Weblate - Package Updates

[Package Updates]

[1.43.0]

• Update weblate to 2026.6
• Full Changelog
• Announcements can now also be managed via the Weblate's REST API for specific project languages.
• Team memberships can now be limited to selected languages for per-user translation permissions.
• Added cost estimates to translation reports.
• Added Workspaces to group related projects, with workspace project listings, workspace-scoped teams and project creation permissions, inherited workspace, project, and category defaults for selected component settings, and billing details when available.
• Outbound URL validation now rejects additional non-public targets (GHSA-vmfc-9982-2m45).
• Project-language Announcements no longer appear across the whole project.
• Gitea and Forgejo pull requests no longer reconfigure existing fork remotes to point to the source repository.
• Gettext POT update add-ons now rescan translations after committing updated POT and PO files.
• Git repositories now update branches correctly when the remote also has a tag with the same name.
• There is a change in INSTALLED_APPS; weblate.workspaces should be added.

[Package Updates]

[1.44.0]

• Update weblate to 2026.6.1
• Full Changelog
• Language-wide Announcements no longer break language overview pages.

[Package Updates]

[1.45.0]

• Update weblate to 2026.7
• Full Changelog
• Added Safe MDX, Source string length, and Accelerator key quality checks for MDX files JSX expressions, source length limits, and accelerator key consistency.
• Added Mistral machinery integration for Mistral LLM automatic suggestions.
• Project level backups backups can now be created and downloaded via the Weblate's REST API.
• Added an option to capitalize the text in status badge widgets.
• Regular expression and Placeholders now enforce regular expression timeouts when evaluating source-string flags (GHSA-r52j-4vjp-q949).
• Restricted component changes are no longer exposed through nested project, component, or translation API change endpoints (GHSA-92m8-wv36-prmx).
• ZIP downloads, including App store metadata files translation bundles, no longer follow child symbolic links outside the downloaded tree (GHSA-xwj4-fp82-r2rj).
• Teams enforcing two-factor authentication now also withhold site-wide permissions from human members without 2FA configured (GHSA-x86c-ff69-cr2m).
• DeepL now handles DeepL API versions internally, uses v3 for glossary management and language discovery, and no longer supports DeepL API v1.
• Fedora Messaging topics now include category path segments, and broker settings are stored as an AMQP URL with existing host and SSL settings migrated automatically.

[Package Updates]

[1.46.0]

• Update weblate to 2026.7.1
• Full Changelog
• Added INTERNAL_BOT_EMAIL_TEMPLATE to customize internal bot e-mail addresses.
• Filtered translation and zen navigation now reuse a stable session result list, keeping positions and counts stable after translated strings leave the filter.
• Component priority icons are no longer shown on translation listings.
• Punctuation spacing no longer flags Markdown image markers as French punctuation and now shows which punctuation marks triggered the check.
• Fedora Messaging received several reliability fixes.
• Anonymous user permission caches are now isolated between requests.
• Accepting a project invitation now automatically adds the project to the user's watched projects.
• Dismissing a failing check no longer shows a JSON parsing error in the translation editor.
• Anonymous and internal bot accounts can no longer be edited through generic user management.
• Azure AI Translator settings now reject malformed region names before validating service connectivity.

[Package Updates]

[1.47.0]

• Update weblate to 2026.8
• Full Changelog
• Added a Show all columns in lists using horizontal scrolling preference to keep all listing columns visible on narrow screens instead of hiding them.
• Workspaces now provide aggregate translation statistics and historical metrics, a permission-filtered My workspaces list, archive downloads, search and replace, upload guidance, workspace translation memory management, and removal of empty workspaces not associated with billing.
• Added project-level translation metrics in JSON, CSV, and OpenMetrics formats.
• Added API endpoints for listing, adding, accepting, rejecting, and voting on translation suggestions.
• Disabling password authentication from site-wide user management now regenerates the user's personal API key by default.
• Protected outbound HTTP and Git connections now bind to validated public addresses; protected Git operations fail closed when clients cannot enforce that binding (GHSA-45m9-pf98-8jmq).
• Self-service REST API e-mail changes are now restricted to verified addresses (GHSA-x84p-6892-473c).
• Project backup imports now validate restored data before creating project state, skip repository-linked components the importer cannot access, and no longer load archive-supplied Mercurial configuration or shared-repository indirection (GHSA-f66g-8pcg-jm8r, GHSA-327h-qqgm-qv55).
• django-compressor is no longer used, and the COMPRESS_* settings have been removed.
• The top-level languages field on user REST API responses has been removed; use profile.languages instead. See User profile.

[Package Updates]

[1.48.0]

• Update weblate to 2026.8.1
• Full Changelog
• Project and component APIs now expose all user-configurable settings, including access control and translation-memory settings. See Weblate's REST API.
• Added the metrics command for retrieving server metrics locally in JSON, CSV, or OpenMetrics format.
• Task progress now requires authentication and works for aggregate automatic translation operations.
• Component creation through the REST API now returns the background task URL in the response when creation work is queued.
• Large language model machine translation services no longer fail when the optional persona and style settings are absent from the stored configuration, as happens when the service is installed through the REST API.
• import_json now preserves the component source language for newly imported components from JSON exports.
• Repository actions now require permission on every component sharing the affected repository, including linked components in other projects.
• Legal document confirmation now explicitly covers the linked privacy policy. See Legal module.
• Add-on change history now retains only explicitly public configuration values and marks changed credential fields as redacted.
• Translator work reports with metrics can now be displayed and downloaded as HTML.

