WeblateOrg/weblate weblate-5.15

Weblate 5.15

on GitHub

Released on December 15th 2025.

New features

• Batch automatic translation can now be manually triggered at project language, category or component level, see Automatic translation.

• Added ability to completely disable the admin contact form by setting CONTACT_FORM to "disabled".

• Added new Ollama machinery tool for local Ollama AI model integration, see Ollama.

• Added GET /api/units/(int:id)/comments/ to get a list of comments for the given translation unit.

• Memory contents imported from TMX files include string context.

• XLIFF 2.0, Nextcloud Apps JSON files, JavaScript Resource Files (RESJSON), and TOML are now supported file formats.

• Fedora Messaging integration is now available as add-on.

• Added Laravel format quality check.

Improvements

• Added disk usage overview in Performance report.

• GET /api/groups/ now includes admins.

• ModernMT better supports language variants.

• Automatically translated strings are now identified by a dedicated flag instead of a label.

• Component discovery preserves File format parameters.

• CyrTranslit now supports Belarusian and Greek.

• Blocking users now accepts internal notes that are not visible to the user.

• Slack Webhooks and Webhook can be installed multiple times.

• Compatibility with Git SHA256 repositories.

• The allowed version control URLs can now be configured using VCS_ALLOW_SCHEMES and VCS_ALLOW_HOSTS.

• The API timeout for creating pull requests or forking can now be configured via VCS_API_TIMEOUT.

• Improved VCS integration documentation to clarify Docker environment variables, commit authorship, hosted vs. self-hosted setup, and authentication options.

• Timestamps from past are now shown with more detail.

Bug fixes

• Improper invitation validation upon accepting (CVE 2025-64725 / GHSA-m6hq-f4w9-qrjj).

• Server-Side Request Forgery while cloning repository (CVE 2025-66407 / GHSA-hfpv-mc5v-p9mm).

• Over‑permissive webhook endpoint enabling mass repository updates plus component enumeration (CVE 2025-67492 / GHSA-pj86-258h-qrvf).

• Notification settings disclosure via Weblate API (CVE 2025-67715 / GHSA-3pmh-24wp-xpf4).

• DeepL integration now correctly handles translating to Chinese variants.

• CSV files format saving translations with empty source fields when using monolingual base files.

• Tighter validation of user and full names to avoid confusing homoglyphs.

• Avoid false positive checks upon committing pending changes.

• Performance improvements for file upload.

• Show glossary matches for the source language.

Compatibility

• Replaced custom RequireLoginMiddleware with Django 5.1’s LoginRequiredMiddleware. This makes settings LOGIN_REQUIRED_URLS and LOGIN_REQUIRED_URLS_EXCEPTIONS no longer supported, including their Docker environment variable counterparts.

• Webhook secret length is now validated to match the Standard Webhooks specification.

• Python 3.12 or newer is now required.

• GLib 2.80 or newer is now required.

• Dropped support for Web Monetization.

• Laravel PHP strings no longer includes return prefix in the keys.

• There are several changes in settings_example.py, most notable are changed settings CRISPY_ALLOWED_TEMPLATE_PACKS and INSTALLED_APPS; please adjust your settings accordingly.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, michael-smt, Steven Loria, Tudor Gradinaru, Karen Konou, Gersona, Miguel A. Bouzada, Kartik Ohri, Florian, Abtin, Aaditya Joshi, Urtzi Odriozola, Cakex2005, was000, KamikazEr101

Translations contributions
Miguel A. Bouzada, Turkish Language Team 🇹🇷, Francisco Serrador, hoanghuy309, Priit Jõerüüt, Ldm Public, eulalio, ssantos, Christian Wia, Andi Chandler, Joel A, Peter Vančo, Dick Groskamp, Besnik Bleta, Dũng Vũ, Nicola Bortoletto, Ricky Tigg, Chang-Chia Tseng, 大学没毕业, Yaron Shahrabani, Karen Konou, Michal Čihař, Minh Tâm Nguyễn, VfBFan, Miniontoby, pan93412, ButterflyOfFire, 이정희, Wirjadisastra Wiki, Sketch6580, liilliil, dreigiau, Blueberry, Jim Kats, Arif Budiman, marvel at flowers, 大王叫我来巡山, Golubev Alexander, Alyaksandr Koshal, Yauhen, 109247019824, Сергей, Manuela Silva, ابْنُ السَدِيمِ, Changseop Yeom, Daniel Nylander, Kristoffer Grundström, Annamurat Ovezov, gattyan61, Fulup Jakez, Milo Ivir, پرویز قادر, Xusi Fons, Anusuk Sangubon, Matthaiks, Gašper Pintar, Максим Горпиніч, Aindriú Mac Giolla Eoin, Fjuro, Любомир Василев, Massimo Pissarello, Pierfrancesco Passerini, Mikenu Takeru, Marazm Mamazm, Takeru Mikenu, Emin Tufan Çetin, Zahid Rizky Fakhri, Serhii Horichenko, Agnieszka C, WaldiS

Documentation contributions
Michal Čihař, michael-smt, Tudor Gradinaru, Gersona, Karen Konou, Kartik Ohri, Abtin, Aaditya Joshi, Urtzi Odriozola, Cakex2005, was000, KamikazEr101

All changes in detail.