Skip to content

weblate

vweblate-2026.5 scope: weblate Breaking

This release includes 3 breaking changes for platform teams planning a safe upgrade.

Published 19d Documentation
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

continuous-localization crowdsourcing dcode-2025 django gettext i18n
+5 more
internationalization l10n localization python translation

ReleasePort's take

Light signal
editorial:auto 9d

The `dos-eol` flag is deprecated; use the new `dos_eol` parameter instead. The CAPTCHA protocol has been upgraded to v3 using Argon2id proof‑of‑work, and `set_language_team` now requires a file parameter via `po_set_language_team`. Additionally, Weblate adopts calendar versioning for releases.

Why it matters: Deprecating `dos-eol` triggers migration before next release; CAPTCHA v3 raises security posture with Argon2id; function signature change for language‑team assignment requires code update; calendar versioning alters upgrade planning cadence.

Summary

AI summary

Removed dos-eol flag, replaced registration CAPTCHA protocol, and changed project attribute set_language_team.

Changes in this release

Security Medium

Hardened search previews and machine translation suggestions against XSS

Hardened search previews and machine translation suggestions against XSS

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Screenshot uploads HTML extraction URL checks reject internal targets

Screenshot uploads HTML extraction URL checks reject internal targets

Source: llm_adapter@2026-05-21

Confidence: low

Security Medium

Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and health‑check redirects now reject internal or non‑public targets by default

Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and health‑check redirects now reject internal or non‑public targets by default

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Breaking Medium

ALTCHA_MAX_NUMBER replaced with COST MEMORY_COST PARALLELISM settings

ALTCHA_MAX_NUMBER replaced with COST MEMORY_COST PARALLELISM settings

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

set_language_team replaced with po_set_language_team file parameter

set_language_team replaced with po_set_language_team file parameter

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

dos-eol flag deprecated use dos_eol parameter instead

dos-eol flag deprecated use dos_eol parameter instead

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

Weblate uses calendar versioning for releases

Weblate uses calendar versioning for releases

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

Upgrades only supported from current or previous calendar year

Upgrades only supported from current or previous calendar year

Source: llm_adapter@2026-05-21

Confidence: low

Breaking Medium

ALTCHA widget v3 protocol Argon2id proof-of-work

ALTCHA widget v3 protocol Argon2id proof-of-work

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Translation memory lookup skips fuzzy matching option

Translation memory lookup skips fuzzy matching option

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

MDX file format support preserves JSX in translations

MDX file format support preserves JSX in translations

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Extended LLM context covers explanations plurals failing checks

Extended LLM context covers explanations plurals failing checks

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

DOS line endings configurable via dos_eol parameter

DOS line endings configurable via dos_eol parameter

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

CSV XLSX downloads export plurals as separate rows

CSV XLSX downloads export plurals as separate rows

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Translation files CDN addon publishes translations

Translation files CDN addon publishes translations

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Backup management command runs services synchronously

Backup management command runs services synchronously

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Engage page highlights actionable translation tasks newcomers

Engage page highlights actionable translation tasks newcomers

Source: llm_adapter@2026-05-21

Confidence: low

Feature Low

Digest‑only translation activity summary notification added

Digest‑only translation activity summary notification added

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Feature Low

Gettext PO/POT file format parameters control Language‑Team, Last‑Translator, X‑Generator, and Report‑Msgid‑Bugs‑To headers

Gettext PO/POT file format parameters control Language‑Team, Last‑Translator, X‑Generator, and Report‑Msgid‑Bugs‑To headers

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Feature Low

Translation memory lookup API can skip fuzzy matches via `exact` query parameter

Translation memory lookup API can skip fuzzy matches via `exact` query parameter

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Dependency Medium

Stricter dependency version constraints control runtime environment

Stricter dependency version constraints control runtime environment

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Gerrit pushes reject branches containing options track targets

Gerrit pushes reject branches containing options track targets

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Category announcements scope fixed no project-wide display

Category announcements scope fixed no project-wide display

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Category repository paths safety improved cleanup moves

Category repository paths safety improved cleanup moves

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Plural counts bounded plural formulas validated to range

Plural counts bounded plural formulas validated to range

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Malformed ALTCHA submissions repository URLs no longer cause errors

Malformed ALTCHA submissions repository URLs no longer cause errors

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Project backup imports run in background avoid memory limits

Project backup imports run in background avoid memory limits

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Per-project tokens expiring today valid until end day

Per-project tokens expiring today valid until end day

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Merge pushes refresh stale fork remotes after hosting change

Merge pushes refresh stale fork remotes after hosting change

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Low

Gerrit review pushes track target branch before invoking `git-review` and suggest short names for full refs supplied

Gerrit review pushes track target branch before invoking `git-review` and suggest short names for full refs supplied

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Bugfix Low

Category announcements now respect language‑scoped permissions and no longer appear project‑wide

Category announcements now respect language‑scoped permissions and no longer appear project‑wide

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Other Medium

OpenAI Alibaba no longer require vendor Python SDKs

OpenAI Alibaba no longer require vendor Python SDKs

Source: llm_adapter@2026-05-21

Confidence: low

Other Medium

Cache directory execution capability validation check

Cache directory execution capability validation check

Source: llm_adapter@2026-05-21

Confidence: low

Other Medium

Setting changes audit trail recorded in history

Setting changes audit trail recorded in history

Source: llm_adapter@2026-05-21

Confidence: low

Full changelog

Released on May 15th 2026.

New features

  • Added MDX files support for translating Markdown text while preserving JSX syntax, with File format parameters shared with Markdown files for line wrapping, code blocks, front matter, and placeholder handling.

