WeblateOrg/weblate weblate-2026.11

Weblate 2026.11

on GitHub

Released on November 2nd 2026.

New features

• Built-in roles can be customized, with permission changes preserved across upgrades and a reset to upstream defaults.

• Added optional self-hosted Anonymous bot protection as a technology preview, with proactive anonymous proof of work and verified crawler exemptions following the robots.txt crawl policy.

• Added a Languages tab to Workspaces for translation and review across projects, a contextual menu for users with multiple workspaces, and watched multi-project workspaces in My workspaces.

• Unified Bulk edit with search and replace, adding regular expressions and translation clearing in manual runs, Automations, and the add-on. Manual edits offer previews, with flags and labels grouped by scope and separate add and remove actions.

• Added permissions for user discovery, profile access, and resource-scoped contributor identities, including editor attribution and identity-safe exports. See Confidential collaboration and Privacy configuration.

• Added workspace translation propagation scopes for sharing translations across projects or components with matching names.

• Added CDN manifests listing available languages and translation files with checksums and sizes.

• Added an optional OpenID Connect identity provider for signing in to other applications with Weblate accounts.

• Added eTranslation automatic suggestions with a default language domain and per-component domain mapping.

• User settings can be imported from a user data export on the account page.

• Added string selection for composing Automation actions with reusable result scopes.

• Translation services support multiple installations at site, workspace, and project scope, with optional slugs, inherited-installation exclusions, and reversible pause controls. See Translation services.

• Added personal and project Saved searches offered in the search filters.

• Automations offer visual and YAML editors, documented change-event identifiers, and a separate execution form with previews and change context for real runs.

• GitHub pull requests can be assigned to a configured user or the acting user’s linked GitHub account, and can have configured labels added using Version control parameters.

Improvements

• Translation services have detail pages with settings, controls, provider error logs, and rate limit status and reset controls. Cooldowns are per installation, support provider retry delays, and use service-specific defaults.

• Kotlin SDK integration now offers Translation files CDN installation and Gradle configuration for original XML downloads.

• Sped up project backup restoration by batching label, comment, and check restoration and reducing source-string linking and author lookup queries.

• Fedora Messaging now publishes using Kombu, removing the Twisted dependency.

• Sped up Git export URL updates for projects with categorized components.

• Reduced database processing overhead for metadata-only updates during repository synchronization.

• Sped up saving custom source language workflows by batching writes, limiting reconciliation to affected translations, reducing author lookups, and running expensive quality checks in background batches.

• Screenshots recognize image text in the background and cache results, with separate image text suggestions and source string search tabs.

• Project backup restoration validates stored parameters, reports skipped unsupported VCS and file format parameters, and corrects screenshot filename extensions using validated image contents.

• Automatic translation reports translation service failures in task results, the API, and the user interface while preserving successful translations.

• Improved project-wide inconsistent and reused translation checks by restricting database searches to eligible peer translations.

• Reduced database queries during stale repository cleanup by cleanuptrans and scheduled maintenance.

• Grouped related add-on settings and separated integration instructions, with setup guidance for webhooks, Slack, and Fedora Messaging.

• Reduced database expression overhead when updating Translation Memory entry statuses.

• PyPI releases include publish attestations recording package provenance.

• Docker deployments can trust custom CA certificates for outgoing connections, including repository operations over HTTPS.

• Docker deployments support signing in through Hosted Weblate or another Weblate installation using OpenID Connect.

• Project administrators with Edit project settings can directly access and manage restricted components in their project; translation and download actions keep their separate permissions.

• Sped up string searches by language code and related objects, avoiding unnecessary deduplication.

• Component creation and discovery presets warn when resource limits might make discovery results incomplete.

• Renamed provider configuration and selection to Translation services, while keeping the translation editor’s Automatic suggestions tab.

• Translation history records change origins, distinguishing user interface, API, repository, system, and automation activity, including automation installation and execution identifiers.

• Bounded JSON webhook response bodies and headers to limit worker memory use and activity-log growth.

• Reorganized user profile settings into clearer tabs for public profile, security, and developer access.

• Component creation loads remote branches only for the selected component, avoiding repository queries when opening the page.

• Automation AI quality evaluation now uses the effective add-on’s service automatically, with an optional service assertion.

• Require selecting an authenticator app at sign-in when multiple apps are registered, so unsuccessful checks affect only the selected app.

