Released on January 14th 2026.

Improvements

• Statistics generator is now triggered upon installation.

• Screenshots updated from the repository have proper history.

• reStructuredText syntax error now reports unintended list conversion.

• Unchanged translation check ignores AsciiDoc source code blocks.

Bug fixes

• Information leak via screenshots (CVE 2026-21889 / GHSA-3g2f-4rjg-9385).

• Explanation sync in TermBase eXchange format.

• User interface fixes.

• Clarified needs editing/checking/rewriting states.

• Automatically translated flag with bulk approvals.

• GitHub forks no longer trigger actions.

• Tighter validation of user provided websites to avoid confusing homoglyphs.

• Glossary support in Google Cloud Translation Advanced.

• Invitations accepting when REQUIRE_LOGIN is turned on.

• CyrTranslit installation.

Compatibility

• Screenshot images are no longer served directly by the HTTP server, please adjust your HTTP server by removing serving of /media/.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

• To make the fix for CVE 2026-21889 effective, the serving of /media/ path should be removed from the HTTP server configuration; see Serving static files.

Contributors

Code contributions
Michal Čihař, Kartik Ohri, Karen Konou, Marek Lukášík, shyraptor, Korpyc, Benjamin Alan Jamie

Translations contributions
Jim Kats, Horus68, Francisco Serrador, VfBFan, Fjuro, Andi Chandler, Eduard Ereza Martínez, Takeru Mikenu, eulalio, Mickaël Binos, Любомир Василев, Peter Vančo, Mateus Liberale Gomes, Hanu E., Pierfrancesco Passerini, amano, Blueberry, ButterflyOfFire, Basheer Radman, therealmate, មនុញ្ញ - MᴇᴀнNսɴн, தமிழ்நேரம், EdoAug, Zahid Rizky Fakhri, Milo Ivir, Kristoffer Grundström, searinminecraft, Kyotaro Iijima, adecorte, Priit Jõerüüt, Rhoslyn Prys, Shah Zaman Pathan, Daniel Nylander, Michal Čihař, Kristijan "Fremen" Velkovski, Aindriú Mac Giolla Eoin, Tuomas Hietala, 이정희, pan93412, Anusuk Sangubon, پ��ویز قادر, Fulup Jakez, Matthaiks, Besnik Bleta, Hotripak, 大王叫我来巡山, Agnieszka C

Documentation contributions
Michal Čihař, Kartik Ohri, michael-smt, Marek Lukášík, shyraptor, Korpyc, alexis-pinon, Benjamin Alan Jamie

All changes in detail.

Released on December 18th 2025.

New features

• Added GET /api/projects/(string:project)/languages/(string:language_code)/file/ to download a ZIP file of all component translations of a project for a specified language.

Improvements

• Updated list of OpenAI models.

• Added Migrating to Weblate guide to help users migrate from other localization platforms.

• Gracefully handle unreachable authentication providers.

• Update language definitions to CLDR 48.

Bug fixes

• Git config file overwrite remote code execution (CVE 2025-68398 / GHSA-8vcg-cfxj-p5m3).

• Arbitrary file read via symbolic links (CVE 2025-68279 / GHSA-g925-f788-4jh7).

• Locking error that prevented updating linked components.

• Fixed e-mail SSL configuration in Docker container.

• Invitations on sites with required authentication.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Karen Konou, Kartik Ohri, ZhuHengjin, Edison, aditi-agni, aditi, Edison Dao, biplopghimire

Translations contributions
eulalio, Yauhen, Emin Tufan Çetin, Priit Jõerüüt, Любомир Василев, Fjuro, Zahid Rizky Fakhri, Takeru Mikenu, ButterflyOfFire, 김인수, Manuela Silva, Pierfrancesco Passerini, Michal Čihař, 大王叫我来巡山, Dick Groskamp, Максим Горпиніч, Matthaiks, γλωσσολαλιά, Turkish Language Team 🇹🇷, Besnik Bleta, Massimo Pissarello, មនុញ្ញ - MᴇᴀнNսɴн, Jim Kats, Aindriú Mac Giolla Eoin, VfBFan

Documentation contributions
Michal Čihař, ZhuHengjin, Edison, aditi-agni, aditi, Edison Dao, biplopghimire

All changes in detail.

Released on December 15th 2025.

New features

• Batch automatic translation can now be manually triggered at project language, category or component level, see Automatic translation.

• Added ability to completely disable the admin contact form by setting CONTACT_FORM to "disabled".

• Added new Ollama machinery tool for local Ollama AI model integration, see Ollama.

• Added GET /api/units/(int:id)/comments/ to get a list of comments for the given translation unit.

• Memory contents imported from TMX files include string context.

