Skip to content

Releases: mozilla/addons-server

2026.04.16-1

16 Apr 09:52
@diox diox
2026.04.16-1
7b2eb4e

Choose a tag to compare

View all tags
2026.04.16-1 Latest
Latest

Cherry-pick for fdd0330 on top of 2026.04.16

Assets 2
Loading

2026.04.16

14 Apr 15:17
@github-actions github-actions
2026.04.16
9756d53
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.04.16

This week's push hero is @diox

Previous Release: 2026.04.02-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.04.02...2026.04.16

Addons Server Changelog:

What's Changed

Notable things shipping

  • Switch to forked yara-x by @willdurand in #24677
  • Process decisions from Cinder without a known job by @eviljeff in #24679
  • Update dependabot.yml by @eviljeff in #24688
  • Allow accessing promoted add-on admin page by Add-on GUID or slug by @diox in #24690
  • Optimize generate_lowercase_homoglyphs_variants_for_string() by @diox in #24706
  • add docker hub token for auth'd requested; add cooldown back into dependabot.yml by @eviljeff in #24703
  • switch elasticsearch to use official docker image by @eviljeff in #24714
  • Obey relevant max_length when importing strings from the XPI by @diox in #24713
  • Add github registry auth to dependabot config by @eviljeff in #24715
  • Create a content review cinderjob on created webhook payload by @eviljeff in #24711
  • Revert "Add github registry auth to dependabot config" by @diox in #24716
  • Check dependabot daily for all ecosystems now that there is cooldown by @diox in #24720
  • Add github registry auth to dependabot config by @diox in #24722
  • Ask dependabot to ignore elasticsearch 9.x in docker_compose by @diox in #24724
  • set override_of on new decision by @eviljeff in #24721
  • Don't allow developers to download attachments on private comments by @diox in #24729
  • Move yara-x to its own requirements.txt file by @willdurand in #24733
  • AMOENG-2436 - Contact Support form UI improvements by @bakulf in #24723
  • Add option to scan add-on summaries with NARC by @diox in #24731
  • Allow multiple BlocklistSubmission in parallel for the same version by @diox in #24728
  • Omit match field in narc results by @willdurand in #24730

Dependendabots

Full Changelog: 2026.04.02...2026.04.16

Contributors

diox, willdurand, and 3 other contributors
Loading

2026.04.02-1

07 Apr 11:24
@diox diox
2026.04.02-1
ac3a882

Choose a tag to compare

View all tags
2026.04.02-1

Cherry-pick for dbbf0ca on top of 2026.04.02

Loading

2026.04.02

01 Apr 08:36
@github-actions github-actions
2026.04.02
2909966

Choose a tag to compare

View all tags
2026.04.02

This week's push hero is @eviljeff

Previous Release: 2026.03.19-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

Addons Server Changelog:

What's Changed

Notable things shipping

  • Fix softening of blocks on unban by @diox in #24620
  • AMOENG-2377 - Introduce an email lookup API endpoint by @bakulf in #24591
  • Add a service_account (UserProfile) FK to ScannerWebhook by @willdurand in #24621
  • Remove ohfp from headers that trigger session anomalies, it creates too much noise by @diox in #24624
  • Remove obsolete CSS that affect fonts by @diox in #24625
  • upgrade django to 5.2 by @eviljeff in #24614
  • Wrap long JSON scanner results in the admin by @willdurand in #24622
  • Denying an appeal on Listing Content Rejection should drop requested by @eviljeff in #24632
  • Introduce a new API endpoint to let scanners push their results by @willdurand in #24601
  • Font in developer/reviewer replies in devhub shouldn't be monospace by @diox in #24643
  • Move upload source step after details in submission flow by @willdurand in #24589
  • Hide API key secret after generation by @diox in #24641
  • add tasks that submit new addons and changes for content review to cinder by @eviljeff in #24642
  • Update and restyle how we expose listing content rejection in devhub by @diox in #24647
  • Expose number of matched add-ons on scanner results (and query results) page by @diox in #24652
  • Fix clipboard interaction in manage API key page by @diox in #24654
  • Update the style of the scanner details in the reviewer tools by @willdurand in #24633
  • Simplify DiscoveryAddon admin filtering by promoted group by @diox in #24655
  • Tweak css to better display the narc results in the reviewer tools by @willdurand in #24663
  • Additional confusable characters by @diox in #24665
  • AMOENG-2407 - Introduce a new serializer for the lookup API endpoint and account retrieval with the Users:Lookup permission by @bakulf in #24653
  • Add triggers for new addons and metadata change to submit to Cinder by @eviljeff in #24662
  • AMOENG-2401 - support form in devhub by @bakulf in #24646
  • Don't consider i18n placeholders as regexp syntax by @diox in #24678
  • Add is_active field to ScannerWebhookEvent to prevent data loss when updating events bound to a webhook scanner by @willdurand in #24664

Dependendabots

Full Changelog: 2026.03.19...2026.04.02

Contributors

diox, willdurand, and 3 other contributors
Loading

2026.03.19-1

19 Mar 13:30
@diox diox
2026.03.19-1
506d970

Choose a tag to compare

View all tags
2026.03.19-1

Cherry-pick for df47da3 on top of 2026.03.19

Loading

2026.03.19

17 Mar 17:27
@github-actions github-actions
2026.03.19
e0de941
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.03.19

This week's push hero is @diox

Previous Release: 2026.03.05-2

Before publishing this release:

  • Switch addons-customs-scanner deploy job for stage & prod to use Node 22
  • Make a new version of addons-customs-scanner, let it be deployed to stage

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

  • Deploy addons-customs-scanner to prod. Verify that it's running Node 22.

