Skip to content

Releases: mozilla/addons-server

2026.04.02

01 Apr 08:36
@github-actions github-actions
2026.04.02
2909966

Choose a tag to compare

View all tags
2026.04.02 Latest
Latest

This week's push hero is @eviljeff

Previous Release: 2026.03.19-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

Addons Server Changelog:

What's Changed

Notable things shipping

  • Fix softening of blocks on unban by @diox in #24620
  • AMOENG-2377 - Introduce an email lookup API endpoint by @bakulf in #24591
  • Add a service_account (UserProfile) FK to ScannerWebhook by @willdurand in #24621
  • Remove ohfp from headers that trigger session anomalies, it creates too much noise by @diox in #24624
  • Remove obsolete CSS that affect fonts by @diox in #24625
  • upgrade django to 5.2 by @eviljeff in #24614
  • Wrap long JSON scanner results in the admin by @willdurand in #24622
  • Denying an appeal on Listing Content Rejection should drop requested by @eviljeff in #24632
  • Introduce a new API endpoint to let scanners push their results by @willdurand in #24601
  • Font in developer/reviewer replies in devhub shouldn't be monospace by @diox in #24643
  • Move upload source step after details in submission flow by @willdurand in #24589
  • Hide API key secret after generation by @diox in #24641
  • add tasks that submit new addons and changes for content review to cinder by @eviljeff in #24642
  • Update and restyle how we expose listing content rejection in devhub by @diox in #24647
  • Expose number of matched add-ons on scanner results (and query results) page by @diox in #24652
  • Fix clipboard interaction in manage API key page by @diox in #24654
  • Update the style of the scanner details in the reviewer tools by @willdurand in #24633
  • Simplify DiscoveryAddon admin filtering by promoted group by @diox in #24655
  • Tweak css to better display the narc results in the reviewer tools by @willdurand in #24663
  • Additional confusable characters by @diox in #24665
  • AMOENG-2407 - Introduce a new serializer for the lookup API endpoint and account retrieval with the Users:Lookup permission by @bakulf in #24653
  • Add triggers for new addons and metadata change to submit to Cinder by @eviljeff in #24662
  • AMOENG-2401 - support form in devhub by @bakulf in #24646
  • Don't consider i18n placeholders as regexp syntax by @diox in #24678
  • Add is_active field to ScannerWebhookEvent to prevent data loss when updating events bound to a webhook scanner by @willdurand in #24664

Dependendabots

Full Changelog: 2026.03.19...2026.04.02

Contributors

diox, willdurand, and 3 other contributors
Assets 2
Loading

2026.03.19-1

19 Mar 13:30
@diox diox
2026.03.19-1
506d970

Choose a tag to compare

View all tags
2026.03.19-1

Cherry-pick for df47da3 on top of 2026.03.19

Loading

2026.03.19

17 Mar 17:27
@github-actions github-actions
2026.03.19
e0de941
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.03.19

This week's push hero is @diox

Previous Release: 2026.03.05-2

Before publishing this release:

  • Switch addons-customs-scanner deploy job for stage & prod to use Node 22
  • Make a new version of addons-customs-scanner, let it be deployed to stage

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

  • Deploy addons-customs-scanner to prod. Verify that it's running Node 22.

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.03.05...2025.03.19

Addons Server Changelog:

What's Changed

Notable things shipping

Dependendabots

Full Changelog: 2026.03.05...2026.03.19

Contributors

diox, willdurand, and 2 other contributors
Loading

2026.03.05-2

10 Mar 15:22
@diox diox
2026.03.05-2
14f82dc

Choose a tag to compare

View all tags
2026.03.05-2

Cherry-pick of 5f4a0f2 on top of 2026.03.05-1

Loading

2026.03.05-1

04 Mar 15:13
@willdurand willdurand
2026.03.05-1
e978dbd
This commit was signed with the committer’s verified signature.
willdurand William Durand
GPG key ID: 804B6263A7476675
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.03.05-1

Cherry-picked the following commits on top of https://github.com/mozilla/addons-server/releases/tag/2026.03.05:

Loading

2026.03.05

03 Mar 17:47
@github-actions github-actions
2026.03.05
44f6878

Choose a tag to compare

View all tags
2026.03.05

This week's push hero is @eviljeff

Previous Release: 2026.02.19-2

Blockers:

Cherry-picks:

Before we push:

  • Deploy customs 5.10.0 to prod

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.02.19...2026.03.05

Addons Server Changelog:

What's Changed

Notable things shipping

  • Fix scanner name in reviewer tools by @willdurand in #24479
  • Fix scanMap logic for webhook-based scanners by @willdurand in #24480
  • Extract matched rules information in scanner results used by webhooks by @willdurand in #24482
  • Make sure 0069_add_service_accounts_to_group migration uses the primary DB by @willdurand in #24483
  • Add more info to reviewer tools developer profile and optimize queries by @diox in #24476
  • Allow users that can edit scanner webhooks to edit scanner webhook events by @diox in #24487
  • Also display authors links for existing blocklistsubmissions, not jus… by @diox in #24481
  • Run test_main* tests in CI with a minimal environment by @diox in #24496
  • When installing deps, don't clean existing dir if only installing dev deps by @diox in #24505
  • Remove the SOURCE_BUILDER_VIEWER_URL setting and related code by @willdurand in #24494
  • Avoid database access in tests where that's easy to do to speed them up by @diox in #24495
  • Fix sort by addon guid in reviewer tools developer profile by @diox in #24512
  • Mark the customs scanner as legacy/deprecated by @willdurand in #24510
  • Use yara_x in clean_yara() method when swich is enabled by @willdurand in #24511
  • Remove legacy customs in the django admin by @willdurand in #24514
  • Record an ActivityLog when session anomalies are detected for a user by @diox in #24486
  • Remove the file_hash argument on process_validation() because it is not used by @willdurand in #24517
  • Add details to activity log admin change page by @diox in #24522
  • Remove run_customs() and the 'enable-customs' waffle switch by @willdurand in #24516
  • Add a migration to remove the enable-source-builder waffle switch by @willdurand in #24523
  • docs: update private docs by @willdurand in #24524
  • Add statsd pings for webhooks by @willdurand in #24525
  • Remove the use of the _CUSTOMS constant in test files by @willdurand in #24526
  • Store IP on session anomaly activity for future investigation by @diox in #24527
  • Pass the event name to the webhook scanners by @willdurand in #24534
  • Expose content changes to content review by @diox in #24498
  • Additional confusable characters by @diox in #24541
  • Optionally link ScannerResult to ActivityLog by @willdurand in #24530
  • Declare the scanner field as read-only in the admin when the scanner rule has been created by @willdurand in #24532
  • Add new webhook event: on_version_created by @willdurand in #24545
  • Remove GET /scanner/results/ endpoint by @willdurand in #24543
  • Fix event name/id in call_webhooks by @willdurand in #24549
  • Remove ScannerResult.state and related code by @willdurand in #24546
  • Add the add-on type to the webhook event payloads by @willdurand in #24551
  • Appeals on listing content rejections set REQUESTED, rather than creating NHR by @eviljeff in #24544
  • Inherit from the addon/version serializers for the webhook event payloads by @willdurand in #24550

Dependendabots

Full Changelog: 2026.02.19...2026.03.05

Contributors

diox, willdurand, and 2 other contributors
Loading

2026.02.19-2

20 Feb 10:23
@diox diox
2026.02.19-2
22c7ade

Choose a tag to compare

View all tags
2026.02.19-2

Cherry-picked the following commits on top of https://github.com/mozilla/addons-server/releases/tag/2026.02.19-1:

Loading

2026.02.19-1

19 Feb 10:49
@willdurand willdurand
2026.02.19-1
ae28def
This commit was signed with the committer’s verified signature.
willdurand William Durand
GPG key ID: 804B6263A7476675
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.02.19-1

Cherry-picked the following commits on top of https://github.com/mozilla/addons-server/releases/tag/2026.02.19:

Full Changelog: 2026.02.19...2026.02.19-1

Loading

2026.02.19

17 Feb 16:55
@github-actions github-actions
2026.02.19
dbc6bf3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
2026.02.19

This week's push hero is @diox

Previous Release: 2026.02.05-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.02.05...2026.02.19

Addons Server Changelog:

What's Changed

Notable things shipping

  • reviewer tools listing content approval and rejection by @eviljeff in #24386
  • Display metadata and link to detail page in scanner admin query results by @diox in #24387
  • Fix fake FxA user auth for local environments by @diox in #24419
  • Remove broken urlconf_decorator - it hasn't worked in 10 years by @diox in #24421
  • Update elasticsearch client libraries to 8.x by @diox in #24370
  • Fix CSP in admin to allow django's jsi18n admin view as a script by @diox in #24422
  • Increase uwsgi buffer-size in local environments to match prod by @diox in #24438
  • Replace last_content_review_pass with content_review_status by @eviljeff in #24437
  • Fix admin CSP: need to use SITE_URL, not INTERNAL_SITE_URL in admin CSP by @diox in #24446
  • Add links to user admin page in reviewer tools review & developer profile pages by @diox in #24425
  • Add actions to block add-ons / view authors in scanner results admin by @diox in #24424
  • Allow developer requests for new content review by @eviljeff in #24420
  • Add yara-x behind a waffle switch by @willdurand in #24439
  • Developer can request a new listing content review via the API by @eviljeff in #24454
  • Add links to authors of add-ons in blocklist submission page by @diox in #24459
  • Add a new group for the service accounts created for the scanners by @willdurand in #24462
  • Additional confusable characters by @diox in #24468
  • Allow scanners to run asynchronously and send their results later by @willdurand in #24447

Dependendabots

Full Changelog: 2026.02.05...2026.02.19

Contributors

diox, willdurand, and 2 other contributors
Loading

2026.02.05-1

16 Feb 14:35
@diox diox
2026.02.05-1
c5be892

Choose a tag to compare

View all tags
2026.02.05-1
Loading