• XLIFF 2.0, Nextcloud Apps JSON files, JavaScript Resource Files (RESJSON), and TOML are now supported file formats.

• Fedora Messaging integration is now available as add-on.

• Added Laravel format quality check.

Improvements

• Added disk usage overview in Performance report.

• GET /api/groups/ now includes admins.

• ModernMT better supports language variants.

• Automatically translated strings are now identified by a dedicated flag instead of a label.

• Component discovery preserves File format parameters.

• CyrTranslit now supports Belarusian and Greek.

• Blocking users now accepts internal notes that are not visible to the user.

• Slack Webhooks and Webhook can be installed multiple times.

• Compatibility with Git SHA256 repositories.

• The allowed version control URLs can now be configured using VCS_ALLOW_SCHEMES and VCS_ALLOW_HOSTS.

• The API timeout for creating pull requests or forking can now be configured via VCS_API_TIMEOUT.

• Improved VCS integration documentation to clarify Docker environment variables, commit authorship, hosted vs. self-hosted setup, and authentication options.

• Timestamps from past are now shown with more detail.

Bug fixes

• Improper invitation validation upon accepting (CVE 2025-64725 / GHSA-m6hq-f4w9-qrjj).

• Server-Side Request Forgery while cloning repository (CVE 2025-66407 / GHSA-hfpv-mc5v-p9mm).

• Over‑permissive webhook endpoint enabling mass repository updates plus component enumeration (CVE 2025-67492 / GHSA-pj86-258h-qrvf).

• Notification settings disclosure via Weblate API (CVE 2025-67715 / GHSA-3pmh-24wp-xpf4).

• DeepL integration now correctly handles translating to Chinese variants.

• CSV files format saving translations with empty source fields when using monolingual base files.

• Tighter validation of user and full names to avoid confusing homoglyphs.

• Avoid false positive checks upon committing pending changes.

• Performance improvements for file upload.

• Show glossary matches for the source language.

Compatibility

• Replaced custom RequireLoginMiddleware with Django 5.1’s LoginRequiredMiddleware. This makes settings LOGIN_REQUIRED_URLS and LOGIN_REQUIRED_URLS_EXCEPTIONS no longer supported, including their Docker environment variable counterparts.

• Webhook secret length is now validated to match the Standard Webhooks specification.

• Python 3.12 or newer is now required.

• GLib 2.80 or newer is now required.

• Dropped support for Web Monetization.

• Laravel PHP strings no longer includes return prefix in the keys.

• There are several changes in settings_example.py, most notable are changed settings CRISPY_ALLOWED_TEMPLATE_PACKS and INSTALLED_APPS; please adjust your settings accordingly.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, michael-smt, Steven Loria, Tudor Gradinaru, Karen Konou, Gersona, Miguel A. Bouzada, Kartik Ohri, Florian, Abtin, Aaditya Joshi, Urtzi Odriozola, Cakex2005, was000, KamikazEr101

Translations contributions
Miguel A. Bouzada, Turkish Language Team 🇹🇷, Francisco Serrador, hoanghuy309, Priit Jõerüüt, Ldm Public, eulalio, ssantos, Christian Wia, Andi Chandler, Joel A, Peter Vančo, Dick Groskamp, Besnik Bleta, Dũng Vũ, Nicola...

Released on November 7th 2025.

Bug fixes

• Observed HTTPS status in Performance report.

• Forced synchronization in the Repository maintenance.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař

Documentation contributions
Michal Čihař

All changes in detail.

Released on November 6th 2025.

Improvements

• Performance when adding strings.

Bug fixes

• Adding terms to glossary was not working in some situations.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař

Documentation contributions
Michal Čihař

All changes in detail.

Released on November 5th 2025.

New features

• String context are now tracked in changes histoy and displayed when available.

Improvements

• Document using Valkey in Background tasks using Celery and Configure cache.

• Added HTTP environment overview in Performance report.

• Docker container is using Python 3.14.

• ICU MessageFormat correctly handles implicit plurals.

Bug fixes

• Avoid storing inviting user information in the invited user audit log (CVE 2025-64326 / GHSA-gr35-vpx2-qxhc).

• Omit admin IP address from audit log.

• Counting outgoing commits in the repository status.

• Listing of other translations.

• SAML configuration in the Docker container.

