WeblateOrg/weblate weblate-2026.11.2

Weblate 2026.11.2

on GitHub

Released on November 12th 2026.

New features

• Added DEFAULT_WORKSPACE_TM to configure default workspace translation memory usage and contribution for projects.

Improvements

• Improved database query performance for category statistics.

• Shortened oversized exception chains in Sentry error reports to avoid losing reports to payload limits.

• Reduced database workspace used by automatic translation searches across ordinary and custom source languages.

• Included category paths in search results, diagnostics, notification navigation, GitHub App migration lists, gettext template headers, and default component templates.

• Improved peer lookup performance for translation propagation and related consistency checks.

• Aligned queued repository maintenance with background-work authorization: later permission changes or account deactivation do not cancel accepted operations.

• Bounded Weblate Client project configuration discovery by repository and POSIX permission boundaries, and added explicit project-file selection and configuration-free invocation.

• Extended the development container with documentation, frontend, and OCR tooling, and isolated upgrade verification.

• Updated the security reporting policy to handle low and medium severity issues publicly on GitHub and reserve private handling and security advisories for high and critical severity vulnerabilities.

• Avoided unnecessary file edits when changing custom source languages and credited required writes to the initiating user.

• Clarified e-mail addition, confirmation steps, and registration breadcrumbs in account settings.

• Processed browser translation uploads in the background and added an optional background mode to the REST API.

Security fixes

• Validated new and renamed translation keys against the file format, dialect, and encoding before queuing changes (GHSA-946j-ggg5-f8jh).

• Cleared invalid GitHub App push settings and prevented installation credentials from being used for another host (GHSA-rg57-5c8r-3p43).

• Used stable subjects for Keycloak authentication in Docker, protecting new and migrated associations from e-mail reassignment (GHSA-r9x5-r4m9-jv4v).

• Revoked project-scoped tokens during project deletion regardless of display name, prevented automatic workspace ownership grants to bots, and repaired existing token scope violations (GHSA-4qxm-fh53-rj5g).

• Escaped rendered plain-text templates when displaying repository browser links in HTML (GHSA-655x-rwmw-vcv8).

• Enforced REQUIRE_LOGIN for Git repository exports, including anonymous clones (GHSA-vhp4-8r2v-8q7w).

• Limited repository URLs in webhook deliveries to prevent excessive matching work (GHSA-m92w-33gf-q3mj).

• Invalidated pending e-mail additions when the account password changes.

• Prevented bypassing confirmation and password-reset form checks through direct e-mail authentication completion requests.

• Preserved previous IP login failures after a successful sign-in to prevent rate-limit bypasses.

• Required recent credential verification for browser changes to restricted component access, form-encoded project API updates, and access settings in the Django admin.

• Required invitation acceptance for other users’ restored project backup memberships and authorship when importing without superuser privileges.

• Applied project blocks and enforced two-factor authentication to component creation and move targets, including GitHub App imports.

• Enforced team language selection when creating translations and required project authority for language workflow settings.

• Enforced source-language permissions for bulk source metadata and source check dismissals, component permissions for propagated dismissals, and terminology permissions across glossary flag edits and uploads.

• Restricted project-wide component locking to components the actor may manage and prevented removal of translations from locked components, including project and category language removal.

• Prevented merge and revert actions from copying read-only state, and kept votes on read-only strings from accepting suggestions automatically. Clarified suggestion autoaccept behavior for approved translations.

• Enforced add-on compatibility checks for project installations through the API.

• Enforced public-only billing plans on project moves and warned when backup restores make restricted components public.

• Disabled Mercurial subrepositories, removed nested repository metadata from managed Mercurial checkouts and project backups, and enforced backend URL restrictions when validating backups.

• Applied VCS_RESTRICT_PRIVATE to hosting API requests, including redirects and pagination URLs.

• Rejected unsafe fork remote names from merge-request repository credentials before running Git commands.

• Concealed linked repository details in HTML when the source component is inaccessible or its repository location is not viewable. See Access control.

• Made missing and inaccessible repository links return the same validation error without exposing hidden repository settings.

• Hid inaccessible component names from deletion history and concealed repository conflict warnings, history signals, and counts when no conflicting component is visible to the viewer. See Project and workspace diagnostics overviews.

• Concealed invitation e-mail addresses and prevented account e-mail discovery through self-service API updates, public history, and project filters.

• Recorded administrative team changes in a restricted audit log and concealed sensitive membership history from public viewers.

• Required contributor attribution permission before linking commit authors to Weblate accounts. Clarified repository permissions for confidential collaboration.

• Limited user activity searches to visible translation history.

• Excluded components shared from other projects from category contributor stats reports.

• Added TRANSLATION_MAX_SIZE to limit translation file size before parsing and limited each file to 100,000 content strings before synchronization or import.

• Limited CSV files to 100,000 data rows while parsing, including automatically detected CSV input, and bounded XLSX archive expansion and conversion before loading shared strings or writing oversized CSV rows.

