Skip to content

Releases: mozilla/addons-server

2026.05.14

12 May 18:02
@github-actions github-actions
2026.05.14
7953dce

Choose a tag to compare

View all tags
2026.05.14 Latest
Latest

This week's push hero is @eviljeff

Previous Release: 2026.04.30

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

  • sync cinder policies with ./manage.py sync_cinder_policies - not executed - the sync command has a bug

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.04.30...2026.05.14-1

Addons Server Changelog:

What's Changed

Notable things shipping

  • Add logic to find actions that can be automatically executed from a list of policies by @diox in #24807
  • Fix some pip packages names by @diox in #24818
  • Keep continue-on-error in _test_check.yml for now by @diox in #24820
  • Implement policy-based scanner actions by @diox in #24796
  • Limit content review triggers to extensions and dictionaries by @eviljeff in #24823
  • AMOENG-2480 - Use a FxA secret instead of the access-token for the support API endpoint by @bakulf in #24813
  • Update contact form by @bacharakis in #24819
  • Always record Promoted Approval when approving add-on versions by @diox in #24824
  • Cope with blank enforcement_actions field in cinder policy admin by @diox in #24831
  • Allow admins to include a soft-blocked version in their add/change blocklistsubmission by @diox in #24830
  • drop ReviewActionReasons support in reviewer tools, and cinder_policy_review_reasons switch by @eviljeff in #24825
  • Refactor ReviewBase.set_promoted() to avoid calling promoted_groups() twice by @diox in #24833
  • AMOENG-2486 throttling for the contact form submission + input fields max length by @bakulf in #24832
  • Make policy selection in scanner rule admin optional by @diox in #24836
  • Replace placeholders with empty string in policy text by @diox in #24835
  • Remove useless colon character in pull request template by @diox in #24838
  • Instruct dependabot to search for requirements starting at the root by @diox in #24843
  • drop CinderJob.decision property by @eviljeff in #24864
  • When syncing policies disable unpublished in reviewer tools by @eviljeff in #24842
  • cache existing Blocks so reversing delayed block actions doesn't fail by @eviljeff in #24863
  • update CheckConstraint to use condition kwarg over check by @eviljeff in #24866
  • Move auto_approval prevention in rejection code to the ContentAction by @diox in #24871
  • Don't allow appeals if content review has been requested already and vice-versa by @diox in #24837

Dependendabots

New Contributors

Full Changelog: 2026.04.30...2026.05.14

Contributors

diox, bakulf, and 3 other contributors
Assets 2
Loading

2026.04.30

28 Apr 16:26
@github-actions github-actions
2026.04.30
fceb273
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.04.30

This week's push hero is @eviljeff

Previous Release: 2026.04.16-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.04.16...2026.04.30

Addons Server Changelog:

What's Changed

Notable things shipping

  • Always send add-ons to NARC when metadata changes now that summaries are considered by @diox in #24766
  • Fix GH actions pin comments to point to the exact version by @diox in #24786
  • Bump yara-x to 2024.04.20 by @willdurand in #24777
  • Define versions of docker images for local environments more explicitly by @diox in #24761
  • Added support for follow-up actions by @eviljeff in #24732
  • Give ContentAction classes an action attribute by @diox in #24785
  • AMOENG-2475 - Use the correct FxA endpoints for the contact support form (stage/prod) by @bakulf in #24800
  • Point to the new BigQuery stats views behind a switch by @willdurand in #24801
  • Linkify urls in the scanner result details by @willdurand in #24806
  • Unblock addon versions from follow-up actions on appeal by @eviljeff in #24799
  • Make configuration of scanner rules possible immediately at creation by @diox in #24808
  • Introduce a new WithResultsFilter in the scanner results admin by @willdurand in #24809

Dependendabots

Full Changelog: 2026.04.16-1...2026.04.30

Contributors

diox, willdurand, and 3 other contributors
Loading

2026.04.16-1

16 Apr 09:52
@diox diox
2026.04.16-1
7b2eb4e

Choose a tag to compare

View all tags
2026.04.16-1

Cherry-pick for fdd0330 on top of 2026.04.16

Loading

2026.04.16

14 Apr 15:17
@github-actions github-actions
2026.04.16
9756d53
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.04.16

This week's push hero is @diox

Previous Release: 2026.04.02-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.04.02...2026.04.16

Addons Server Changelog:

What's Changed

Notable things shipping

  • Switch to forked yara-x by @willdurand in #24677
  • Process decisions from Cinder without a known job by @eviljeff in #24679
  • Update dependabot.yml by @eviljeff in #24688
  • Allow accessing promoted add-on admin page by Add-on GUID or slug by @diox in #24690
  • Optimize generate_lowercase_homoglyphs_variants_for_string() by @diox in #24706
  • add docker hub token for auth'd requested; add cooldown back into dependabot.yml by @eviljeff in #24703
  • switch elasticsearch to use official docker image by @eviljeff in #24714
  • Obey relevant max_length when importing strings from the XPI by @diox in #24713
  • Add github registry auth to dependabot config by @eviljeff in #24715
  • Create a content review cinderjob on created webhook payload by @eviljeff in #24711
  • Revert "Add github registry auth to dependabot config" by @diox in #24716
  • Check dependabot daily for all ecosystems now that there is cooldown by @diox in #24720
  • Add github registry auth to dependabot config by @diox in #24722
  • Ask dependabot to ignore elasticsearch 9.x in docker_compose by @diox in #24724
  • set override_of on new decision by @eviljeff in #24721
  • Don't allow developers to download attachments on private comments by @diox in #24729
  • Move yara-x to its own requirements.txt file by @willdurand in #24733
  • AMOENG-2436 - Contact Support form UI improvements by @bakulf in #24723
  • Add option to scan add-on summaries with NARC by @diox in #24731
  • Allow multiple BlocklistSubmission in parallel for the same version by @diox in #24728
  • Omit match field in narc results by @willdurand in #24730

Dependendabots

Full Changelog: 2026.04.02...2026.04.16

Contributors

diox, willdurand, and 3 other contributors
Loading

2026.04.02-1

07 Apr 11:24
@diox diox
2026.04.02-1
ac3a882

Choose a tag to compare

View all tags
2026.04.02-1

Cherry-pick for dbbf0ca on top of 2026.04.02

Loading

2026.04.02

01 Apr 08:36
@github-actions github-actions
2026.04.02
2909966

Choose a tag to compare

View all tags
2026.04.02

This week's push hero is @eviljeff

Previous Release: 2026.03.19-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

Addons Server Changelog:

What's Changed

Notable things shipping

  • Fix softening of blocks on unban by @diox in #24620
  • AMOENG-2377 - Introduce an email lookup API endpoint by @bakulf in #24591
  • Add a service_account (UserProfile) FK to ScannerWebhook by @willdurand in #24621
  • Remove ohfp from headers that trigger session anomalies, it creates too much noise by @diox in #24624
  • Remove obsolete CSS that affect fonts by @diox in #24625
  • upgrade django to 5.2 by @eviljeff in #24614
  • Wrap long JSON scanner results in the admin by @willdurand in #24622
  • Denying an appeal on Listing Content Rejection should drop requested by @eviljeff in #24632
  • Introduce a new API endpoint to let scanners push their results by @willdurand in #24601
  • Font in developer/reviewer replies in devhub shouldn't be monospace by @diox in #24643
  • Move upload source step after details in submission flow by @willdurand in #24589
  • Hide API key secret after generation by @diox in #24641
  • add tasks that submit new addons and changes for content review to cinder by @eviljeff in #24642
  • Update and restyle how we expose listing content rejection in devhub by @diox in #24647
  • Expose number of matched add-ons on scanner results (and query results) page by @diox in #24652
  • Fix clipboard interaction in manage API key page by @diox in #24654
  • Update the style of the scanner details in the reviewer tools by @willdurand in #24633
  • Simplify DiscoveryAddon admin filtering by promoted group by @diox in #24655
  • Tweak css to better display the narc results in the reviewer tools by @willdurand in #24663
  • Additional confusable characters by @diox in #24665
  • AMOENG-2407 - Introduce a new serializer for the lookup API endpoint and account retrieval with the Users:Lookup permission by @bakulf in #24653
  • Add triggers for new addons and metadata change to submit to Cinder by @eviljeff in #24662
  • AMOENG-2401 - support form in devhub by @bakulf in #24646
  • Don't consider i18n placeholders as regexp syntax by @diox in #24678
  • Add is_active field to ScannerWebhookEvent to prevent data loss when updating events bound to a webhook scanner by @willdurand in #24664

Dependendabots

Full Changelog: 2026.03.19...2026.04.02

Contributors

diox, willdurand, and 3 other contributors
Loading

2026.03.19-1

19 Mar 13:30
@diox diox
2026.03.19-1
506d970

Choose a tag to compare

View all tags
2026.03.19-1

Cherry-pick for df47da3 on top of 2026.03.19

Loading

2026.03.19

17 Mar 17:27
@github-actions github-actions
2026.03.19
e0de941
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.03.19

This week's push hero is @diox

Previous Release: 2026.03.05-2

Before publishing this release:

  • Switch addons-customs-scanner deploy job for stage & prod to use Node 22
  • Make a new version of addons-customs-scanner, let it be deployed to stage

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

  • Deploy addons-customs-scanner to prod. Verify that it's running Node 22.

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.03.05...2025.03.19

Addons Server Changelog:

What's Changed

Notable things shipping

Dependendabots

Full Changelog: 2026.03.05...2026.03.19

Contributors

diox, willdurand, and 2 other contributors
Loading

2026.03.05-2

10 Mar 15:22
@diox diox
2026.03.05-2
14f82dc

Choose a tag to compare

View all tags
2026.03.05-2

Cherry-pick of 5f4a0f2 on top of 2026.03.05-1

Loading

2026.03.05-1

04 Mar 15:13
@willdurand willdurand
2026.03.05-1
e978dbd
This commit was signed with the committer’s verified signature.
willdurand William Durand
GPG key ID: 804B6263A7476675
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.03.05-1

Cherry-picked the following commits on top of https://github.com/mozilla/addons-server/releases/tag/2026.03.05:

Loading