This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+5 more
ReleasePort's take
Light signalThe `dos-eol` flag is deprecated; use the new `dos_eol` parameter instead. The CAPTCHA protocol has been upgraded to v3 using Argon2id proof‑of‑work, and `set_language_team` now requires a file parameter via `po_set_language_team`. Additionally, Weblate adopts calendar versioning for releases.
Why it matters: Deprecating `dos-eol` triggers migration before next release; CAPTCHA v3 raises security posture with Argon2id; function signature change for language‑team assignment requires code update; calendar versioning alters upgrade planning cadence.
Summary
AI summaryRemoved dos-eol flag, replaced registration CAPTCHA protocol, and changed project attribute set_language_team.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Hardened search previews and machine translation suggestions against XSS Hardened search previews and machine translation suggestions against XSS Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Security | Medium |
Screenshot uploads HTML extraction URL checks reject internal targets Screenshot uploads HTML extraction URL checks reject internal targets Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Security | Medium |
Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and health‑check redirects now reject internal or non‑public targets by default Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and health‑check redirects now reject internal or non‑public targets by default Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Breaking | Medium |
ALTCHA_MAX_NUMBER replaced with COST MEMORY_COST PARALLELISM settings ALTCHA_MAX_NUMBER replaced with COST MEMORY_COST PARALLELISM settings Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
set_language_team replaced with po_set_language_team file parameter set_language_team replaced with po_set_language_team file parameter Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
dos-eol flag deprecated use dos_eol parameter instead dos-eol flag deprecated use dos_eol parameter instead Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
Weblate uses calendar versioning for releases Weblate uses calendar versioning for releases Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
Upgrades only supported from current or previous calendar year Upgrades only supported from current or previous calendar year Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Breaking | Medium |
ALTCHA widget v3 protocol Argon2id proof-of-work ALTCHA widget v3 protocol Argon2id proof-of-work Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Translation memory lookup skips fuzzy matching option Translation memory lookup skips fuzzy matching option Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
MDX file format support preserves JSX in translations MDX file format support preserves JSX in translations Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Extended LLM context covers explanations plurals failing checks Extended LLM context covers explanations plurals failing checks Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
DOS line endings configurable via dos_eol parameter DOS line endings configurable via dos_eol parameter Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
CSV XLSX downloads export plurals as separate rows CSV XLSX downloads export plurals as separate rows Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Translation files CDN addon publishes translations Translation files CDN addon publishes translations Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Backup management command runs services synchronously Backup management command runs services synchronously Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Engage page highlights actionable translation tasks newcomers Engage page highlights actionable translation tasks newcomers Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Low |
Digest‑only translation activity summary notification added Digest‑only translation activity summary notification added Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Gettext PO/POT file format parameters control Language‑Team, Last‑Translator, X‑Generator, and Report‑Msgid‑Bugs‑To headers Gettext PO/POT file format parameters control Language‑Team, Last‑Translator, X‑Generator, and Report‑Msgid‑Bugs‑To headers Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Translation memory lookup API can skip fuzzy matches via `exact` query parameter Translation memory lookup API can skip fuzzy matches via `exact` query parameter Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Dependency | Medium |
Stricter dependency version constraints control runtime environment Stricter dependency version constraints control runtime environment Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Gerrit pushes reject branches containing options track targets Gerrit pushes reject branches containing options track targets Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Category announcements scope fixed no project-wide display Category announcements scope fixed no project-wide display Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Category repository paths safety improved cleanup moves Category repository paths safety improved cleanup moves Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Plural counts bounded plural formulas validated to range Plural counts bounded plural formulas validated to range Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Malformed ALTCHA submissions repository URLs no longer cause errors Malformed ALTCHA submissions repository URLs no longer cause errors Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Project backup imports run in background avoid memory limits Project backup imports run in background avoid memory limits Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Per-project tokens expiring today valid until end day Per-project tokens expiring today valid until end day Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Merge pushes refresh stale fork remotes after hosting change Merge pushes refresh stale fork remotes after hosting change Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Low |
Gerrit review pushes track target branch before invoking `git-review` and suggest short names for full refs supplied Gerrit review pushes track target branch before invoking `git-review` and suggest short names for full refs supplied Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Category announcements now respect language‑scoped permissions and no longer appear project‑wide Category announcements now respect language‑scoped permissions and no longer appear project‑wide Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Other | Medium |
OpenAI Alibaba no longer require vendor Python SDKs OpenAI Alibaba no longer require vendor Python SDKs Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Other | Medium |
Cache directory execution capability validation check Cache directory execution capability validation check Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Other | Medium |
Setting changes audit trail recorded in history Setting changes audit trail recorded in history Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
Released on May 15th 2026.
New features
-
Added MDX files support for translating Markdown text while preserving JSX syntax, with File format parameters shared with Markdown files for line wrapping, code blocks, front matter, and placeholder handling.
-
Added extended LLM translation context for automatic suggestions, covering string context, explanations, secondary-language translations, plurals, failing checks, and placeholders.
-
Added a digest-only translation activity summary notification, see Notifications.
-
CSV and XLSX downloads in Downloading translations now export plural strings as separate plural-form rows that can be imported back.
-
Added Gettext PO and POT File format parameters to control whether Weblate updates the
Language-Team,Last-Translator,X-Generator, andReport-Msgid-Bugs-Toheaders. -
Added a backup to run configured backup services synchronously.
-
The translation memory lookup API can now skip fuzzy matching with the
exactquery parameter. -
Added Translation files CDN to publish translation files to the configured CDN.