• Commit Policy could miss some changes in certain situations.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Karen Konou, Gersona

Translations contributions
Agnieszka C, Žiga Deisinger, Anthony Guéchoum, VfBFan, eulalio, Zahid Rizky Fakhri, Максим Горпиніч, Fjuro, Aindriú Mac Giolla Eoin, Peter Vančo, Dick Groskamp, Kyotaro Iijima, Pavel Miniutka, delvani, 大王叫我来巡山, Kaya Zeren, Øjvind Fritjof Arnfred, cat, mdfaruk896852-code, Michal Čihař, GitHub webhook, Besnik Bleta, Horus68, Hotripak, Aitor Astorga, Massimo Pissarello, Rafael Fontenelle, Sketch6580, Любомир Василев, Danial Behzadi, Milo Ivir, 大学没毕业, Francisco Serrador, hoanghuy309, Arantxa, Denys Nykula, Martin Srebotnjak, Andi Chandler, Ricky Tigg, Kevin Zhang, Nataniel Dika Kurniawan

Documentation contributions
Michal Čihař, DeMiro5001, Gersona, Steffen

All changes in detail.

Released on October 22nd 2025.

New features

• Flag updated translations from repository as “Needs editing” is now available as an add-on.

• DELETE /api/projects/(string:project)/labels/(int:label_id)/.

• Added multivalue CSV in Downloading translations for multivalue formats.

• New global permissions have been added to control viewing teams, users and roles without edit rights, see List of privileges.

• New unit.bulk_edit permission for bulk editing operations, replacing the overloaded use of translation.auto permission, see List of privileges.

• Searching for DATETIME fields.

• Last changed lookup in Searching for strings.

• Localization Threat Model documentation.

• Do not show glossary matches component setting.

• Screenshots now can be uploaded from a URL, see Visual context for strings.

Improvements

• Notification hooks improvements.

  • Now follows Error responses.

  • Available in the OpenAPI.

  • Dropped long-deprecated endpoints.

• Improved activity logging for Add missing languages add-on.

• Inconsistent reStructuredText and reStructuredText syntax error now support substitutions.

• Improved performance for Multiple failing checks and Long untranslated checks with batch operations.

• File format parameters can now be configured via the Weblate’s REST API.

• Admins can configure Expiring user accounts.

• Rate limiting of notification e-mails, configurable by RATELIMIT_NOTIFICATION_LIMITS.

• Repository maintenance now supports resetting the repository while keeping the current state of translations in Weblate.

• Improved listing of Automatic translation configuration.

Bug fixes

• Plurals and File format parameters handling on file upload.

• Team administrators can no longer edit teams besides membership.

• Highlighting syntax of overlapping elements.

• Searching case sensitivity for short strings.

• Inconsistent file formatting for new translations.

• Memory contents imported via the import_memory command are marked as active.

• Importing some strings from XLIFF.

Compatibility

• The default attributes for SAML authentication in Docker container now matches non-Docker defaults.

• Dropped long-deprecated GET /hooks/update/(string:project)/(string:component)/ and GET /hooks/update/(string:project)/.

• Removed Akismet spam protection integration as it was no longer effective and used an unmaintained Python library.

• New positional argument (activity_log_id) passed to the add-on event handlers, see weblate.addons.base.BaseAddon. Adjust any custom subclass accordingly.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, softworkz, Gersona, Benjamin Alan Jamie, Kartik Ohri, Kai Kewley, Raphael Michel, Dmytro Doroshenko, michael-smt, IoeCmcomc, Karen Konou, Juhari Yusuf Fatahillah, eulalio, Sketch6580

Translations contributions
Michal Čihař, eulalio, Zahid Rizky Fakhri, Divarrek, Sam Plimmer, amano, Sketch6580, Manuela Silva, Aindriú Mac Giolla Eoin, Максим Горпиніч, Milo Ivir, qywter11 qywter11, 大学没毕业, Changseop Yeom, Marija Grineviciute, Peter Vančo, Laurent FAVOLE, Сергей, Royston Shufflebotham, Massimo Pissarello, Emin Tufan Çetin, Juno Takano, Horus68, Martin Srebotnjak, Altos, ovl-1, 이정희, Yauhen, cat, Jessica Patricio, Alejandro Moctezuma, Kristijan "Fremen" Velkovski, Liviu Roman, Sveinn í Felli, Yamin Siahmargooei, Besnik Bleta, Øjvind Fritjof Arnfred, Danial Behzadi, Miguel A. Bouzada, CRISTIAN ANDREI, Denis96, Ldm Public, ROSPL-GR2-2025, Dick Groskamp, Jim Kats, Graaati, coronabond, VfBFan, Любомир Василев, GitHub webhook, Agnieszka C, Arif Budiman, Yaron Shahrabani, Karen Konou, Kartik Ohri, Juhari Yusuf Fatahillah, Дмитрий Михирев, Fjuro, Yago Raña Gayoso

Documentation contributions
Michal Čihař, Gersona, Kai Kewley, Raphael Michel, Benjamin Alan Jamie, michael-smt, softworkz, Karen Konou, Kartik Ohri, Juhari Yusuf Fatahillah, eulalio, Sketch6580

All changes in detail.

