Released on November 5th 2026.
New features
-
Added account security findings with CSV leaked-password validation, persistent reports, and bulk password resets or dismissal.
-
Added an upgrade check for legacy lookalike verified e-mail identities, with administrator cleanup in account security findings.
-
Added authenticated
GET/api/activity/for daily activity and recently active projects.
Improvements
-
Improved user profiles and administration on large installations by loading team choices on demand and using search for large admin relations.
-
Reduced database queries when committing pending translations.
-
Improved performance of user profiles, contribution lists, and author-filtered changes on large installations.
-
Added XML file format parameters for UTF-8 byte order marks, declaration encoding case, and final newlines.
-
Clarified verification and account recovery guidance when adding an e-mail address in account settings.
-
Automation condition groups and branching actions can now be edited in the visual editor.
-
Removed per-event DNS lookups when reusing Fedora Messaging publisher connections.
Security fixes
-
Require acceptance of invitations from automatic team assignments to project and workspace teams, including rules restored from project backups.
-
Bound file-mask matching during component validation and repository updates to prevent crafted masks from exhausting workers.
-
Restrict font uploads to TrueType and OpenType content.
-
Require review permission to replace translation or Glossary files when reviews are enabled.
-
Prevented blocked project administrators from gaining workspace ownership when the last billed project is removed, and restricted new blocks and direct administrative grants that would combine those states.
-
Require recent credential verification for browser changes to access rights, user accounts, and project visibility; use a password or linked sign-in provider when two-factor authentication is absent. See Two-factor authentication.
-
Prevented a removed invitation from granting access, including site-wide superuser status, when it was being accepted at the same time.
-
Prevented excessive CPU and memory use and failed saves in the Fluent checks caused by strings with many variants or deep nesting. Strings exceeding the limits now fail the check.
Bug fixes
-
Prevent overlapping automatic translation operations for the same component and language.
-
Use atomic file replacement when creating translation files and updating supporting files in add-ons.
-
Reduced memory use when building ZIP downloads by storing completed archives in temporary files.
-
Fixed lock contention when updating inconsistent and reused translation checks concurrently.
-
Preserve plural forms when uploading translations as suggestions.
Compatibility
- Removed
/activity/month.json; useGET/api/activity/instead.
Upgrading
Please follow Generic upgrade instructions in order to perform update.
Contributors
Code contributions
Michal Čihař, Kartik Ohri, Karen Konou, Benjamin Alan Jamie
Translations contributions
Michal Čihař, Watchman89, Kaya Abe, Hyeonjeong Lee, Любомир Василев, Milo Ivir, Rumuz AGO, fserrador, Massimo Pissarello, Sup! 0_0, Fjuro, Frank Paul Silye, پرویز قادر, Eduard Ereza Martínez
Documentation contributions
Michal Čihař, Kartik Ohri, Karen Konou, Benjamin Alan Jamie