Improvements
-
Using DOS line endings can now be configured using the
dos_eolFile format parameters. -
OpenAI and Alibaba no longer require their vendor Python SDKs.
-
Audited project and component setting changes are now recorded in history.
-
Gerrit review pushes now use Push branch as the target branch.
-
Weblate now checks whether
CACHE_DIRallows executing generated helper files. -
The Software Bill of Material is now generated during release and published as a versioned release asset instead of being stored in the source repository.
-
The translating page now separates screenshots from string information, collapses rarely used string details, and groups glossary and screenshot actions more consistently.
-
Project access management now paginates users and better explains site-wide automatic team assignments.
-
Added provider-oriented code hosting documentation and Gettext-style Plural formula guidance.
-
The Python wheel no longer ships source translation catalogs, test files, or deployment example files, reducing the installed package size.
-
The engage page now highlights actionable translation task buckets for newcomers.
-
RSS feeds can now use the same filters as the changes browsing page.
-
Update gettext template (Django) now supports gettext PO files used as templates when they are excluded by the language filter.
-
Reworked Weblate threat model into a contract-style document.
Bug fixes
-
Hardened search previews and Automatic suggestions suggestion origins against XSS, and stopped exposing database error details in upload failures.
-
Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and URL health-check redirects now reject internal or non-public targets by default.
-
Gerrit review pushes now reject target branches containing push options, track the target branch before invoking
git-review, and suggest short branch names when full refs are supplied. -
Category Announcements no longer appear across the whole project, and translation announcement deletion now honors language-scoped permissions.
-
Merge request pushes now refresh stale fork remotes after changing repository hosting.
-
Plural counts parsed from translation file headers are now bounded, and plural formulas are rejected when they can evaluate outside the configured plural form range.
-
Per-project access tokens expiring today now remain valid until the end of the day.
-
Malformed ALTCHA CAPTCHA submissions and repository URLs in webhook payloads no longer cause server errors.
-
Placeholders now merges overlapping non-nested spans from multiple flags.
-
Backing up and moving Weblate logs no longer include OpenSSH post-quantum key exchange warnings from remote Borg connections.
-
Category repository paths are now handled more safely during cleanup and moves.
-
Locked component pages now show an unsubscribe action after subscribing to unlock notifications.
-
Project level backups imports now restore in the background to avoid web worker memory limits.
Compatibility
-
The
dos-eolflag is no longer supported. Use thedos_eolFile format parameters instead. -
The registration CAPTCHA now uses the ALTCHA widget v3 protocol with Argon2id proof-of-work.
-
The
set_language_teamproject attribute has been replaced with thepo_set_language_teamfile format parameter at the component level; see File format parameters. -
Weblate now uses calendar versioning for releases, see Release cycle.
-
Weblate now uses stricter dependency version constraints to better control runtime environment.
Upgrading
Please follow Generic upgrade instructions in order to perform update.
-
The
ALTCHA_MAX_NUMBERsetting has been replaced byALTCHA_COST,ALTCHA_MEMORY_COST, andALTCHA_PARALLELISM; please adjust your settings accordingly. -
The upgrading policy was changed, and upgrades are only supported from the current or previous calendar year.
-
The
COMMENT_CLEANUP_DAYSandSUGGESTION_CLEANUP_DAYSsettings are migrated once to site-wide Stale comment removal and Stale suggestion removal add-ons; configure those add-ons instead.
Contributors
Code contributions
Michal Čihař, Karen Konou, AliceVisek, Gersona, Weblate CI
Translations contributions
이정희, Andrei Stepanov, Milo Ivir, ssantos, 大王叫我来巡山, Kaya Zeren, reducedradius, Peter Vančo, amano, Michal Čihař, Anucha Hlownonkor, Yaron Shahrabani, UDP, Максим Горпиніч, Agnieszka C, VfBFan, Blueberry, ojppe, Francisco Serrador, Aindriú Mac Giolla Eoin, Fjuro, Любомир Василев, Frank Paul Silye, Temuri Doghonadze, Yuri Chornoivan, Sergio Granadoz, Sketch6580, Hyeonjeong Lee, 為什麼不加空格, ℂ𝕠𝕠𝕠𝕝 (𝕘𝕚𝕥𝕙𝕦𝕓.𝕔𝕠𝕞/ℂ𝕠𝕠𝕠𝕝), justcontributor, Kristijan "Fremen" Velkovski, Pierfrancesco Passerini, Besnik Bleta, Arif Budiman, Andi Chandler, jernejp21, Manuela Silva, Sjur N Moshagen, Abduqadir Abliz, Laitei, Кирилл Ванин, Matthaiks, Nozomu Matsui, Dick Groskamp, MrZwave, hoanghuy309, Jim Spentzos, Adam Havránek, Ricky Tigg, Christian Wia, ButterflyOfFire
Documentation contributions
Michal Čihař, Gersona, Karen Konou, AliceVisek
Breaking Changes
- Removed `dos-eol` flag; use `dos_eol` File format parameters instead.
- Registration CAPTCHA now uses ALTCHA widget v3 protocol with Argon2id proof-of-work.
- Replaced project attribute `set_language_team` with component-level file format parameter `po_set_language_team`.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- vweblate-2026.6 'weblate.workspaces' must be added to INSTALLED_APPS during upgrade.
Beta — feedback welcome: [email protected]