Released on September 12th 2025.

Improvements

• Text on the registration page informs about possible use of user’s data in more detail.

• Clarified account removal view.

Bug fixes

• Components pagination.

• Project level backups with same named components in different categories.

• Source string location display.

• Correctly track team adding via invitation in Audit log.

• Add missing languages no longer includes shared component languages.

• Azure DevOps pull requests API URL parsing.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Benjamin Alan Jamie, Raphael Michel, nijel

Translations contributions
Michal Čihař, eulalio, Zahid Rizky Fakhri, Divarrek, Sam Plimmer, amano, Sketch6580, Manuela Silva, Aindriú Mac Giolla Eoin, Максим Горпиніч, Milo Ivir, qywter11 qywter11, 大学没毕业, Changseop Yeom, Marija Grineviciute

Documentation contributions
Michal Čihař, Benjamin Alan Jamie, Raphael Michel, nijel

All changes in detail.

Released on September 5th 2025.

Improvements

• Error reporting upon validation of the file upload method.

• Detailed language information in new language notifications.

Bug fixes

• Sign-in could not be completed with LDAP.

• Nonspacing mark changes highlighting in history.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař

Translations contributions
Divarrek, VfBFan

Documentation contributions
Michal Čihař, nijel

All changes in detail.

Released on September 4th 2025.

Improvements

• Smarter retries of unwritable pending changes.

• Failed Two-factor authentication is visible in Audit log.

Bug fixes

• Sign-in form not shown for LDAP.

• Access control for GET /api/users/(str:username)/.

• Inconsistent reStructuredText allows translatable reference names.

• File format parameters were not properly applied in some situations.

• Removed stale Customize XML output.

• LibreTranslate compatibility with LibreTranslate 1.7.0.

• Username autocompletion in comments.

• Shorten session expiry while in Two-factor authentication.

• Statistics when using Share in projects.

• Component Lists are no longer blocking dashboard loading.

• OpenMetrics API format.

Compatibility

• Removed support for no longer working IBM Watson Language Translator.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

• There are several changes in settings_example.py, most notably, django_otp.middleware.OTPMiddleware was removed from MIDDLEWARE; please adjust your settings accordingly.

Contributors

Code contributions
Michal Čihař, nijel, alisa, Gersona, Karen Konou, Kartik Ohri, softworkz, Paul Harriet Asiñero

Translations contributions
pan93412, eulalio, Zahid Rizky Fakhri, Maciej Olko, Aindriú Mac Giolla Eoin, Christian Wia, Fjuro, Brian Njoroge, ssantos, Junghyuk Kwon, hugoalh, Alexis Launay, Wolf, ℂ𝕠𝕠𝕠𝕝 (𝕘𝕚𝕥𝕙𝕦𝕓.𝕔𝕠𝕞/ℂ𝕠𝕠𝕠𝕝), Yaron Shahrabani, Marija Grineviciute, Milo Ivir, Данил Костенков, Dick Groskamp, abdelbasset jabrane, CyrTranslit, cat, Michal Čihař, VfBFan, Wuzzy, Michalis, Deleted User, Francisco Serrador, Adolfo Jayme Barrientos, Ricky Tigg, Nicolas Van Aarsen, Julien Humbert, Jérôme, Nifou, Miguel A. Bouzada, elid, RViktor, Taufik Adi Wicaksono, Reza Almanda, Sveinn í Felli, Massimo Pissarello, Kyotaro Iijima, amano, 이정희, WaldiS, tomkolp, Piotr Kołtun, Horus68, Manuela Silva, Alan Marques, Rafael Fontenelle, Alefsander Ribeiro Nascimento, Simona Iacob, Nicoara Alex, Golubev Alexander, Сергей, Blueberry, Mingun, xXx, Vin, BouenMarsh, gfbdrgn, Igor Polyakov, qtm, Alexey Napalkov, Julija Juli, Reno Tx, தமிழ்நேரம், Kaya Zeren, Yuri Chornoivan, Ihor Hordiichuk, Mirka Danylenko, Tymofii Lytvynenko, Andrij Mizyk, Максим Горпиніч, 大王叫我来巡山, Sketch6580, JY3, 大学没毕业, Xiang Heng Wei, yangyangdaji, Xzonn, Peter Dave Hello, 峡州仙士, Winston Sung, Toomore Chiang, Haowei Hsu, Chang-Chia Tseng, notlin4, Supaplex, n1ck, Changseop Yeom, Ldm Public, Vitalii, Yago Raña Gayoso, Agnieszka C, Nguyễn Ngọc Khánh

Documentation contributions
Michal Čihař, nijel, Kartik Ohri, Paul Harriet Asiñero

All changes in detail.