absent from the stored configuration, as happens when the service is installed through the REST API.
• import_json now preserves the component source language for newly imported components from JSON exports.
• Repository actions now require permission on every component sharing the affected repository, including linked components in other projects.
• Legal document confirmation now explicitly covers the linked privacy policy. See Legal module.
• Add-on change history now retains only explicitly public configuration values and marks changed credential fields as redacted.
• Translator work reports with metrics can now be displayed and downloaded as HTML.

[Package Updates]

[1.49.0]

• Update weblate to 2026.9
• Full Changelog
• Repository maintenance actions now run as background tasks, avoiding request and proxy timeouts.
• Component discovery can optionally create components from a monolingual base or new base file when no translation files exist yet.
• Added Version control parameters to configure repository behavior per component, including force pushing, opting out of pull requests, and GitHub pull request automerge.
• Component discovery now limits repository paths and file-mask comparisons to prevent excessive resource consumption from specially crafted repositories.
• Webhook target matching no longer falls back to host/path suffix matching. Component repository URLs must match a repository URL from the webhook payload. See Matching webhook targets.
• LLM-based machine translation services now report invalid provider responses more clearly, custom OpenAI and Mistral models no longer require a model-listing endpoint, and OpenAI automatic selection supports API keys restricted to older GPT models.
• The json_sort_keys File format parameters is now a choice between none, case_sensitive, and case_insensitive instead of a boolean, including when reading or writing it through the component REST API; existing components are migrated automatically.
• The Git with force push version control system has been replaced by the git_force_push version control parameter; existing components are migrated automatically.
• The project deletion REST API endpoint now returns 202 Accepted instead of 204 No Content and contains a task URL in the response to track asynchronous deletion progress.
• Docker deployments need to configure trusted proxy addresses. Set WEBLATE_TRUSTED_PROXY_ADDRESSES to preserve client IP addresses in nginx logs and Weblate when WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR is used; otherwise, the immediate TCP peer is used.

[Package Updates]

[1.50.0]

• Update weblate to 2026.9.1
• Full Changelog
• Added per-user notification diagnostics for users and administrators, with compact explanations of matching subscriptions for object paths.
• Prevented repeated authenticator app registration from creating duplicate devices and allowing reuse of one-time codes. Existing equivalent duplicate devices are merged while preserving consumed codes.
• Engage pages and status widgets no longer disclose Private or Custom projects unless Public sharing is enabled.
• Fixed the approved-only commit policy blocking commits for languages with reviews disabled by workflow settings.
• Restored DeepL API v1 translation support while retaining modern API language discovery and glossary improvements.
• REST API unit updates now enforce the same translation text length limit as the web editor.
• Anonymous access to engage pages and status widgets is now disabled by default for Private and Custom projects. Enable Public sharing to preserve existing shared links after upgrading. Public and Protected projects are unchanged.
• Authenticator app registrations started before this upgrade must be restarted. Sessions referencing a removed duplicate device may require two-factor verification again.
• Docker deployments now default to the combined Celery worker mode. If your deployment relies on separate workers for each queue or configures them using CELERY_MAIN_OPTIONS, CELERY_NOTIFY_OPTIONS, CELERY_MEMORY_OPTIONS, CELERY_TRANSLATE_OPTIONS, or CELERY_BACKUP_OPTIONS, set CELERY_WORKER_MODE=split to preserve the previous behavior.
• All changes in detail.

[Package Updates]

[1.51.0]

• Update weblate to 2026.10
• Full Changelog
• Added enforced-check inheritance at workspace, project, category, and component level.
• Added the Automation add-on for conditional translation and editing workflows. See Automation reference and cookbook.
• Source strings and translation keys can now be edited in the editor and REST API while preserving translations and history.
• An explicit source-wide read-only flag now takes precedence over translation flags. Remove it from the source to allow editing.
• Existing project API tokens lose permissions inherited from non-project teams. Assign required permissions through project-specific teams.
• API throttles now use API_RATELIMIT_ANON and API_RATELIMIT_USER instead of REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"].
• API authentication now rejects unsupported authentication schemes, such as Basic, with HTTP 401, including when a valid browser session is present.
• Project backups now tolerate missing or damaged repositories and preserve available files and translation data during restore.
• Fixed false positives in the consecutive duplicated words check for South Asian languages and prevented the punctuation spacing check from inserting spaces in URLs.
• Fixed an upgrade failure when migrating dismissed component alerts from releases before 2026.8.