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.03.05...2025.03.19

Addons Server Changelog:

What's Changed

Notable things shipping

Dependendabots

Full Changelog: 2026.03.05...2026.03.19

Contributors

diox, willdurand, and 2 other contributors
Loading

2026.03.05-2

10 Mar 15:22
@diox diox
2026.03.05-2
14f82dc

Choose a tag to compare

View all tags
2026.03.05-2

Cherry-pick of 5f4a0f2 on top of 2026.03.05-1

Loading

2026.03.05-1

04 Mar 15:13
@willdurand willdurand
2026.03.05-1
e978dbd
This commit was signed with the committer’s verified signature.
willdurand William Durand
GPG key ID: 804B6263A7476675
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.03.05-1

Cherry-picked the following commits on top of https://github.com/mozilla/addons-server/releases/tag/2026.03.05:

Loading

2026.03.05

03 Mar 17:47
@github-actions github-actions
2026.03.05
44f6878

Choose a tag to compare

View all tags
2026.03.05

This week's push hero is @eviljeff

Previous Release: 2026.02.19-2

Blockers:

Cherry-picks:

Before we push:

  • Deploy customs 5.10.0 to prod

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.02.19...2026.03.05

Addons Server Changelog:

What's Changed

Notable things shipping

  • Fix scanner name in reviewer tools by @willdurand in #24479
  • Fix scanMap logic for webhook-based scanners by @willdurand in #24480
  • Extract matched rules information in scanner results used by webhooks by @willdurand in #24482
  • Make sure 0069_add_service_accounts_to_group migration uses the primary DB by @willdurand in #24483
  • Add more info to reviewer tools developer profile and optimize queries by @diox in #24476
  • Allow users that can edit scanner webhooks to edit scanner webhook events by @diox in #24487
  • Also display authors links for existing blocklistsubmissions, not jus… by @diox in #24481
  • Run test_main* tests in CI with a minimal environment by @diox in #24496
  • When installing deps, don't clean existing dir if only installing dev deps by @diox in #24505
  • Remove the SOURCE_BUILDER_VIEWER_URL setting and related code by @willdurand in #24494
  • Avoid database access in tests where that's easy to do to speed them up by @diox in #24495
  • Fix sort by addon guid in reviewer tools developer profile by @diox in #24512
  • Mark the customs scanner as legacy/deprecated by @willdurand in #24510
  • Use yara_x in clean_yara() method when swich is enabled by @willdurand in #24511
  • Remove legacy customs in the django admin by @willdurand in #24514
  • Record an ActivityLog when session anomalies are detected for a user by @diox in #24486
  • Remove the file_hash argument on process_validation() because it is not used by @willdurand in #24517
  • Add details to activity log admin change page by @diox in #24522
  • Remove run_customs() and the 'enable-customs' waffle switch by @willdurand in #24516
  • Add a migration to remove the enable-source-builder waffle switch by @willdurand in #24523
  • docs: update private docs by @willdurand in #24524
  • Add statsd pings for webhooks by @willdurand in #24525
  • Remove the use of the _CUSTOMS constant in test files by @willdurand in #24526
  • Store IP on session anomaly activity for future investigation by @diox in #24527
  • Pass the event name to the webhook scanners by @willdurand in #24534
  • Expose content changes to content review by @diox in #24498
  • Additional confusable characters by @diox in #24541
  • Optionally link ScannerResult to ActivityLog by @willdurand in #24530
  • Declare the scanner field as read-only in the admin when the scanner rule has been created by @willdurand in #24532
  • Add new webhook event: on_version_created by @willdurand in #24545
  • Remove GET /scanner/results/ endpoint by @willdurand in #24543
  • Fix event name/id in call_webhooks by @willdurand in #24549
  • Remove ScannerResult.state and related code by @willdurand in #24546
  • Add the add-on type to the webhook event payloads by @willdurand in #24551
  • Appeals on listing content rejections set REQUESTED, rather than creating NHR by @eviljeff in #24544
  • Inherit from the addon/version serializers for the webhook event payloads by @willdurand in #24550

Dependendabots

Full Changelog: 2026.02.19...2026.03.05

Contributors

diox, willdurand, and 2 other contributors
Loading

2026.02.19-2

20 Feb 10:23
@diox diox
2026.02.19-2
22c7ade

Choose a tag to compare

View all tags
2026.02.19-2

Cherry-picked the following commits on top of https://github.com/mozilla/addons-server/releases/tag/2026.02.19-1:

Loading