• Required login for translation uploads, bounded suggestion uploads and unmatched-string diagnostics, and added a shared browser/API upload rate limit.

• Bounded translation-memory imports by file size and entry count, batched database writes, and shared the translation-upload rate limit.

• Enforced text length limits for translation and source string edits and newly added strings, including file uploads and the API.

• Kept malformed DTD files intact during saves, reported source-edit validation failures cleanly, and removed control characters from base-file edits before writing translation files.

• Prevented concurrent language creation from breaking Apple XLIFF and Stringsdict plural handling and repaired existing duplicate plural definitions.

• Bounded built-in format checks and highlighting with matching timeouts and made whitespace fixups linear on long input.

• Bounded component file-mask scans and prevented cyclic directory-symlink traversal.

• Bounded font check measurement, replacement expansion, and preview rendering.

• Limited interactive machine-translation request frequency and concurrent requests per service installation.

• Limited decoded HTTP response bodies before buffering and applied existing timeouts across redirects and complete downloads, with caller-specific limits for translation services, assets, OCR data, and VCS APIs.

• Limited text shown in translation history lists and added a full change view for long entries.

• Bounded text template source, loops, intermediate values, output, and helper resource usage during validation and execution.

Bug fixes

• Fixed project backup imports when plural rules with a separate zero form do not yet exist on the target server.

• Fixed missing plural forms in automatic translation by comparing plural rules over shared example counts instead of capped display examples.

• Respected custom XML names when creating new translations for Flat XML files without a template.

• Improved Fedora Messaging delivery with automatic stale-connection recovery and separate connection and publish timeouts per attempt.

• Fixed browser Content Security Policy blocking identity confirmation using an external authentication provider.

• Restored inline terms on Legal module confirmation when no external terms URL is configured.

• Restored pending translation writes for text files and other database-backed formats, PHP, and XWiki, and made output of translations needing editing consistent with cleanup rebuilds.

• Generated valid resource names for incompatible keys when exporting Android translations.

• Fixed concurrent initialization and language creation in local Glossary repositories.

• Escaped multiline keys when exporting iOS strings translations.

• Limited repository add-on installation to repository-owning components and showed inherited add-ons on linked components.

• Preserved approvals during concurrent translation edits, suggestion acceptance, merges, and reverts, and preserved text and approvals when dismissing automatically translated status.

• Rechecked billing status when creating components through the API or web wizard.

• Fixed the Matplotlib font rendering check to run without accessing the cache.

• Required contributor agreement acceptance before creating a translation file.

• Preserved independently retained translation-memory scopes during concurrent scope deletion.

• Used the custom source language text for unit.source in the Automation execution context.

Compatibility

• Changed the Docker WEBLATE_SOCIAL_AUTH_KEYCLOAK_ID_KEY default from email to sub. When the identifier is unset, existing associations migrate on login, including those without saved subjects; historical identifier reassignment remains a risk until migration. See the Keycloak upgrade guidance for backfill requirements and how to require subject evidence. Explicit identifier overrides remain supported.

• Translation files are now subject to a pre-parse byte limit and a 100,000-content-string limit. See TRANSLATION_MAX_SIZE.

• The temporary background API option and synchronous translation upload processing will be removed in 2027.1. Switch clients to background processing before upgrading; see Weblate’s REST API.

• Clarified the RESP3 datastore requirement introduced in Weblate 2026.11.1, including errors from incompatible Redis servers or proxies.

• Automation conditions using unit.source now evaluate the custom source text, or an empty string when unavailable. Review workflows relying on canonical source text.

Upgrading

• Pending e-mail additions started before this upgrade retain their existing validity and expiry behavior.

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, 小卡塔克, Любомир Василев, Dick Groskamp, Karen Konou, Kartik Ohri, devimarj

Translations contributions
Michal Čihař, Besnik Bleta, Sup! 0_0, VfBFan, Любомир Василев, Watchman89, Matthaiks, Arif Budiman, justcontributor, Dick Groskamp, Eduard Ereza Martínez, Aindriú Mac Giolla Eoin, Packodol Account, Adam Havránek, fserrador, Andrei Stepanov, delvani, reducedradius, Vaclovas Intas (Vac31.), Kaya Abe, Pierfrancesco Passerini, Hyeonjeong Lee, پرویز قادر, jernejp21, Alexis Launay, Ldm Public, Andi Chandler, Manuela Silva, Daniel Nylander, Kristoffer Grundström, Erenay, Lee Vincent, ℂ𝕠𝕠𝕠𝕝 (𝕘𝕚𝕥𝕙𝕦𝕓.𝕔𝕠𝕞/ℂ𝕠𝕠𝕠𝕝), Peter Vančo, Kaya Zeren, Massimo Pissarello, hoanghuy309, Dr. Delvani

Documentation contributions
Michal Čihař, 小卡塔克, michael-smt, Kartik Ohri, devimarj

All changes in detail.