[Package Updates]

[1.49.0]

• Update weblate to 2026.9
• Full Changelog
• Repository maintenance actions now run as background tasks, avoiding request and proxy timeouts.
• Component discovery can optionally create components from a monolingual base or new base file when no translation files exist yet.
• Added Version control parameters to configure repository behavior per component, including force pushing, opting out of pull requests, and GitHub pull request automerge.
• Component discovery now limits repository paths and file-mask comparisons to prevent excessive resource consumption from specially crafted repositories.
• Webhook target matching no longer falls back to host/path suffix matching. Component repository URLs must match a repository URL from the webhook payload. See Matching webhook targets.
• LLM-based machine translation services now report invalid provider responses more clearly, custom OpenAI and Mistral models no longer require a model-listing endpoint, and OpenAI automatic selection supports API keys restricted to older GPT models.
• The json_sort_keys File format parameters is now a choice between none, case_sensitive, and case_insensitive instead of a boolean, including when reading or writing it through the component REST API; existing components are migrated automatically.
• The Git with force push version control system has been replaced by the git_force_push version control parameter; existing components are migrated automatically.
• The project deletion REST API endpoint now returns 202 Accepted instead of 204 No Content and contains a task URL in the response to track asynchronous deletion progress.
• Docker deployments need to configure trusted proxy addresses. Set WEBLATE_TRUSTED_PROXY_ADDRESSES to preserve client IP addresses in nginx logs and Weblate when WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR is used; otherwise, the immediate TCP peer is used.

[Package Updates]

[1.50.0]

• Update weblate to 2026.9.1
• Full Changelog
• Added per-user notification diagnostics for users and administrators, with compact explanations of matching subscriptions for object paths.
• Prevented repeated authenticator app registration from creating duplicate devices and allowing reuse of one-time codes. Existing equivalent duplicate devices are merged while preserving consumed codes.
• Engage pages and status widgets no longer disclose Private or Custom projects unless Public sharing is enabled.
• Fixed the approved-only commit policy blocking commits for languages with reviews disabled by workflow settings.
• Restored DeepL API v1 translation support while retaining modern API language discovery and glossary improvements.
• REST API unit updates now enforce the same translation text length limit as the web editor.
• Anonymous access to engage pages and status widgets is now disabled by default for Private and Custom projects. Enable Public sharing to preserve existing shared links after upgrading. Public and Protected projects are unchanged.
• Authenticator app registrations started before this upgrade must be restarted. Sessions referencing a removed duplicate device may require two-factor verification again.
• Docker deployments now default to the combined Celery worker mode. If your deployment relies on separate workers for each queue or configures them using CELERY_MAIN_OPTIONS, CELERY_NOTIFY_OPTIONS, CELERY_MEMORY_OPTIONS, CELERY_TRANSLATE_OPTIONS, or CELERY_BACKUP_OPTIONS, set CELERY_WORKER_MODE=split to preserve the previous behavior.
• All changes in detail.

[Package Updates]

[1.51.0]

• Update weblate to 2026.10
• Full Changelog
• Added enforced-check inheritance at workspace, project, category, and component level.
• Added the Automation add-on for conditional translation and editing workflows. See Automation reference and cookbook.
• Source strings and translation keys can now be edited in the editor and REST API while preserving translations and history.
• An explicit source-wide read-only flag now takes precedence over translation flags. Remove it from the source to allow editing.
• Existing project API tokens lose permissions inherited from non-project teams. Assign required permissions through project-specific teams.
• API throttles now use API_RATELIMIT_ANON and API_RATELIMIT_USER instead of REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"].
• API authentication now rejects unsupported authentication schemes, such as Basic, with HTTP 401, including when a valid browser session is present.
• Project backups now tolerate missing or damaged repositories and preserve available files and translation data during restore.
• Fixed false positives in the consecutive duplicated words check for South Asian languages and prevented the punctuation spacing check from inserting spaces in URLs.
• Fixed an upgrade failure when migrating dismissed component alerts from releases before 2026.8.

[Package Updates]

[1.52.0]

• Update weblate to 2026.10.1
• Full Changelog
• Added opt-in team synchronization from identity providers, including GitLab group mapping and group-based login restrictions.
• Added DEFAULT_NOTIFICATIONS to configure Notifications settings for new users.
• Added Push on update to push only after committing translations, not after upstream updates.
• Prevented project backup imports from granting site-wide permissions through restored project teams (GHSA-pgmx-p3h7-7q8x).
• Disallowed filesystem paths and the file scheme for version control repository URLs.
• Fixed Key filter for JSON and other formats supporting both monolingual and bilingual use.
• Fixed Project level backups restoration of translation file language aliases and duplicate team names, and improved validation error formatting.
• Components using the GitHub App now follow renamed or transferred repositories; existing Apps need to subscribe to the Repository event, see App webhook URL.
• The file scheme is disabled for security reasons and can no longer be included in VCS_ALLOW_SCHEMES. Weblate now fails to start until it is removed from the setting and existing components are migrated to supported repository URLs.

[Package Updates]

[1.53.0]

• Update python-base | final to 3.14-20261023
• security: fix eMudhra cert compromise