  • Added extended LLM translation context for automatic suggestions, covering string context, explanations, secondary-language translations, plurals, failing checks, and placeholders.

  • Added a digest-only translation activity summary notification, see Notifications.

  • CSV and XLSX downloads in Downloading translations now export plural strings as separate plural-form rows that can be imported back.

  • Added Gettext PO and POT File format parameters to control whether Weblate updates the Language-Team, Last-Translator, X-Generator, and Report-Msgid-Bugs-To headers.

  • Added a backup to run configured backup services synchronously.

  • The translation memory lookup API can now skip fuzzy matching with the exact query parameter.

  • Added Translation files CDN to publish translation files to the configured CDN.

Improvements

  • Using DOS line endings can now be configured using the dos_eol File format parameters.

  • OpenAI and Alibaba no longer require their vendor Python SDKs.

  • Audited project and component setting changes are now recorded in history.

  • Gerrit review pushes now use Push branch as the target branch.

  • Weblate now checks whether CACHE_DIR allows executing generated helper files.

  • The Software Bill of Material is now generated during release and published as a versioned release asset instead of being stored in the source repository.

  • The translating page now separates screenshots from string information, collapses rarely used string details, and groups glossary and screenshot actions more consistently.

  • Project access management now paginates users and better explains site-wide automatic team assignments.

  • Added provider-oriented code hosting documentation and Gettext-style Plural formula guidance.

  • The Python wheel no longer ships source translation catalogs, test files, or deployment example files, reducing the installed package size.

  • The engage page now highlights actionable translation task buckets for newcomers.

  • RSS feeds can now use the same filters as the changes browsing page.

  • Update gettext template (Django) now supports gettext PO files used as templates when they are excluded by the language filter.

  • Reworked Weblate threat model into a contract-style document.

Bug fixes

  • Hardened search previews and Automatic suggestions suggestion origins against XSS, and stopped exposing database error details in upload failures.

  • Screenshot URL uploads, remote HTML extraction in JavaScript localization CDN, and URL health-check redirects now reject internal or non-public targets by default.

  • Gerrit review pushes now reject target branches containing push options, track the target branch before invoking git-review, and suggest short branch names when full refs are supplied.

  • Category Announcements no longer appear across the whole project, and translation announcement deletion now honors language-scoped permissions.

  • Merge request pushes now refresh stale fork remotes after changing repository hosting.

  • Plural counts parsed from translation file headers are now bounded, and plural formulas are rejected when they can evaluate outside the configured plural form range.

  • Per-project access tokens expiring today now remain valid until the end of the day.

  • Malformed ALTCHA CAPTCHA submissions and repository URLs in webhook payloads no longer cause server errors.

  • Placeholders now merges overlapping non-nested spans from multiple flags.

  • Backing up and moving Weblate logs no longer include OpenSSH post-quantum key exchange warnings from remote Borg connections.

  • Category repository paths are now handled more safely during cleanup and moves.

  • Locked component pages now show an unsubscribe action after subscribing to unlock notifications.

  • Project level backups imports now restore in the background to avoid web worker memory limits.

Compatibility

  • The dos-eol flag is no longer supported. Use the dos_eol File format parameters instead.

  • The registration CAPTCHA now uses the ALTCHA widget v3 protocol with Argon2id proof-of-work.

  • The set_language_team project attribute has been replaced with the po_set_language_team file format parameter at the component level; see File format parameters.

  • Weblate now uses calendar versioning for releases, see Release cycle.

  • Weblate now uses stricter dependency version constraints to better control runtime environment.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Karen Konou, AliceVisek, Gersona, Weblate CI

Translations contributions
이정희, Andrei Stepanov, Milo Ivir, ssantos, 大王叫我来巡山, Kaya Zeren, reducedradius, Peter Vančo, amano, Michal Čihař, Anucha Hlownonkor, Yaron Shahrabani, UDP, Максим Горпиніч, Agnieszka C, VfBFan, Blueberry, ojppe, Francisco Serrador, Aindriú Mac Giolla Eoin, Fjuro, Любомир Василев, Frank Paul Silye, Temuri Doghonadze, Yuri Chornoivan, Sergio Granadoz, Sketch6580, Hyeonjeong Lee, 為什麼不加空格, ℂ𝕠𝕠𝕠𝕝 (𝕘𝕚𝕥𝕙𝕦𝕓.𝕔𝕠𝕞/ℂ𝕠𝕠𝕠𝕝), justcontributor, Kristijan "Fremen" Velkovski, Pierfrancesco Passerini, Besnik Bleta, Arif Budiman, Andi Chandler, jernejp21, Manuela Silva, Sjur N Moshagen, Abduqadir Abliz, Laitei, Кирилл Ванин, Matthaiks, Nozomu Matsui, Dick Groskamp, MrZwave, hoanghuy309, Jim Spentzos, Adam Havránek, Ricky Tigg, Christian Wia, ButterflyOfFire

Documentation contributions
Michal Čihař, Gersona, Karen Konou, AliceVisek

All changes in detail.

Breaking Changes

  • Removed `dos-eol` flag; use `dos_eol` File format parameters instead.
  • Registration CAPTCHA now uses ALTCHA widget v3 protocol with Argon2id proof-of-work.
  • Replaced project attribute `set_language_team` with component-level file format parameter `po_set_language_team`.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track weblate

Get notified when new releases ship.

Sign up free

About weblate

Web based localization tool with tight version control integration.

All releases →

Related context

Related tools

Earlier breaking changes

  • vweblate-2026.6 'weblate.workspaces' must be added to INSTALLED_APPS during upgrade.

Beta — feedback welcome: [email protected]