• Added recovery of missing Git checkouts or .git directories, including local glossaries, through Reset and reapply translations recovery behavior, with clearer alert diagnostics and repository maintenance links.

• Sped up disk-state snapshot writes during file reapply and cleanup during translation commits and repository resets.

• SVG status badges now use a blurred text shadow to match the shields.io style, improving text contrast.

• The translation editor remembers whether the string details in the translation context are expanded.

Security fixes

• Prevented arbitrary file overwrite and remote code execution through authenticated project backup imports (GHSA-8jpg-5gm2-hjp6).

• Bounded Bulk edit operations to 20,000 matching strings, processed browser edits in background batches, and added submission rate limiting.

• Signed-out third-party sign-ins can link to an existing account by matching e-mail only when REGISTRATION_REBIND is enabled.

• Prevented linked components in the REST API and component duplication from revealing repository settings or credentials without repository access.

• Enforced REGISTRATION_EMAIL_MATCH and disposable e-mail restrictions when importing authentication-provider addresses and selecting public or commit e-mail addresses through the API.

• Protected template downloads through the REST API against symlink races during concurrent repository updates.

• Prevented account takeover through Unicode lookalike e-mail addresses in password reset and account linking. See Registration and user profile.

• Prevented Mercurial option values and Git revisions from being interpreted as command-line options, and rejected invalid revisions in project backup imports.

• Require confirmation of an existing sign-in method before first two-factor enrollment and a separate second-factor check before creating a project token afterward.

• Require recent two-factor verification for API key disclosure, credential and project token changes, member or token removal, and account deletion. Verification is bound to the signed-in account during third-party sign-in and sensitive actions.

• Bounded screenshot image text matching to prevent excessive web worker CPU use on large components or dense images.

• Enforced per-string edit permissions for automatic translation and review permissions for translation reverts and merges.

• Prevented translation, Zen, project-language, and category-language pages, conflict history, single-project redirects, and component settings forms from disclosing restricted component details, linked repository settings, or private component slugs.

• Bounded CPU use in interpolation, markup, Markdown link, AngularJS, unchanged translation, AsciiDoc, and Java MessageFormat checks, including Java format detection and highlighting. Hardened translation sanitization and service placeholder restoration against excessive non-breaking spaces and syntax tokens.

• Bounded diff rendering and edit-distance calculations for large translations in translation history, CSV exports, and reports.

• Applied the translation write rate limit to the Zen editor save endpoint.

• Prevented the automatic translation add-on from exposing restricted source component IDs in change history.

• Prevented reused and inconsistent translation checks from exposing restricted component strings or confirming matching translations across access boundaries.

• Bounded search query parsing and regular expression analysis to prevent excessive CPU and memory use.

• Restricted sensitive background task diagnostics to users allowed to view the repository location, retaining general progress and failure messages for members.

• Prevented translation service credentials in request URLs from appearing in automatic suggestion errors.

• Rejected invalid language codes from Language aliases and automatically created languages.

• Prevented unintended workspace ownership grants when removing components or translations, and revoked project team access when assigned components move to another project.

• Excluded projects from component creation and management destinations for blocked users, including users with project administration permissions.

• Restricted contributor IP addresses in change API responses to superusers.

• Bounded component discovery preset detection work for repositories with many translation layouts.

• Prevented spreadsheet formulas, including those hidden behind Unicode characters, in Translation history, Weblate’s REST API, and Downloading translations CSV files.

• Prevented restricted glossary terms from leaking through other components or translation services, and private or restricted translations from leaking through the automatic suggestion cache.

• Prevented aggregate translation archives from bypassing restricted-component and language-scoped download permissions.

• Prevented restricted team administrators from granting access through teams covering projects where they are blocked or have not satisfied Two-factor authentication requirements.

• Require glossary editing permission when changing glossary flags through the string context form or Bulk edit.

• Fixed role permission revocation through partial API updates.

Bug fixes

• Fixed a crash when moving components between projects with incompatible inherited settings.

• Removed stale notification subscriptions through daily cleanup, including after project access changes and component moves.

• Stopped automatic sign-in retries after authentication provider errors when only one provider is configured.

• Fixed missing workspace breadcrumbs on project administration and related pages.

• Fixed custom source language workflows to display source changes, retain history for strings needing editing, and allow editing newly imported strings when an intermediate language file is configured.

• Fixed Project level backups imports rejecting strings with empty sources.

