Weblate - Package Updates

[Package Updates]

[1.49.0]

• Update weblate to 2026.9
• Full Changelog
• Repository maintenance actions now run as background tasks, avoiding request and proxy timeouts.
• Component discovery can optionally create components from a monolingual base or new base file when no translation files exist yet.
• Added Version control parameters to configure repository behavior per component, including force pushing, opting out of pull requests, and GitHub pull request automerge.
• Component discovery now limits repository paths and file-mask comparisons to prevent excessive resource consumption from specially crafted repositories.
• Webhook target matching no longer falls back to host/path suffix matching. Component repository URLs must match a repository URL from the webhook payload. See Matching webhook targets.
• LLM-based machine translation services now report invalid provider responses more clearly, custom OpenAI and Mistral models no longer require a model-listing endpoint, and OpenAI automatic selection supports API keys restricted to older GPT models.
• The json_sort_keys File format parameters is now a choice between none, case_sensitive, and case_insensitive instead of a boolean, including when reading or writing it through the component REST API; existing components are migrated automatically.
• The Git with force push version control system has been replaced by the git_force_push version control parameter; existing components are migrated automatically.
• The project deletion REST API endpoint now returns 202 Accepted instead of 204 No Content and contains a task URL in the response to track asynchronous deletion progress.
• Docker deployments need to configure trusted proxy addresses. Set WEBLATE_TRUSTED_PROXY_ADDRESSES to preserve client IP addresses in nginx logs and Weblate when WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR is used; otherwise, the immediate TCP peer is used.

[Package Updates]

[1.50.0]

• Update weblate to 2026.9.1
• Full Changelog
• Added per-user notification diagnostics for users and administrators, with compact explanations of matching subscriptions for object paths.
• Prevented repeated authenticator app registration from creating duplicate devices and allowing reuse of one-time codes. Existing equivalent duplicate devices are merged while preserving consumed codes.
• Engage pages and status widgets no longer disclose Private or Custom projects unless Public sharing is enabled.
• Fixed the approved-only commit policy blocking commits for languages with reviews disabled by workflow settings.
• Restored DeepL API v1 translation support while retaining modern API language discovery and glossary improvements.
• REST API unit updates now enforce the same translation text length limit as the web editor.
• Anonymous access to engage pages and status widgets is now disabled by default for Private and Custom projects. Enable Public sharing to preserve existing shared links after upgrading. Public and Protected projects are unchanged.
• Authenticator app registrations started before this upgrade must be restarted. Sessions referencing a removed duplicate device may require two-factor verification again.
• Docker deployments now default to the combined Celery worker mode. If your deployment relies on separate workers for each queue or configures them using CELERY_MAIN_OPTIONS, CELERY_NOTIFY_OPTIONS, CELERY_MEMORY_OPTIONS, CELERY_TRANSLATE_OPTIONS, or CELERY_BACKUP_OPTIONS, set CELERY_WORKER_MODE=split to preserve the previous behavior.
• All changes in detail.

[Package Updates]

[1.51.0]

• Update weblate to 2026.10
• Full Changelog
• Added enforced-check inheritance at workspace, project, category, and component level.
• Added the Automation add-on for conditional translation and editing workflows. See Automation reference and cookbook.
• Source strings and translation keys can now be edited in the editor and REST API while preserving translations and history.
• An explicit source-wide read-only flag now takes precedence over translation flags. Remove it from the source to allow editing.
• Existing project API tokens lose permissions inherited from non-project teams. Assign required permissions through project-specific teams.
• API throttles now use API_RATELIMIT_ANON and API_RATELIMIT_USER instead of REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"].
• API authentication now rejects unsupported authentication schemes, such as Basic, with HTTP 401, including when a valid browser session is present.
• Project backups now tolerate missing or damaged repositories and preserve available files and translation data during restore.
• Fixed false positives in the consecutive duplicated words check for South Asian languages and prevented the punctuation spacing check from inserting spaces in URLs.
• Fixed an upgrade failure when migrating dismissed component alerts from releases before 2026.8.

[Package Updates]

[1.52.0]

• Update weblate to 2026.10.1
• Full Changelog
• Added opt-in team synchronization from identity providers, including GitLab group mapping and group-based login restrictions.
• Added DEFAULT_NOTIFICATIONS to configure Notifications settings for new users.
• Added Push on update to push only after committing translations, not after upstream updates.
• Prevented project backup imports from granting site-wide permissions through restored project teams (GHSA-pgmx-p3h7-7q8x).
• Disallowed filesystem paths and the file scheme for version control repository URLs.
• Fixed Key filter for JSON and other formats supporting both monolingual and bilingual use.
• Fixed Project level backups restoration of translation file language aliases and duplicate team names, and improved validation error formatting.
• Components using the GitHub App now follow renamed or transferred repositories; existing Apps need to subscribe to the Repository event, see App webhook URL.
• The file scheme is disabled for security reasons and can no longer be included in VCS_ALLOW_SCHEMES. Weblate now fails to start until it is removed from the setting and existing components are migrated to supported repository URLs.