• Fixed edits to existing subtitle cues being skipped when committing translation files.

• Fixed initial installation of the AI quality evaluation add-on.

• Fixed Sphinx POT extraction to respect the component’s gettext line wrapping setting.

• Fixed legal document links to prefer configured external URLs and kept privacy policy confirmation optional when hidden without a URL.

Compatibility

• The default PRIVATE_COMMIT_EMAIL_TEMPLATE now uses user-{user_id}@users.noreply.{site_domain} instead of the username. This changes generated addresses for users following the private e-mail default; explicitly selected addresses are preserved. Set the template to {username}@users.noreply.{site_domain} to retain the previous behavior. See Privacy configuration.

• Custom integrations must use Recording acting users instead of transient model acting_user attributes; redundant actor task arguments have been removed.

• Removed the SAML identity provider integration and the saml2idp extra. Use the OpenID Connect identity provider for signing in to other applications with Weblate accounts. SAML sign-in to Weblate remains supported.

• Fedora Messaging broker URLs no longer accept query strings or fragments; configure delivery timing using the add-on fields.

• import_project, import_json, import_demo, add_suggestions, and install_addon now require --user USERNAME to attribute component and configuration changes to an existing account.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

• Stop task producers and schedulers, drain queued work and deferred repository follow-ups, and upgrade the application and workers together.

• Remove djangosaml2idp from INSTALLED_APPS and its configuration before upgrading if you used the removed SAML identity provider. See OpenID Connect identity provider for its replacement.

• Update custom SOCIAL_AUTH_PIPELINE configurations in settings.py to match weblate/settings_example.py. The example configuration and Docker image already include these steps. See Authentication.

  • Add weblate.accounts.pipeline.verify_first_factor_sso immediately after social_core.pipeline.social_auth.social_user to verify the existing sign-in method before first two-factor enrollment.

  • Replace social_core.pipeline.social_auth.associate_by_email with weblate.accounts.pipeline.associate_by_email to enforce REGISTRATION_REBIND for third-party sign-ins.

  • Add weblate.accounts.pipeline.verify_recent_second_factor immediately after weblate.accounts.pipeline.associate_by_email to enforce recent two-factor verification before linking a new sign-in identity.

• If you customize CELERY_TASK_ROUTES, route weblate.trans.tasks.bulk_edit_task to the translate queue, following weblate/settings_example.py.

• To enable optional Anonymous bot protection, add weblate.utils.bot_protection.BotProtectionMiddleware after django.contrib.sessions.middleware.SessionMiddleware and before Weblate’s authentication middleware, following the example configuration.

• The upgrade repairs stored screenshot filename extensions. Screenshot storage must be accessible during migration; see Project level backups.

Contributors

Code contributions
Michal Čihař, Neil Roberts, Keunes, nicommteam, Karen Konou, Benjamin Alan Jamie, 与世无争剑宇子, tahodev, Anish kunda, Kartik Ohri

Translations contributions
Michal Čihař, Alexis Launay, Matthaiks, Peter Vančo, hoanghuy309, Dick Groskamp, Watchman89, Sup! 0_0, VfBFan, Aindriú Mac Giolla Eoin, QuietCedar47, Daniel Nylander, Arif Budiman, Yaron Shahrabani, Andrei Stepanov, CemileDener3127, Ldm Public, Fjuro, Любомир Василев, ahmetergvnc, Basheer Radman, Nicat, Eduard Ereza Martínez, Kristoffer Grundström, suyeon kim, Milo Ivir, Adam Havránek, Alyona Bolshova, Hasan, Adolfo Jayme Barrientos, justcontributor, TCP, Lee Vincent, Manuela Silva, Fúlvio Alves, Carmelo Serraino, Aniwene Madolomani, Priit Jõerüüt, jernejp21, Kaya Abe, คนแปล มังงะฝึกหัด, Phuc Nam Hoang, CongBao, Omer I.S., EkaterinePapava, soma Rashidi, Kristijan Tkalec, Joel A, پرویز قادر, Black Daniel, Erdem, Florent, Besnik Bleta, 김신애, HammadMengal, Rumuz AGO, reducedradius

Documentation contributions
Michal Čihař, Keunes, nicommteam, Benjamin Alan Jamie, Karen Konou, 与世无争剑宇子, tahodev, Anish kunda, Kartik Ohri, Jah-yee

All changes in detail.